48,000 CVEs.
Only 256 Mattered.
Patching by CVSS is failing. Our analysis of the 2025 vulnerability landscape shows where attackers actually focused, and where your team is burning quarters on noise.
This report will feel familiar, if you’ve ever:
- delayed firewall patching because downtime felt riskier
- watched exploits hit before remediation finished
- argued why a Medium CVE mattered more than a Critical one
48,000+
CVEs
256
Exploited
104
Zero-days
4-hour
Exploit window
THE PRIORITIZATION GAP
Teams patched 20,000. Attackers used 210.
In 2025, security teams treated nearly 20,000 vulnerabilities as urgent because CVSS rated them High or Critical. Attackers exploited roughly 210.
Meanwhile, 32 exploited vulnerabilities were rated Medium or Low — and would have quietly fallen into backlog queues.
Most Teams Are Prioritizing the Wrong Vulnerabilities
-
Why 99.5% of published CVEs were never exploited
-
Why 32 exploited vulnerabilities were rated Medium or Low
-
Why attackers targeted VPNs, firewalls, EDR, and IAM systems first
-
How the exploit window collapsed from 7 days to near-zero
-
Which threat actors and ransomware groups dominated exploitation activity
-
Hidden patterns among 104 zero-days hit that in production