CISA KEV Statistics 2026: Counts by Vendor

CISA's Known Exploited Vulnerabilities (KEV) catalog listed 1,739 vulnerabilities in its October 8, 2026 release. Microsoft accounts for 389 of them, 22.4%, more than any other vendor, and CISA added 255 entries in 2026 through October 8.

Every CISA figure below is recounted from the catalog file, so each one can be checked against the source. The counts reflect catalog version 2026.10.08, read on October 10, 2026.

Dupple data: 47 Cyberpresso pages in our content archive name 71 distinct KEV entries, and 63 of those were added in 2026, about a quarter of the year's additions.

The catalog in numbers

• The catalog holds 1,739 entries, one CVE each. The earliest entry is dated November 3, 2021. Each CVE ID appears once, so the entry count and the CVE count are the same.
• Additions by year: 311 in 2021 (November and December only), 555 in 2022, 187 in 2023, 186 in 2024, 245 in 2025 and 255 in 2026 up to October 8. The 2026 total already exceeds all of 2025. Read the trend as a steady stream of newly exploited flaws, not a closed list.
• 2026 additions peaked in September with 43, after 31 in August and 9 in the first eight days of October. The month-by-month breakdown of due windows is in the due dates section below.
• Most 2026 additions are recent CVEs. Of 2026's additions, 169 (66.3%) carry a CVE ID issued in 2026, and 37 carry a 2025 ID. The other 49 (about one in five) carry an ID from 2024 or earlier, so a 2026 listing can be an older flaw that was exploited this year.
• Across the whole catalog, 768 entries (44.2%) were listed in the same calendar year as the year in their CVE ID. The other 971 were listed in a later calendar year than their CVE ID.

Vendors: who the catalog lists most

The table counts entries by the vendor named in CISA's vendorProject field, for the eleven vendors with the most entries. The 2021 column covers November and December only.

• Microsoft is 22.4% of the catalog and 15.3% of 2026 additions, with 39 so far this year. Its yearly count has ranged from 27 in 2023 to 165 in 2022, and it was 39 in both 2025 and 2026.
• Cisco added 18 entries in 2026, the most in any year since its 50 in 2022. That is more than double its 8 in 2025.
• Apple's additions fell from 26 in 2022 to 9 in each of 2025 and 2026. Apple still ranks third all-time with 95 entries.
• Fortinet, Linux and Google each had 8 entries in 2026, behind Microsoft (39), Cisco (18) and Apple (9).
• 288 distinct vendors appear in the catalog, and 99 of them appear among 2026 additions. The top ten vendors hold more than half of all entries.

Products: where the entries cluster

The product field is more granular than the vendor field. The catalog names 732 distinct vendor and product pairs, and the ten most-listed pairs account for 454 entries, 26.1% of the catalog.

• Windows is the single largest product, at 172 entries or about 9.9% of the catalog. It leads 2026 as well, with 13 additions, ahead of the Linux kernel (8) and Apple's multiple-products entries (7).
• Three products tie for the next places in 2026 with 5 additions each: Citrix NetScaler, Cisco Catalyst SD-WAN Manager and Microsoft SharePoint. Our reports on exploited flaws from the same vendors include the Cisco Secure FMC auth bypass, the Citrix NetScaler report, the Fortinet FortiMail zero-day and the September 2026 Patch Tuesday.
• Chromium V8 is Google's largest product, with 41 entries. Our Chrome V8 exploited flaw report covers one of the 2026 Chromium V8 entries.
• Apple files 54 entries under the generic label "Multiple Products". The product list cannot say which Apple products those entries cover.

