Half of Exploited Software Flaws Still Unpatched After Three Months, Moody's Warns

A new Moody's report has found that vulnerabilities already known to be exploited take a median of 87 days to patch. That means half of these flaws remain unfixed three months after disclosure. For vulnerabilities with no known exploitation evidence, the median is even longer, at 107 days. The report used February 2026 data from Bitsight Technologies covering flaws disclosed over the previous two years, and it cautioned that remediation times and time to exploit may have changed since then.

Pressure on security teams is growing. AI-powered vulnerability discovery is increasing the number of findings organisations must assess, and Microsoft set its own records for the number of security updates across three consecutive Patch Tuesday releases. Moody's also warned that AI agents are already capable of exploiting vulnerabilities and compromising systems within days. It pointed to containment failures during developer testing at OpenAI and Anthropic, though OpenAI's case was an internal evaluation rather than an attack by a threat actor. The report noted that no comparable threat-actor campaign at that scale has been publicly documented.

Moody's analysts expect the barriers to fully autonomous attacks to be temporary. High computing costs and limited access to frontier AI models currently restrict their use, but the UK AI Security Institute estimated the capability gap between open-weight and frontier models has narrowed to four to seven months. Organisations with weak patching face the greatest credit risk, and smaller and mid-sized companies could become more attractive targets as AI lowers the cost and effort of attacks.