CISA KEV Statistics 2026: Exploited Vulnerabilities by Vendor

CISA added 264 vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog from 1 January to 16 October 2026, already more than the 245 it added in all of 2025. Microsoft leads 2026 with 40 entries, ahead of Cisco with 19, and the catalog now holds 1,748 CVEs from 289 vendors.

Every figure on this page is computed from CISA's KEV JSON feed, catalog version 2026.10.16, as of 16 October 2026 and read on 17 October 2026. The sample is the whole catalog of 1,748 entries, with 2026 figures based on the 264 entries whose "dateAdded" falls in 2026. The page is refreshed after each month closes; for the day-by-day log, see the KEV additions tracker.

Dupple data: a quarter of this year's KEV entries (66 of 264) are named in at least one Cyberpresso post, counted across our 218 published Cyberpresso posts on 17 October 2026.

Five findings

1. The pace is up about 31%. CISA added 264 entries between 1 January and 16 October 2026, against 202 in the same window of 2025. September 2026, with 43, was the busiest month of the year.
2. Microsoft still leads, with a smaller share. Its 40 entries are 15.2% of 2026 additions, well below its 22.3% share of the full catalog (390 of 1,748).
3. Most exploited bugs are new. 177 of the 264 entries added in 2026 (67%) carry a 2026 CVE ID, but 40 (15%) date from 2023 or earlier, including three from 2008.
4. Deadlines collapsed to three days. 139 of the 2026 entries (52.7%) carry a three-day federal deadline, most of them since BOD 26-04 took effect in June. The 21-day deadline, the norm through 2025, last appeared in March.
5. Ransomware flags are rarer. CISA marks 27 of the 2026 additions (10.2%) as known to be used in ransomware campaigns, half the 20.7% rate across the whole catalog. The flag lags: no September or October 2026 entry carries it yet.

KEV additions by vendor, 2026

Source: CISA KEV feed, catalog version 2026.10.16. Vendor names as CISA records them; Langflow appears under two vendor names and is counted separately in the feed.

The long tail matters as much as the head, because that is where patch programs have blind spots. 101 vendors have at least one KEV entry in 2026, and 61 of them have exactly one. A patch program that watches only Microsoft's Patch Tuesday and Cisco advisories would have missed most vendors on the list, from Ahsay backup servers to Zammad help desks.

Microsoft's lead comes from breadth, not from a single product. Windows accounts for 14 of its 40 entries, SharePoint for 8 across two product names, Office for 4 and Defender for 3. For the SharePoint cases, see our report on the SharePoint and vCenter KEV batch.

All-time leaders in the catalog

Source: CISA KEV feed, catalog version 2026.10.16, n = 1,748.

Fortinet's position is the change worth noticing for anyone running its firewalls. It ranks ninth all-time with 32 entries, yet its 9 entries in 2026 tie it for third this year, so more than a quarter of its catalog history landed in the last ten months.

Additions by year and by month

The 2021 and 2022 counts include the backlog CISA loaded at launch: 287 entries arrived on 3 November 2021 alone, and 412 of the 2022 additions carry CVE IDs from before 2021. The fair comparison for 2026 is with 2023 to 2025. Against those years, 2026 is the first to pass 250 entries.

Monthly additions in 2026 ran 17 in January, 28 in February, 26 in March, 31 in April, 21 in May, 23 in June, 26 in July, 31 in August, 43 in September and 18 in the first 16 days of October. Entries landed on 121 distinct days, so a new KEV entry appeared on roughly two of every five days this year.

What kinds of flaws get exploited

Source: CISA KEV feed; an entry can carry more than one CWE, and 9 of the 264 carry none.

Authentication flaws stand out. Improper authentication and missing authentication together account for 29 tags, and both describe a door an attacker walks through without a password. On internet-facing appliances, those bugs need no phishing and no foothold, which is why they get exploited fast.

Where 2026 exploitation clustered

Three clusters explain much of the year, counted from the products CISA lists:

• Firewalls and VPN gateways: 20 entries. Fortinet (9), Check Point (4), SonicWall (4) and Palo Alto Networks (3). The devices meant to keep attackers out are a steady source of entries; our small business firewall guide covers the patch cadence to expect.
• Remote access and IT management tools: 10 entries. SimpleHelp (3), N-able N-central (3), ConnectWise ScreenConnect (2) and BeyondTrust (2). Compromising the tool the help desk uses gives an attacker every endpoint it manages. See our ScreenConnect report.
• AI and data tooling: 11 entries. Langflow (5 across two vendor names), LiteLLM (3), Ray (1), MLflow (1) and Marimo (1). These products barely appeared in earlier years of the catalog, and many teams deployed them outside the usual patch process. Our Ray framework KEV report covers one case.

