Fourteen vendors that make firewalls, VPN gateways, load balancers and similar network edge products hold 277 of the 1,748 CISA KEV entries (16%). Their share of each year's additions rose from 14% in 2022 to 20% in 2026. Edge devices are a growing part of what attackers use, though the vendor-level count is a rough measure.
Method
We downloaded the KEV JSON on 19 October 2026 (version 2026.10.16) and counted entries by vendorProject. We picked fourteen vendors by judgment, because they are best known for network edge or remote access products: Cisco, Fortinet, Ivanti, Citrix, SonicWall, Palo Alto Networks, F5, Juniper, Check Point, WatchGuard, Zyxel, Sophos, Barracuda and Pulse Secure.
This is a vendor-level proxy and it has two flaws. Cisco and Juniper also make non-edge products, so some entries are not edge devices. And vendors we did not list, such as router or storage appliance makers, also have edge products. The numbers show direction, not an exact share.
The counts
The 277 entries split as: Cisco 101, Ivanti 36, Fortinet 32, Citrix 27, SonicWall 19, Palo Alto Networks 16, F5 8, Juniper 8, Zyxel 13, Sophos 7, Check Point 5, WatchGuard 4, Pulse Secure 1 and Barracuda 0 in the version read. Barracuda stays on the list for completeness but adds nothing.
The share by year
| Year added | All entries | Listed vendors | Share |
|---|---|---|---|
| 2022 | 555 | 79 | 14% |
| 2023 | 187 | 29 | 16% |
| 2024 | 186 | 33 | 18% |
| 2025 | 245 | 43 | 18% |
| 2026 | 264 | 54 | 20% |
The rise is steady, not a spike. In 2026 one in five additions comes from this small set of vendors. The 2021 rows are left out because the launch backlog dominated them.
Why edge products matter
An edge device sits on the boundary of a network, often exposed to the internet, and often holds credentials or can see internal traffic. A flaw there tends to give an attacker a position on the inside without needing to trick a user. These products are also awkward to patch: they carry traffic for the whole organisation, so teams delay maintenance windows.
What to do with it
- List every internet-facing device and its software version. Many teams find one they forgot.
- Set a shorter patch target for these devices than for ordinary servers.
- Turn off management interfaces on the public side.
- Treat a KEV addition for one of your edge products as an incident to check for compromise, not only a patch to apply. A fix does not remove an attacker who got in before it.
None of this requires knowing which vendor will be next. It requires knowing what you run at the edge.
Safeguard's SBOM and dependency scanning lists the components you run, and reachability analysis helps separate vulnerable code your application calls from code it does not. You can try a free scan at gold.safeguard.sh/scan.
Try it yourself
Click through it at your own pace, or open it full screen.
Open the exploitability view and look at how internet exposure changes the answer for a device.
Quick check
Does a vendor on this list have worse security than one that is not?
Not from this data. Entry counts reflect install base and attacker attention as well as product quality.
Are all Cisco entries edge devices?
No. Cisco also makes products that are not at the edge, so the count is a proxy.
Sources
- CISA Known Exploited Vulnerabilities catalog, JSON read on 19 October 2026, catalog version 2026.10.16 (1,748 entries).
Last reviewed: 19 October 2026.
