Key figure: CISA's Known Exploited Vulnerabilities catalog listed 1,748 entries as of October 16, 2026, every one confirmed exploited in the wild (CISA KEV catalog, version 2026.10.16).
This cybersecurity news tool ranks how fast major vendors patch critical CVEs in 2026. Slow patching leaves systems exposed for months — the leaderboard shows who fixes in days and who takes quarters.
It measures the time between public disclosure of a critical CVE and the vendor shipping a fix, across seven of 2026's most consequential flaws. Vendors rank fastest to slowest, so you can see which suppliers leave customers exposed longest — and factor patch speed into buying decisions.
How fast do vendors ship patches for critical CVEs? Seven of 2026's biggest cases, ranked by days from first public disclosure to patch release — every date sourced. The best vendors patch before they tell anyone. The worst disclose with no fix at all. Wondering if you're affected by one of these CVEs? Run a free CVE checker on your versions — patching starts with knowing.
Critical OS command injection in the Nextcloud built-in CODE server app (proxy.php), exploited in the wild in September–October 2026. Collabora shipped the fix in version 26.4.303 on September 11, 2026 — a full 33 days before the public advisory of October 14, 2026. Textbook patch-first: the fix was out before attackers got the playbook.
−33 days (patch before disclosure)Exploited in wild: yesSources: The Hacker News · NeoTeo · Hendry Adrian
Critical unauthenticated GraphQL flaw allowing modification or deletion of public projects. GitLab shipped an out-of-band patch on August 17–18, 2026 — days after its scheduled August 12 release — with the advisory the same day. No exploitation confirmed at disclosure. Going out-of-band within days is the severity signal mature vendors send.
0 days (patch + advisory same day)Exploited in wild: no (at disclosure)Sources: Security Affairs · The Hacker News · Dark Reading
Critical remote code execution reachable through contributed modules, rated 19/25 on Drupal's risk scale. The security team pre-announced the release on October 12 so admins could reserve time, then shipped fixed releases (11.4.10, 11.3.19, 10.6.10) with the advisory — same day. No public exploit or attacks at the time of writing.
0 days (patch + advisory same day)Exploited in wild: no (at disclosure)Source: BitNewsBot
Unauthenticated path traversal in the repository commits API exposing arbitrary files — secrets, tokens, private keys. Patches released September 10, 2026 (CE 19.1.8, EE 19.2.6/19.3.2); CISA added it to the KEV catalog September 11 with a 3-day remediation deadline. Same-day coordinated disclosure — but active exploitation was already confirmed by CISA and observed by watchTowr, so defenders were patching under fire.
0 days (patch + advisory same day)Exploited in wild: yesSources: Cryptonomist · GBHackers
Two chained zero-days (CVSS 10.0 + 7.2) in SMA1000 secure remote access appliances, exploited by threat actor UTA0533 to deliver custom malware. Volexity believes exploitation began around June 22, 2026; SonicWall's patch + advisory landed July 14 — roughly 22 days of zero-day exploitation with no fix available. CISA added both to KEV the same day.
0 days from disclosure~22 days exploited before any patchSources: SecurityWeek · SecurityOnline
Authentication bypass (CVSS 8.6) in Ivanti Connect Secure VPN appliances, chained with other flaws for unauthenticated root code execution. Volexity found intrusions began October 3, 2026; Ivanti patched October 13 — ~10 days of active exploitation before a fix, during which attackers looted AD credentials, BitLocker keys, and LAPS passwords. Worse: a third vulnerability in the chain remained unpatched at disclosure.
0 days from disclosure~10 days exploited before patchChain incomplete at patchSource: CVETodo
Path traversal enabling remote code execution on exposed Langflow AI-pipeline servers. Researcher Joshua Martinelle first reported it January 20, 2026, followed up January 27 and February 4, and issued a final notice March 23. It was publicly disclosed March 27, 2026 — with no official patch released. Sixty-six days from first report to disclosure, and defenders still had no fix.
Unpatched at disclosure66 days from first report to disclosureSource: Cyber Security News
Most mature vendors cluster at 0 — coordinated same-day patch and advisory is now the industry norm, which is good news. The real differentiators are patch-first behavior (Collabora's −33 days: the fix was out before the advisory told attackers where to look) and the pre-patch exploitation window (SonicWall's ~22 days, Ivanti's ~10 days, Langflow's no-fix-at-disclosure). When you evaluate a vendor, ask two questions: do they patch before they disclose — and how many days do attackers get before they do?
Because coordinated disclosure — shipping the patch and the advisory on the same day — is standard practice among mature vendors. A 0 is good: it means defenders and the patch arrived together. The leaderboard's real signal is in the exceptions: patch-first (negative) and unpatched-at-disclosure.
No. This is an illustrative sample of 2026's biggest documented cases where both the disclosure date and the patch release date are publicly sourced. It is not a census of the software industry.
Private notification dates are almost never published, so a vendor's true response time from first report is usually unknowable. Public disclosure is the first date attackers definitively have the information — that's the exposure window that matters to defenders.
With each major 2026 case that has both dates sourced. New entries are added newest-first with their sources linked.
A CVE checker is a free tool that tells you whether your software is affected by a published CVE — a publicly known cybersecurity vulnerability. It compares your version or configuration against the official advisory and gives you a patched, vulnerable, or unknown verdict in about 30 seconds.
Find your exact version number, then compare it against the vendor's security advisory or the NVD entry for the CVE. The fastest way is a CVE checker built for that product: paste your version and get an instant verdict against the published version tables.
You are affected when you run a vulnerable version and the vulnerable component is reachable or enabled — for example, open sign-ups, an exposed management port, or a vulnerable app installed. A CVE checker gives you the version verdict in seconds; the advisory's conditions tell you whether that verdict means real exposure.
CVE identifiers, dates, and vendor names are factual references to publicly reported security incidents, linked to their sources. Grades reflect patch-speed behavior only — not overall vendor quality.