Microsoft has 390 of the 1,748 entries in the CISA Known Exploited Vulnerabilities catalog as of version 2026.10.16, about 22%. Windows alone has 173. The share was near 30% in 2022 and has sat between 15% and 19% since 2023. A big share reflects install base and scrutiny, not a verdict on quality.
Method
We downloaded the KEV catalog JSON on 19 October 2026 (catalog version 2026.10.16, 1,748 entries). We counted entries by the vendorProject and product fields and grouped by the year in dateAdded. Nothing was sampled or estimated. Vendor labels are CISA's, so a product CISA files under a different vendor name is not counted here.
Which Microsoft products dominate
The 390 Microsoft entries split unevenly:
- Windows: 173
- Internet Explorer: 36
- Office: 29
- Win32k: 25
- Exchange Server: 17
- SharePoint and SharePoint Server: 15 together
Win32k is a Windows component, so the operating system family is even larger than the first line suggests. Internet Explorer is a browser many organisations retired, but its 36 entries remain in the catalog because the catalog does not remove entries when a product goes out of use.
The share by year
Entries added per year, with Microsoft's part:
| Year added | All entries | Microsoft | Share |
|---|---|---|---|
| 2021 (from 3 November) | 311 | 83 | 27% |
| 2022 | 555 | 165 | 30% |
| 2023 | 187 | 27 | 14% |
| 2024 | 186 | 36 | 19% |
| 2025 | 245 | 39 | 16% |
| 2026 (to 16 October) | 264 | 40 | 15% |
The 2021 and 2022 numbers are inflated by the way a new catalog fills. When CISA launched it, many older exploited vulnerabilities went in at once, and Microsoft had a long history of them. The steadier numbers from 2023 are a better guide to the current rate: Microsoft adds roughly 27 to 40 entries a year while the catalog as a whole adds close to 190 to 265.
How much of this is ransomware
CISA flags some entries as known to be used in ransomware campaigns. In the catalog, 117 of the 390 Microsoft entries carry that flag, which is 30%. Of all 361 flagged entries, Microsoft holds about 32%. Old Windows, Exchange and Win32k bugs are a large part of that.
What not to conclude
A high count says three things at once: Microsoft software is installed almost everywhere, attackers study it heavily, and the company reports and patches in a regular public cycle that makes exploitation easy to tie to a CVE. None of that ranks vendors by secure development. A vendor with few entries may simply have fewer deployments, less public exploitation reporting, or fixes that never get a public CVE.
The practical use is narrower. If you run a Windows fleet, KEV additions that name Windows components are the ones to watch for first, and your patch process should treat them differently from a routine monthly update.
Safeguard's SBOM and dependency scanning lists the components you run, and its reachability analysis helps separate vulnerable code that your application calls from code it does not. You can try a free scan at gold.safeguard.sh/scan.
Try it yourself
Click through it at your own pace, or open it full screen.
Click a finding and look at how the exploited flag changes its place in the queue.
Quick check
Does a high KEV count mean a vendor is less secure?
No. The count mixes install base, attacker attention and public reporting. It is a prioritisation signal for the products you run, not a vendor ranking.
Why did the Microsoft share fall after 2022?
The first two years of the catalog absorbed a backlog of older exploited bugs. From 2023 the catalog grew more slowly and drew more from other vendors.
Sources
- CISA Known Exploited Vulnerabilities catalog, JSON read on 19 October 2026, catalog version 2026.10.16.
Last reviewed: 19 October 2026.
