CISA KEV, 1 Sep to 16 Oct 2026: 61 Additions by Vendor and Product

Between 1 September and 16 October 2026, CISA added 61 CVEs to its Known Exploited Vulnerabilities (KEV) catalog. They span 36 vendors. Cisco led with five entries, and Microsoft and Citrix had four each.

We pulled the KEV JSON feed on 18 October 2026 (catalog version 2026.10.16) and counted everything with a dateAdded in that window. Below is the method, the counts, and what they suggest about where your patch effort should go.

How we counted

Download the feed and filter on dateAdded. Nothing else is needed.

curl -sS -o kev.json \
  https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

import json, collections, datetime as dt

d = json.load(open("kev.json"))
w = [v for v in d["vulnerabilities"]
     if "2026-09-01" <= v["dateAdded"] <= "2026-10-16"]
print(d["catalogVersion"], len(w), "entries,",
      len({v["vendorProject"] for v in w}), "vendors")

for vendor, n in collections.Counter(v["vendorProject"] for v in w).most_common(8):
    print(vendor, n)

def window(v):
    return (dt.date.fromisoformat(v["dueDate"])
            - dt.date.fromisoformat(v["dateAdded"])).days

print(collections.Counter(window(v) for v in w))
print(collections.Counter(v["forensicTriage"] for v in w))
print(collections.Counter(v["knownRansomwareCampaignUse"] for v in w))

Run it with python3 -I count_kev.py. If you run it after 16 October, the window filter keeps the result stable unless CISA edits or removes an entry. September had 43 additions and the first 16 days of October had 18.

What's affected

Top vendors by number of KEV entries added in the window:

Vendor counts hide the more useful pattern, so we also grouped the 61 entries by the kind of product. This grouping is our own judgment from the KEV product and shortDescription fields:

Two more fields stood out. 52 of the 61 entries carry a due date three days after the date added, and the other nine carry 14 days. The nine 14-day entries were Chromium V8 (2), Windows (2), Apple, JFrog Artifactory (2), LiteLLM and Starlette. 47 entries are flagged forensicTriage: Yes, and none of the 14-day entries are. Every one of the 61 lists knownRansomwareCampaignUse as Unknown.

The requiredAction text on these entries points to BOD 26-04, which replaced BOD 22-01. The directive says the "& forensic triage" label means an agency must remediate within three days and check whether the asset was already compromised.

How to check if you're exposed

Match the 61 entries against what you run. The simplest version is a vendor and product list from your CMDB or asset inventory:

python3 -I -c '
import json
d = json.load(open("kev.json"))
for v in d["vulnerabilities"]:
    if "2026-09-01" <= v["dateAdded"] <= "2026-10-16":
        print(v["cveID"], v["vendorProject"], v["product"], v["dueDate"], sep="\t")
' > kev_window.tsv

grep -iF -f my_vendors.txt kev_window.tsv

my_vendors.txt is one vendor name per line, spelled as KEV spells it (for example Citrix, MikroTik, Zammad GmbH).

For the library entries (Starlette, LiteLLM, Strapi, Apache Struts) a CMDB won't help. Those live inside applications. Check lockfiles and SBOMs instead:

grep -rniE "^(starlette|litellm)==" --include=requirements*.txt .
grep -rn '"strapi"\|"@strapi/strapi"' --include=package.json .

What to do now

1. Sort the matches by due date, not CVSS. 52 of these entries gave federal agencies three days. That is a reasonable internal target for anything internet facing.
2. Treat edge appliances as compromised until checked. 24 of 61 entries hit network edge and security gear. For those, patching isn't enough. Follow the vendor's indicators of compromise and look at the appliance's logs and config for changes.
3. Check developer platforms like production. Artifactory, GitLab and Kestra hold credentials and build pipelines. If one was exposed, rotate the tokens it stores after patching.
4. Search code for the library entries. Starlette, LiteLLM and Strapi show up as dependencies, often transitive. Use your SBOM or lockfiles, not your server inventory.
5. Re-run the script weekly. CISA added entries on 24 separate days in this window.

Why it matters

The vendor list looks familiar, and that's the point. Edge devices from a handful of vendors keep coming back. If your patch process for appliances is slower than for servers, this is where the gap shows.

The newer signal is the developer tooling. Ten entries in six weeks were build systems, artifact stores, workflow engines or application libraries. Those don't sit in the network team's inventory, so they need an owner on the engineering side.

Try it yourself

Take kev_window.tsv from the step above and count how many rows you can match to a named owner in under ten minutes. Anything without an owner is your real exposure. The Gold directory at https://gold.safeguard.sh shows CVEs with their CISA KEV status if you want to check a single package fast. The demo below shows how a watch list flags newly exploited CVEs against your inventory.

Click through it at your own pace, or open it full screen.

Quick check

Sources

• CISA Known Exploited Vulnerabilities catalog, JSON feed
• CISA Known Exploited Vulnerabilities catalog
• CISA BOD 26-04: Prioritizing Security Updates Based on Risk