Over 31,800 new CVE vulnerabilities are published annually in the NIST National Vulnerability Database as 48.5% are rated High or Critical severity, only 4.2% are actively exploited in the wild (CISA KEV), automated attacker botnets scan for new CVEs within 14 minutes, and enterprises average 58.0 days to patch critical flaws. While 86% of breaches exploit known N-day flaws with existing patches and memory safety bugs account for 70% of Windows/Chromium CVEs, EPSS reduces patch triage effort by -82% and legacy flaws like Log4j persist in 34% of downloads. The figures below come from empirical research published by NIST NVD, MITRE, CISA, FIRST.org, Qualys, and Google Project Zero.
TL;DR
- Over 31,800 new Common Vulnerabilities and Exposures (CVEs) are cataloged annually (averaging 87 new CVEs per day)
- 48.5% of all published CVE software vulnerabilities are classified as High or Critical severity (CVSS 7.0 to 10.0)
- Over 275,000 total cumulative CVE vulnerabilities have been cataloged since MITRE established the system in 1999
- Only 4.2% of all published CVEs are confirmed to be actively weaponized and exploited in the wild (CISA KEV Catalog)
- Automated threat actor bots begin mass internet scanning for newly published CVEs in an average of just 14 minutes
- 86.0% of vulnerability-driven enterprise breaches exploit known N-day vulnerabilities for which patches were already available
- Prioritizing vulnerability remediation using the EPSS model reduces unnecessary patch effort by -82.0% (FIRST.org)
- The enterprise Mean Time to Remediate (MTTR) for critical severity CVE vulnerabilities averages 58.0 days (Qualys)
- 42.0% of all Critical severity CVEs target web browser engines and perimeter networking hardware / VPN concentrators
- 28.0% of enterprise internal servers run at least one unpatched vulnerability published more than 5 years ago
- 34.0% of modern Log4j Java package downloads in 2025/2026 still fetch vulnerable Log4Shell (CVE-2021-44228) builds
- 70.0% of all high-severity security vulnerabilities in Microsoft Windows and Google Chromium are memory safety bugs
- Executing an emergency out-of-band enterprise-wide patch cycle costs an average of $48,500 in direct operational labor
1. Annual Disclosures: 31,800+ Annual CVEs and 48.5% High/Critical
Automated fuzzing and bug bounty programs have driven an exponential acceleration in official vulnerability cataloging. NIST NVD records 31,800+ new CVEs annually.
Severity distribution: 48.5% of CVEs are High or Critical severity (NIST/MITRE), adding to a historical cumulative catalog surpassing 275,000 vulnerabilities.
| Metric | Value | Source |
|---|---|---|
| Total Common Vulnerabilities and Exposures (CVEs) published annually in the NIST National Vulnerability Database (NVD) | 31,800+ new CVE vulnerabilities cataloged in 2025/2026 (averaging 87 new CVEs per day) | NIST National Vulnerability Database (NVD) / MITRE |
| Share of published CVE vulnerabilities categorized as High or Critical severity (CVSS Score 7.0 to 10.0) | 48.5% of all published CVEs are rated High or Critical severity | NIST NVD Severity Analytics / First.org CVSS |
| Total cumulative CVE vulnerabilities published since MITRE established the CVE system in 1999 | 275,000+ total cumulative CVE vulnerabilities cataloged to date | MITRE CVE Program Official Statistics |
Bug bounty programs and ethical hacking disclosures connect to our bug bounty statistics. Source: NIST National Vulnerability Database.
2. Real-World Exploitation: 4.2% CISA KEV and 14-Minute Exploitation
Most theoretical vulnerabilities are never weaponized, while critical perimeter flaws face automated exploitation within minutes of disclosure. Only 4.2% of CVEs are exploited in the wild.
Scan velocity: botnets scan for new CVEs within 14 minutes (Palo Alto), while 86.0% of breaches exploit known N-day flaws with existing patches (Mandiant).
| Metric | Value | Source |
|---|---|---|
| CISA Known Exploited Vulnerabilities (KEV) Catalog: share of total published CVEs confirmed to be actively weaponized in the wild by threat actors | 4.2% of all published CVEs are confirmed to be actively exploited in the wild | CISA KEV Catalog Telemetry / Qualys |
| Speed from CVE publication to in-the-wild exploitation: time between public CVE disclosure and automated attacker scanning campaigns | 14 minutes average time for threat actors to begin automated scanning for newly published CVEs | Palo Alto Networks Unit 42 Threat Report |
| Zero-Day vs N-Day exploitation: share of enterprise network breaches exploiting known N-day vulnerabilities with existing patches (vs zero-days) | 86.0% of vulnerability-driven breaches exploit known N-day flaws with available patches | Mandiant M-Trends / Verizon DBIR |
Data breach attack vectors and initial access connect to our data breach statistics. Source: CISA Known Exploited Vulnerabilities.
