Is vulnerability information arriving in time? English within 2 hours, 40% exploited within a day, Japanese a median 4.6 days later (脆弱性の情報は間に合っている？)
A · Strong evidence An independent IT consultant (IT Renkei Map) traces 74 exploited vulnerabilities one by one through English and Japanese sources with stated counting rules and a public per-case record, so the timings can be checked; the author also runs a free alert service that fills the gap measured.
Summary based on the full text·Original: about 10 minutes to read
In short
A Qiita version (8 November 2026) of a study by the IT Renkei Map editorial team on how fast Japanese-language information arrives for vulnerabilities that are actually exploited. Exploitation often starts on publication day: 41% of the 74 cases entered CISA's Known Exploited Vulnerabilities catalogue within a day of the CVE record. English sources keep up (NVD listed all within two hours), but the Japanese database JVN iPedia took a median 4.6 days and only 15% got a JPCERT/CC alert. The author concludes that Japanese firms should not wait for Japanese information and should collect vendor advisories and KEV daily, with AI summarising and matching against their software inventory.
Key numbers
- 74CVEs with 2026 records added to CISA's KEV catalogue between 1 September and 7 November 2026
- 41% (30)entered the KEV catalogue within a day either side of the CVE record's publication
- 74 of 74 within 2 hourslisted in the English NVD (median 0.8 hours)
- median 4.6 daysdelay to the Japanese JVN iPedia database (69 of 74 listed; 4.7 days for the 68 published before its outage)
- 15% (11)of the 74 that received a JPCERT/CC alert in Japanese
As reported by the source.
Japanese·Web page·opens qiita.com
What it reports
- NVD: 74 of 74 within 2 hours, median 0.8 hours. JVN iPedia: 69 of 74 (93%), median 4.6 days, 15 within 2 days. JPCERT/CC alerts: 11 (15%), 9 of them within 2 days. IPA important security information: 4, all within 2 days.
- JVN iPedia has been down for maintenance since 22 October 2026; for the 68 cases published before the outage the median was 4.7 days, so the outage does not explain the delay.
- Of the 30 cases exploited around publication, 27 reached JVN iPedia, at a median 51 hours; 7 got a JPCERT/CC alert. CISA's own statistics: 42% exploited on the day of disclosure, 50% within 2 days.
- Examples: PHP and Citrix NetScaler got JPCERT/CC alerts the next day; WordPress core and a SonicWall VPN flaw had no Japanese entry as of 7 November.
- Context from official sources: Japan's Project YATA-Shield (May 2026) says AI misuse has sharply raised attack speed and scale; Cloudflare cites exploitation 22 minutes after a proof of concept.
- Rules differ: EU Cyber Resilience Act asks manufacturers for a 24-hour early warning and 72-hour notice (from 11 September 2026); US BOD 26-04 gives federal agencies 3 days for certain flaws; Japan's guideline sets publication 45 days after first contact with the developer.
- Recommended steps follow the government's 5 November 2026 advisory: build a software inventory, collect advisories and KEV daily, match, then patch or mitigate.
How they got it
Each case was timed from the publication time in the CVE record. NVD and JVN iPedia times are known to the minute and counted in hours; KEV and alert dates are date-only, so "within 2 days" includes the next calendar day. Per-case records and method sit on the study page at renkeimap.jp; quoted sources were rechecked on 7 November 2026.
Limits
- 74 cases over about ten weeks, limited to CVEs published in 2026.
- KEV entry date is a proxy for start of exploitation.
- The author's site offers a free Japanese security feed and MCP server as the remedy; its own speed has not been measured, and its AI summaries are not reviewed by a person before posting.
Why it matters for companies
Any firm whose security team relies on local-language bulletins is working days behind attackers on the vulnerabilities that matter most. The practical fix is a daily process that reads English vendor advisories and the KEV catalogue directly, uses AI to summarise and match them to the firm's own inventory, and treats local-language sources as confirmation. The same gap is likely in other non-English markets.
Key passages in translation
Japanese original
答えは、悪用は公開の日に始まり、日本語の情報は後から届く、です。
The answer: exploitation starts on the day of publication, and the Japanese information arrives later.
Japanese original
英語の NVD には 74 件すべてが 2 時間以内に掲載されましたが、日本語の JVN iPedia は中央値 4.6 日後で、JPCERT/CC の注意喚起が出たのは 15% でした。
The English NVD listed all 74 within two hours, but the Japanese JVN iPedia took a median 4.6 days, and JPCERT/CC issued alerts for only 15%.
Japanese original
日本語の注意喚起と JVN iPedia は、確かめと社内への説明に使います。
Use the Japanese alerts and JVN iPedia for confirmation and for explaining the issue inside the company.
Summary based on the full text. Read the original for the full argument and data.Read the original on qiita.com