How Adversaries Are Turning the Vulnerability Ecosystem Against Defenders
CrowdStrike, Thursday, November 5th, 2026
CrowdStrike found the median time from public proof-of-concept to exploitation was under one day in the first half of 2026.
CrowdStrike Counter Adversary Operations analyzed exploitation observed from January to July 2026 and found the median time from public proof-of-concept release to in-the-wild exploitation was under one day, with the fastest at 35 minutes.
Of exploited vulnerabilities with public POCs, 91 percent were exploited within 48 hours, leaving traditional patch cycles too slow.
In one case, a published detection-artifact generator for cPanel authentication bypass CVE-2026-41940 could be turned into an exploit by uncommenting one line, and widespread exploitation followed, though one actor had used it as a zero-day since at least April 3.
CrowdStrike also cites the CopyFail Linux privilege escalation flaw CVE-2026-31431, whose POC was released while many distributions were unpatched.