The typical gap between a CVE record being published and CISA adding that CVE to its Known Exploited Vulnerabilities (KEV) catalog is 20 days, but the spread is wide. In the 686 KEV entries added from 2024 to 2026 (catalog version 2026.10.08), 137 were listed on or before the day the record was published, and 151 were listed more than a year after it.
- 20 daysMedian days from CVE record publication to KEV listing, 686 entriesSource: CISA KEV catalog, version 2026.10.08, with CVE Program records (cvelistV5), both downloaded 2026-10-09
- 137Entries listed on or before the day the CVE record was publishedSource: CISA KEV catalog, version 2026.10.08, with CVE Program records (cvelistV5), both downloaded 2026-10-09
- 151Entries listed more than 365 days after publicationSource: CISA KEV catalog, version 2026.10.08, with CVE Program records (cvelistV5), both downloaded 2026-10-09
- 63Entries listed more than 5 years (1826 days) after publicationSource: CISA KEV catalog, version 2026.10.08, with CVE Program records (cvelistV5), both downloaded 2026-10-09
Method: how did we measure the delay?
We took every KEV entry whose “dateAdded” falls in 2024, 2025 or 2026. That gives 686 entries from a catalog of 1,739. For each CVE we read the “datePublished” field in its CVE Program record (the cvelistV5 repository). All records were downloaded on 2026-10-09, and none was missing a publication date.
Days are the KEV “dateAdded” minus that “datePublished”. A negative or zero value means the entry was listed on or before the day the CVE record was published. We then counted entries in bands and took the median and the 25th and 75th percentiles. Product classes come from our own keyword rules, described in our study of KEV additions by product type. They are a heuristic, not an official label.
What does the shape of the delay look like?
The middle of the data is short and the end is long. The 25th percentile is 1 day, the median is 20 days and the 75th percentile is 259 days. The shortest value is minus 6 days and the longest is 6765 days. A median alone hides this, because a quarter of the entries sit above 259 days.
The bands below split the 686 entries without overlap. They add up to 686.
| Band (days) | All 2024 to 2026 | Added 2024 | Added 2025 | Added 2026 |
|---|---|---|---|---|
| 0 or negative (on or before publication day) | 137 | 39 | 49 | 49 |
| 1 to 7 | 145 | 39 | 48 | 58 |
| 8 to 30 | 82 | 17 | 29 | 36 |
| 31 to 365 | 171 | 46 | 63 | 62 |
| Over 365 | 151 | 45 | 56 | 50 |
| Entries in total | 686 | 186 | 245 | 255 |
The first three rows add up to 364 entries listed within 30 days of publication. The other 322 came later. Both groups are large, which is why the median tells only half of the story.
Did the delay change from 2024 to 2026?
The medians are 21.5 days for entries added in 2024, 26 days for 2025 and 15 days for 2026. The 75th percentile moves the same way: 273, 304 and 187 days. In 2026 there are 58 entries in the 1 to 7 day band, the most of any year. These are three snapshots of one catalog, and each year holds a different mix of products. We do not claim a trend from them.
Does the delay depend on the type of product?
Yes, a lot, in this data. The table shows four of the nine classes. Operating systems and mobile platforms have a median of 1 day. Cameras, NAS and other IoT devices have a median of 1051 days.
| Class (entries) | Median days | Listed on or before publication day |
|---|---|---|
| Operating systems and mobile platforms (131) | 1 | 62 |
| Network edge devices (124) | 5.5 | 41 |
| Web applications, CMS and frameworks (81) | 85 | 1 |
| Cameras, NAS and other IoT (23) | 1051 | 0 |
Other classes sit between these. Browsers have a median of 2.5 days over 30 entries. Mail, collaboration and file transfer servers have 28 days, IT management and remote access tools have 29.5 days, and office and document software has 171 days over 23 entries. Network edge devices show both ends: 41 of 124 were listed on or before publication day, yet 27 came more than a year later. For background on how attackers reach internet-facing systems, see the technique exploit public-facing application. This data does not show which technique was used for any entry.
How much of the long tail is old CVEs?
A large part of it. Of the 686 entries, 75 carry a CVE number from 2020 or earlier, and 63 were listed more than five years after publication. The longest gap is 6765 days. At the other end, 436 entries have a CVE number from the same year in which they were added.
The CVE year here is the year inside the CVE number, not the publication date. The data does not say why each old CVE was added. Routine cyber hygiene work such as asset inventory is one place such CVEs can be found, and a prediction score such as EPSS was not part of this study.
Limits: what can these figures not say?
Four limits matter most.
- Publication is not the start of exploitation. A CVE can be exploited before its record exists, or long after. The delay measures a catalog event against a record date, not attacker activity.
- Listing needs conditions. CISA says it adds a vulnerability when it has a CVE ID, there is reliable evidence of active exploitation in the wild, and there is a clear remediation action such as a vendor update (BOD 22-01 FAQ). A CVE can be exploited and still wait for evidence or a fix.
- The CVE record date can be later than public disclosure. A flaw may be known before its record is published, so some “days” are shorter than the real time since disclosure.
- Product classes are our heuristic. The class medians rest on small groups in some cases, such as 23 entries for IoT, and correlation is not cause.
What questions does this raise?
These are questions, not advice. For systems you run, which product classes sit in the fast end, where 62 of 131 operating system entries were listed on or before publication day? Which sit in the slow end, where the median is measured in months or years? If an old CVE appears in the catalog, do you know whether any asset in your inventory still carries it? How the catalog adds entries over time is covered in our note on KEV deadlines and pace, and the weakness types behind the entries in our CWE study.