CISA Known Exploited Vulnerabilities (KEV) catalog
The KEV catalog lists vulnerabilities that CISA has evidence of being exploited in the wild. It is the clearest public signal of exploitation, and far smaller than the full CVE List.
- Entries in the catalog1,760First added 3 Nov 2021
- Tied to ransomware20.5%361 of 1,760 marked as known ransomware use
- Most recent addition27 Oct 2026
- Median days, CVE published to KEV2371,760 entries with a CVE record; negative means KEV came first
Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.27, as of 27 Oct 2026; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.
Additions over time
Show data as a table
| Month | KEV entries |
|---|---|
| 2021-11 | 291 |
| 2021-12 | 20 |
| 2022-01 | 40 |
| 2022-02 | 32 |
| 2022-03 | 226 |
| 2022-04 | 45 |
| 2022-05 | 83 |
| 2022-06 | 48 |
| 2022-07 | 3 |
| 2022-08 | 23 |
| 2022-09 | 24 |
| 2022-10 | 12 |
| 2022-11 | 10 |
| 2022-12 | 9 |
| 2023-01 | 5 |
| 2023-02 | 14 |
| 2023-03 | 18 |
| 2023-04 | 17 |
| 2023-05 | 19 |
| 2023-06 | 24 |
| 2023-07 | 16 |
| 2023-08 | 8 |
| 2023-09 | 19 |
| 2023-10 | 18 |
| 2023-11 | 18 |
| 2023-12 | 11 |
| 2024-01 | 21 |
| 2024-02 | 9 |
| 2024-03 | 10 |
| 2024-04 | 10 |
| 2024-05 | 14 |
| 2024-06 | 9 |
| 2024-07 | 14 |
| 2024-08 | 19 |
| 2024-09 | 25 |
| 2024-10 | 17 |
| 2024-11 | 22 |
| 2024-12 | 16 |
| 2025-01 | 14 |
| 2025-02 | 27 |
| 2025-03 | 32 |
| 2025-04 | 15 |
| 2025-05 | 24 |
| 2025-06 | 20 |
| 2025-07 | 20 |
| 2025-08 | 15 |
| 2025-09 | 16 |
| 2025-10 | 31 |
| 2025-11 | 11 |
| 2025-12 | 20 |
| 2026-01 | 17 |
| 2026-02 | 28 |
| 2026-03 | 26 |
| 2026-04 | 31 |
| 2026-05 | 21 |
| 2026-06 | 23 |
| 2026-07 | 26 |
| 2026-08 | 31 |
| 2026-09 | 43 |
| 2026-10 | 30 |
Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.27, as of 27 Oct 2026. About the data.
| Year | Added | Tied to ransomware | Share |
|---|---|---|---|
| 2026 | 276 | 27 | 9.8% |
| 2025 | 245 | 31 | 12.7% |
| 2024 | 186 | 44 | 23.7% |
| 2023 | 187 | 43 | 23% |
| 2022 | 555 | 132 | 23.8% |
| 2021 | 311 | 84 | 27% |
Vendors with the most KEV entries
| # | Vendor | KEV entries | Tied to ransomware |
|---|---|---|---|
| 1 | Microsoft | 390 | 117 |
| 2 | Cisco | 101 | 7 |
| 3 | Apple | 95 | 0 |
| 4 | Adobe | 83 | 11 |
| 5 | 76 | 0 | |
| 6 | Oracle | 46 | 13 |
| 7 | Apache | 41 | 8 |
| 8 | Ivanti | 36 | 12 |
| 9 | Fortinet | 32 | 14 |
| 10 | Linux | 31 | 2 |
| 11 | VMware | 29 | 10 |
| 12 | Citrix | 27 | 7 |
| 13 | D-Link | 26 | 2 |
| 14 | SonicWall | 19 | 13 |
| 15 | Synacor | 19 | 6 |
See About the data for how vendors are shown. The full list is on the vendors page.
Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.27, as of 27 Oct 2026. About the data.
Most recent additions
| Added | CVE | Vendor | Product | Ransomware |
|---|---|---|---|---|
| 2026-10-27 | CVE-2026-111497 | Brotli | Unknown | |
| 2026-10-27 | CVE-2026-48356 | Adobe | Commerce and Magento | Unknown |
| 2026-10-26 | CVE-2026-109618 | PHP Group | PHP | Unknown |
| 2026-10-26 | CVE-2026-109619 | PHP Group | PHP | Unknown |
| 2026-10-23 | CVE-2026-110447 | Collabora | Collabora Online – Built-in CODE Server | Unknown |
| 2026-10-23 | CVE-2026-114625 | Arista | VeloCloud Orchestrator | Unknown |
| 2026-10-20 | CVE-2026-106931 | EG Secure Solutions | SiteGuard Server Edition | Unknown |
| 2026-10-20 | CVE-2026-110936 | Siemens | Software Center | Unknown |
| 2026-10-20 | CVE-2026-96652 | Plex | Media Server | Unknown |
| 2026-10-20 | CVE-2026-96654 | Plex | Media Server | Unknown |
10 entries shown, newest first.
Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.27, as of 27 Oct 2026. About the data.