netVigilance Vulnerability intelligence since 2004

KEV in numbers

What the Known Exploited Vulnerabilities catalogue looks like as a dataset: 1,760 records as of 2026-10-27, computed directly from the data and recomputed twice a day. Every figure here can be reproduced from the public JSON.

1,760records tracked
291vendors
21%ransomware-linked
45%exploited within the CVE's first year
99CVEs 10+ years old at entry
21dmedian remediation window

Additions by year

2021–2022 include the catalogue's launch backlog, not fresh exploitation of those years

KEV additions by year with ransomware share
Year Added Share of catalogue Ransomware-linked
2021 311 17.7% 27%
2022 555 31.5% 24%
2023 187 10.6% 23%
2024 186 10.6% 24%
2025 245 13.9% 13%
2026 276 15.7% 10%

How old a CVE is when exploitation is confirmed

Catalogue year minus CVE identifier year — an assignment-year proxy, see the note below

Age of CVEs at the moment they enter KEV
Age at entry Records Share
Same year 788 44.8%
1 year 275 15.6%
2–4 years 324 18.4%
5–9 years 274 15.6%
10+ years 99 5.6%
The headline: 55% of confirmed exploitation targets a vulnerability older than the current year. Patching new CVEs is half the job; the other half is the backlog.

Old vulnerabilities, fresh exploitation

CVEs at least a decade old when CISA confirmed attacks, added since 2025

Decade-old CVEs recently added to KEV
CVE Vendor / product Age at entry Added
CVE-2007-0671 Microsoft / Office 18 years 2025-08-12
CVE-2008-0015 Microsoft / Windows 18 years 2026-02-17
CVE-2008-4128 Cisco / IOS 18 years 2026-07-13
CVE-2008-4250 Microsoft / Windows 18 years 2026-05-20
CVE-2009-0238 Microsoft / Office 17 years 2026-04-14
CVE-2009-0556 Microsoft / Office 17 years 2026-01-07
CVE-2009-1537 Microsoft / DirectX 17 years 2026-05-20
CVE-2009-3459 Adobe / Acrobat and Reader 17 years 2026-05-20

Vendors

All-time and the last 12 months (311 additions)

Vendors by number of KEV records
Vendor All time Share Last 12 months
Microsoft 390 22.2% 42
Cisco 101 5.7% 20
Apple 95 5.4% 10
Adobe 83 4.7% 7
Google 76 4.3% 11
Oracle 46 2.6% 5
Apache 41 2.3% 3
Ivanti 36 2.0% 6
Fortinet 32 1.8% 12
Linux 31 1.8% 8
Citrix 27 1.5% 6
D-Link 26 1.5% 2
VMware 26 1.5% —
Synacor 19 1.1% 5
SonicWall 19 1.1% 5
Top 15 of 291 vendors · full per-vendor pages are linked from each row

Remediation windows

Days between a record entering KEV and its federal deadline

Distribution of remediation windows
Window Records Share
7 days or less 185 10.5%
8–21 days 1311 74.5%
22–90 days 7 0.4%
Over 90 days 257 14.6%
The 7-day windows are CISA's "act now" tier; the long tail over 90 days is mostly the catalogue's 2021 launch, which gave agencies six months for the historical backlog.

Method, honestly

Everything above is computed from the CISA KEV catalogue as of 2026-10-27. "Age at entry" uses the year embedded in the CVE identifier, which is the year the identifier was assigned — usually but not always the disclosure year, so treat single-year precision with care. Ransomware share reflects CISA's "known ransomware campaign use" flag, which is conservative: absence of the flag is not evidence of absence. Reproduce or extend any of this from the public JSON; if you publish something based on it, a link back is appreciated.