3. Remediation Metrics & EPSS: -82% Triage Effort and 58-Day MTTR
Relying strictly on CVSS base scores causes patch fatigue, whereas predictive probability scoring focuses remediation on active threats. EPSS cuts patch effort by -82.0%.
Remediation latency: enterprises average 58.0 days to deploy critical patches (Qualys), with perimeter VPNs and browsers representing 42.0% of critical flaws.
| Metric | Value | Source |
|---|---|---|
| EPSS (Exploit Prediction Scoring System) efficiency: EPSS probability score effectiveness in predicting in-the-wild exploitation vs raw CVSS score | 82.0% reduction in unnecessary patch prioritization effort using EPSS + CISA KEV over raw CVSS | FIRST.org EPSS Data / Cyentia Institute |
| Average Mean Time to Remediate (MTTR) critical CVEs: days required for enterprise IT departments to patch a critical severity CVE | 58.0 days average time for enterprise organizations to patch a critical CVE | Qualys TruRisk Threat Research / Ponemon |
| Top vulnerable software category: software domains accounting for the highest volume of critical CVE disclosures (Web Browsers, OS Kernels, Edge VPNs) | 42.0% of Critical CVEs target web browsers and perimeter networking hardware/firewalls | VulnCheck State of Exploitation / NIST |
SIEM and SOC operations vulnerability management connect to our siem soc statistics. Source: FIRST.org EPSS Data.
4. Legacy Persistence & Memory Safety: 28% 5-Year CVEs and 70% Memory Bugs
Unmanaged legacy servers and embedded devices often run forgotten codebases that remain permanently vulnerable to historic exploits. 28.0% of servers run 5+ year old CVEs.
Memory bugs: 70.0% of Windows/Chromium vulnerabilities are memory safety flaws (Microsoft/Google), while 34.0% of Log4j downloads remain vulnerable to Log4Shell (Sonatype).
| Metric | Value | Source |
|---|---|---|
| Legacy vulnerability persistence: enterprise systems actively running unpatched CVEs published more than 5 years ago (e.g., Log4j, EternalBlue) | 28.0% of enterprise internal servers run at least one unpatched 5+ year old CVE | Tenable State of Vulnerability Management |
| Log4j (Log4Shell / CVE-2021-44228) persistence: enterprise applications still downloading and running vulnerable Log4j library versions | 34.0% of Log4j package downloads in 2025/2026 remain vulnerable Log4Shell versions | Sonatype Central Repository Telemetry |
| Memory safety CVEs: share of high-severity vulnerabilities caused by memory management bugs (buffer overflows, use-after-free) in C/C++ code | 70.0% of all Microsoft and Google Chromium security CVEs are memory safety vulnerabilities | Microsoft Security Response Center (MSRC) / Google Chromium |
Software supply chain vulnerabilities and dependencies connect to our supply chain attack statistics. Source: Microsoft Security Response Center.
5. Patch Economics & Zero-Day Latency: $48.5k Patch Costs and 52-Day Vendor Delay
Deploying emergency out-of-band updates across distributed global production clusters requires extensive compatibility testing. Emergency patches cost $48,500 per cycle.
Vendor responsiveness: vendors require 52.0 days on average to patch reported zero-days (Google Project Zero), with 32.0% of disclosures adopting CVSS v4.0.
| Metric | Value | Source |
|---|---|---|
| Cost of emergency out-of-band security patching: operational IT labor cost per single emergency enterprise patch deployment | $48,500 average operational labor cost to execute an emergency enterprise-wide patch cycle | Ponemon Institute Vulnerability Management Study |
| Vendor patch release delay: average time from initial private zero-day vulnerability report to vendor public patch release (days) | 52.0 days average vendor response time to develop and release a security patch | Google Project Zero Annual Review |
| CVSS v4.0 adoption: vulnerability disclosures adopting the enhanced CVSS 4.0 standard incorporating threat metrics and attack ease | 32.0% of newly published vulnerability advisories provide CVSS v4.0 ratings | FIRST.org Common Vulnerability Scoring System |
Endpoint security detection and behavioral patching connect to our endpoint security statistics. Source: Google Project Zero.
6. Scanning Governance & Backlogs: +24% Backlog Growth and 88% CISA Compliance
Continuous automated vulnerability assessment tools discover more vulnerabilities each month than development teams can remediate. Unpatched backlogs grew +24.0%.
