The State of Exploit Development: 80% of Exploits Publish Faster than CVEs
Summary: Unit 42 researchers analyzed 45,450 public exploits in Exploit Database and found that 80% of the exploits they studied were published before their CVEs, on average 23 days earlier. In a sample of 500 high-severity exploits since 2015, 14% were published before the patch, 23% in the first week after the patch, and 50% within the first month, with an exploit appearing on average 37 days after patch release.
Bottom line: The CVE is not the starting gun it is treated as: 80% of these exploits were already public before the CVE published, and 75% of the exploits in the database have no associated CVE at all, so a patch-priority queue keyed to CVE disclosure is working from a signal that arrives after the attack code.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026