From Disclosure to Exploit: How Fast Are Threat Actors Weaponizing New CVEs?

The report explains that the mean time from public CVE disclosure to active exploitation has collapsed—from weeks to days and in some high-risk categories to hours—driven by unprecedented CVE volume, automated scanning infrastructure, and AI that accelerates discovery and weaponization; it documents AI-assisted campaigns (APT45), open-source AI attack frameworks (CyberStrikeAI) reaching mass exploitation, and a sharp rise in exploited zero-days, concluding that proactive, exploitation-signal-based threat intelligence and compensating controls are now essential.