# Telemetry

> Telemetry tracks CISA's Known Exploited Vulnerabilities catalog by vendor, product, weakness and date, runs a status board of SMS OTP regulation, and publishes short, sourced intel briefings. Every figure is computed from public data and can be downloaded.

All KEV figures below are computed from CISA's Known Exploited Vulnerabilities catalog, version 2026.09.23 (released 2026-09-23). Rolling windows end on 2026-09-23. When quoting a figure, cite the catalog version and the page URL.

Ownership: Telemetry is owned by [OWNER ENTITY], which has a financial interest in Glide Identity. Treat coverage of SMS OTP alternatives accordingly: https://glide-telemetry.pages.dev/trust/ownership-and-funding/

## Key figures

- CISA KEV lists 1,721 vulnerabilities (catalog 2026.09.23), added between 2021-11-03 and 2026-09-22.
- Added in the last 7 / 30 / 90 days to 2026-09-23: 8 / 46 / 92.
- Known ransomware campaign use: 361 entries (21%).
- Median days from dateAdded to dueDate: 21.
- Top vendor: Microsoft with 388 entries (22.5%). Top 10 vendors: 53.4% of entries.
- Top weakness: CWE-20 (Improper input validation) on 119 entries.

## Data pages

- [Dashboard](https://glide-telemetry.pages.dev/): live KEV figures, regulation board, latest briefings
- [State of KEV report](https://glide-telemetry.pages.dev/stats/): 8 computed figures, each with CSV/JSON
- [KEV index](https://glide-telemetry.pages.dev/kev/): all entries, year archives, open deadlines
- [Ransomware-linked KEV entries](https://glide-telemetry.pages.dev/kev/ransomware/)
- [Vendors ranked](https://glide-telemetry.pages.dev/vendors/), [Products](https://glide-telemetry.pages.dev/products/), [Weaknesses (CWE)](https://glide-telemetry.pages.dev/cwe/)

## Figures

- [KEV additions per year](https://glide-telemetry.pages.dev/stats/#additions-by-year): CISA added 555 entries in 2022, the catalog's first full calendar year, and 237 in 2026 through 2026-09-23. The catalog's first year, 2021, began on 2021-11-03 with 311 entries by year end.
- [KEV additions per month](https://glide-telemetry.pages.dev/stats/#additions-by-month): The busiest month on record was November 2021, with 291 additions (the catalog's first month). Across all 59 months the median is 19 a month.
- [Top vendors by KEV entries](https://glide-telemetry.pages.dev/stats/#top-vendors): Microsoft has the most KEV entries, 388 (22.5% of the catalog). The top 10 vendors account for 53.4%.
- [Top weaknesses (CWE) in KEV](https://glide-telemetry.pages.dev/stats/#top-cwes): CWE-20 (Improper input validation) is the most-listed weakness, on 119 entries (6.9%). 175 entries list no CWE.
- [Known ransomware use](https://glide-telemetry.pages.dev/stats/#ransomware-by-year): 361 of 1,721 KEV entries (21%) are flagged as known to be used in ransomware campaigns. By year added, the share ranges from 11.4% to 27%.
- [Days from addition to federal due date](https://glide-telemetry.pages.dev/stats/#remediation-by-year): The median KEV entry gives federal agencies 21 days from dateAdded to dueDate. The median by year added was 2021: 181; 2022: 21; 2023: 21; 2024: 21; 2025: 21; 2026: 14.
- [Age of CVE IDs when added](https://glide-telemetry.pages.dev/stats/#cve-age-by-year): 21.4% of KEV entries carry a CVE ID at least five years older than the year they were added. In 2022 that share was 47%.
- [KEV additions per week (last 26 weeks)](https://glide-telemetry.pages.dev/stats/#weekly-additions): 169 entries were added in the 26 weeks to 2026-09-23, an average of 6.5 a week.

