How fast do vendors ship patches for critical CVEs? Seven of 2026's biggest cases, ranked by days from first public disclosure to patch release — every date sourced. The best vendors patch before they tell anyone. The worst disclose with no fix at all.
Critical OS command injection in the Nextcloud built-in CODE server app (proxy.php), exploited in the wild in September–October 2026. Collabora shipped the fix in version 26.4.303 on September 11, 2026 — a full 33 days before the public advisory of October 14, 2026. Textbook patch-first: the fix was out before attackers got the playbook.
−33 days (patch before disclosure)Exploited in wild: yesSources: The Hacker News · NeoTeo · Hendry Adrian
Critical unauthenticated GraphQL flaw allowing modification or deletion of public projects. GitLab shipped an out-of-band patch on August 17–18, 2026 — days after its scheduled August 12 release — with the advisory the same day. No exploitation confirmed at disclosure. Going out-of-band within days is the severity signal mature vendors send.
0 days (patch + advisory same day)Exploited in wild: no (at disclosure)Sources: Security Affairs · The Hacker News · Dark Reading
Critical remote code execution reachable through contributed modules, rated 19/25 on Drupal's risk scale. The security team pre-announced the release on October 12 so admins could reserve time, then shipped fixed releases (11.4.10, 11.3.19, 10.6.10) with the advisory — same day. No public exploit or attacks at the time of writing.
0 days (patch + advisory same day)Exploited in wild: no (at disclosure)Source: BitNewsBot
Unauthenticated path traversal in the repository commits API exposing arbitrary files — secrets, tokens, private keys. Patches released September 10, 2026 (CE 19.1.8, EE 19.2.6/19.3.2); CISA added it to the KEV catalog September 11 with a 3-day remediation deadline. Same-day coordinated disclosure — but active exploitation was already confirmed by CISA and observed by watchTowr, so defenders were patching under fire.
0 days (patch + advisory same day)Exploited in wild: yesSources: Cryptonomist · GBHackers
Two chained zero-days (CVSS 10.0 + 7.2) in SMA1000 secure remote access appliances, exploited by threat actor UTA0533 to deliver custom malware. Volexity believes exploitation began around June 22, 2026; SonicWall's patch + advisory landed July 14 — roughly 22 days of zero-day exploitation with no fix available. CISA added both to KEV the same day.
0 days from disclosure~22 days exploited before any patchSources: SecurityWeek · SecurityOnline
Authentication bypass (CVSS 8.6) in Ivanti Connect Secure VPN appliances, chained with other flaws for unauthenticated root code execution. Volexity found intrusions began October 3, 2026; Ivanti patched October 13 — ~10 days of active exploitation before a fix, during which attackers looted AD credentials, BitLocker keys, and LAPS passwords. Worse: a third vulnerability in the chain remained unpatched at disclosure.
0 days from disclosure~10 days exploited before patchChain incomplete at patchSource: CVETodo
Path traversal enabling remote code execution on exposed Langflow AI-pipeline servers. Researcher Joshua Martinelle first reported it January 20, 2026, followed up January 27 and February 4, and issued a final notice March 23. It was publicly disclosed March 27, 2026 — with no official patch released. Sixty-six days from first report to disclosure, and defenders still had no fix.
Unpatched at disclosure66 days from first report to disclosureSource: Cyber Security News
Most mature vendors cluster at 0 — coordinated same-day patch and advisory is now the industry norm, which is good news. The real differentiators are patch-first behavior (Collabora's −33 days: the fix was out before the advisory told attackers where to look) and the pre-patch exploitation window (SonicWall's ~22 days, Ivanti's ~10 days, Langflow's no-fix-at-disclosure). When you evaluate a vendor, ask two questions: do they patch before they disclose — and how many days do attackers get before they do?
Because coordinated disclosure — shipping the patch and the advisory on the same day — is standard practice among mature vendors. A 0 is good: it means defenders and the patch arrived together. The leaderboard's real signal is in the exceptions: patch-first (negative) and unpatched-at-disclosure.
No. This is an illustrative sample of 2026's biggest documented cases where both the disclosure date and the patch release date are publicly sourced. It is not a census of the software industry.
Private notification dates are almost never published, so a vendor's true response time from first report is usually unknowable. Public disclosure is the first date attackers definitively have the information — that's the exposure window that matters to defenders.
With each major 2026 case that has both dates sourced. New entries are added newest-first with their sources linked.
CVE identifiers, dates, and vendor names are factual references to publicly reported security incidents, linked to their sources. Grades reflect patch-speed behavior only — not overall vendor quality.