In the CISA KEV catalog, 175 of 1,748 entries (10%) have no CWE listed. Microsoft accounts for 66 of them, Oracle for 26, and Apple and Adobe for 13 each. If you count weaknesses across KEV, those entries are invisible, and the missing share is larger for some vendors than others.
Method
We downloaded the KEV JSON on 19 October 2026 (version 2026.10.16) and counted entries whose cwes field was empty. We grouped by year added and by vendor. We did not look up the weakness for any of these entries, so we cannot say whether a CWE exists elsewhere, only that the catalog data carries none.
The gap by year
| Year added | Entries | No CWE | Share |
|---|---|---|---|
| 2021 | 311 | 42 | 14% |
| 2022 | 555 | 69 | 12% |
| 2023 | 187 | 22 | 12% |
| 2024 | 186 | 8 | 4% |
| 2025 | 245 | 25 | 10% |
| 2026 | 264 | 9 | 3% |
The gap is not shrinking in a straight line. 2024 and 2026 are low, 2025 is back near 10%. Older entries, especially from 2021 and 2022, have the highest share.
Who is missing
Among the 175, Microsoft has 66 (17% of its 390 entries), Oracle 26 (57% of its 46), Apple 13 (14% of 95) and Adobe 13 (16% of 82). Oracle's figure stands out: more than half of its KEV entries have no weakness code.
So a chart of top weaknesses across KEV quietly undercounts anything from vendors who rarely tag a CWE. A vendor's apparent absence from a weakness class may be a labelling habit.
How to handle the gap
- Report the missing share with any weakness chart. A line saying "10% of entries have no CWE" costs nothing and stops a reader misreading the result.
- Do not assign a CWE to an entry yourself from the one-line description unless you read the advisory. A guess is worse than a gap.
- For a specific entry, open the vendor advisory or the CVE record. Many carry a weakness type or a description of the flaw even when the catalog row does not.
- For decisions, rely on exposure, exploitation status and fix availability, not weakness class. Weakness class is useful for coaching developers and choosing tests, and much less so for ranking patches.
What it means for secure coding teams
If you use KEV to pick what to teach or test, the gap suggests using more than one data source. The catalog is built to prompt patching, and its weakness field is a side benefit. A complete picture of weakness trends needs CVE records and advisories alongside it.
Safeguard's SBOM and dependency scanning lists the components you run, and reachability analysis helps separate vulnerable code your application calls from code it does not. You can try a free scan at gold.safeguard.sh/scan.
Quick check
Why would a KEV entry have no CWE?
The catalog does not say. The field is empty when no weakness code is recorded in the data it carries.
Should I guess the missing CWE?
No. Read the advisory or the CVE record, or leave it marked as unknown.
Sources
- CISA Known Exploited Vulnerabilities catalog, JSON read on 19 October 2026, catalog version 2026.10.16 (1,748 entries).
Last reviewed: 19 October 2026.