## Vendor dossiers

- [Microsoft](https://glide-telemetry.pages.dev/vendors/microsoft/): 388 KEV entries (22.5%), 117 ransomware-linked, latest added 2026-09-08
- [Cisco](https://glide-telemetry.pages.dev/vendors/cisco/): 99 KEV entries (5.8%), 7 ransomware-linked, latest added 2026-09-16
- [Apple](https://glide-telemetry.pages.dev/vendors/apple/): 94 KEV entries (5.5%), 0 ransomware-linked, latest added 2026-08-18
- [Adobe](https://glide-telemetry.pages.dev/vendors/adobe/): 81 KEV entries (4.7%), 11 ransomware-linked, latest added 2026-09-08
- [Google](https://glide-telemetry.pages.dev/vendors/google/): 75 KEV entries (4.4%), 0 ransomware-linked, latest added 2026-09-16
- [Oracle](https://glide-telemetry.pages.dev/vendors/oracle/): 46 KEV entries (2.7%), 13 ransomware-linked, latest added 2026-08-24
- [Apache](https://glide-telemetry.pages.dev/vendors/apache/): 40 KEV entries (2.3%), 8 ransomware-linked, latest added 2026-08-04
- [Ivanti](https://glide-telemetry.pages.dev/vendors/ivanti/): 35 KEV entries (2%), 12 ransomware-linked, latest added 2026-06-11
- [Linux](https://glide-telemetry.pages.dev/vendors/linux/): 31 KEV entries (1.8%), 2 ransomware-linked, latest added 2026-09-18
- [Fortinet](https://glide-telemetry.pages.dev/vendors/fortinet/): 30 KEV entries (1.7%), 14 ransomware-linked, latest added 2026-09-09
- [D-Link](https://glide-telemetry.pages.dev/vendors/d-link/): 26 KEV entries (1.5%), 2 ransomware-linked, latest added 2026-04-24
- [VMware](https://glide-telemetry.pages.dev/vendors/vmware/): 26 KEV entries (1.5%), 9 ransomware-linked, latest added 2025-03-04
- [Citrix](https://glide-telemetry.pages.dev/vendors/citrix/): 24 KEV entries (1.4%), 7 ransomware-linked, latest added 2026-09-09
- [SonicWall](https://glide-telemetry.pages.dev/vendors/sonicwall/): 19 KEV entries (1.1%), 13 ransomware-linked, latest added 2026-09-02
- [Synacor](https://glide-telemetry.pages.dev/vendors/synacor/): 19 KEV entries (1.1%), 6 ransomware-linked, latest added 2026-08-21
- [Android](https://glide-telemetry.pages.dev/vendors/android/): 17 KEV entries (1%), 0 ransomware-linked, latest added 2026-06-02
- [Palo Alto Networks](https://glide-telemetry.pages.dev/vendors/palo-alto-networks/): 15 KEV entries (0.9%), 6 ransomware-linked, latest added 2026-05-29
- [Samsung](https://glide-telemetry.pages.dev/vendors/samsung/): 15 KEV entries (0.9%), 0 ransomware-linked, latest added 2026-04-24
- [SAP](https://glide-telemetry.pages.dev/vendors/sap/): 14 KEV entries (0.8%), 3 ransomware-linked, latest added 2025-05-15
- [Atlassian](https://glide-telemetry.pages.dev/vendors/atlassian/): 13 KEV entries (0.8%), 8 ransomware-linked, latest added 2024-11-12
- [Mozilla](https://glide-telemetry.pages.dev/vendors/mozilla/): 13 KEV entries (0.8%), 1 ransomware-linked, latest added 2025-10-06
- [Zyxel](https://glide-telemetry.pages.dev/vendors/zyxel/): 13 KEV entries (0.8%), 2 ransomware-linked, latest added 2026-09-21
- [Qualcomm](https://glide-telemetry.pages.dev/vendors/qualcomm/): 12 KEV entries (0.7%), 0 ransomware-linked, latest added 2026-03-03
- [Trend Micro](https://glide-telemetry.pages.dev/vendors/trend-micro/): 12 KEV entries (0.7%), 0 ransomware-linked, latest added 2026-05-21
- [QNAP](https://glide-telemetry.pages.dev/vendors/qnap/): 11 KEV entries (0.6%), 9 ransomware-linked, latest added 2023-12-21
