2023 in review
All of 2023. Numbers as of 12 October 2026.
- Exploited
- 187
- not compared with 2022, when CISA was mostly catching up on older flaws
- Exploited from day one
- 24%
- 44 of 187 were already under attack when they went public
- Typical time to exploitation
- 12 days
- from going public to confirmed attacks
- Used in ransomware
- 43
- 23% of the exploited ones
- New vulnerabilities
- 28,816
- up 15% from 2022
- Rated critical
- 4,628
- up 9% from 2022
exploited each month
all exploited exploited each monthVulnerabilities added to KEV each month in 2023. KEV (Known Exploited Vulnerabilities) is the US government agency CISA's list of flaws attackers are known to be using. Each counts in the month it was added, however old it is.
Busiest month: June, with 24. CISA usually gave US federal agencies 21 days to patch each one.
| Month | Exploited | Used in ransomware |
|---|---|---|
| January | 5 | 3 |
| February | 14 | 9 |
| March | 18 | 2 |
| April | 17 | 6 |
| May | 19 | 1 |
| June | 24 | 2 |
| July | 16 | 4 |
| August | 8 | 3 |
| September | 19 | 3 |
| October | 18 | 5 |
| November | 18 | 3 |
| December | 11 | 2 |
time to exploitation
Time from going public to being added to KEV, for each vulnerability added in 2023.
- Critical
- High
- Medium
- Low
- No score
By the day it went public44
Within a week41
Within a month18
Within a year38
1 to 5 years later30
Over 5 years later16
| Time to exploitation | Exploited | Critical | High | Medium | Low | No score |
|---|---|---|---|---|---|---|
| By the day it went public | 44 | 6 | 31 | 7 | 0 | 0 |
| Within a week | 41 | 17 | 20 | 3 | 1 | 0 |
| Within a month | 18 | 5 | 9 | 3 | 1 | 0 |
| Within a year | 38 | 12 | 15 | 11 | 0 | 0 |
| 1 to 5 years later | 30 | 10 | 14 | 6 | 0 | 0 |
| Over 5 years later | 16 | 5 | 9 | 2 | 0 | 0 |
new vulnerabilities each month
browse new vulnerabilities each monthCVEs published each month in 2023, by severity. A CVE is the public ID given to one vulnerability; its severity comes from its CVSS score.
- Critical
- High
- Medium
- Low
- No score
| Month | CVEs | Critical | High | Medium | Low | No score |
|---|---|---|---|---|---|---|
| January | 2,337 | 510 | 855 | 946 | 26 | 0 |
| February | 2,122 | 341 | 860 | 887 | 34 | 0 |
| March | 2,516 | 402 | 962 | 1,118 | 34 | 0 |
| April | 2,330 | 356 | 822 | 1,120 | 32 | 0 |
| May | 2,418 | 340 | 949 | 1,095 | 34 | 0 |
| June | 2,384 | 314 | 899 | 1,135 | 36 | 0 |
| July | 2,305 | 331 | 906 | 1,025 | 43 | 0 |
| August | 2,477 | 435 | 874 | 1,136 | 32 | 0 |
| September | 2,148 | 358 | 782 | 953 | 55 | 0 |
| October | 2,680 | 423 | 1,080 | 1,137 | 40 | 0 |
| November | 2,449 | 354 | 989 | 1,076 | 30 | 0 |
| December | 2,650 | 464 | 974 | 1,186 | 25 | 1 |
how many were confirmed exploited
All of 2023's CVEs against the ones added to KEV before the year was out, by severity.
- Critical
- High
- Medium
- Low
- No score
All new vulnerabilities 100%28,816
Exploited within 2023 0.4%127
| Vulnerabilities | CVEs | Critical | High | Medium | Low | No score |
|---|---|---|---|---|---|---|
| All new vulnerabilities | 28,816 | 4,628 | 10,952 | 12,814 | 421 | 1 |
| Exploited within 2023 | 127 | 36 | 70 | 19 | 2 | 0 |
most exploited vendors
Top 10 vendors by vulnerabilities added to KEV in 2023.
- Critical
- High
- Medium
- Low
- No score
| Vendor | Exploited | Critical | High | Medium | Low | No score |
|---|---|---|---|---|---|---|
| Microsoft | 31 | 2 | 24 | 5 | 0 | 0 |
| Debian | 25 | 8 | 12 | 4 | 1 | 0 |
| Apple | 23 | 0 | 19 | 4 | 0 | 0 |
| Fedoraproject | 19 | 4 | 11 | 3 | 1 | 0 |
| Red Hat | 12 | 3 | 8 | 1 | 0 | 0 |
| 10 | 2 | 8 | 0 | 0 | 0 | |
| Netapp | 9 | 3 | 6 | 0 | 0 | 0 |
| Cisco | 8 | 2 | 4 | 2 | 0 | 0 |
| Oracle | 8 | 4 | 3 | 1 | 0 | 0 |
| Apache | 7 | 5 | 2 | 0 | 0 | 0 |
most vulnerabilities
Top 10 vendors by new vulnerabilities in 2023.
