WithSecure Warns CVE-to-Exploit Timeline Collapsing Below 24 Hours in 2026
New exploited vulnerabilities emerge every two days as median response window shrinks, WithSecure threat research reveals.
AI-generated summary. This news item was written automatically by an AI pipeline from published reporting and was not reviewed by a person before publication. It may contain errors. Read the original source.
The Shrinking Window for Vulnerability Response
WithSecure’s threat research predicts the median time from CVE disclosure to active attack will drop below 24 hours in 2026. The concerning pace of vulnerability exploitation is already evident: a new exploited vulnerability is published every two days, while a new exploited zero-day vulnerability emerges every three days.
This accelerating timeline reflects a fundamental shift in the threat landscape. CVEs are now competing with compromised identity as the most common initial attack vector, according to WithSecure’s analysis.
A New Defense: Pre-Zero-Day Detection
In response to this pressure, WithSecure’s Elements platform now includes a patent-pending pre-zero-day vulnerability discovery capability. The technology uses behavioural telemetry from XDR sensors to detect exploitable vulnerabilities before they have been reported or analysed.
The approach has moved from theoretical to proven: WithSecure identified its first pre-zero-day vulnerability in 2025, and the vendor confirmed the fix in their own release notes.
The AI-Generated Code Security Gap
Separately, Veracode’s analysis of AI-generated code reveals a critical security blind spot. According to GitHub’s 2024 developer survey, 97% of developers have used AI coding tools—yet security performance remains stubbornly weak.
Veracode’s analysis of 80 coding tasks across four programming languages and four critical vulnerability types found alarming failure rates in specific vulnerability classes. AI models generated insecure Cross-Site Scripting (CWE-80) code 86% of the time and insecure Log Injection (CWE-117) code 88% of the time. Performance was marginally better for SQL Injection (CWE-89), where AI models achieved an 80% security pass rate, and Cryptographic Failures (CWE-327), where they achieved an 86% pass rate.
More troubling still: AI model security performance in generating secure code has remained largely unchanged over time, even as models have dramatically improved in generating syntactically correct code. Newer and larger AI models do not generate significantly more secure code than their predecessors.
Accelerating Vulnerability Remediation
While AI struggles with secure code generation, it shows promise in remediation. Veracode Fix achieved a 92% reduction in vulnerability detection time in a case study, along with over 200% faster remediation compared to manual processes and over 80% fix acceptance rates from developers.
Source: WithSecure