- [Roundcube](https://glide-telemetry.pages.dev/vendors/roundcube/): 11 KEV entries (0.6%), 0 ransomware-linked, latest added 2026-02-20
- [SolarWinds](https://glide-telemetry.pages.dev/vendors/solarwinds/): 11 KEV entries (0.6%), 2 ransomware-linked, latest added 2026-06-05
- [Arm](https://glide-telemetry.pages.dev/vendors/arm/): 9 KEV entries (0.5%), 0 ransomware-linked, latest added 2024-06-12
- [Progress](https://glide-telemetry.pages.dev/vendors/progress/): 9 KEV entries (0.5%), 4 ransomware-linked, latest added 2026-08-07
- [Red Hat](https://glide-telemetry.pages.dev/vendors/red-hat/): 9 KEV entries (0.5%), 4 ransomware-linked, latest added 2026-08-26
- [Zoho](https://glide-telemetry.pages.dev/vendors/zoho/): 9 KEV entries (0.5%), 2 ransomware-linked, latest added 2023-03-07
- [F5](https://glide-telemetry.pages.dev/vendors/f5/): 8 KEV entries (0.5%), 4 ransomware-linked, latest added 2026-09-22
- [IBM](https://glide-telemetry.pages.dev/vendors/ibm/): 8 KEV entries (0.5%), 2 ransomware-linked, latest added 2026-08-04
- [Juniper](https://glide-telemetry.pages.dev/vendors/juniper/): 8 KEV entries (0.5%), 0 ransomware-linked, latest added 2025-10-02
- [NETGEAR](https://glide-telemetry.pages.dev/vendors/netgear/): 8 KEV entries (0.5%), 0 ransomware-linked, latest added 2022-09-08
- [Mitel](https://glide-telemetry.pages.dev/vendors/mitel/): 7 KEV entries (0.4%), 5 ransomware-linked, latest added 2025-02-12
- [Sophos](https://glide-telemetry.pages.dev/vendors/sophos/): 7 KEV entries (0.4%), 2 ransomware-linked, latest added 2025-02-06
- [Jenkins](https://glide-telemetry.pages.dev/vendors/jenkins/): 6 KEV entries (0.3%), 1 ransomware-linked, latest added 2025-10-02
- [TP-Link](https://glide-telemetry.pages.dev/vendors/tp-link/): 6 KEV entries (0.3%), 0 ransomware-linked, latest added 2025-09-03
- [Broadcom](https://glide-telemetry.pages.dev/vendors/broadcom/): 5 KEV entries (0.3%), 1 ransomware-linked, latest added 2026-08-18
- [Check Point](https://glide-telemetry.pages.dev/vendors/check-point/): 5 KEV entries (0.3%), 2 ransomware-linked, latest added 2026-09-22
- [DrayTek](https://glide-telemetry.pages.dev/vendors/draytek/): 5 KEV entries (0.3%), 0 ransomware-linked, latest added 2025-05-15
- [Drupal](https://glide-telemetry.pages.dev/vendors/drupal/): 5 KEV entries (0.3%), 2 ransomware-linked, latest added 2026-05-22
- [Exim](https://glide-telemetry.pages.dev/vendors/exim/): 5 KEV entries (0.3%), 1 ransomware-linked, latest added 2022-03-25
- [GitLab](https://glide-telemetry.pages.dev/vendors/gitlab/): 5 KEV entries (0.3%), 1 ransomware-linked, latest added 2026-09-11
- [GNU](https://glide-telemetry.pages.dev/vendors/gnu/): 5 KEV entries (0.3%), 0 ransomware-linked, latest added 2026-01-26
- [Langflow](https://glide-telemetry.pages.dev/vendors/langflow/): 5 KEV entries (0.3%), 1 ransomware-linked, latest added 2026-07-21
- [N-able](https://glide-telemetry.pages.dev/vendors/n-able/): 5 KEV entries (0.3%), 0 ransomware-linked, latest added 2026-09-08
- [PaperCut](https://glide-telemetry.pages.dev/vendors/papercut/): 5 KEV entries (0.3%), 2 ransomware-linked, latest added 2026-08-31
- [RARLAB](https://glide-telemetry.pages.dev/vendors/rarlab/): 5 KEV entries (0.3%), 4 ransomware-linked, latest added 2025-12-09
- [WordPress](https://glide-telemetry.pages.dev/vendors/wordpress/): 5 KEV entries (0.3%), 0 ransomware-linked, latest added 2026-07-21

