KEV is concentrated but also long-tailed. Ten vendors account for 53.1 percent of the 1,748 entries, and Microsoft alone for 22.3 percent. Yet 149 of the 289 vendors appear exactly once. A watchlist of big names catches about half of the catalog and misses the rest.
Method
We downloaded the CISA KEV JSON feed on 19 October 2026 (catalog version 2026.10.16) and counted the vendorProject field. That field is free text, so "Linux" means the kernel, and related products may be listed under slightly different names. We did not merge names.
What the numbers say
Across the whole catalog:
- 289 distinct vendor or project names.
- Top vendor: Microsoft, 390 entries, 22.3 percent.
- Top five: 42.5 percent. Top ten: 53.1 percent.
- 27 vendors have ten or more entries.
- 196 vendors have one or two entries. 149 have exactly one.
The biggest names are Microsoft (390), Cisco (101), Apple (95), Adobe (82), Google (75), Oracle (46), Apache (41), Ivanti (36), Fortinet (32) and Linux (31).
The tail is not shrinking. Since 1 January 2024 there are 191 vendors across 695 entries, and 102 of them appear once. In 2026 so far there are 101 vendors, and 46 of those had never appeared in the catalog before. The 2026 leaders are Microsoft (40), Cisco (19), Fortinet (9), Apple (9), Linux (8) and Google (8).
So roughly 45 percent of the vendors in this year's additions are new to the list.
What to do with it
A vendor list is a useful starting filter, but it is the wrong final filter. Three suggestions.
Match on what you run, not who makes it. The only reliable way to know whether an entry applies is an inventory of products and versions: operating systems, network devices, libraries, SaaS connectors. Without it, you read each addition and guess.
Plan for the unknown name. Almost half of this year's vendors are new, so a rule like "alert on these twenty vendors" will miss exactly the entries you have no process for. Alert on every addition, then filter against your inventory automatically.
Pay attention to open source components. Some of the single-entry names are libraries and developer tools, which end up inside your own software without a purchase order. A dependency scan with a software bill of materials is how those become visible.
Safeguard's asset discovery and SBOM scanning build that inventory, and the free scan at https://gold.safeguard.sh/scan is a way to try it on one repository.
Quick check
Can I just watch the top ten vendors?
That covers 53.1 percent of entries. The other 46.9 percent come from other vendors, so you need an inventory match, not a name list.
Is the vendor name field reliable for filtering?
Only roughly. It is free text, and names for related products can differ. Match on product and version where you can.
Sources
- CISA Known Exploited Vulnerabilities JSON feed, fetched 19 October 2026
- CISA Known Exploited Vulnerabilities Catalog
Last reviewed: 19 October 2026.
