GreyNoise: Scanning surges against network edge vendors precede CVE disclosure by a median of 11 days
GreyNoise analyzed 147.8 million sessions over 103 days across 276 vendor-specific tags covering 18 network infrastructure vendors. It found that surges in scanning and exploitation activity regularly precede vendor advisories. Of 104 detected surges, 68 preceded a vendor-matched CVE (33 vulnerabilities across 16 vendor families), with a median lead time of 11 days. 49% arrived within 10 days of disclosure and 78% within 21 days. Before Cisco published its advisory for CVE-2026-20127 (CVSS 10.0 zero-day, cited in a Five Eyes joint warning), GreyNoise sensors saw eight surges, the earliest 39 days before disclosure. The findings suggest that waiting for an advisory before acting leaves a measurable exposure gap.
Detalhes técnicos
- Session volume is the primary early-warning signal. IP count alone is a weaker predictor. When both spike together, confidence is highest and lead time extends to about 21 days.
- SonicWall CVE-2026-0400 saw six surges from 37 to 3 days before disclosure, peaking at 69x median volume.
- Fortinet CVE-2026-24858 (CVSS 9.4, zero-day) gave only one day of warning.
- Distributed surges averaged 21.3 days of lead time, while concentrated hosting surges averaged 7.5 days.
- 11 ASNs appeared across 3 or more vendor families. The report also describes 4 attacker clusters.
- Context cited: Mandiant M-Trends 2026 found mean time-to-exploit has gone negative, and VulnCheck found 28.96% of 2025 KEVs were exploited on or before publication day.
- The report also covers Ivanti and MikroTik case studies.
Remediação
- Integrate pre-disclosure surge signals (session volume and unique IP spikes against specific vendors) into patch prioritization and threat hunting.
- Treat spikes against edge and network infrastructure vendors as a trigger to harden, restrict exposure of and monitor those devices before an advisory is published.
Linha do tempo
-
GreyNoise: Scanning surges against network edge vendors precede CVE disclosure by a median of 11 days
ler a análise desta fonte ocultar
GreyNoise analyzed 147.8 million sessions over 103 days across 276 vendor-specific tags covering 18 network infrastructure vendors. It found that surges in scanning and exploitation activity regularly precede vendor advisories. Of 104 detected surges, 68 preceded a vendor-matched CVE (33 vulnerabilities across 16 vendor families), with a median lead time of 11 days. 49% arrived within 10 days of disclosure and 78% within 21 days. Before Cisco published its advisory for CVE-2026-20127 (CVSS 10.0 zero-day, cited in a Five Eyes joint warning), GreyNoise sensors saw eight surges, the earliest 39 days before disclosure. The findings suggest that waiting for an advisory before acting leaves a measurable exposure gap.
Technical Details
- Session volume is the primary early-warning signal. IP count alone is a weaker predictor. When both spike together, confidence is highest and lead time extends to about 21 days.
- SonicWall CVE-2026-0400 saw six surges from 37 to 3 days before disclosure, peaking at 69x median volume.
- Fortinet CVE-2026-24858 (CVSS 9.4, zero-day) gave only one day of warning.
- Distributed surges averaged 21.3 days of lead time, while concentrated hosting surges averaged 7.5 days.
- 11 ASNs appeared across 3 or more vendor families. The report also describes 4 attacker clusters.
- Context cited: Mandiant M-Trends 2026 found mean time-to-exploit has gone negative, and VulnCheck found 28.96% of 2025 KEVs were exploited on or before publication day.
- The report also covers Ivanti and MikroTik case studies.
Remediation
- Integrate pre-disclosure surge signals (session volume and unique IP spikes against specific vendors) into patch prioritization and threat hunting.
- Treat spikes against edge and network infrastructure vendors as a trigger to harden, restrict exposure of and monitor those devices before an advisory is published.