CISA KEV statistics: exploited vulnerabilities by year, vendor and ransomware use (2026-10-08)
The CISA Known Exploited Vulnerabilities catalog lists 1,739 CVEs from 288 vendors; 304 were added in the last 365 days and 20.8% are known to be used in ransomware campaigns.
Key numbers
2026 is year to date (catalog 2026.10.08).
Embed or download this chart (CC BY 4.0)
Embed or download this chart (CC BY 4.0)
Top 10 vendors
| Vendor | KEV CVEs | Last 365 days | Ransomware | Latest added |
|---|---|---|---|---|
| Microsoft | 389 | 45 | 117 | 2026-09-25 |
| Cisco | 100 | 19 | 7 | 2026-09-30 |
| Apple | 95 | 11 | 0 | 2026-09-29 |
| Adobe | 82 | 8 | 11 | 2026-09-24 |
| 75 | 10 | 0 | 2026-09-16 | |
| Oracle | 46 | 6 | 13 | 2026-08-24 |
| Apache | 41 | 3 | 8 | 2026-10-08 |
| Ivanti | 35 | 5 | 12 | 2026-06-11 |
| Fortinet | 31 | 11 | 14 | 2026-10-01 |
| Linux | 31 | 8 | 2 | 2026-09-18 |
How these numbers were computed
From the CISA KEV JSON feed (catalog version 2026.10.08, released 2026-10-08) joined with FIRST EPSS scores of 2026-10-08. "Due" is the remediation date CISA sets for US federal civilian agencies. Ransomware = the catalog's knownRansomwareCampaignUse field is "Known". Year counts use the dateAdded field. Per-vendor pages: exploited CVEs by vendor.
Cite or reuse
Free to quote, chart and republish with a link back (CC BY 4.0). Each number above has its own link (the # next to it).
CyberMax, "CISA KEV statistics: exploited vulnerabilities by year, vendor and ransomware use (2026-10-08)", https://cybermaxtools.com/stats/cisa-kev/ (data as of 2026-10-08). Licensed CC BY 4.0.<a href="https://cybermaxtools.com/stats/cisa-kev/">CISA KEV statistics: exploited vulnerabilities by year, vendor and ransomware use (2026-10-08)</a> (CyberMax, data as of 2026-10-08, <a href="https://creativecommons.org/licenses/by/4.0/">CC BY 4.0</a>)Download every number on this page: data.csv. More statistics.