## SMS OTP regulation board (verified 2026-09-24)

- [Board](https://glide-telemetry.pages.dev/regulations/): Singapore, Malaysia, the UAE and the Philippines have ordered banks off SMS or email codes for some or all transactions since 2022. India's 2025 RBI rules, in force April 2026, open the door to alternatives.
- [UAE](https://glide-telemetry.pages.dev/regulations/uae/): SMS and email OTP phase-out. Jul 2025 – Mar 2026. Complete. Source: https://thepaypers.com/fraud-and-fincrime/news/uae-banks-cancel-otps-switching-to-in-app-verification
- [Philippines](https://glide-telemetry.pages.dev/regulations/philippines/): Circular 1213: no SMS or email OTP for high-risk transactions. From Jun 25, 2026. In force. Source: https://www.gmanetwork.com/news/money/economy/992561/no-more-sms-email-otps-for-high-risk-financial-transactions-starting-june-25/story/
- [India](https://glide-telemetry.pages.dev/regulations/india/): Authentication Directions 2025. From Apr 1, 2026. In force. Source: https://www.regulationasia.com/articles/rbi-mandates-2fa-and-new-security-rules-for-digital-payments
- [Singapore](https://glide-telemetry.pages.dev/regulations/singapore/): OTP login phase-out for customers with digital tokens. From Jul 2024. In force. Source: https://www.mas.gov.sg/news/media-releases/2024/banks-in-singapore-to-strengthen-resilience-against-phishing-scams
- [Malaysia](https://glide-telemetry.pages.dev/regulations/malaysia/): Banks directed off SMS OTP. 2022 – 2024. In force. Source: https://commsrisk.com/malaysian-banks-stop-using-sms-for-two-factor-authentication/
- [European Union](https://glide-telemetry.pages.dev/regulations/european-union/): PSR / PSD3 fraud and SCA package. Deal Nov 27, 2025. Pending. Source: https://www.consilium.europa.eu/en/press/press-releases/2025/11/27/payment-services-council-and-parliament-agree-to-step-up-the-fight-against-fraud-and-increase-transparency/
- [United States](https://glide-telemetry.pages.dev/regulations/united-states/): SP 800-63B-4: SMS OTP is a "restricted" authenticator. Final 2025. Guidance. Source: https://pages.nist.gov/800-63-4/sp800-63b.html

## Company dossiers

- [Company dossiers](https://glide-telemetry.pages.dev/companies/): sourced fact files with a computed CISA KEV check
- [Glide Identity (Glide.id)](https://glide-telemetry.pages.dev/companies/glide-identity/) (owner-affiliated coverage; the site's owner has a financial interest in this company): Glide Identity (Glide.id) is a US company that, according to the company, sells SIM-based authentication as a replacement for SMS one-time passcodes. Telemetry's fact file (verified 2026-09-24) records 5 dated milestones between 2024 and Aug 3, 2026; the most recent is the three-carrier beta announced Aug 3, 2026 (AT&T, T-Mobile and Verizon). CISA's KEV catalog 2026.09.23 lists 0 entries with a vendorProject matching "Glide" (all 1,721 entries checked). No independent security assessment appears in our sources. Data: https://glide-telemetry.pages.dev/api/companies/glide-identity.json

