Report by GreyNoise
Ten Days Before Zero: How Activity Surges in GreyNoise Data Precede Vulnerability Disclosure
Key Findings
SonicWall CVE-2026-0400 experienced six surges with lead times compressing from 37 days to 3 days and peak session volume reaching 69 times the median.
68 of 104 detected surge events preceded a vendor-matched CVE, spanning 33 vulnerabilities across 16 vendor families.
The median lead time of vendor-targeted surges before a matched vulnerability disclosure is 11 days.
49% of vendor-targeted surges begin within 10 days before the associated vulnerability disclosure.
78% of vendor-targeted surges begin within 21 days before the associated vulnerability disclosure.
Fortinet CVE-2026-24858 provides one day of warning before disclosure.
Distributed surges average 21.3 days of lead time before disclosure.
Concentrated hosting surges average 7.5 days of lead time before disclosure.
GreyNoise sensors observe eight distinct surges targeting Cisco before the advisory for CVE-2026-20127, with the earliest surge occurring 39 days before disclosure.
When session volume and IP count spike simultaneously, lead time extends to 21 days.