KEV 2026.09.231,721 entries+8 in 7d8 open federal deadlinesas of / search ? keys
Telemetry

Report / State of KEV

State of the KEV catalog

Computed figures on what CISA's Known Exploited Vulnerabilities catalog contains and how it changes. Each figure has a table, a citation and a download.

Catalog
2026.09.23
Released
2026-09-23
Entries
1,721

Answer As of catalog 2026.09.23, CISA's KEV lists 1,721 entries from 283 vendors, added between 2021-11-03 and 2026-09-22. 21% are ransomware-linked, the median remediation window is 21 days, and Microsoft alone accounts for 22.5%.

Entries
1,721
Vendors
283
Products
725
CWEs
185
Ransomware: known
21%
Median days to due
21
Top-10 vendor share
53.4%

F1KEV additions per year

Entries added to KEV per calendar year (the current year is year to date).

CISA added 555 entries in 2022, the catalog's first full calendar year, and 237 in 2026 through 2026-09-23. The catalog's first year, 2021, began on 2021-11-03 with 311 entries by year end.

KEV additions per yearColumn chart of KEV additions per calendar year. 2021: 311; 2022: 555; 2023: 187; 2024: 186; 2025: 245; 2026: 237.02004006002021: 311 added31120212022: 555 added55520222023: 187 added18720232024: 186 added18620242025: 245 added24520252026: 237 added (year to date)2372026
KEV additions per year
YearAdded
2021311
2022555
2023187
2024186
2025245
2026237

Cite this

CISA added 555 entries in 2022, the catalog's first full calendar year, and 237 in 2026 through 2026-09-23. The catalog's first year, 2021, began on 2021-11-03 with 311 entries by year end. Source: Telemetry analysis of the CISA Known Exploited Vulnerabilities catalog, version 2026.09.23 (released 2026-09-23). https://glide-telemetry.pages.dev/stats/#additions-by-year

F2KEV additions per month

Entries added per calendar month.

The busiest month on record was November 2021, with 291 additions (the catalog's first month). Across all 59 months the median is 19 a month.

KEV additions per monthMonthly additions from 2021-11 to 2026-09. Peak 291 in Nov 21.0100200300Nov 21: 291 addedNov 21Dec 21: 20 addedJan 22: 40 addedFeb 22: 32 addedMar 22: 226 addedApr 22: 45 addedMay 22: 83 addedMay 22Jun 22: 48 addedJul 22: 3 addedAug 22: 23 addedSep 22: 24 addedOct 22: 12 addedNov 22: 10 addedNov 22Dec 22: 9 addedJan 23: 5 addedFeb 23: 14 addedMar 23: 18 addedApr 23: 17 addedMay 23: 19 addedMay 23Jun 23: 24 addedJul 23: 16 addedAug 23: 8 addedSep 23: 19 addedOct 23: 18 addedNov 23: 18 addedNov 23Dec 23: 11 addedJan 24: 21 addedFeb 24: 9 addedMar 24: 10 addedApr 24: 10 addedMay 24: 14 addedMay 24Jun 24: 9 addedJul 24: 14 addedAug 24: 19 addedSep 24: 25 addedOct 24: 17 addedNov 24: 22 addedNov 24Dec 24: 16 addedJan 25: 14 addedFeb 25: 27 addedMar 25: 32 addedApr 25: 15 addedMay 25: 24 addedMay 25Jun 25: 20 addedJul 25: 20 addedAug 25: 15 addedSep 25: 16 addedOct 25: 31 addedNov 25: 11 addedNov 25Dec 25: 20 addedJan 26: 17 addedFeb 26: 28 addedMar 26: 26 addedApr 26: 31 addedMay 26: 21 addedMay 26Jun 26: 23 addedJul 26: 26 addedAug 26: 31 addedSep 26: 34 added
Table view (59 months)
KEV additions per month
MonthAdded
Nov 21291
Dec 2120
Jan 2240
Feb 2232
Mar 22226
Apr 2245
May 2283
Jun 2248
Jul 223
Aug 2223
Sep 2224
Oct 2212
Nov 2210
Dec 229
Jan 235
Feb 2314
Mar 2318
Apr 2317
May 2319
Jun 2324
Jul 2316
Aug 238
Sep 2319
Oct 2318
Nov 2318
Dec 2311
Jan 2421
Feb 249
Mar 2410
Apr 2410
May 2414
Jun 249
Jul 2414
Aug 2419
Sep 2425
Oct 2417
Nov 2422
Dec 2416
Jan 2514
Feb 2527
Mar 2532
Apr 2515
May 2524
Jun 2520
Jul 2520
Aug 2515
Sep 2516
Oct 2531
Nov 2511
Dec 2520
Jan 2617
Feb 2628
Mar 2626
Apr 2631
May 2621
Jun 2623
Jul 2626
Aug 2631
Sep 2634

Cite this

The busiest month on record was November 2021, with 291 additions (the catalog's first month). Across all 59 months the median is 19 a month. Source: Telemetry analysis of the CISA Known Exploited Vulnerabilities catalog, version 2026.09.23 (released 2026-09-23). https://glide-telemetry.pages.dev/stats/#additions-by-month

F3Top vendors by KEV entries

The 15 vendorProject values with the most entries.