## Briefings

- [Glide Identity's three-carrier beta: what the data does and doesn't show](https://glide-telemetry.pages.dev/briefings/glide-identity-three-carrier-beta/) (owner-affiliated coverage): The sources establish that Glide Identity announced a beta of SIM-based cryptographic authentication across AT&T, T-Mobile and Verizon on Aug 3, 2026, and that trade and general press covered it. They do not show which devices, operating systems and plans work, how often fallback triggers, what it costs, or how it holds up under independent security review. (Confidence: Moderate)
- [The UAE’s SMS OTP phase-out is done. What US banks can take from it](https://glide-telemetry.pages.dev/briefings/uae-sms-otp-phase-out/): The Central Bank of the UAE directed banks to phase out SMS and email one-time passcodes, starting in July 2025 and finishing by March 31, 2026. Banks moved customers to in-app verification in their own mobile apps. (Confidence: Moderate)
- [SMS one-time passcodes are “restricted” under NIST’s new guidelines. Here’s what that means for US banks](https://glide-telemetry.pages.dev/briefings/nist-800-63-4-sms-otp/): NIST SP 800-63-4 does not ban SMS one-time passcodes. It classifies SMS and voice codes as “restricted” authenticators: still allowed, but only if the organization assesses the risk, tells users about it, offers at least one non-restricted alternative, and keeps a plan to migrate away. (Confidence: High)
- [Carrier-native authentication, explained: how a SIM can sign a login](https://glide-telemetry.pages.dev/briefings/carrier-authentication-explained/): Carrier-based authentication verifies a user through their mobile operator instead of sending them a code. The simplest form checks that a request comes from the SIM tied to a phone number; stronger forms use cryptographic keys held in the SIM to sign the request. (Confidence: Moderate)
- [What the UK’s APP fraud reimbursement rules changed for fraud teams](https://glide-telemetry.pages.dev/briefings/uk-app-fraud-reimbursement/): Since October 7, 2024, UK payment service providers must reimburse most victims of authorized push payment scams on Faster Payments, up to £85,000 per claim, with the cost split between the sending and receiving firms. (Confidence: High)
- [Are synced passkeys phishing-resistant?](https://glide-telemetry.pages.dev/briefings/synced-passkeys-phishing-resistant/): Yes. A passkey is bound to the website it was created for, so it can’t be entered on a look-alike site. NIST’s 800-63-4 update accepts synced passkeys at AAL2. The main new risk is the account that syncs them, which needs strong protection of its own. (Confidence: High)
- [Why OTP bots keep working against bank customers](https://glide-telemetry.pages.dev/briefings/otp-bots-explained/): An OTP bot is an automated calling or messaging service that impersonates a bank or other service and persuades the victim to read out or type in a one-time passcode, which the criminal uses at the same moment to log in or approve a payment. (Confidence: Moderate)
- [SIM swap attacks, explained](https://glide-telemetry.pages.dev/briefings/sim-swap-attacks-explained/): A criminal persuades, tricks or bribes a mobile carrier into moving a victim’s phone number to a SIM they control. From then on the victim’s calls and texts, including one-time passcodes, go to the attacker. (Confidence: High)
- [The FCC’s SIM-swap rules: what carriers now have to do](https://glide-telemetry.pages.dev/briefings/fcc-sim-swap-rules/): The FCC’s 2023 order (FCC 23-95) requires US wireless carriers to authenticate customers securely before moving their number to a new SIM or provider, to notify customers of SIM change and port-out requests, and to offer account locks. It does not regulate how banks or apps use SMS codes. (Confidence: High)
- [Inside BSP Circular 1213, the Philippines’ OTP rule](https://glide-telemetry.pages.dev/briefings/philippines-bsp-circular-1213/): Bangko Sentral ng Pilipinas Circular No. 1213 bars banks and other supervised financial institutions from using SMS or email one-time passcodes to authenticate high-risk transactions, starting June 25, 2026. (Confidence: Moderate)
- [Singapore banks to phase out OTPs for customers with digital tokens](https://glide-telemetry.pages.dev/briefings/singapore-banks-phase-out-otp/): In July 2024 the Monetary Authority of Singapore and the Association of Banks in Singapore announced that major retail banks would phase out one-time passcodes for bank account logins by customers who have digital tokens activated on their mobile devices. (Confidence: High)

