159 CVEs Exploited in Q1 2025 — 28.3% Within 24 Hours of Disclosure

In Q1 2025, 159 CVEs were exploited in the wild, with 28.3% exploited within 24 hours of disclosure. The majority of exploited vulnerabilities were found in content management systems, network edge devices, and operating systems. Despite attackers’ efforts, defenders are improving at identifying compromises, with the global median dwell time decreasing to 11 days.