Zero-Day Statistics 2026: Exploits, Targets & Patch Speed

Executive Benchmark: Zero-Day Statistics for 2026

Methodology: What Counts as a Zero-Day?

“Zero-day statistics” is used for four different counts. Each answers a different question, comes from a different kind of source, and can be wrong in a different way.

How Google counts. Google Threat Intelligence Group defines a zero-day as a vulnerability maliciously exploited in the wild before a patch was publicly available. Its counts use Google’s own research plus open-source reporting, only include detected and disclosed cases, and can change as past incidents are discovered. Its 2025 review has a cutoff of 31 December 2025. Its September 2026 analysis uses a different dataset of monthly counts, so its monthly figures (8 and 11 a month) are not a restatement of the 90 and should not be multiplied out to match it.

How ScanTitan counted. We downloaded the CISA Known Exploited Vulnerabilities feed, version 2026.11.06 with 1,769 entries, and looked up each CVE’s publication date in the CVE Services API. The gap is the number of days between CISA adding the flaw and the CVE record being published. This measures when CISA listed a flaw, not when exploitation started, so it is a proxy and a ceiling on how fast CISA reacts. CISA added 311 entries in 2021 and 555 in 2022, most of them old CVEs listed in bulk when the catalog launched, so we show the trend from 2023.

Source confidence. Google, CISA and the CVE Program publish their methods. VulnCheck’s figures come from its own catalog and are labeled vendor-only. VulnCheck notes that not every flaw exploited on or before its CVE day is a true zero-day.

How Many Zero-Days Are Exploited Each Year?

Source: Google Threat Intelligence Group, 2025 Zero-Days in Review.

Three readings matter. First, the count is stable, not climbing: 2025 is 10 below the 2023 record and Google says volume has stayed within 60 to 100 for five years, “a trend toward stabilization.” Second, the mix is changing: enterprise products rose to 48% and operating systems to 44%, while browsers fell below 10%, which Google reads as browser hardening working, with the caveat that better attacker secrecy may hide some exploitation. Third, the figure is a floor. Google counts only detected cases, and says the 14 zero-days in edge devices likely understate the real number because most edge devices cannot run endpoint detection.

The 2026 Update: Exploitation Up, Zero-Days Flat

Google’s 30 September 2026 analysis covers vulnerabilities disclosed from January 2025 to August 2026.

Source: Google Threat Intelligence Group.

Google’s reading is that the 2026 rise “is driven by the rapid, targeted weaponization of high-risk exploits” and that growth is concentrated in n-days. Zero-days still make up 62% of the exploited set in the period, about 87 of 141 by ScanTitan’s arithmetic, but they grew from 8 to 11 a month while all exploitation grew from 10.5 to 18. Google suggests attackers may use AI tools to compare product versions, patches and proof-of-concept code to weaponize n-days quickly, and says that is a possibility, not a finding. It also notes the exploited share of disclosures is tiny: 0.23% of 2026 disclosures, about 1 in 431. Since May 2026, exploitation growth (+127%) has tracked disclosure growth (+128%), so exploitation is scaling with the number of vulnerabilities rather than ahead of it.

VulnCheck’s first-half 2026 report points the same way. Early exploitation held steady at roughly 200 CVEs reaching its catalog within 31 days of publication in each of 2024 (196), 2025 (194) and the first half of 2026, while CVE volume grew sharply, so the share fell. Its KEV to CVE ratio dropped from 2.7% in the second half of 2023 to 1.4% in the first half of 2026. Source: VulnCheck, vendor-only.

What Zero-Days Hit: Enterprise, Operating Systems and Browsers

Google splits the 90 zero-days of 2025 into 43 in enterprise products (48%) and 47 in end-user products (52%).

Source: Google Threat Intelligence Group. Operating systems and mobile overlap in Google’s grouping (mobile operating systems count as operating systems), so the rows do not add to 90.

Google reports that memory safety flaws, mainly use-after-free and out-of-bounds write, were roughly 35% of the 2025 zero-days. Enterprise appliances more often fell to injection, deserialization, authentication bypass and design flaws, which allow remote code execution without memory corruption. Twenty vendors had just one exploited zero-day each, so exploitation is spread widely, though big tech vendors and security vendors saw the most. In the 2026 data, 14% of exploited vulnerabilities affected edge and security appliances and 11% affected enterprise directory and collaboration systems, and over 65% of the exploited edge flaws were rated high or critical risk by Google.

Who Uses Zero-Days

Google attributed exploitation of a share of the 2025 zero-days to named groups. Many are not attributed at all.

Source: Google Threat Intelligence Group.

Two points stand out. For the first time, Google attributed more zero-day exploitation to commercial surveillance vendors than to traditional state-sponsored espionage groups, which means paid access to zero-days now reaches a wider set of customers. And financial groups nearly matched their 2023 high: Google tracked zero-day exploitation by a threat actor claiming affiliation with the CL0P extortion brand against Oracle E-Business Suite as early as 9 August 2025, weeks before a patch.

