We compared the CVSS severity of the 61 CVEs CISA added to KEV between 1 September and 16 October 2026 with the 23,934 non-rejected CVEs NVD published in the same window. Half of the KEV entries (30 of 61, 49.2%) are Critical. Among all new CVEs, 9.9% are.
The same data also shows the limit of severity as a filter: only 19 of the 2,362 new Critical CVEs (0.80%) were on KEV by 16 October.
How we counted
NVD CVE API 2.0 data, downloaded on 18 October 2026. For all CVEs, we filtered by publication date (24,141 records, 207 rejected). For KEV, we took every cveID with dateAdded in the window from the KEV JSON feed (catalog version 2026.10.16) and fetched each one by ID, because many are older than the window.
# all CVEs: repeat with startIndex=0,2000,4000... and sleep between calls
curl -sS "https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-09-01T00:00:00.000Z&pubEndDate=2026-10-16T23:59:59.999Z&resultsPerPage=2000&startIndex=0"
# one KEV entry
curl -sS "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-102764"
def severity(cve):
m = cve.get("metrics", {})
for key in ("cvssMetricV31", "cvssMetricV30", "cvssMetricV40"):
if key in m:
entries = sorted(m[key], key=lambda e: e["type"] != "Primary")
d = entries[0]["cvssData"]
return d["baseSeverity"], d["baseScore"]
return None, None
The rule is: use CVSS 3.1 if present, then 3.0, then 4.0, preferring NVD's own (Primary) metric over the CNA's. Of the 23,934 CVEs, 20,317 are scored on 3.1, 79 on 3.0 and 1,892 on 4.0 only. 1,646 have no CVSS metric. Of the KEV entries, 59 use 3.1, 1 uses 3.0 and 1 has no metric.
What's affected
| Severity | All new CVEs | Share | KEV additions | Share |
|---|---|---|---|---|
| Critical (9.0 to 10.0) | 2,362 | 9.9% | 30 | 49.2% |
| High (7.0 to 8.9) | 10,066 | 42.1% | 25 | 41.0% |
| Medium (4.0 to 6.9) | 8,957 | 37.4% | 5 | 8.2% |
| Low (0.1 to 3.9) | 901 | 3.8% | 0 | 0.0% |
| Score 0.0 (None) | 2 | 0.0% | 0 | 0.0% |
| No CVSS metric | 1,646 | 6.9% | 1 | 1.6% |
| Total | 23,934 | 61 |
Other summary numbers, using only entries that have a score:
| Measure | All new CVEs | KEV additions |
|---|---|---|
| Median CVSS base score | 7.1 | 8.95 |
| Score of 10.0 | 161 of 22,288 (0.7%) | 10 of 60 (16.7%) |
| Score 9.0 or higher | 2,362 of 22,288 (10.6%) | 30 of 60 (50.0%) |
| Score 7.0 or higher | 12,428 of 22,288 (55.8%) | 55 of 60 (91.7%) |
The one KEV entry with no metric is CVE-2026-21589, whose CVE record was rejected on 16 October. The five Medium entries are CVE-2025-61624, CVE-2023-22894, CVE-2026-67279, CVE-2025-39964 and CVE-2026-48710.
Severity is not a filter on its own
37 of the KEV additions are CVEs published inside the window and not rejected. Counting only those:
| Severity | New CVEs | Reached KEV by 16 Oct | Rate |
|---|---|---|---|
| Critical | 2,362 | 19 | 0.80% |
| High | 10,066 | 17 | 0.17% |
| Medium | 8,957 | 1 | 0.01% |
| Low | 901 | 0 | 0.00% |
| All | 23,934 | 37 | 0.15% |
A new Critical CVE was about 4.8 times as likely to be on KEV as a High one (0.80% against 0.17%). Even so, 99.2% of new Critical CVEs had no KEV entry yet. Several KEV entries are old CVEs, so this is a measure of the window, not of a CVE's whole life, and some of the new CVEs may join KEV later.
How to check if you're exposed
Check your own backlog against both signals. If you have a list of CVE IDs from your scanner in ids.txt:
import json, urllib.request
kev = {v["cveID"] for v in json.load(urllib.request.urlopen(
"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"))["vulnerabilities"]}
mine = open("ids.txt").read().split()
print([c for c in mine if c in kev])
Anything it prints is known to be exploited, whatever its CVSS score.
What to do now
- Put KEV matches ahead of every score. The five Medium entries above are exploited, and a cutoff at 7.0 would have dropped them.
- Don't read "Critical" as "exploited". 99.2% of new Critical CVEs were not on KEV at 16 October. Use KEV as the exploitation signal and CVSS as a tiebreaker.
- Handle unscored CVEs explicitly. 6.9% of new CVEs had no CVSS metric, and a filter on score silently drops them.
- Record which CVSS version you use. Mixing 3.1 and 4.0 scores in one threshold gives inconsistent cutoffs.
Why it matters
The skew toward Critical is real: 10 of 60 scored KEV entries have a 10.0, against 0.7% of all new CVEs. But the base rate is low, so a policy of "patch all Critical in 24 hours" is mostly spent on CVEs that nobody is exploiting. Severity says what could happen. KEV says what has happened.
Try it yourself
Take your ten highest-CVSS open findings and check how many are on KEV, using the snippet above. Then try the exploitability demo below.
Click through it at your own pace, or open it full screen.
Quick check
What share of the 61 KEV additions are rated Critical?
30, or 49.2%. Among all 23,934 new CVEs the share is 9.9%.
What share of new Critical CVEs reached KEV in the window?
19 of 2,362, or 0.80%, counting only CVEs published from 1 September to 16 October.
