KEV 2026.10.301,766 entries+10 in 7d11 open federal deadlinesas of / search ? keys
KEV Now

Report / State of KEV

State of the KEV catalog

Computed figures on what CISA's Known Exploited Vulnerabilities catalog contains and how it changes. Each figure has a table and a citation.

Catalog
2026.10.30
Released
2026-10-30
Entries
1,766

Answer As of catalog 2026.10.30, CISA's KEV lists 1,766 entries from 291 vendors, added between 2021-11-03 and 2026-10-30. 20.4% are ransomware-linked, the median remediation window is 21 days, and Microsoft alone accounts for 22.1%.

Entries
1,766
Vendors
291
Products
742
CWEs
198
Ransomware: known
20.4%
Median days to due
21
Top-10 vendor share
52.9%

F1KEV additions per year

Entries added to KEV per calendar year (the current year is year to date).

CISA added 555 entries in 2022, the catalog's first full calendar year, and 282 in 2026 through 2026-10-30. The catalog's first year, 2021, began on 2021-11-03 with 311 entries by year end.

KEV additions per yearColumn chart of KEV additions per calendar year. 2021: 311; 2022: 555; 2023: 187; 2024: 186; 2025: 245; 2026: 282.02004006002021: 311 added31120212022: 555 added55520222023: 187 added18720232024: 186 added18620242025: 245 added24520252026: 282 added (year to date)2822026
KEV additions per year
YearAdded
2021311
2022555
2023187
2024186
2025245
2026282

Cite this

CISA added 555 entries in 2022, the catalog's first full calendar year, and 282 in 2026 through 2026-10-30. The catalog's first year, 2021, began on 2021-11-03 with 311 entries by year end. Source: KEV Now analysis of the CISA Known Exploited Vulnerabilities catalog, version 2026.10.30 (released 2026-10-30). https://kevnow.com/stats/#additions-by-year

F2KEV additions per month

Entries added per calendar month.

The busiest month on record was November 2021, with 291 additions (the catalog's first month). Across all 60 months the median is 19.5 a month.

KEV additions per monthMonthly additions from 2021-11 to 2026-10. Peak 291 in Nov 21.0100200300Nov 21: 291 addedNov 21Dec 21: 20 addedJan 22: 40 addedFeb 22: 32 addedMar 22: 226 addedApr 22: 45 addedMay 22: 83 addedMay 22Jun 22: 48 addedJul 22: 3 addedAug 22: 23 addedSep 22: 24 addedOct 22: 12 addedNov 22: 10 addedNov 22Dec 22: 9 addedJan 23: 5 addedFeb 23: 14 addedMar 23: 18 addedApr 23: 17 addedMay 23: 19 addedMay 23Jun 23: 24 addedJul 23: 16 addedAug 23: 8 addedSep 23: 19 addedOct 23: 18 addedNov 23: 18 addedNov 23Dec 23: 11 addedJan 24: 21 addedFeb 24: 9 addedMar 24: 10 addedApr 24: 10 addedMay 24: 14 addedMay 24Jun 24: 9 addedJul 24: 14 addedAug 24: 19 addedSep 24: 25 addedOct 24: 17 addedNov 24: 22 addedNov 24Dec 24: 16 addedJan 25: 14 addedFeb 25: 27 addedMar 25: 32 addedApr 25: 15 addedMay 25: 24 addedMay 25Jun 25: 20 addedJul 25: 20 addedAug 25: 15 addedSep 25: 16 addedOct 25: 31 addedNov 25: 11 addedNov 25Dec 25: 20 addedJan 26: 17 addedFeb 26: 28 addedMar 26: 26 addedApr 26: 31 addedMay 26: 21 addedMay 26Jun 26: 23 addedJul 26: 26 addedAug 26: 31 addedSep 26: 43 addedOct 26: 36 added
Table view (60 months)
KEV additions per month
MonthAdded
Nov 21291
Dec 2120
Jan 2240
Feb 2232
Mar 22226
Apr 2245
May 2283
Jun 2248
Jul 223
Aug 2223
Sep 2224
Oct 2212
Nov 2210
Dec 229
Jan 235
Feb 2314
Mar 2318
Apr 2317
May 2319
Jun 2324
Jul 2316
Aug 238
Sep 2319
Oct 2318
Nov 2318
Dec 2311
Jan 2421
Feb 249
Mar 2410
Apr 2410
May 2414
Jun 249
Jul 2414
Aug 2419
Sep 2425
Oct 2417
Nov 2422
Dec 2416
Jan 2514
Feb 2527
Mar 2532
Apr 2515
May 2524
Jun 2520
Jul 2520
Aug 2515
Sep 2516
Oct 2531
Nov 2511
Dec 2520
Jan 2617
Feb 2628
Mar 2626
Apr 2631
May 2621
Jun 2623
Jul 2626
Aug 2631
Sep 2643
Oct 2636

Cite this

The busiest month on record was November 2021, with 291 additions (the catalog's first month). Across all 60 months the median is 19.5 a month. Source: KEV Now analysis of the CISA Known Exploited Vulnerabilities catalog, version 2026.10.30 (released 2026-10-30). https://kevnow.com/stats/#additions-by-month

F3Top vendors by KEV entries

The 15 vendorProject values with the most entries.

