Research · observation only, not scored
Zero-day exploitation trends
A zero-day here is a vulnerability with credible evidence of malicious exploitation before a publicly available patch.
Loading…
What these counts cover
Records
AI and these counts
Methodology
- Confirmed exploited zero-day: the product vendor's own security release that publishes the fix states the issue was already exploited — Microsoft "Exploited: Yes" at the advisory's original release, Google Chrome "aware that an exploit … exists in the wild", Apple "aware of a report that this issue may have been exploited" (Apple's hedged wording, also counted separately).
- Reported or under review: exploitation is established but its timing against the fix is not — listed in CISA KEV on the day the CVE was published, a Microsoft "Exploited: Yes" added in a later revision, or a governed source calling it a zero-day. A KEV listing alone never makes a zero-day.
- Rapidly exploited N-day: no evidence of exploitation before the fix, and CISA confirmed exploitation 1–30 days after the CVE was published. Later confirmations are listed as N-days and not trended.
- Never evidence on their own: a critical CVSS score, EPSS, a public proof of concept, an unpatched status.
- Dates are kept apart and never filled: reported to the vendor (only when the vendor states it), first known exploitation (no source here states it), CVE published, exploitation first publicly confirmed, fix available, added to KEV, first read by ICHI. Windows count by the date exploitation was first publicly confirmed, in UTC days, today included; the prior window is the same number of days before it.
- Changes compare only events from sources that covered both windows. A percentage change is not stated when the prior window holds no event. Fewer than ten events in either window is marked as a small sample.
- One record per CVE: the same CVE in several releases or sources is one event, dated by its earliest statement; differing dates are named. A record a source stops listing is kept: "not in the current feed" is not "did not happen". A changed class or date is recorded as a correction.
- Not scored: nothing here changes VECTORS, the ICHI score, Edge Pressure, Patch Pressure or the exploitation verdict.