- Critical
- High
- Medium
- Low
- No score
| Vendor | CVEs | Critical | High | Medium | Low | No score |
|---|---|---|---|---|---|---|
| 1,752 | 59 | 552 | 1,119 | 22 | 0 | |
| Microsoft | 1,026 | 50 | 684 | 282 | 10 | 0 |
| Adobe | 676 | 11 | 261 | 392 | 12 | 0 |
| Fedoraproject | 558 | 34 | 229 | 275 | 20 | 0 |
| Debian | 515 | 37 | 253 | 213 | 12 | 0 |
| Apple | 489 | 22 | 203 | 226 | 38 | 0 |
| IBM | 415 | 30 | 178 | 200 | 7 | 0 |
| Intel | 347 | 8 | 186 | 151 | 2 | 0 |
| Qualcomm | 314 | 26 | 250 | 38 | 0 | 0 |
| Linux | 308 | 7 | 127 | 170 | 4 | 0 |
most common weaknesses
Top 10 weaknesses behind 2023's vulnerabilities. A CWE (Common Weakness Enumeration) names the kind of mistake that caused a flaw, such as cross-site scripting or a buffer overflow.
- Critical
- High
- Medium
- Low
- No score
Cross-site Scripting CWE-794,728
SQL Injection CWE-892,023
Out-of-bounds Write CWE-7871,984
Cross-Site Request Forgery (CSRF) CWE-3521,304
Out-of-bounds Read CWE-125987
Missing Authorization CWE-862845
Improper Input Validation CWE-20821
Path Traversal CWE-22770
Use After Free CWE-416645
Classic Buffer Overflow CWE-120607
| Weakness | CVEs | Critical | High | Medium | Low | No score |
|---|---|---|---|---|---|---|
| Cross-site Scripting (CWE-79) | 4,728 | 69 | 44 | 4,609 | 6 | 0 |
| SQL Injection (CWE-89) | 2,023 | 1,164 | 725 | 132 | 1 | 1 |
| Out-of-bounds Write (CWE-787) | 1,984 | 524 | 989 | 464 | 7 | 0 |
| Cross-Site Request Forgery (CSRF) (CWE-352) | 1,304 | 6 | 913 | 377 | 8 | 0 |
| Out-of-bounds Read (CWE-125) | 987 | 42 | 364 | 563 | 18 | 0 |
| Missing Authorization (CWE-862) | 845 | 42 | 208 | 577 | 18 | 0 |
| Improper Input Validation (CWE-20) | 821 | 98 | 370 | 338 | 15 | 0 |
| Path Traversal (CWE-22) | 770 | 137 | 385 | 238 | 10 | 0 |
| Use After Free (CWE-416) | 645 | 33 | 469 | 141 | 2 | 0 |
| Classic Buffer Overflow (CWE-120) | 607 | 207 | 282 | 117 | 1 | 0 |
old flaws, newly exploited
The 10 oldest vulnerabilities added to KEV in 2023: when each went public, and when it was confirmed exploited.
- Went public
- Confirmed exploited
CVE-2004-1464 Cisco IOS18 years
CVE-2010-3904 Canonical Ubuntu Linux12 years
CVE-2013-3163 Microsoft Internet Explorer9 years
CVE-2014-0196 Canonical Ubuntu Linux9 years
CVE-2014-8361 Aterm w1200ex-Ms Firmware8 years
CVE-2015-5317 Jenkins7 years
CVE-2016-0165 Microsoft Windows 10 15077 years
CVE-2016-3427 Apache Cassandra7 years
CVE-2016-6415 Cisco IOS6 years
CVE-2017-6884 Zyxel EMG2926 Firmware6 years
| CVE | Product | Went public | Attacks confirmed | Gap |
|---|---|---|---|---|
| CVE-2004-1464 | Cisco IOS | 2004-12-31 | 2023-05-19 | 18 years |
| CVE-2010-3904 | Canonical Ubuntu Linux | 2010-12-06 | 2023-05-12 | 12 years |
| CVE-2013-3163 | Microsoft Internet Explorer | 2013-07-10 | 2023-03-30 | 9 years |
| CVE-2014-0196 | Canonical Ubuntu Linux | 2014-05-07 | 2023-05-12 | 9 years |
| CVE-2014-8361 | Aterm w1200ex-Ms Firmware | 2015-05-01 | 2023-09-18 | 8 years |
| CVE-2015-5317 | Jenkins | 2015-11-25 | 2023-05-12 | 7 years |
| CVE-2016-0165 | Microsoft Windows 10 1507 | 2016-04-12 | 2023-06-22 | 7 years |
| CVE-2016-3427 | Apache Cassandra | 2016-04-21 | 2023-05-12 | 7 years |
| CVE-2016-6415 | Cisco IOS | 2016-09-19 | 2023-05-19 | 6 years |
| CVE-2017-6884 | Zyxel EMG2926 Firmware | 2017-04-06 | 2023-09-18 | 6 years |
About these numbers
- Vulnerabilities are counted by the date NVD published them. Rejected ones aren't counted.
- "Exploited" means CISA added it to its Known Exploited Vulnerabilities list that year, however old it is. The list started in late 2021 and spent 2022 mostly catching up on older flaws, so these reviews start with 2023.
- Severity is NVD's current rating. "No score" means NVD hasn't rated it yet.
- Everything about exploitation counts only what CISA added within the year, so it doesn't change once the year is over. The two exceptions: severity and the ransomware link are NVD's and CISA's current values, as neither keeps a history.
- A vulnerability that affects several vendors counts once for each.
- Late ratings and rejections can still shift these numbers a little.