Microsoft has the most KEV entries, 390 (22.1% of the catalog). The top 10 vendors account for 52.9%.

Top 15 vendors by KEV entries
VendorEntriesShare of catalog
Microsoft39022.1%
Cisco1025.8%
Apple955.4%
Adobe834.7%
Google764.3%
Oracle462.6%
Apache412.3%
Ivanti382.2%
Fortinet321.8%
Linux321.8%
Citrix271.5%
D-Link261.5%
VMware261.5%
SonicWall191.1%
Synacor191.1%

Cite this

Microsoft has the most KEV entries, 390 (22.1% of the catalog). The top 10 vendors account for 52.9%. Source: KEV Now analysis of the CISA Known Exploited Vulnerabilities catalog, version 2026.10.30 (released 2026-10-30). https://kevnow.com/stats/#top-vendors

F4Top weaknesses (CWE) in KEV

The 15 CWEs listed on the most entries. Entries may list several CWEs.

CWE-20 (Improper input validation) is the most-listed weakness, on 119 entries (6.7%). 175 entries list no CWE.

Top 15 CWEs by KEV entries
CWEEntriesShare of catalog
CWE-20 Improper input validation1196.7%
CWE-78 OS command injection1136.4%
CWE-787 Out-of-bounds write1066%
CWE-416 Use after free955.4%
CWE-119 Memory buffer bounds error885%
CWE-22 Path traversal824.6%
CWE-94 Code injection724.1%
CWE-502 Unsafe deserialization714%
CWE-287 Improper authentication482.7%
CWE-306 Missing authentication432.4%
CWE-843 Type confusion382.2%
CWE-284 Improper access control372.1%
CWE-77 Command injection331.9%
CWE-79 Cross-site scripting (XSS)331.9%
CWE-89 SQL injection331.9%

Cite this

CWE-20 (Improper input validation) is the most-listed weakness, on 119 entries (6.7%). 175 entries list no CWE. Source: KEV Now analysis of the CISA Known Exploited Vulnerabilities catalog, version 2026.10.30 (released 2026-10-30). https://kevnow.com/stats/#top-cwes

F5Known ransomware use

Entries flagged Known for ransomware campaign use, by year added. The flag can change after an entry is added.

361 of 1,766 KEV entries (20.4%) are flagged as known to be used in ransomware campaigns. By year added, the share ranges from 9.6% to 27%.

Share flagged known ransomware use, by year added2021: 27%; 2022: 23.8%; 2023: 23%; 2024: 23.7%; 2025: 12.7%; 2026: 9.6%01020302021: 27%2720212022: 23.8%23.820222023: 23%2320232024: 23.7%23.720242025: 12.7%12.720252026: 9.6%9.62026
Known ransomware use by year added
YearAddedKnownShare
20213118427%
202255513223.8%
20231874323%
20241864423.7%
20252453112.7%
2026282279.6%

Cite this

361 of 1,766 KEV entries (20.4%) are flagged as known to be used in ransomware campaigns. By year added, the share ranges from 9.6% to 27%. Source: KEV Now analysis of the CISA Known Exploited Vulnerabilities catalog, version 2026.10.30 (released 2026-10-30). https://kevnow.com/stats/#ransomware-by-year

F6Days from addition to federal due date

Days between dateAdded and dueDate, summarized by year added.

The median KEV entry gives federal agencies 21 days from dateAdded to dueDate. The median by year added was 2021: 181; 2022: 21; 2023: 21; 2024: 21; 2025: 21; 2026: 3.

