Assessed continuously from the binaries actually present on disk across the production servers Mimic monitors — not from self-reported inventory, and not diluted by lab or proof-of-concept fleets. This is how far real-world patching lags the public CVE record, and how concentrated the urgent part of it really is.
Sign in to explore the live catalog.
Sign in →Missing Patches is a continuous assessment of vulnerability exposure across the production server estates Mimic monitors. For each server, the software observed on disk is matched to its entry in the CPE (Common Platform Enumeration) dictionary and compared against the public vulnerability record: CVE identifiers and their affected-version ranges from NVD, and known-exploited status from CISA's Known Exploited Vulnerabilities catalog. The result is a per-server exposure finding — which installed software is running at a version reported as affected, and which of those vulnerabilities attackers are already known to be using.
Two things separate it from the vulnerability statistics usually published. The first is that it is observed rather than reported: the assessment reads the binaries on the disk, not an inventory system's record of what should be there. The second is the population. Figures cover production customer environments only — development, proof-of-concept and internal environments are excluded — so the numbers describe estates running real workloads rather than a blend diluted by machines nobody depends on and nobody patches.
The share of monitored servers that could be assessed at all, and of those, the share running at least one product at a version the public record reports as affected. This is the broad, low-grade layer, and it is consistently large — the ordinary condition of a server estate rather than an emergency.
The subset that matters most operationally: software carrying vulnerabilities CISA has confirmed exploited in the wild, and within that, the ones CISA records as used in ransomware campaigns. Known-exploited status makes a far better remediation queue than CVE volume or peak severity score, because it separates vulnerabilities someone already has working code for from vulnerabilities that merely exist. The dataset ranks both the products and the individual CVEs by how widespread they are across servers, and records the month each entered CISA's catalog. Flags are matched on the CVE identifier rather than the product name, so "known-exploited" means this vulnerability is on CISA's list, not that something else in the same product family once was.
Windows is not patched component by component; it is patched by cumulative update, so a server's patch level is a single revision number and a host at that revision has every fix shipped at or below it. That makes the gap calculable in a way a version-by-version comparison cannot manage, and it is calculated separately: the server's build and revision — reported by the host where available, otherwise estimated from the versions of its own OS binaries — is compared against Microsoft's published update ledger to give the fixes shipped since. The dataset carries the share of Windows servers estimated to be more than one servicing month behind, and folds those missed fixes into the same ranking as the version-level findings. Both halves are counted: software observed at an affected version, and Microsoft fixes a server's patch level has not reached.
The same assessment cut by customer environment instead of blended across everything monitored, so the shape of the distribution is visible rather than just its average. The recurring pattern is that broad exposure is near-universal while the urgent portion is tightly concentrated — a small number of environments, and within them a small number of products, account for most of the known-exploited findings. That is a more encouraging finding than the headline suggests: the genuinely actionable backlog is smaller and far more specific than a raw CVE count implies. The cohort publishes nothing unless it clears a minimum number of production environments, and an environment with too few observed servers is left out rather than shown.
An unpatched server is only a problem if the gap between disclosure and exploitation is short enough for someone to use it. For most of the last two decades it was not, and enterprise patch cycles were designed around that assumption. That assumption no longer holds.
Across the 3,605 CVE–exploit pairs in the Zero Day Clock dataset, vulnerabilities disclosed in 2018 had a median gap of 771 days between public disclosure and first observed exploitation. For the 2026 cohort the median has fallen to zero or below — at the midpoint, exploitation is no longer observed after disclosure. In 2026, 68.2% of recorded vulnerabilities were first exploited before they were publicly disclosed at all.
Figures read live from /data/zeroday.json when this page was served, which reshapes the published Zero Day Clock dataset (compiled from CISA KEV, VulnCheck KEV and XDB, with a public reproducibility guide). They describe the public vulnerability record, not Mimic's monitored fleet.
Set that against a patch cycle. Thirty to forty-five days is a normal, competent interval for a production estate — testing, change approval and staged rollout exist for good reasons, and skipping them causes outages. The problem is arithmetic rather than diligence. When the interval to a working exploit is shorter than the interval to a deployed patch, the exposure is structural, and patching faster does not close it. Missing Patches is the measurement of what that arithmetic leaves behind on real servers.
It also explains why the dataset's most useful column is not the largest one. The highest CVSS scores in any estate tend to sit on browsers and utility software that publish hundreds of CVEs against even a current build. The riskiest software on a server is rarely the software anyone thinks about — a virtualisation guest agent or a legacy runtime installed everywhere and owned by no one is where known-exploited versions survive, precisely because nobody has been asked to look after them.
Being explicit about the limits is part of publishing the numbers at all.
These are public and need no sign-in.
Findings are assessed from software observed on the production servers Mimic monitors, aggregated across them, and published as percentages only — never traceable to a single customer. Vulnerability records come from NVD, from CISA's Known Exploited Vulnerabilities catalog, and, for the Windows half, from Microsoft's published security update guide. The live view is updated as the assessment and those public catalogs are refreshed; the figures on this page describing the public vulnerability record are read from the Zero Day Clock feed at the moment the page is served.
This product uses the NVD API but is not endorsed or certified by the NVD.