The window closed BLUF: The time between vulnerability disclosure and active exploitation is now measured in days, not sprints. Traditional patch cycles were not built for this. 1. Two days is not a cycle The disclosure-to-KEV gap on CVE-2024-1709 (ConnectWise ScreenConnect, CVSS 10. 0, EPSS 99. 96th percentile) was two days. CVE-2024-27198 (JetBrains TeamCity, CVSS 9. 8) was three days. CVE-2024-3094 (XZ Utils supply chain, CVSS 10. 0) was four days. These are not edge cases — they are the new center of the distribution for anything touching remote access, CI/CD pipelines, or widely-deployed enterprise software. Ransomware affiliation is confirmed on three of the four. EPSS flagged near-certain exploitation before CISA added any of them to KEV. The model is now faster than the catalog. 2. The quiet failure mode CVE-2024-20767 (Adobe ColdFusion, CVSS 7. 4, EPSS 99. 90th percentile) took nine months to land in KEV. That is a different failure — medium severity on paper, easy to defer, exploited anyway. Both the fast entries and the slow ones resolve in the same place: unpatched when it mattered. The BleepingComputer piece is circling a structural point the data confirms: scan-triage-ticket-schedule-patch was designed for a world where the exploitation curve ran weeks. That world is gone. Operator take: If CVE-2024-1709 is in your stack, the questions that matter are already overdue — where is it exposed, who owns the patch, what compensating control is live, and what telemetry would prove nobody touched it during the window. The quiet work now is cheaper than the loud paperwork later.
Post summary
The article underscores the rapid transition from disclosure to exploitation for several high‑severity CVEs, citing EPSS predictions and ransomware activity, and stresses the need for immediate patching in the face of such swift attacks.
