--- id: "lib-2026-11-08-is-vulnerability-information-arriving-in-time" type: "library" title: "Is vulnerability information arriving in time? English within 2 hours, 40% exploited within a day, Japanese a median 4.6 days later (脆弱性の情報は間に合っている？)" lang: "JA" org: "songchong (Qiita)" source_type: "Practitioner post" date: "2026-11-08" week: "2026-W45" url: "https://nosov.ai/library/lib-2026-11-08-is-vulnerability-information-arriving-in-time/" original_url: "https://qiita.com/songchong/items/b3c6c879f03f9bb665d3" tier: "A" tier_name: "Strong evidence" tier_reason: "An independent IT consultant (IT Renkei Map) traces 74 exploited vulnerabilities one by one through English and Japanese sources with stated counting rules and a public per-case record, so the timings can be checked; the author also runs a free alert service that fills the gap measured." summary_basis: "full-text" original_minutes: "10" tags: ["ai technology", "security operations", "language gap"] --- # Is vulnerability information arriving in time? English within 2 hours, 40% exploited within a day, Japanese a median 4.6 days later (脆弱性の情報は間に合っている？) Tier A (Strong evidence): An independent IT consultant (IT Renkei Map) traces 74 exploited vulnerabilities one by one through English and Japanese sources with stated counting rules and a public per-case record, so the timings can be checked; the author also runs a free alert service that fills the gap measured. Summary based on the full text. ## In short A Qiita version (8 November 2026) of a study by the IT Renkei Map editorial team on how fast Japanese-language information arrives for vulnerabilities that are actually exploited. Exploitation often starts on publication day: 41% of the 74 cases entered CISA's Known Exploited Vulnerabilities catalogue within a day of the CVE record. English sources keep up (NVD listed all within two hours), but the Japanese database JVN iPedia took a median 4.6 days and only 15% got a JPCERT/CC alert. The author concludes that Japanese firms should not wait for Japanese information and should collect vendor advisories and KEV daily, with AI summarising and matching against their software inventory. ## Key numbers - 74: CVEs with 2026 records added to CISA's KEV catalogue between 1 September and 7 November 2026 - 41% (30): entered the KEV catalogue within a day either side of the CVE record's publication - 74 of 74 within 2 hours: listed in the English NVD (median 0.8 hours) - median 4.6 days: delay to the Japanese JVN iPedia database (69 of 74 listed; 4.7 days for the 68 published before its outage) - 15% (11): of the 74 that received a JPCERT/CC alert in Japanese ## What it reports - NVD: 74 of 74 within 2 hours, median 0.8 hours. JVN iPedia: 69 of 74 (93%), median 4.6 days, 15 within 2 days. JPCERT/CC alerts: 11 (15%), 9 of them within 2 days. IPA important security information: 4, all within 2 days. - JVN iPedia has been down for maintenance since 22 October 2026; for the 68 cases published before the outage the median was 4.7 days, so the outage does not explain the delay. - Of the 30 cases exploited around publication, 27 reached JVN iPedia, at a median 51 hours; 7 got a JPCERT/CC alert. CISA's own statistics: 42% exploited on the day of disclosure, 50% within 2 days. - Examples: PHP and Citrix NetScaler got JPCERT/CC alerts the next day; WordPress core and a SonicWall VPN flaw had no Japanese entry as of 7 November. - Context from official sources: Japan's Project YATA-Shield (May 2026) says AI misuse has sharply raised attack speed and scale; Cloudflare cites exploitation 22 minutes after a proof of concept. - Rules differ: EU Cyber Resilience Act asks manufacturers for a 24-hour early warning and 72-hour notice (from 11 September 2026); US BOD 26-04 gives federal agencies 3 days for certain flaws; Japan's guideline sets publication 45 days after first contact with the developer. - Recommended steps follow the government's 5 November 2026 advisory: build a software inventory, collect advisories and KEV daily, match, then patch or mitigate. ## How they got it Each case was timed from the publication time in the CVE record. NVD and JVN iPedia times are known to the minute and counted in hours; KEV and alert dates are date-only, so "within 2 days" includes the next calendar day. Per-case records and method sit on the study page at renkeimap.jp; quoted sources were rechecked on 7 November 2026. ## Limits - 74 cases over about ten weeks, limited to CVEs published in 2026. - KEV entry date is a proxy for start of exploitation. - The author's site offers a free Japanese security feed and MCP server as the remedy; its own speed has not been measured, and its AI summaries are not reviewed by a person before posting. ## Why it matters for companies Any firm whose security team relies on local-language bulletins is working days behind attackers on the vulnerabilities that matter most. The practical fix is a daily process that reads English vendor advisories and the KEV catalogue directly, uses AI to summarise and match them to the firm's own inventory, and treats local-language sources as confirmation. The same gap is likely in other non-English markets. ## Key passages in translation > 答えは、悪用は公開の日に始まり、日本語の情報は後から届く、です。 The answer: exploitation starts on the day of publication, and the Japanese information arrives later. > 英語の NVD には 74 件すべてが 2 時間以内に掲載されましたが、日本語の JVN iPedia は中央値 4.6 日後で、JPCERT/CC の注意喚起が出たのは 15% でした。 The English NVD listed all 74 within two hours, but the Japanese JVN iPedia took a median 4.6 days, and JPCERT/CC issued alerts for only 15%. > 日本語の注意喚起と JVN iPedia は、確かめと社内への説明に使います。 Use the Japanese alerts and JVN iPedia for confirmation and for explaining the issue inside the company. Original: https://qiita.com/songchong/items/b3c6c879f03f9bb665d3