Distribution of remediation windows0-7 days: 189; 8-14 days: 288; 15-21 days: 1025; 22-30 days: 2; 31-90 days: 5; 91+ days: 25705001,0001,5000-7 days: 189 entries1890-7 days8-14 days: 288 entries2888-14 days15-21 days: 1,025 entries1,02515-21 days22-30 days: 2 entries222-30 days31-90 days: 5 entries531-90 days91+ days: 257 entries25791+ days
Remediation window by year added (days from dateAdded to dueDate)
YearEntriesMedianShortestLongest
202131118114182
2022555214184
202318721443
202418621221
202524521121
20262823221

Cite this

The median KEV entry gives federal agencies 21 days from dateAdded to dueDate. The median by year added was 2021: 181; 2022: 21; 2023: 21; 2024: 21; 2025: 21; 2026: 3. Source: KEV Now analysis of the CISA Known Exploited Vulnerabilities catalog, version 2026.10.30 (released 2026-10-30). https://kevnow.com/stats/#remediation-by-year

F7Age of CVE IDs when added

Year added minus the year in the CVE ID. The ID year is when the ID was assigned or reserved, not necessarily disclosure.

21.1% of KEV entries carry a CVE ID at least five years older than the year they were added. In 2022 that share was 47%.

Years between CVE ID year and year addedSame year: 794; 1 year: 275; 2-4 years: 324; 5-9 years: 274; 10+ years: 990200400600800Same year: 794 entries794Same year1 year: 275 entries2751 year2-4 years: 324 entries3242-4 years5-9 years: 274 entries2745-9 years10+ years: 99 entries9910+ years
CVE IDs five or more years older than the year added
Year addedEntries5+ years olderShareMedian age (years)
2021311175.5%1
202255526147%4
2023187189.6%0
2024186189.7%0
20252453012.2%0
20262822910.3%0

Cite this

21.1% of KEV entries carry a CVE ID at least five years older than the year they were added. In 2022 that share was 47%. Source: KEV Now analysis of the CISA Known Exploited Vulnerabilities catalog, version 2026.10.30 (released 2026-10-30). https://kevnow.com/stats/#cve-age-by-year

F8KEV additions per week (last 26 weeks)

Entries added in each of the last 26 seven-day blocks.

179 entries were added in the 26 weeks to 2026-10-30, an average of 6.9 a week.

KEV additions per weekWeekly additions for 26 weeks ending 2026-10-30.051015Week from 2026-05-02: 3 added05-02Week from 2026-05-09: 2 addedWeek from 2026-05-16: 10 addedWeek from 2026-05-23: 5 addedWeek from 2026-05-30: 5 added05-30Week from 2026-06-06: 7 addedWeek from 2026-06-13: 4 addedWeek from 2026-06-20: 6 addedWeek from 2026-06-27: 2 added06-27Week from 2026-07-04: 6 addedWeek from 2026-07-11: 10 addedWeek from 2026-07-18: 6 addedWeek from 2026-07-25: 3 added07-25Week from 2026-08-01: 6 addedWeek from 2026-08-08: 3 addedWeek from 2026-08-15: 9 addedWeek from 2026-08-22: 11 added08-22Week from 2026-08-29: 10 addedWeek from 2026-09-05: 14 addedWeek from 2026-09-12: 7 addedWeek from 2026-09-19: 10 added09-19Week from 2026-09-26: 7 addedWeek from 2026-10-03: 6 addedWeek from 2026-10-10: 9 addedWeek from 2026-10-17: 8 added10-17Week from 2026-10-24: 10 added
Table view
KEV additions per week
Week startingWeek endingAdded
2026-05-022026-05-083
2026-05-092026-05-152
2026-05-162026-05-2210
2026-05-232026-05-295
2026-05-302026-06-055
2026-06-062026-06-127
2026-06-132026-06-194
2026-06-202026-06-266
2026-06-272026-07-032
2026-07-042026-07-106
2026-07-112026-07-1710
2026-07-182026-07-246
2026-07-252026-07-313
2026-08-012026-08-076
2026-08-082026-08-143
2026-08-152026-08-219
2026-08-222026-08-2811
2026-08-292026-09-0410
2026-09-052026-09-1114
2026-09-122026-09-187
2026-09-192026-09-2510
2026-09-262026-10-027
2026-10-032026-10-096
2026-10-102026-10-169
2026-10-172026-10-238
2026-10-242026-10-3010

Cite this

179 entries were added in the 26 weeks to 2026-10-30, an average of 6.9 a week. Source: KEV Now analysis of the CISA Known Exploited Vulnerabilities catalog, version 2026.10.30 (released 2026-10-30). https://kevnow.com/stats/#weekly-additions

Source: CISA KEV catalog v2026.10.30, released 2026-10-30. Windows end 2026-10-30. See the methodology for definitions.

Keyboard shortcuts

Keyboard shortcuts
/Focus search
?Show this panel
EscClose panel or clear search
g dGo to Dashboard
g kGo to KEV
g vGo to Vendors
g pGo to Products
g wGo to Weaknesses
g sGo to Stats
g rGo to Regulations
g bGo to Briefings