CISA KEV statistics: exploited CVEs by year, vendor, ransomware
The CISA Known Exploited Vulnerabilities catalog lists 1,779 CVEs from 294 vendors; 323 were added in the last 365 days and 20.3% are known to be used in ransomware campaigns.
Key numbers
2026 is year to date (catalog 2026.11.10).
Embed or download this chart (CC BY 4.0)
Embed or download this chart (CC BY 4.0)
Top 10 vendors
| Vendor | KEV CVEs | Last 365 days | Ransomware | Latest added |
|---|---|---|---|---|
| Microsoft | 391 | 43 | 117 | 2026-11-10 |
| Cisco | 103 | 22 | 7 | 2026-11-10 |
| Apple | 96 | 11 | 0 | 2026-11-04 |
| Adobe | 83 | 7 | 11 | 2026-10-27 |
| 77 | 12 | 0 | 2026-11-10 | |
| Oracle | 46 | 5 | 13 | 2026-08-24 |
| Apache | 41 | 3 | 8 | 2026-10-08 |
| Ivanti | 38 | 8 | 12 | 2026-10-30 |
| Linux | 32 | 9 | 2 | 2026-10-28 |
| Fortinet | 32 | 12 | 14 | 2026-10-16 |
How these numbers were computed
From the CISA KEV JSON feed (catalog version 2026.11.10, released 2026-11-10) joined with FIRST EPSS scores of 2026-11-11. "Due" is the remediation date CISA sets for US federal civilian agencies. Ransomware = the catalog's knownRansomwareCampaignUse field is "Known". Year counts use the dateAdded field. Per-vendor pages: exploited CVEs by vendor.
Cite or reuse
Free to quote, chart and republish with a link back (CC BY 4.0). Each number above has its own link (the # next to it).
CyberMax, "CISA KEV statistics: exploited CVEs by year, vendor, ransomware", https://cybermaxtools.com/stats/cisa-kev/ (data as of 2026-11-10). Licensed CC BY 4.0.<a href="https://cybermaxtools.com/stats/cisa-kev/">CISA KEV statistics: exploited CVEs by year, vendor, ransomware</a> (CyberMax, data as of 2026-11-10, <a href="https://creativecommons.org/licenses/by/4.0/">CC BY 4.0</a>)Download every number on this page: data.csv. More statistics.
Free: the Free API Starter Kit
Copy-paste calls for 4 APIs with free daily tiers (CVE priority, VIN recalls, US duty rates, email checks), then 5 short emails on KEV/EPSS, MCP and free data.