48,000 CVEs.
Only 256 Mattered.
Patching by CVSS is failing. Our analysis of the 2025 vulnerability landscape shows where attackers actually focused, and where your team is burning quarters on noise.
48,000+
CVEs
256
Exploited
104
Zero-days
4-hour
Exploit window
Teams patched 20,000.
Attackers used 210.
In 2025, security teams treated nearly 20,000 vulnerabilities as urgent because CVSS rated them High or Critical. Attackers exploited roughly 210. Meanwhile, 32 exploited vulnerabilities were rated Medium or Low and would have quietly fallen into backlog queues.
CVSS-first prioritization
47,000 findings. Patch backlog expands every quarter. Engineering teams stop trusting severity ratings. Nobody can answer the board.
Attacker-led prioritization
256 CVEs were actively exploited. This report maps exactly which ones, who them, and which industries were targeted first.
Most Teams Are Prioritizing
the Wrong Vulnerabilities
This report will feel familiar if you've ever delayed firewall patching because downtime felt riskier, watched exploits hit before remediation finished, or argued why a Medium CVE mattered more than a Critical one.
-
Why 99.5% of published CVEs were never exploited
-
Why 32 exploited vulnerabilities were rated Medium or Low
-
Why attackers targeted VPNs, firewalls, EDR, and IAM systems first
-
How the exploit window collapsed from 7 days to near-zero
-
Which threat actors and ransomware groups dominated exploitation activity
-
Hidden patterns among 104 zero-days hit that in production
Attackers already prioritized the CVEs for you. The hard part isn't finding vulnerabilities anymore. It's knowing which ones matter before another quarter burns on noise.