Developer tooling is a smaller but newer cluster, with single entries for Vite, TanStack, Nx Console, the React Native CLI, eslint-config-prettier and Trivy. Several of these are packages rather than servers, so the fix is a dependency update across every repository that pulls them.

Deadlines and forensic triage

Source: CISA KEV feed, "dueDate" minus "dateAdded".

BOD 26-04, issued on 10 June 2026, revoked BOD 22-01 and BOD 19-02 and sets timelines by risk and exposure. It also added forensic triage: for flagged entries, agencies must check whether the asset was already compromised, not only patch it. Of the 121 entries added since the field first read "Yes" on 25 June 2026, 87 (71.9%) carry the flag.

For private companies, the directive is not binding, but it is a useful benchmark. If the federal government gives itself three days on most exploited bugs, a quarterly patch cycle for internet-facing systems is hard to defend to an auditor or an insurer. A vulnerability scanner and an attack surface management tool are the two tools that tell you which entries apply to you.

Methodology

We downloaded CISA's KEV JSON feed (catalog version 2026.10.16, 1,748 entries) on 17 October 2026 and counted entries by the "dateAdded" field. Vendors and products are counted as CISA spells them, without merging spelling variants except where stated. Deadlines are calendar days between "dateAdded" and "dueDate". Ransomware and forensic triage values are copied from the feed and can change when CISA updates an entry.

Cluster counts are our grouping of CISA's vendor and product names and are listed in full above so they can be checked. The Cyberpresso coverage figure counts CVE IDs that appear in our published posts. Dupple runs no test lab: every exploitation claim on this page is CISA's, not ours. Earlier single-batch reports include the Gitea KEV entry, the ownCloud, Linux and Artifactory batch, the TrueConf entries and the WSO2 and Adobe batch.

This dataset summary is published under CC BY 4.0: reuse it with attribution to Cyberpresso and a link to this page.

FAQ

How many vulnerabilities are in the CISA KEV catalog in 2026?

The catalog holds 1,748 CVEs as of catalog version 2026.10.16 (16 October 2026). CISA added 264 of them between 1 January and 16 October 2026, more than the 245 it added in all of 2025.

Which vendor has the most KEV entries in 2026?

Microsoft, with 40 of the 264 entries added in 2026, or 15.2%. Cisco follows with 19, then Fortinet and Apple with 9 each. Across the full catalog, Microsoft has 390 entries, 22.3% of the total.

How many KEV vulnerabilities are linked to ransomware?

CISA marks 361 of the 1,748 catalog entries (20.7%) as known to be used in ransomware campaigns. For 2026 additions the figure is 27 of 264 (10.2%), and no September or October 2026 entry is flagged yet, because CISA updates the field as evidence arrives.

How fast must agencies patch KEV vulnerabilities in 2026?

Under BOD 26-04, issued on 10 June 2026, timelines depend on risk and exposure. In the 2026 data, 52.7% of entries carry a three-day deadline and 29.5% carry 14 days. The older 21-day deadline covers 16.7% of 2026 entries and last appeared in March.

Are old vulnerabilities still added to KEV?

Yes. 40 of the 264 entries added in 2026 have CVE IDs from 2023 or earlier, including three from 2008 and four from 2015. A KEV listing reflects current evidence of exploitation, so an old CVE on the list means attackers are using it now.

What type of vulnerability is most exploited in 2026?

Code injection (CWE-94) is the most common weakness among 2026 KEV entries, with 19, followed by improper authentication (CWE-287) with 17. Path traversal and OS command injection follow with 14 each.

Cite this: Cyberpresso, "CISA KEV Statistics 2026: Exploited Vulnerabilities by Vendor", October 2026, data from CISA KEV catalog version 2026.10.16, CC BY 4.0.

Cyberpresso turns every KEV batch into a short, prioritized brief for security teams. Join at cyberpresso.com.

Some offers on this page may be paid placements or contain affiliate links.