Federal enforcement: 88.0% of Federal civilian agencies patch CISA KEV flaws within mandated 14-day windows (CISA BOD 22-01), supported by 64.0% daily scanning adoption.
| Metric | Value | Source |
|---|---|---|
| Automated vulnerability scanning frequency: enterprises conducting continuous daily or weekly automated asset vulnerability scans | 64.0% of enterprise IT environments perform continuous automated vulnerability scans | Gartner Market Guide for Vulnerability Assessment |
| Vulnerability backlog growth: annual increase in the total backlog of unresolved, unpatched CVEs tracked in enterprise ticketing systems (Jira, ServiceNow) | +24.0% annual growth in enterprise unpatched vulnerability backlogs | Brinqa State of Cyber Risk Operations |
| CISA binding operational directives (BOD 22-01): federal agency compliance rate in patching CISA KEV vulnerabilities within mandated 14-day windows | 88.0% of Federal civilian agencies patch CISA KEV vulnerabilities within the 14-day mandate | CISA BOD 22-01 Federal Compliance Digest |
Summary: CVE Vulnerabilities by the Numbers
| Metric | Value | Primary Source |
|---|---|---|
| Annual new CVE vulnerabilities cataloged | 31,800+ new CVEs / year | NIST NVD / MITRE |
| Published CVEs rated High or Critical severity | 48.5% High or Critical | NIST NVD Analytics |
| Total cumulative CVEs since 1999 | 275,000+ total CVEs | MITRE CVE Program |
| Published CVEs actively exploited in the wild | 4.2% actively exploited | CISA KEV Catalog / Qualys |
| Time from CVE release to automated bot scans | 14 minutes to scan | Palo Alto Unit 42 Report |
| Breaches exploiting known N-day flaws with patches | 86.0% N-day exploitation | Mandiant / Verizon DBIR |
| Patch triage effort reduction via EPSS model | -82.0% triage effort | FIRST.org / Cyentia |
| Average time to patch a critical CVE (MTTR) | 58.0 days to patch | Qualys TruRisk Research |
| Critical CVEs targeting browsers and perimeter VPNs | 42.0% browsers/firewalls | VulnCheck / NIST |
| Enterprise servers running unpatched 5+ yr old CVEs | 28.0% legacy CVEs | Tenable Vulnerability Study |
| Log4j downloads that remain vulnerable Log4Shell | 34.0% vulnerable Log4j | Sonatype Central Telemetry |
| Chromium & Windows CVEs caused by memory safety | 70.0% memory safety bugs | Microsoft MSRC / Google |
| Cost of an emergency enterprise-wide patch cycle | $48,500 / patch cycle | Ponemon Institute Study |
| Average vendor time to release a patch for zero-day | 52.0 days vendor delay | Google Project Zero |
| Federal agency compliance with 14-day KEV mandate | 88.0% federal compliance | CISA BOD 22-01 Report |
Methodology and Sources
The statistics in this report were compiled from official vulnerability database records from the NIST National Vulnerability Database (NVD) and MITRE CVE Program, exploit tracking telemetry from CISA’s Known Exploited Vulnerabilities (KEV) Catalog, predictive modeling data from FIRST.org (EPSS and CVSS v4.0), enterprise vulnerability benchmarks from Qualys, Tenable, and Sonatype, and zero-day research from Google Project Zero and Microsoft Security Response Center.
-
NIST National Vulnerability Database (NVD) & MITRE: CVE Program Statistics, CVSS Score Distributions, and NVD Metrics (31,800+ annual CVEs, 48.5% High/Critical, 275k total).
-
Cybersecurity and Infrastructure Security Agency (CISA): Known Exploited Vulnerabilities (KEV) Catalog and BOD 22-01 Compliance (4.2% exploited in wild, 88% federal compliance).
-
FIRST.org & Cyentia Institute: Exploit Prediction Scoring System (EPSS) Research and CVSS v4.0 Specifications (-82% patch effort via EPSS, 32% CVSS 4.0).
-
Qualys & Tenable: TruRisk Vulnerability Management Report: MTTR Benchmarks and Legacy CVE Persistence (58.0 days MTTR, 28% 5+ year old CVEs).
-
Google Project Zero & Microsoft Security (MSRC): Year in Review: Zero-Day Exploitation and 70% Memory Safety Vulnerabilities (52-day patch delay, 70% memory bugs).
-
Data watch: CVE statistics reflect standardized vulnerability disclosures cataloged in the NIST NVD and MITRE dictionaries across enterprise software, operating systems, and firmware. Private undisclosed proprietary vulnerabilities are categorized separately.
-
Last updated: August 2026. This roundup is updated quarterly as NIST NVD quarterly counts, CISA KEV catalog expansions, and EPSS predictive models are refreshed.