CISA's Known Exploited Vulnerabilities (KEV) catalog listed 1,748 CVEs in the version dated 16 October 2026. Entries share few traits except evidence of real exploitation: many are old, a few vendors dominate, and common weakness types recur. Use KEV as a prioritization input, not as a full list of risk.
How many CVEs are in KEV?
We downloaded CISA's published JSON feed on 18 October 2026. It reports catalog version 2026.10.16, released 2026-10-16, with a count of 1,748, and the file contains 1,748 entries. The CISA catalog page showed the same total at the time we fetched it. The numbers move whenever CISA adds an entry, so treat these figures as a dated snapshot.
What gets a CVE into KEV?
CISA lists three criteria. The vulnerability must have a CVE ID. There must be reliable evidence of active exploitation, meaning an actor executed malicious code on a system without the owner's permission. Attempted exploitation, including on honeypots, and successful exploitation both count. Scanning, security research and proof of concept code do not. And there must be clear remediation guidance, such as a vendor update, or removal from networks if the product is end of life.
CISA says that exploitability alone is not a criterion. A flaw that is easy to exploit but has no evidence of use does not qualify. CISA also says organizations should use the catalog as an input to their vulnerability management prioritization.
What do the counts show?
All figures below come from our analysis of the 16 October 2026 feed.
Entries by year added.
- 2021: 311
- 2022: 555
- 2023: 187
- 2024: 186
- 2025: 245
- 2026 (to 16 October): 264
2022 is the largest year. 2026 is already above all of 2025 with about two and a half months left.
Old bugs stay useful. Of the 1,748 CVEs, 558 (about 32 percent) have a CVE ID from before 2020. Attackers keep using flaws that are years old, which is a patch hygiene finding.
A few vendors dominate. The five vendors with the most entries are Microsoft (390), Cisco (101), Apple (95), Adobe (82) and Google (75). Together they account for 743 entries, about 43 percent. Yet 289 vendors appear in total, and 149 of them have exactly one entry. KEV is concentrated at the top and long tailed below.
Ransomware link. 361 entries (about 21 percent) are flagged as known to be used in ransomware campaigns. The flag is "Unknown" for the other 1,387, which does not mean unused.
Weakness types. 1,573 entries carry at least one CWE identifier, and 175 carry none. The most frequent are CWE-20 improper input validation (119), CWE-78 OS command injection (111), CWE-787 out of bounds write (105), CWE-416 use after free (93), CWE-119 memory buffer errors (88), CWE-22 path traversal (82), CWE-94 code injection (72) and CWE-502 deserialization of untrusted data (71). Entries can list more than one CWE, so the counts overlap.
What do they have in common?
Reading the data, three themes stand out. First, memory safety and injection classes make up most of the top weakness types. Second, the catalog is full of widely deployed products, so one flaw reaches many organizations. Third, age is no protection. Those are observations about this dataset, not claims about all exploitation, since KEV only includes what CISA has evidence for.
How to reproduce it
Download the feed and group the entries yourself. A starting point:
curl -sL https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json -o kev.json
jq '.count, (.vulnerabilities | map(.dateAdded[0:4]) | group_by(.) | map([.[0], length]))' kev.json
What to do
- Subscribe to KEV updates, or poll the JSON feed daily.
- Match each entry against your asset and dependency inventory.
- Treat a match on an internet facing system as urgent, and set a target time you can meet.
- Track how many KEV matches you have open, and their age.
- Also look at old CVEs in your inventory. A third of KEV is pre 2020.
- Remember KEV is a floor. Flaws without public evidence of exploitation still matter.
Where Safeguard fits
Safeguard offers zero day watch and reachability analysis, which help you see whether a listed flaw is in code that runs. You can try the zero day watch demo here.
Quick check
Does KEV list every exploited vulnerability?
No. It lists those with a CVE ID, reliable evidence of exploitation and clear remediation guidance. Exploited flaws without those traits can be missing.
Is a KEV entry the same as a high CVSS score?
No. KEV is based on evidence of exploitation, not severity. CISA says exploitability alone is not a criterion.
Sources
- CISA, Known Exploited Vulnerabilities Catalog
- CISA, Known Exploited Vulnerabilities (criteria)
- CISA KEV JSON feed, version 2026.10.16, downloaded 18 October 2026
Last reviewed: 18 October 2026.
