Most KEV entries are recent bugs, but not all. Since 2023, about 62 to 67 percent of entries in a given year carry a CVE ID from the same year they were added, and 10 to 12 percent carry an ID at least five years older. Old flaws stay on attacker checklists.
Method
We downloaded the CISA Known Exploited Vulnerabilities JSON feed (catalog version 2026.10.16, released 16 October 2026, 1,748 entries) on 19 October 2026. For each entry we took the year in the CVE ID and the year in the dateAdded field, then subtracted.
Two limits matter. The year in a CVE ID is the year the ID was reserved, which can be earlier than the day the flaw was disclosed. And 2026 is a partial year, so its counts will keep moving.
What the numbers say
| Year added | Entries | Median age (years) | Same year as CVE ID | Five or more years old |
|---|---|---|---|---|
| 2021 | 311 | 1 | 38.6% | 5.5% |
| 2022 | 555 | 4 | 16.4% | 47.0% |
| 2023 | 187 | 0 | 64.7% | 9.6% |
| 2024 | 186 | 0 | 62.4% | 9.7% |
| 2025 | 245 | 0 | 61.6% | 12.2% |
| 2026 | 264 | 0 | 67.0% | 11.0% |
The 2021 and 2022 rows are different because the catalog launched in November 2021 with a large backlog of older bugs, and 2022 added many more. From 2023 on the pattern is steady: the median entry is from the year it was added.
The tail is real, though. Across the whole catalog, 30 entries have CVE IDs from before 2010 and 156 from before 2015. We do not claim these are in active use today. We only count what CISA lists.
What to do with it
Three practical points follow from the counts.
First, a patch policy that only looks at the last twelve months of CVE IDs would miss about one entry in ten. Query by exploited status, not by age.
Second, old entries tend to sit in software that nobody thinks about: legacy appliances, forgotten libraries, a build server from a previous team. An asset inventory is what turns an old KEV entry into a finding. Without one, the entry stays abstract.
Third, new entries are the urgent ones. Six in ten arrive within the year their ID was assigned, so a daily check of the feed is worth more than an annual sweep.
If you want your own dependency list checked against exploited-in-the-wild data, the free scan at https://gold.safeguard.sh/scan takes a manifest or repository, and Safeguard's SBOM and dependency scanning keeps that inventory current.
Try it yourself
Open the demo, run the exploitability check, and look at how an exploited flag changes the order of a findings list.
Click through it at your own pace, or open it full screen.
Quick check
Does an old CVE ID mean the flaw is no longer a risk?
No. In this snapshot 156 of 1,748 KEV entries have a CVE ID from before 2015. Age of the ID says nothing about whether the software is still deployed.
Why is 2022 so different from later years?
The catalog began in November 2021 with a backlog of older flaws, and 2022 added 555 entries, 47 percent of them five or more years old. Later years reflect steady additions.
Sources
- CISA Known Exploited Vulnerabilities JSON feed, fetched 19 October 2026
- CISA Known Exploited Vulnerabilities Catalog
Last reviewed: 19 October 2026.