How Fast Exploited Flaws Reach CISA’s KEV Catalog

ScanTitan measured the days between each CVE’s publication and the date CISA added it to the Known Exploited Vulnerabilities catalog.

Source: CISA KEV feed version 2026.11.06 and the CVE Services API, counted by ScanTitan.

Across 2023 to 2026, 187 of 903 entries (20.7%) were listed on or before the day the CVE was published. That sits below VulnCheck’s 28.96% for 2025, which is expected: VulnCheck tracks exploitation evidence from over 100 sources and says it often finds evidence earlier than CISA, and CISA lists a flaw only after it has reliable evidence. The two methods still agree on the shape: roughly one in five to three in ten exploited flaws are exploited by the time defenders hear of them, and about half reach the catalog within a month. The other half are older flaws. Between a fifth and a quarter of each year’s additions are more than a year old, so exploitation of known, patched flaws continues long after disclosure.

What CISA’s BOD 26-04 Changes

On 10 June 2026 CISA issued Binding Operational Directive 26-04, which revokes BOD 22-01 (which created the catalog) and BOD 19-02. Federal agencies now set remediation timelines from four inputs: whether the asset is publicly exposed, whether the CVE is in the KEV catalog, whether an adversary can automate exploitation, and whether exploitation gives partial or total control. The top tier requires remediation within three days and a forensic triage to check whether the system was already compromised. The criteria for adding a flaw to the catalog are unchanged. Sources: BOD 26-04 and its implementation guidance.

The catalog feed shows the effect. ScanTitan compared each entry’s due date with the date it was added.

Source: CISA KEV feed, counted by ScanTitan from each entry’s dateAdded and dueDate fields.

Before the directive, about a quarter of 2026 additions had a due date of three days or less. Since it, about four in five do, and 97 entries carry a forensic triage flag. Together with the data above, the shortest due dates now apply to most newly listed flaws. These are federal deadlines; private organizations are not bound, but the catalog is a free signal of what attackers are using.

Zero-Day Statistics Commonly Misquoted

What the Numbers Mean for a Lean Team

You cannot patch a flaw that has no patch, so zero-days are a response problem as much as a prevention problem. Three facts shape the work: exploitation clusters in internet-facing enterprise and edge products, about half of CISA-listed flaws are listed within a month of disclosure, and most of the growth in 2026 is n-days that a patch already fixes.

1. Patch exposed edge and remote-access products first. Security appliances, VPNs and admin interfaces are the most targeted group. Treat a KEV listing for software you run as an emergency, not a ticket.
2. Subscribe to the KEV feed. It is free and lists what is being exploited. The CVE priority checker shows whether a flaw is on it.
3. Cut exposure before a patch exists. Remove management interfaces from the public internet, restrict them by IP, and disable unused features. Mitigation is often the only option on day zero.
4. Plan a forensic check for top-tier flaws. BOD 26-04 pairs three-day remediation with triage for a reason: assume the flaw was used before the patch landed.
5. Know your external assets. You cannot patch what you do not know is exposed. A website vulnerability scanner finds known flaws on the assets you list.
6. Read the neighbors. For the wider picture see ScanTitan’s vulnerability statistics, web application attack statistics and XSS statistics.

How We Compiled and Verified These Statistics

• Used: Google Threat Intelligence Group’s 2025 Zero-Days in Review (6 March 2026) and its Vulnerability Discovery and Exploitation Trends in the AI Era analysis (30 September 2026), VulnCheck’s State of Exploitation 2026 and 1H 2026 reports, CISA’s BOD 26-04 and its implementation guidance, the CISA Known Exploited Vulnerabilities feed (version 2026.11.06) and CVE publication dates from the CVE Services API. Vendor figures are labeled vendor-only.
• Method: each KEV entry’s dateAdded was compared with its CVE datePublished, and each entry’s dueDate with its dateAdded. Every other figure was read on its own page.
• Excluded: roundup and aggregator pages, competitor figures, unsourced zero-day market prices, and any monthly zero-day figure multiplied out to match another dataset.
• Refresh: reviewed every 90 days. KEV counts change daily, and Google revises its zero-day totals as past incidents are found.

How to cite this research. ScanTitan, “Zero-Day Statistics 2026: Exploits, Targets & Patch Speed,” 12 November 2026. For single figures, cite the primary source beside each number.

Primary Sources

• Google Threat Intelligence Group, Look What You Made Us Patch: 2025 Zero-Days in Review
• Google Threat Intelligence Group, Vulnerability Discovery and Exploitation Trends in the AI Era
• VulnCheck State of Exploitation 2026 and 1H 2026, vendor-only
• CISA BOD 26-04 and implementation guidance
• CISA Known Exploited Vulnerabilities catalog data feed
• CVE Program

Frequently Asked Questions