DaystoPatch

Days to Patch grades software vendors on how fast they respond to security bugs that attackers are already using. Every timestamp links to its source. 84% of 1,079 are archived and quote-checked. The rest are marked.

Exploited, not yet fixed

2 open0 with no fix, 2 partly fixed

Compressed time scale
  1. Open forsince 11 Mar 2025
    Juniper NetworksJunos OS kernel isolation flaw used by UNC3886 to implant backdoors on Juniper routersCVE-2025-21590CVSS 6.7
    Partly fixedFirst fix after 1d
  2. Open forsince 13 Oct 2026, 14:33 UTC
    IvantiIvanti Connect Secure zero-day exploit chain (auth bypass + RCE, root privilege escalation)CVE-2026-104935, CVE-2026-111357CVSS 8.6
    Partly fixedA fix existed at disclosure

Report cards

All 36 report cards

What a grade means. B means the vendor met the public norm, such as a first fix within 7 days of the first public report or a private fix within 120 days. Taking half the norm time scores 92, an A. Taking twice the norm time scores 43, a D−. How grades work

Response to exploited bugs

10 of 36 vendors graded. 1 firm, 9 provisional. A grade needs 3 reviewed zero-days.

Score
  1. 1Cisco 14 reviewed zero-days90
  2. 2SonicWallProvisional 4 reviewed zero-days84
  3. 3CitrixProvisional 4 reviewed zero-days82
  4. 4BeyondTrustProvisional 4 reviewed zero-days81
  5. 5IvantiProvisional 4 reviewed zero-days82
  6. 6FortinetProvisional 7 reviewed zero-days80
  7. 7Check PointProvisional 3 reviewed zero-days80
  8. 8Palo Alto NetworksProvisional 3 reviewed zero-days80
  9. 9OracleProvisional 4 reviewed zero-days79
  10. 10MicrosoftProvisional 3 reviewed zero-days75

Fixing privately reported bugs

20 of 36 vendors graded. 6 firm, 14 provisional. From bugs reported privately to the vendor.

Score

Highest

  1. 1Apple 78 private reports, median 105 days79
  2. 2Progress Software 21 private reports, median 98 days79
  3. 3Adobe 56 private reports, median 89 days77
  4. 4OracleProvisional 25 private reports, median 64 days78
  5. 5SonicWallProvisional 7 private reports, median 77 days78

Lowest

  1. 16MicrosoftProvisional 112 private reports, median 140 days63
  2. 17QNAPProvisional 10 private reports, median 226 days66
  3. 18Trend Micro 65 private reports, median 194 days61
  4. 19IvantiProvisional 41 private reports, median 126 days64
  5. 20GoogleProvisional 8 private reports, median 299 days65

Fixed in the last 30 days

Compressed time scale
  1. Palo Alto NetworksPAN-OS management interface authenticated remote code execution
    First fix
    0h
    All versions
    27h
  2. MicrosoftWindows Command Injection VulnerabilityNot reviewedBuilt automatically from collected sources. Not yet checked by a researcher, so it doesn't count toward any grade.
    First fix
    same day
    All versions
    same day
  3. BeyondTrustRemote Support improper origin validation (BT26-05)
    First fix
    same day
    All versions
    same day
  4. AtlassianArbitrary File Access Vulnerability impacts Multiple Atlassian Data Center Products
    First fix
    same day
    All versions
    same day
  5. FortinetFortiMail unauthenticated arbitrary file write via IBE path traversal
    First fix
    4d
    All versions
    4d
  6. CitrixNetScaler ADC and Gateway SAML memory overflow exploited for denial of service
    First fix
    32h
    All versions
    32h
  7. CiscoCatalyst SD-WAN Manager API Authentication Bypass Vulnerability
    First fix
    <1h
    All versions
    <1h
  8. AppleMultiple Products Out-of-Bounds Write VulnerabilityNot reviewedBuilt automatically from collected sources. Not yet checked by a researcher, so it doesn't count toward any grade.
    First fix
    same day
    All versions
    same day
  9. CitrixNetScaler ADC and Gateway zero-day RCE pair (input validation and DTLS memory overflow)
    First fix
    25h
    All versions
    25h

Advisory changes

All changes

Most important first: severity, exploitation, re-dated revisions, fixed versions. Newest first within each.

  1. Palo Alto Networks PAN-SA-2024-0015CVSS base vector changed from AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L to AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:N/SA:N. Published date changed from 2024-11-08 to 2024-11-18.Recorded in the revision history
  2. Palo Alto Networks CVE-2026-0257CVSS exploit maturity changed from unreported to attacked (displayed score 4.7 to 7.8). Advisory now says the bug is exploited (earlier version: vendor not aware). Version table: 4 rows added and 4 rows removed. One new row reads "PAN-OS 12.1 | = 12.1.4-h6 >= 12.1.7".Recorded in the revision history
  3. Fortinet FG-IR-25-910CVSS exploit maturity changed from functional to high (displayed score 9.1 to 9.4).Changed without a revision note

The Wire

Latest from vendor and public channels
  1. SecurityWeekLiteLLM Compromised in Fresh Supply Chain Attack
  2. Android Security BulletinsAndroid Security Bulletin—October 2026
  3. WatchGuard PSIRT advisories and CVEsWGSA-2026-0032 — PHP2Shell (CVE-2026-109618 and CVE-2026-109619)
  4. WatchGuard PSIRT advisories and CVEsCVE-2026-96293 — Endpoint Security Cleartext Storage of FileVault Recovery Key in Log File
  5. WatchGuard PSIRT advisories and CVEsCVE-2026-115253 — WatchGuard Agent Incorrect Permission Assignment in Log Directory Allows Local Log Tampering
  6. Veeam Knowledge Base feedMitigating Impact of Compromised eMudhra Intermediate CA Certificates on Veeam Kasten for Kubernetes