Every security team has a patch backlog, and every security team knows that a backlog is a form of accepted risk. Effective vulnerability management relies on understanding the depth of this risk. The uncomfortable question is how much risk, and for how long. New data from Contrast's AppSec Overflow 2026 report answers that question with hard numbers pulled from thousands of live production applications, and it should change how security leaders think about the window between a CVE's disclosure and its patch.
Known vulnerabilities linger in production far longer than most patch programs assume; attackers are actively reaching them, and the specific CVEs adversaries exploit are overwhelmingly old, well-documented flaws that have been public for years. Patching remains essential, but few organizations have the resources to reliably close the exposure window attackers operate in. Defenders need runtime protection to prevent exploitation while the patch process runs its course. Contrast CVE Shield fills the gap.
Contrast observes CVEs where it matters most: inside running applications, not in a static inventory or dependency manifest. That vantage point reveals not just theoretical vulnerabilities, but actual exploitable vulnerabilities in production. Across the CVE instances Contrast observed in customer environments, 54% were published more than a year ago. A meaningful share reaches back much further than that, some more than two decades.
Persistence alone would be manageable if the aging vulnerabilities were harmless. The data shows that they are not. When Contrast narrows the view to CVEs that are confirmed as actively exploited in the wild, meaning they appear in CISA's Known Exploited Vulnerabilities (KEV) catalog, the age skew becomes even sharper. A striking 98% of the known-exploited CVE instances Contrast observed in production were published more than a year ago. The vulnerabilities attackers are weaponizing are not the freshly disclosed zero days that dominate headlines. They are the mature, thoroughly documented flaws that have had years to accumulate reliable exploit code and find their way into commodity attacker tooling.
Figure: CVE Shield observes and monitors what CVEs are running in your applications
This is the exposure window in its most concrete form. A CVE gets disclosed, the patch process begins, and somewhere in the gap between those two events the vulnerability becomes a live target that can stay exploitable for years.
The persistence of known CVEs would matter less if attackers were not actively pursuing them, but Contrast's runtime telemetry shows the opposite. The average application faces 42 confirmed, viable attacks every month, each one an exploitation attempt that reached and triggered a real vulnerability in the running application. These are not probes or spray-and-pray scans against vulnerabilities that do not exist. Runtime observation confirms that the vulnerable code was actually activated.
Set that figure against the disclosure-to-exploit timeline and the pressure becomes clear. In 2018, the average time from CVE disclosure to first observed exploitation was more than two years. By 2026, that interval has collapsed to a matter of hours. Independent research from VulnCheck corroborates the trend, finding that 29% of exploited CVEs in 2025 were weaponized on or before the day their CVE was published. Attackers are moving at machine speed against a patch process that still runs at human speed.
The report calls out several high-prevalence CVEs that show vulnerabilities introduce live risk long after disclosure. Each appears with meaningful frequency across monitored applications and APIs, and each represents a flaw that has been public, documented and patchable for years.
A pattern in the exploitation data points to the right defensive response. When Contrast categorizes the known-exploited CVE instances it observes by the type of weakness attackers abuse, the distribution is heavily concentrated. Remote code execution accounts for 41% of known-exploited CVE instances and path traversal for another 31%. Add deserialization and unrestricted file upload, and these four capability categories together represent 77% of the known-exploited CVE instances observed in production.
Attackers vary their payloads endlessly, and AI-generated exploit code makes that variation cheaper and faster than ever, but the underlying dangerous behavior an exploit needs to succeed falls into a small and predictable set of system-level capabilities. A defense that recognizes exploitation by what an attack does inside the application, rather than by what its payload looks like at the perimeter, can address most real-world CVE exploitation without anticipating every payload variant.
This is the gap that Contrast CVE Shield is built to close. CVE Shield runs inside live production applications and gives teams an immediate, evidence-based answer to the question that matters during a fast-moving CVE event: Is this vulnerability actually present, is the vulnerable code actually running, and is anyone actually attacking it? That runtime confirmation cuts through the noise of theoretical findings and lets teams focus remediation on the CVEs that are genuinely reachable and exposed.
Figure: CVE Shield blocks malicious activity while allowing the application to function normally
When it detects exploitation, CVE Shield goes further and blocks it. Rather than attempting to define what an entire application is and is not allowed to do, CVE Shield creates a narrow microsandbox scoped to the exact method involved in a specific CVE. Within that scope, it intercepts the dangerous capabilities an attacker needs to exploit the flaw, while the application continues to function normally. Because the block happens at the capability level the exploit abuses rather than the specific payload, it holds up against manually crafted and AI-generated exploit variants alike.
The result is a compensating control for the exact window the report exposes. While a patch works its way through change management, dependency analysis, regression testing, and limited maintenance windows, CVE Shield defends the running application against exploitation of the very CVEs attackers are most likely to reach. Patching and building more secure software still matter. What CVE Shield provides is protection during the interval between disclosure and patch completion, the interval where this report shows attackers are already operating.
CVE Shield is free to start. You can connect your applications and, within minutes, see which CVEs are present, which are actively running, and which are being targeted in your own production environment. It is the lowest-friction way to see how much of the risk documented in this report is currently in your stack.
Get started with CVE Shield for free
For the full picture of how AI is reshaping the application threat landscape, including the complete data behind these findings, download the AppSec Overflow 2026 report.