CISA KEV statistics 2026: 1,779 exploited vulnerabilities by the numbers

This page keeps the main numbers on CISA's Known Exploited Vulnerabilities catalog in one place: how big it is, how fast it grows, how long agencies get to fix each entry, which vendors and weakness types appear most, and how the entries score on EPSS. We recompute it from the public data, and the script that produces every figure is described at the end.

Figures are from CISA's KEV JSON feed, catalog version 2026.11.10 (released 10 November 2026), and FIRST's EPSS API. You are welcome to reuse them; a link back to this page is appreciated. For the month-by-month detail, see the CISA KEV report for October 2026.

How many vulnerabilities are on CISA KEV?

1,779, as of CISA's 10 November 2026 update. The catalog launched in November 2021 with a large first batch, grew fastest in 2022 as CISA worked through older exploited CVEs, and has added between 186 and 295 a year since.

2026 passed 2025's full-year total in September. From January to October CISA added 28 CVEs a month on average, with 43 in September and 36 in October.

How long do agencies get to fix a KEV entry?

Every KEV entry has a due date for US federal civilian agencies. The fix window is the gap between the date CISA added the entry and that due date. For three years the standard window was 21 days. In 2026 it collapsed.

In 2025, 92% of new entries got 15 to 21 days and 3% got 3 days or less. In 2026, 54% got 3 days or less, 31% got 4 to 14 days, and only 15% got the old 15 to 21 days. CISA's Binding Operational Directive 26-04, issued in June 2026, ties the deadline to risk, and most new entries now carry 3 days.

What did EPSS say the day before CISA listed each CVE?

EPSS estimates the chance a CVE will be exploited in the next 30 days. A fair test of any forecast is what it said before the event. So for each of the 295 CVEs CISA added in 2026, we looked up the EPSS score published the day before the listing.

238 of the 295 (81%) had no score or a score under 10% the day before CISA confirmed they were being exploited. Of the 214 that did have a score, 157 (73%) were under 10% and 110 were under 1%.

The gap is widest for new vulnerabilities. 207 of the 295 carry a 2026 CVE number. Of those, 80 had no EPSS score the day before listing, usually because the CVE had only just been published, and only 19 (9%) scored 10% or more. The other 88 additions were older CVEs, and 38 of those (43%) scored 10% or more.

This is not a flaw in EPSS so much as a limit on what a forecast can do. The model needs public signals such as exploit code, detection signatures and observed attack traffic, and many KEV entries are listed because of targeted attacks that produce none of those before the listing. FIRST presents EPSS as one input to a prioritization decision, not the whole decision. Scores often climb in the days after a KEV listing, once the exploitation is public.

How do KEV entries score on EPSS today?

Across the whole catalog, using EPSS scores dated 10 November 2026: 1,777 of the 1,779 entries have a score. 910 (51%) score 50% or more. But 439 (25%) still score under 10%, and 58 score under 1%, even though every one of them has confirmed exploitation.

Put another way, a rule that says "only act when EPSS is 10% or higher" would skip one in four vulnerabilities that are known to be exploited.

Which vendors have the most KEV entries?

The catalog covers 294 vendors and projects, but it is top-heavy. Microsoft has 391 entries, 22% of the catalog, and the top five vendors together hold 750 (42%).

A blank cell means the vendor was not among the twelve with the most additions in 2026. By product, Microsoft Windows leads with 173 entries, followed by Apple's multi-product entries (55), Chromium V8 (41), Internet Explorer (36), Adobe Flash Player (33) and the Linux kernel (32). A long list of entries says as much about how widely a product is used and attacked as about its quality.

The 2026 list leans toward network and remote-access vendors: Cisco, Fortinet, Ivanti, Citrix and SonicWall together account for 49 of the year's 295 additions.

How many KEV entries are linked to ransomware?

361 of 1,779 (20%) are marked "Known" in the catalog's ransomware field, meaning CISA has evidence the vulnerability was used in ransomware campaigns. Among 2026's additions, 27 of 295 carry the mark so far.

The 2026 figure will rise. CISA often sets the field to "Unknown" when it adds an entry and updates it later, once ransomware use is reported. An "Unknown" value does not mean the vulnerability is not used by ransomware groups.

How old are the CVEs CISA adds?

Not everything CISA adds is new. Of the 295 additions in 2026, 88 (30%) carry a CVE number from an earlier year, and 29 (10%) are five or more years old. The oldest added this year is CVE-2008-0015, a Microsoft Windows vulnerability from 2008 that CISA added on 17 February 2026.

An old CVE that keeps showing up in a scan is not safe just because it is old. Attackers go back to whatever still works. Check it against KEV before anyone signs a risk acceptance.

Which weakness types are exploited most?

CISA tags most entries with one or more CWE weakness types. 175 entries have none, and an entry with several is counted once for each, so the counts below do not add up to the catalog total.

The mix is shifting. The all-time list is led by input validation and memory-corruption bugs. In 2026 the most common weakness types are improper authentication and code injection (19 entries each), OS command injection (18), path traversal (14), then missing authentication and deserialization (13 each). These are the bugs that let an attacker walk into an internet-facing device or web application without valid credentials.

How these numbers are made

• The catalog figures come from CISA's public KEV JSON feed, catalog version 2026.11.10. An entry's year is the year of its dateAdded field.
• The fix window is dueDate minus dateAdded, in calendar days.
• EPSS scores come from FIRST's public API. "The day before listing" is the score for the calendar day before dateAdded. "Not scored yet" means the API returned no score for that CVE on that day.
• A CVE's age is taken from the year in its CVE number.
• Vendor and product names are used as CISA writes them.
• Nothing here comes from customer data, and no figure is estimated.

You can reproduce the catalog counts yourself with the commands in track CISA KEV and EPSS with curl and jq, and browse every CVE on the catalog with its current EPSS score. Varaxon Scan Hub checks every finding in a scan export against KEV and EPSS and puts the exploited ones first.

Common questions