Due dates and ransomware flags

• Most 2026 listings get a three-day due date. Of the 2026 additions, 130 (51%) carry a due date three days after listing, 78 (31%) get 14 days, 44 (17%) get 21 days and 3 get a 2-day or 5-day window. In January the three-day window applied to 2 of 17 additions. In September it applied to 34 of 43.
• Across the whole catalog, 1,025 entries (59%) carry a 21-day window. Every window longer than 100 days belongs to a 2021 or 2022 entry, 257 in total.
• The required-action text of 122 entries cites CISA's BOD 26-04 directive, titled "Prioritizing Security Updates Based on Risk."
• The catalog marks 361 entries (20.8%) as "Known" for use in ransomware campaigns. Only 27 of the 2026 additions (10.6%) carry that flag, and 4 of Microsoft's 39 additions this year do. Our TeamCity report covers a KEV-listed flaw that CISA flagged for ransomware use.

2026 additions by month and due window

The three-day count went from 2 of 17 January additions to 17 of 23 in June, and every October entry so far carries it. Check each listing's own due date rather than assuming the early-2026 pattern.

What our Cyberpresso pages cover

Our Cyberpresso pages name 71 KEV entries in total, 63 of them added in 2026. The 47 pages behind that count are all dated on or before October 9, 2026. A CVE counts only when its ID appears in a page's text, so the figure is a floor, not a full tally of our coverage. Several of our KEV news items are linked from this page, including the SharePoint and vCenter listing, the Ray AI framework listing and the WSO2 and Adobe listing. The cybersecurity statistics page covers the wider cyber news flow rather than the catalog.

How we counted

• Source: CISA's Known Exploited Vulnerabilities catalog, published as a JSON file. The file's catalog version is 2026.10.08, released October 8, 2026. The public catalog page is CISA Known Exploited Vulnerabilities Catalog.
• Counting rules: one entry per CVE ID. The year is the dateAdded field. The vendor and product are CISA's vendorProject and product labels as published, so Zimbra entries count under Synacor, the product's vendor. The due window is dueDate minus dateAdded, in days. The CVE year is the year in the CVE ID.
• Dupple data: our own Cyberpresso pages, matched on CVE ID text, as of October 10, 2026.
• Snapshot: CISA changes the catalog as it adds entries, so these are dated counts. The "Last updated" date at the top changes when the page is recounted.

Reading the counts

A KEV entry is one vulnerability that CISA lists as known to be exploited. It is not one attack, and the counts do not show how many organizations were affected. A year's total reflects what CISA chose to list in that year, which is why older CVEs appear among 2026 additions.

Vendor totals use CISA's labels, so a company's footprint can be split across more than one name. Product counts can also understate a vendor, as the generic Apple label shows. Use the table and product list as a ranking of where the catalog concentrates, not as a risk score for any one organization.

Due windows have changed over the catalog's life, so compare windows only within the same period. The due dates above are the catalog's own fields, and this page does not infer agency policy from them.

Frequently asked questions

How many vulnerabilities are in the CISA KEV catalog?

The October 8, 2026 release (catalog version 2026.10.08) lists 1,739 entries, one CVE each.

Which vendor has the most KEV entries?

Microsoft, with 389 entries and 22.4% of the catalog. Cisco is second with 100 and Apple third with 95. Microsoft also leads 2026 additions with 39.

How many KEV entries were added in 2026?

255 up to October 8, 2026. September was the busiest month with 43 additions.

Does the catalog flag ransomware use?

Yes. It marks 361 entries (20.8%) as "Known" for use in ransomware campaigns and 1,378 as "Unknown." Among 2026 additions, 27 carry the "Known" flag.

How long is the due date for a KEV entry?

It varies by entry. Across the whole catalog, 1,025 entries (59%) have 21 days from listing. Among 2026 additions, 130 (51%) have three days.

How old are the CVEs CISA adds?

Mostly recent. 169 of the 2026 additions (66.3%) carry a 2026 CVE ID, and 49 carry an ID from 2024 or earlier.

Cite this: Cyberpresso, "CISA KEV Statistics 2026: Counts by Vendor," counted October 10, 2026 from CISA catalog version 2026.10.08. Licensed CC BY 4.0, with a link back to this page.