The KEV gap: how fast do exploited bugs get flagged?

How long it takes a known security bug to reach CISA’s list of bugs attackers are actively using.

Key takeaways

• CISA typically flags newly exploited vulnerabilities quickly. For vulnerabilities published since 2022, the median time between CVE publication and inclusion in the Known Exploited Vulnerabilities (KEV) Catalog is just nine days, with nearly half added within a week.
• Long KEV delays are usually driven by older vulnerabilities re-emerging. The multi-year gaps that inflate overall averages are largely the result of attackers returning to exploit older vulnerabilities, not evidence that CISA is becoming significantly slower at identifying actively exploited flaws.
• EPSS can provide valuable early warning, but KEV remains the strongest exploitation signal. The Exploit Prediction Scoring System (EPSS) identified elevated risk before KEV inclusion for roughly one in five vulnerabilities, but KEV was still the first actionable confirmation of exploitation for most cases.

The Cybersecurity and Infrastructure Security Agency (CISA) keeps a public list called the Known Exploited Vulnerabilities catalog, or KEV: the security bugs it has confirmed attackers are actually using. U.S. federal agencies must patch everything on the list by a deadline, and many private security teams use it as their top fix-first queue. Each bug on the list has two dates: the day it was first published as a Common Vulnerabilities and Exposures (CVE), and the day CISA added it to KEV. The days between those two dates are the “KEV gap.” A common worry is that the gap is growing; that it takes longer and longer to flag a dangerous bug. It doesn’t. For new bugs, CISA is fast: the typical gap is about nine days, and nearly half are flagged within a week. The long delays you see in the raw numbers come from a separate group: old bugs, published years ago, that attackers have started using again.

How fast are new bugs flagged?

To answer that, we looked at every CVE added to KEV since the start of 2023, 740 in all, and measured each one’s gap. Then we split them into two groups, because they tell two different stories. The first group is new bugs: CVEs published in 2022 or later. There are 608 of them, about four in five. For this group, CISA moves quickly. The typical (median) gap is 9 days. Nearly half (48%) are flagged within a week of being published. Even the slower cases are not extreme: 9 in 10 are flagged within about ten months.

Typical gap for new bugs, by year: 6 days (2023) → 9 days (2024) → 12 days (2025) → 14 days (2026, so far). It is creeping up, but still inside two weeks.

The gap is inching wider over time, but slowly. In 2023 the typical new bug reached KEV in 6 days; in 2026 so far it takes 14. That is worth watching, but it is a long way from the “months and growing” picture the raw numbers suggest.

Nearly half are flagged within a week

A one-week gap tells you something important: the bug was almost certainly under attack before it was even public. CISA does not list a bug on KEV unless it has evidence of real attacks, so a listing that lands within days of publication means the attacks were already happening. For new bugs, that describes close to half of every month’s additions.

Treat that 48% as a floor, not a ceiling. Some bugs that were attacked from day one only reach KEV weeks later, once CISA confirms it. So the real share of new bugs under attack at the moment they go public is higher than what the chart shows.

Old bugs don’t retire — they wait

Now the second group, and the reason the raw numbers look so alarming. Of the 740 additions since 2023, 132, about one in six, are old bugs, published before 2022. For these, the gap is not a measure of how fast CISA reacted; it is a measure of how long the bug sat around before attackers came back to it. The typical age of these bugs when CISA listed them is about five and a half years. The oldest stretch much further. The flaw behind the Conficker worm (CVE-2008-4250) was published in 2008 and added to KEV in May 2026, more than 17 years later. Another bug from 2004 (CVE-2004-1464) waited until 2023.

These are the grey dots riding high on Chart 1. They are real and worth knowing about: a bug you patched and forgot about a decade ago can become urgent again, but they say nothing about CISA’s speed on today’s threats. Mixing them in with new bugs is what makes the average gap look like years instead of days. Separating the two groups provides a more accurate view of how quickly newly disclosed vulnerabilities reach KEV.

Does EPSS warn earlier?

There is another exploitation signal worth checking against KEV: the Exploit Prediction Scoring System (EPSS), a score from FIRST.org that estimates each day how likely a given bug is to be attacked. Could it warn security teams before CISA does? Mostly not. For every bug added to KEV since 2023 we found the first day its EPSS score crossed 0.10 (a common “pay attention” threshold) and compared it to the KEV listing date. EPSS got there first in only 19% of cases.

For 57% of the bugs, CISA listed them first and EPSS only rose afterwards. For another 23%, EPSS never crossed 0.10 at all. The likely reason is circular: FIRST.org’s model uses KEV listing as one of its inputs, so once CISA acts, the EPSS score follows. Where EPSS does lead, the warning is genuine: on average it arrives 201 days early. EPSS is a useful head start for the roughly one bug in five it catches early; for the rest, the KEV listing is still the first solid signal you get.

A note on the EPSS v4 change: FIRST.org switched to a new version of EPSS on 2025-09-17 (the dashed line on chart 3), which lowered the starting scores for brand-new bugs. Because chart 3 looks at each bug’s full score history rather than a single day, the split barely moves across that date (EPSS leads 17% of the time before, 24% after), so the finding holds either way.

What the gap does and doesn’t tell you

One caution about reading these numbers. The KEV date is the day CISA added the bug, not the day attacks began. A 200-day gap does not mean 200 quiet days. Either the attacks were happening all along and CISA confirmed them late, or an old bug came back into use only recently. So the gap is partly a measure of attacker behavior and partly a measure of CISA’s own workflow, which is exactly why splitting new bugs from old ones matters. Read on its own, the new-bug gap is the honest measure of how fast CISA flags today’s threats: about nine days, and holding within two weeks.

Key observations

• For new bugs (published 2022 or later, 608 of the 740 additions since 2023), CISA is fast: the typical gap is 9 days, and 9 in 10 are flagged within about ten months.
• Nearly half (48%) of new bugs are flagged within a week of publication. That is a floor on how many were already under attack when they went public.
• The gap for new bugs is creeping up slowly: 6 days in 2023, 14 so far in 2026, but stays inside two weeks.
• The scary-looking multi-year delays come from old bugs coming back: about one addition in six is a pre-2022 bug, typically five and a half years old when listed. One dated to 2008.
• EPSS gives an early warning for about one bug in five (on average 201 days ahead). For the other four in five, the KEV listing is the first solid signal.