Microsoft has the most KEV entries, 388 (22.5% of the catalog). The top 10 vendors account for 53.4%.

Top 15 vendors by KEV entries
VendorEntriesShare of catalog
Microsoft38822.5%
Cisco995.8%
Apple945.5%
Adobe814.7%
Google754.4%
Oracle462.7%
Apache402.3%
Ivanti352%
Linux311.8%
Fortinet301.7%
D-Link261.5%
VMware261.5%
Citrix241.4%
SonicWall191.1%
Synacor191.1%

Cite this

Microsoft has the most KEV entries, 388 (22.5% of the catalog). The top 10 vendors account for 53.4%. Source: Telemetry analysis of the CISA Known Exploited Vulnerabilities catalog, version 2026.09.23 (released 2026-09-23). https://glide-telemetry.pages.dev/stats/#top-vendors

F4Top weaknesses (CWE) in KEV

The 15 CWEs listed on the most entries. Entries may list several CWEs.

CWE-20 (Improper input validation) is the most-listed weakness, on 119 entries (6.9%). 175 entries list no CWE.

Top 15 CWEs by KEV entries
CWEEntriesShare of catalog
CWE-20 Improper input validation1196.9%
CWE-78 OS command injection1106.4%
CWE-787 Out-of-bounds write1046%
CWE-416 Use after free935.4%
CWE-119 Memory buffer bounds error854.9%
CWE-22 Path traversal794.6%
CWE-502 Unsafe deserialization714.1%
CWE-94 Code injection704.1%
CWE-287 Improper authentication472.7%
CWE-306 Missing authentication422.4%
CWE-843 Type confusion382.2%
CWE-284 Improper access control362.1%
CWE-79 Cross-site scripting (XSS)331.9%
CWE-122 Heap-based buffer overflow331.9%
CWE-89 SQL injection321.9%

Cite this

CWE-20 (Improper input validation) is the most-listed weakness, on 119 entries (6.9%). 175 entries list no CWE. Source: Telemetry analysis of the CISA Known Exploited Vulnerabilities catalog, version 2026.09.23 (released 2026-09-23). https://glide-telemetry.pages.dev/stats/#top-cwes

F5Known ransomware use

Entries flagged Known for ransomware campaign use, by year added. The flag can change after an entry is added.

361 of 1,721 KEV entries (21%) are flagged as known to be used in ransomware campaigns. By year added, the share ranges from 11.4% to 27%.

Share flagged known ransomware use, by year added2021: 27%; 2022: 23.8%; 2023: 23%; 2024: 23.7%; 2025: 12.7%; 2026: 11.4%01020302021: 27%2720212022: 23.8%23.820222023: 23%2320232024: 23.7%23.720242025: 12.7%12.720252026: 11.4%11.42026
Known ransomware use by year added
YearAddedKnownShare
20213118427%
202255513223.8%
20231874323%
20241864423.7%
20252453112.7%
20262372711.4%

Cite this

361 of 1,721 KEV entries (21%) are flagged as known to be used in ransomware campaigns. By year added, the share ranges from 11.4% to 27%. Source: Telemetry analysis of the CISA Known Exploited Vulnerabilities catalog, version 2026.09.23 (released 2026-09-23). https://glide-telemetry.pages.dev/stats/#ransomware-by-year

F6Days from addition to federal due date

Days between dateAdded and dueDate, summarized by year added.

The median KEV entry gives federal agencies 21 days from dateAdded to dueDate. The median by year added was 2021: 181; 2022: 21; 2023: 21; 2024: 21; 2025: 21; 2026: 14.

