What the 1,748 CVEs in CISA's KEV list have in common

CISA's Known Exploited Vulnerabilities catalog held 1,748 entries in its 16 October 2026 release. Most were added within a year of the CVE being published, a fifth were five or more years old, and one in five is flagged as used in ransomware. The practical use is simple: patch what is on this list before anything else.

What is the KEV catalog?

CISA describes it as the authoritative source of vulnerabilities exploited in the wild, and recommends using it as an input to vulnerability prioritisation. It is distributed as a web table, CSV and JSON. The page I fetched refers to BOD 26-04, "Prioritizing Security Updates Based on Risk," and entries carry a field for whether forensic triage is required under it.

A CVE gets on the list when there is evidence of exploitation. Severity score is not the test.

What did we count?

I downloaded CISA's JSON feed on 18 October 2026 (catalog version 2026.10.16, 1,748 entries) and counted the fields. These are my counts, not CISA's published statistics. The earliest date added in the file is 3 November 2021.

By year added: 311 in 2021, 555 in 2022, 187 in 2023, 186 in 2024, 245 in 2025, and 264 so far in 2026. The 2021 and 2022 totals look inflated by older flaws added when the catalog began, though the file does not say so.

By vendor project (top ten): Microsoft 390, Cisco 101, Apple 95, Adobe 82, Google 75, Oracle 46, Apache 41, Ivanti 36, Fortinet 32, Linux 31.

Ransomware flag: 361 entries (about 21 percent) are marked as known to be used in ransomware campaigns. The rest say unknown, which is not the same as no.

Age: 1,051 entries (about 60 percent) have a CVE year equal to or one year before the year they were added. 373 (about 21 percent) were added five or more calendar years after the CVE year. Old flaws stay useful to attackers.

What weaknesses show up most?

Of the 1,748 entries, 175 carry no CWE. Among the rest, the most common are CWE-20 improper input validation (119), CWE-78 OS command injection (111), CWE-787 out-of-bounds write (105), CWE-416 use after free (93), CWE-119 memory buffer errors (88), CWE-22 path traversal (82), CWE-94 code injection (72) and CWE-502 unsafe deserialization (71). Authentication and access control follow: CWE-287 (48), CWE-306 (42) and CWE-284 (37).

Entries can list more than one CWE, so the counts overlap. CWE-20 and CWE-119 are broad labels, and a precise classification would split them.

What do they have in common?

1. They lead to code execution or access. Command injection, memory corruption, deserialisation and missing authentication all convert quickly into control.
2. They cluster in widely deployed products. The vendor list reads like a software inventory of most companies.
3. Many sit on network edges. Ivanti and Fortinet each have dozens of entries, and several of their flaws are in VPN and gateway products.
4. They are not all new. One in five is five years or more past its CVE year.
5. Severity alone does not predict them. The list is built on evidence of use.

What to do

1. Match your inventory to KEV daily. Alert on any product and version you run.
2. Make a KEV hit a deadline. Choose a fixed number of days and a named owner.
3. Rank KEV above score. A medium score with exploitation beats a high score without.
4. Check ransomware-flagged entries first when time is short.
5. Include old and unmaintained software in the sweep, including appliances.
6. Combine KEV with reachability. Knowing the vulnerable function is actually called helps you act on the code you ship. Safeguard's reachability analysis does this for dependencies, and its vulnerability data draws on CISA KEV among other sources.

Quick check

Sources

• CISA Known Exploited Vulnerabilities catalog
• CISA KEV JSON feed (version 2026.10.16, downloaded 18 October 2026)

Last reviewed: 18 October 2026.