Median patch window
8d
Half of exploited CVEs hit before this
Average patch window
43d
Mean across all KEV CVEs
Shortest observed
1d
0-day or near-0-day exploitation
CVEs measured
28
CISA KEV with full date data
Key insight
The median patch window is 8 days — but 14 CVEs were exploited within 7 days of publication. For internet-facing systems like VPN appliances and firewalls, you should assume a 3–7 day window from patch release to active exploitation.
Average Patch Window by Vendor
appleCRITICAL WINDOW
5 KEV3d
googleCRITICAL WINDOW
4 KEV4d
linuxSHORT WINDOW
3 KEV17d
debianSHORT WINDOW
5 KEV26d
microsoftMODERATE
6 KEV39d
netappMODERATE
2 KEV64d
kenticoEXTENDED
2 KEV210d
Distribution of Exploitation Speed
0-7 days14 CVEs (50%)
8-30 days6 CVEs (21%)
31-90 days3 CVEs (11%)
91-365 days5 CVEs (18%)
Based on 28 CVEs confirmed in CISA KEV catalog. Patch window = days from NVD publication to KEV addition.