Vulnerability management: what an enterprise fixes first, and what it buys

How many vulnerabilities are published each year

FIRST, the global forum of incident response teams, forecasts CVE volume each year. With two days of 2025 left, it counted 49,183 CVEs published. That landed inside its forecast range of 41,142 to 49,868, near the top.³

Its February 2026 forecast put the 2026 median at about 59,000. By mid-June, publications were running 46.3% above that forecast, and FIRST raised its 2026 projection to about 66,000. It credits part of the rise to AI-assisted bug discovery, and part to GitHub and VulnCheck assigning CVE IDs to a backlog.^6,7

NIST, which runs the National Vulnerability Database, reports that CVE submissions rose 263% between 2020 and 2025. It enriched nearly 42,000 CVEs in 2025 and still could not keep up.⁸

Most of that volume will never be attacked. FIRST's EPSS team says the CISA Known Exploited Vulnerabilities catalog lists roughly 0.5% of published CVEs, and that 2.5% to 3% show exploitation activity in any 30-day window. In its June 2026 update, FIRST found that once the count is filtered to KEV entries and CVEs with an EPSS score above 10%, the patching burden has stayed flat.^4,9

How to prioritize vulnerabilities: CVSS, EPSS, CISA KEV and SSVC

Four public signals do most of the ranking. They answer different questions, and none of them knows your environment.^4,5

The CVSS v4.0 specification says consumers should enrich Base metrics with Threat and Environmental values for their own systems. It names factors outside CVSS that an organization may also weigh, including regulatory requirements, the number of customers affected and monetary losses.⁵

EPSS has no built-in cutoff. FIRST says the right threshold depends on remediation capacity, risk tolerance and asset context, and that the commonly cited 0.10 carries no special authority.¹⁶

More on vulnerability management

• Vulnerability Management PlatformsBuyer Guide
• Patch ManagementBuyer Guide
• Attack Surface Management (ASM / CTEM)Buyer Guide
• Rapid7 vs TenableComparison
• Qualys vs TenableComparison
• RFP questions: Vulnerability Management PlatformsRFP questions
• How should a CIO choose cybersecurity software?Article

How fast attackers exploit vulnerabilities

Mandiant measured an average time to exploit of 63 days in 2018 and 2019, and 32 days across 2021 and 2022. For vulnerabilities disclosed in 2023, it was five days. That figure leaves out 15 outliers; with them included, the average is 47 days.¹⁷

Flaws first exploited after a patch existed moved fast too. Of those n-days, 12% were exploited within one day, 29% within one week and 56% within one month. Mandiant also found that exploit release and media attention did not predict when exploitation would start.¹⁷

Verizon's 2026 Data Breach Investigations Report puts exploitation of vulnerabilities ahead of credential abuse as the most common way into a breached organization, at 31% against 13%. It also found that the median organization had 50% more KEV vulnerabilities to patch than the year before.^18,19

The internet edge is where this concentrates. In the 2025 report, edge devices and VPNs were 22% of the targets of vulnerability exploitation, up from 3% the year before.²⁰

Remediation SLAs and compliance deadlines

Several rules set remediation deadlines. They do not agree on when the deadline starts.

• CISA Binding Operational Directive 22-01 binds US federal agencies. They must remediate KEV entries within two weeks, or within six months for CVEs assigned before 2021. Each catalog entry carries its own due date.^13,21
• PCI DSS requirement 6.3.3 requires patches for critical vulnerabilities within one month of release. Other patches follow timeframes the entity sets from its own risk ranking under requirement 6.3.1.²²
• PCI DSS does not make an entity accept outside risk rankings. Under requirements 11.3.1 and 11.3.1.1, critical and high-risk vulnerabilities found in internal scans must be resolved.²²
• FedRAMP's Rev5 guidance, now filed as legacy documentation, requires critical and high risks remediated within 30 days of discovery, moderate within 90 days and low within 180 days.²³
• CIS Control 7 sets no clock. It asks for a plan to continuously assess and track vulnerabilities on all enterprise assets and to watch public and private sources for new threat information.¹

The start dates matter for reporting. PCI DSS counts from the patch's release. FedRAMP counts from discovery. A tool that reports age from first detection will understate PCI DSS lateness whenever the scan runs after the patch ships.^22,23

Vulnerability scanning, exposure management and patch management

A scanner can only report on assets it knows about. SSVC's guidance for deployers starts from an inventory of deployed product versions, which the deployer has to collect, matched against fixes that usually come from the supplier.¹⁴

Exposure changes the ranking. In SSVC, the more exposed a system is, the more likely it is to get a higher priority, and the same holds for a flaw with known exploitation. Edge devices face the internet by design, and Verizon's figures show exploitation shifting toward them.^14,20

Patch management is the step that closes most findings. NIST SP 800-40 Rev. 4 defines it as identifying, prioritizing, acquiring, installing and verifying patches, updates and upgrades across an organization. NIST frames patching as preventive maintenance and a cost of doing business.²

When no patch exists, SSVC lists the alternatives: mitigate, for example by shutting down services or adding controls, or accept the risk.¹⁴

What vulnerability management tools cost to buy and run

Few vendors publish prices. Tenable does for its smaller tiers. On November 9, 2026, its buy page listed Nessus Professional at $4,790 for a one-year license, and Nessus Expert, which adds web app scanning and external attack surface discovery, at $6,790. Tenable One Vulnerability Management was $3,700 for a one-year subscription, sold online for up to 250 assets. Larger estates and Tenable's exposure management platform are quoted by sales.²⁴

The main prioritization data is free. FIRST publishes EPSS scores daily as CSV and through an API. CISA publishes the KEV catalog as a JSON file on GitHub.^11,13

Running the program costs more than the license. FIRST's June 2026 update says the constraint is no longer discovery but the human capacity to verify, coordinate and patch. It expects work patching live systems to stay steady through the end of 2026, while teams that maintain software should prepare to double theirs.⁹

Where vulnerability management programs go wrong

• Ranking on the Base score alone. The CVSS v4.0 Base score assumes the reasonable worst case across all environments, and the CVSS v4.0 FAQ, as FIRST's EPSS team quotes it, says Base scores are not risk.^5,25
• Multiplying EPSS by CVSS. FIRST says the result is not probability times severity and has no interpretable meaning.²⁵
• Assuming NVD has scored every CVE. Since April 15, 2026, NVD enriches first the CVEs in KEV, in software the federal government uses, and in critical software under Executive Order 14028. The rest are marked lowest priority, and NVD no longer routinely adds its own score where the CVE's issuer already gave one.²⁶
• Taking scores on trust. In April 2026, NVD found about 4,500 CVE records, 19% of those with a CVSS v4.0 score, carrying a v4.0 number higher than the correct one.²⁷
• Treating a fix as final. SSVC's guidance notes that a vulnerability can return through updates or rollbacks, and that a firewall rule used as a mitigation holds only until someone changes the rule.¹⁴
• Leaving known-exploited flaws partly fixed. Verizon found organizations fully remediated only 26% of KEV vulnerabilities in 2025.¹⁹