{
 "title": "CVE Exploitation Speed Index 2026: The Patch-Gap Race",
 "url": "https://www.servnetuk.com/research/cve-exploitation-speed-index-2026",
 "publisher": "Servnet Research",
 "license": "CC BY 4.0 — free to reuse with attribution",
 "collected": "2026-08-11",
 "records": [
  {
   "metric": "Median time from CVE publication to KEV, 2025",
   "value": "120 days",
   "source": "VulnCheck"
  },
  {
   "metric": "Median time from CVE publication to KEV, H1 2026",
   "value": "80 days",
   "source": "VulnCheck"
  },
  {
   "metric": "Mean time to exploit, 2025/2026 reporting",
   "value": "-7 days",
   "source": "Mandiant"
  },
  {
   "metric": "KEVs exploited on or before publication, 2025",
   "value": "28.96%",
   "source": "VulnCheck"
  },
  {
   "metric": "Exploited CVEs weaponised within 7 days of publication, Q2 2026",
   "value": "22%",
   "source": "SecurityOnline.info"
  },
  {
   "metric": "Average publication-to-KEV gap, Q2 2026",
   "value": "1,072 days",
   "source": "SecurityOnline.info"
  },
  {
   "metric": "Median publication-to-KEV gap, Q2 2026",
   "value": "68 days",
   "source": "SecurityOnline.info"
  },
  {
   "metric": "CERT-In patch deadline for known exploited vulnerabilities on internet-facing systems",
   "value": "12 hours",
   "source": "CERT-In"
  }
 ]
}