Known Exploited Vulnerabilities: An Analysis of the CISA KEV Catalog, 2026

Original analysis of the full CISA catalog, version 2026.10.02 · Last updated October 2026

CISA’s Known Exploited Vulnerabilities catalog lists 1,733 vulnerabilities confirmed as exploited in the wild as of 2026-10-02. Our analysis of every entry finds 2026 on a record pace: 249 additions year to date, already more than the 245 added in all of 2025, and 32% ahead of the same period last year.

What is the CISA KEV catalog?

The Known Exploited Vulnerabilities catalog is a list maintained by the U.S. Cybersecurity and Infrastructure Security Agency of software flaws with reliable evidence of active exploitation. Under Binding Operational Directive 22-01, federal civilian agencies must remediate listed vulnerabilities by a set due date. Private organizations are not bound by the directive, but CISA recommends that all organizations use the catalog to prioritize patching. Because inclusion requires evidence of real-world exploitation, the catalog is one of the most direct public signals of which flaws attackers actually use.

Is exploitation accelerating in 2026?

Yes, by the measure of catalog additions. CISA added 249 entries between January 1 and 2026-10-02, compared with 188 in the same period of 2025, an increase of 32%. The 2026 year-to-date count already exceeds the 245 entries added in all of 2025. Additions are not a perfect measure of exploitation volume, because they depend on CISA’s evidence threshold and review capacity, but the direction is clear.

The 2021 and 2022 totals (311 and 555) are inflated by the catalog’s launch, when CISA loaded a backlog of older exploited vulnerabilities. Year-over-year comparisons are most meaningful from 2023 onward.

Which vendors appear most often?

Microsoft leads with 389 entries, more than three times the next vendor. The catalog spans 284 distinct vendors, but the ten most frequent account for 53.3% of all entries. Frequency partly reflects install base: the most widely deployed software attracts the most attacker attention and the most security research. It is not, on its own, a measure of any vendor’s relative security quality.

Which vendors are linked to ransomware?

CISA tags 361 entries as known to be used in ransomware campaigns. Microsoft accounts for 117 of them (32.4%). After Microsoft, the list is dominated by network-edge and remote-access products.

Why do edge devices matter so much?

We grouped firewall, VPN, and remote-access gateway vendors (Fortinet, SonicWall, Ivanti, Citrix, Palo Alto Networks, F5, Zyxel, Juniper, Check Point, Pulse Secure, Array Networks, Cisco, Sophos, and WatchGuard) as “edge” vendors. These products sit at the network perimeter and are directly reachable from the internet. Edge vendors account for 274 entries (15.8% of the catalog) but 71 of the 361 ransomware-linked entries (19.7%), a higher share of ransomware use than of the full catalog.

Are old vulnerabilities still being exploited?

Yes. Of all catalog entries, 369 (21.3%) were added to the KEV catalog five or more years after their CVE identifier year. Attackers continue to exploit flaws in systems that were never patched, which is why asset inventory and legacy-system coverage matter as much as fast patching of new disclosures.

Is ransomware use declining?

The data does not support that conclusion. The share of new entries tagged as ransomware-linked appears to fall in recent years, but the ransomware flag is frequently added months after a vulnerability enters the catalog, once campaign evidence emerges. Recent years are therefore undercounted.

Frequently asked questions

How many vulnerabilities are in the CISA KEV catalog?

1,733 as of catalog version 2026.10.02, released 2026-10-02.

How many were added in 2026?

249 through 2026-10-02, more than the 245 added in all of 2025.

Which vendor has the most known exploited vulnerabilities?

Microsoft, with 389 entries, followed by Cisco (100) and Apple (95).

How many KEV entries are linked to ransomware?

361 entries carry CISA’s “Known” ransomware campaign use tag.

Do private companies have to follow the KEV catalog?

No. BOD 22-01 binds federal civilian agencies. CISA recommends that all organizations use the catalog to prioritize remediation.

What is the typical KEV remediation deadline?

Most entries carry a 21-day federal due date; 1,025 of 1,733 entries use that window.

Why does Microsoft appear so often?

Its software has the largest install base, which concentrates attacker and researcher attention. Entry counts reflect exposure as much as product quality.

Are edge devices overrepresented in ransomware?

Edge vendors make up 15.8% of the catalog but 19.7% of ransomware-linked entries.

How often is the KEV catalog updated?

CISA updates it continuously, typically several times a week.

Is this analysis reproducible?

Yes. It is computed directly from CISA’s public JSON feed; the summary dataset is linked below.

Methodology

Data and citation

References

1. CISA, Known Exploited Vulnerabilities Catalog. Accessed October 2026.
2. CISA, KEV catalog JSON feed, version 2026.10.02. Accessed October 2026.
3. CISA, Binding Operational Directive 22-01. Accessed October 2026.