How many CVEs are in CISA KEV, and what do they share?

CISA's Known Exploited Vulnerabilities catalog listed 1,748 CVEs in its 16 October 2026 release. They come from 289 vendors, 920 of them carry a CVE ID from 2021 or earlier, and 361 are flagged for known ransomware campaign use. Old bugs and a few big vendors dominate the list.

We downloaded CISA's own JSON feed on 18 October 2026 and counted. Everything below comes from that file unless a source is named. Counts change whenever CISA adds entries, so treat them as a dated snapshot.

How big is KEV and how fast does it grow?

The feed reports catalog version 2026.10.16 with 1,748 entries. Of those, 307 were added from 20 October 2025 onward, and 264 carry a 2026 date added. That is close to one new entry a day, but the pace is uneven: the file shows 555 entries added in 2022 and 187 in 2023.

KEV is evidence of exploitation, not a complete list of exploited bugs. CISA's own directive says it adds a vulnerability when there is reliable evidence of active exploitation, so a CVE missing from KEV is not proof that nobody attacks it.

Which vendors show up most?

• Microsoft: 390
• Cisco: 101
• Apple: 95
• Adobe: 82
• Google: 75

Those five hold 743 entries, about 42 percent. Then come Oracle (46), Apache (41), Ivanti (36), Fortinet (32) and Linux (31). At the other end, 149 of the 289 vendor or project names appear exactly once. KEV is a long tail of products, so a watchlist built from a few big vendors misses a lot.

What weaknesses repeat?

1,573 entries carry at least one CWE tag. The most common in the file:

• CWE-20, improper input validation: 119
• CWE-78, OS command injection: 111
• CWE-787, out-of-bounds write: 105
• CWE-416, use after free: 93
• CWE-119, memory buffer errors: 88
• CWE-22, path traversal: 82
• CWE-94, code injection: 72
• CWE-502, deserialization of untrusted data: 71

Grouping CWEs is our own judgment, but it shows a shape. Entries tagged with an injection or file-handling CWE (78, 94, 22, 502, 89, 77, 434) number 415. Entries tagged with a memory-safety CWE (787, 416, 119, 843, 125, 122, 190) number 378. Authentication and access-control tags (287, 306, 284, 862, 863, 798, 522) number 166. An entry can fall in more than one group.

How old are the entries?

920 of 1,748 CVE IDs start with 2021 or an earlier year. Only 530 start with 2024 or later. The practical reading: attackers keep using bugs that were patched years ago, because some systems never got the patch. Age of a CVE tells you little about whether it is safe to ignore.

Does KEV still drive remediation deadlines?

For US federal agencies it did, under BOD 22-01. CISA's page now marks that directive as revoked and superseded by BOD 26-04, dated 10 June 2026. The new directive keeps the KEV catalog and sets urgency from four questions: is the asset publicly exposed, is the CVE on KEV, can an attacker automate every step of the exploit, and does exploitation give partial or total control. It applies to federal agencies, not to private companies, but the four questions are a sound template for anyone.

What to do

1. Join your dependency and asset inventory to the KEV file by CVE ID. The JSON feed is free and updates in place.
2. Sort matches by exposure first. A KEV match on an internet-facing system outranks one on a build server.
3. Do not drop old CVEs from your scans. More than half of KEV is 2021 or earlier.
4. Add EPSS as a second signal for CVEs that are not on KEV. FIRST describes it as a probability of exploitation in the next 30 days, published daily for every CVE.
5. Alert on new KEV additions that match something you run, not on the whole feed.
6. Record when you fixed each match, so you can show the interval from KEV listing to fix.

Here is the whole counting method, so you can repeat it:

import json, collections
d = json.load(open("known_exploited_vulnerabilities.json"))
v = d["vulnerabilities"]
print(d["catalogVersion"], len(v))
print(collections.Counter(x["vendorProject"] for x in v).most_common(5))

Quick check

Sources

• CISA Known Exploited Vulnerabilities Catalog
• KEV JSON feed, fetched 18 October 2026
• BOD 22-01, marked revoked
• BOD 26-04: Prioritizing Security Updates Based on Risk
• FIRST, Exploit Prediction Scoring System

Last reviewed: 18 October 2026.