Distribution of remediation windows0-7 days: 151; 8-14 days: 281; 15-21 days: 1025; 22-30 days: 2; 31-90 days: 5; 91+ days: 25705001,0001,5000-7 days: 151 entries1510-7 days8-14 days: 281 entries2818-14 days15-21 days: 1,025 entries1,02515-21 days22-30 days: 2 entries222-30 days31-90 days: 5 entries531-90 days91+ days: 257 entries25791+ days
Remediation window by year added (days from dateAdded to dueDate)
YearEntriesMedianShortestLongest
202131118114182
2022555214184
202318721443
202418621221
202524521121
202623714221

Cite this

The median KEV entry gives federal agencies 21 days from dateAdded to dueDate. The median by year added was 2021: 181; 2022: 21; 2023: 21; 2024: 21; 2025: 21; 2026: 14. Source: Telemetry analysis of the CISA Known Exploited Vulnerabilities catalog, version 2026.09.23 (released 2026-09-23). https://glide-telemetry.pages.dev/stats/#remediation-by-year

F7Age of CVE IDs when added

Year added minus the year in the CVE ID. The ID year is when the ID was assigned or reserved, not necessarily disclosure.

21.4% of KEV entries carry a CVE ID at least five years older than the year they were added. In 2022 that share was 47%.

Years between CVE ID year and year addedSame year: 755; 1 year: 274; 2-4 years: 323; 5-9 years: 273; 10+ years: 960200400600800Same year: 755 entries755Same year1 year: 274 entries2741 year2-4 years: 323 entries3232-4 years5-9 years: 273 entries2735-9 years10+ years: 96 entries9610+ years
CVE IDs five or more years older than the year added
Year addedEntries5+ years olderShareMedian age (years)
2021311175.5%1
202255526147%4
2023187189.6%0
2024186189.7%0
20252453012.2%0
20262372510.5%0

Cite this

21.4% of KEV entries carry a CVE ID at least five years older than the year they were added. In 2022 that share was 47%. Source: Telemetry analysis of the CISA Known Exploited Vulnerabilities catalog, version 2026.09.23 (released 2026-09-23). https://glide-telemetry.pages.dev/stats/#cve-age-by-year

F8KEV additions per week (last 26 weeks)

Entries added in each of the last 26 seven-day blocks.

169 entries were added in the 26 weeks to 2026-09-23, an average of 6.5 a week.

KEV additions per weekWeekly additions for 26 weeks ending 2026-09-23.051015Week from 2026-03-26: 4 added03-26Week from 2026-04-02: 3 addedWeek from 2026-04-09: 9 addedWeek from 2026-04-16: 10 addedWeek from 2026-04-23: 7 added04-23Week from 2026-04-30: 3 addedWeek from 2026-05-07: 2 addedWeek from 2026-05-14: 9 addedWeek from 2026-05-21: 7 added05-21Week from 2026-05-28: 5 addedWeek from 2026-06-04: 6 addedWeek from 2026-06-11: 5 addedWeek from 2026-06-18: 5 added06-18Week from 2026-06-25: 4 addedWeek from 2026-07-02: 4 addedWeek from 2026-07-09: 9 addedWeek from 2026-07-16: 9 added07-16Week from 2026-07-23: 3 addedWeek from 2026-07-30: 5 addedWeek from 2026-08-06: 4 addedWeek from 2026-08-13: 6 added08-13Week from 2026-08-20: 11 addedWeek from 2026-08-27: 12 addedWeek from 2026-09-03: 9 addedWeek from 2026-09-10: 10 added09-10Week from 2026-09-17: 8 added
Table view
KEV additions per week
Week startingWeek endingAdded
2026-03-262026-04-014
2026-04-022026-04-083
2026-04-092026-04-159
2026-04-162026-04-2210
2026-04-232026-04-297
2026-04-302026-05-063
2026-05-072026-05-132
2026-05-142026-05-209
2026-05-212026-05-277
2026-05-282026-06-035
2026-06-042026-06-106
2026-06-112026-06-175
2026-06-182026-06-245
2026-06-252026-07-014
2026-07-022026-07-084
2026-07-092026-07-159
2026-07-162026-07-229
2026-07-232026-07-293
2026-07-302026-08-055
2026-08-062026-08-124
2026-08-132026-08-196
2026-08-202026-08-2611
2026-08-272026-09-0212
2026-09-032026-09-099
2026-09-102026-09-1610
2026-09-172026-09-238

Cite this

169 entries were added in the 26 weeks to 2026-09-23, an average of 6.5 a week. Source: Telemetry analysis of the CISA Known Exploited Vulnerabilities catalog, version 2026.09.23 (released 2026-09-23). https://glide-telemetry.pages.dev/stats/#weekly-additions

Source: CISA KEV catalog v2026.09.23, released 2026-09-23. Windows end 2026-09-23. See the methodology for definitions.

Keyboard shortcuts

Keyboard shortcuts
/Focus search
?Show this panel
EscClose panel or clear search
g dGo to Dashboard
g kGo to KEV
g vGo to Vendors
g pGo to Products
g wGo to Weaknesses
g sGo to Stats
g rGo to Regulations
g bGo to Briefings
g aGo to API