## API

- [API documentation](https://glide-telemetry.pages.dev/api/)
- [/api/kev/all.json](https://glide-telemetry.pages.dev/api/kev/all.json): Every KEV entry as published by CISA, newest first, plus a Telemetry URL.
- [/api/kev/latest.json](https://glide-telemetry.pages.dev/api/kev/latest.json): The 100 most recent entries.
- [/api/kev/open-deadlines.json](https://glide-telemetry.pages.dev/api/kev/open-deadlines.json): Entries whose dueDate is on or after the reference date.
- [/api/kev/index.json](https://glide-telemetry.pages.dev/api/kev/index.json): Array rows for fast client-side filtering: [cveID, vendor, product, name, dateAdded, dueDate, ransomware 0/1, cwes, url, vendorUrl, productUrl].
- [/api/kev/ransomware.json](https://glide-telemetry.pages.dev/api/kev/ransomware.json): Every KEV entry whose knownRansomwareCampaignUse is Known, newest first.
- [/api/vendors.json](https://glide-telemetry.pages.dev/api/vendors.json): Every vendorProject in the catalog with counts and dates.
- [/api/products.json](https://glide-telemetry.pages.dev/api/products.json): Every vendor-product pair with counts and dates.
- [/api/cwe.json](https://glide-telemetry.pages.dev/api/cwe.json): Every CWE listed in the catalog with counts.
- [/api/stats/additions-by-year.json](https://glide-telemetry.pages.dev/api/stats/additions-by-year.json): Entries added to KEV per calendar year (the current year is year to date).
- [/api/stats/additions-by-month.json](https://glide-telemetry.pages.dev/api/stats/additions-by-month.json): Entries added per calendar month.
- [/api/stats/top-vendors.json](https://glide-telemetry.pages.dev/api/stats/top-vendors.json): The 15 vendorProject values with the most entries.
- [/api/stats/top-cwes.json](https://glide-telemetry.pages.dev/api/stats/top-cwes.json): The 15 CWEs listed on the most entries. Entries may list several CWEs.
- [/api/stats/ransomware-by-year.json](https://glide-telemetry.pages.dev/api/stats/ransomware-by-year.json): Entries flagged Known for ransomware campaign use, by year added. The flag can change after an entry is added.
- [/api/stats/remediation-by-year.json](https://glide-telemetry.pages.dev/api/stats/remediation-by-year.json): Days between dateAdded and dueDate, summarized by year added.
- [/api/stats/cve-age-by-year.json](https://glide-telemetry.pages.dev/api/stats/cve-age-by-year.json): Year added minus the year in the CVE ID. The ID year is when the ID was assigned or reserved, not necessarily disclosure.
- [/api/stats/weekly-additions.json](https://glide-telemetry.pages.dev/api/stats/weekly-additions.json): Entries added in each of the last 26 seven-day blocks.
- [/api/stats.json](https://glide-telemetry.pages.dev/api/stats.json): Every headline figure on the dashboard and stats report.
- [/api/regulations.json](https://glide-telemetry.pages.dev/api/regulations.json): Every regulator that has restricted or phased out SMS one-time passcodes for banking, with dates, status and the primary source for each.
- [/api/briefings.json](https://glide-telemetry.pages.dev/api/briefings.json): Every briefing with its BLUF and confidence level.
- [/api/companies/glide-identity.json](https://glide-telemetry.pages.dev/api/companies/glide-identity.json): Structured Glide Identity dossier with a source on every row and a computed CISA KEV check. Owner-affiliated coverage.
- [/api/companies.json](https://glide-telemetry.pages.dev/api/companies.json): Every company dossier with its coverage label, verification date and KEV check result.
- [/api/glossary.json](https://glide-telemetry.pages.dev/api/glossary.json): All glossary terms.
- [/api/search.json](https://glide-telemetry.pages.dev/api/search.json): Titles and URLs of every indexable page, used by site search.
- /api/vendors/{slug}.json: every entry for one vendor (51 vendors)

## Trust

- [Methodology](https://glide-telemetry.pages.dev/trust/methodology/)
- [Ownership and funding](https://glide-telemetry.pages.dev/trust/ownership-and-funding/)
- [Corrections](https://glide-telemetry.pages.dev/trust/corrections/)
- [AI use](https://glide-telemetry.pages.dev/trust/ai-use/)
- [Full text for LLMs](https://glide-telemetry.pages.dev/llms-full.txt)