Question Vulnerabilities
How many vulnerabilities are in the CISA KEV catalog?
CISA’s Known Exploited Vulnerabilities catalog lists 1,721 vulnerabilities as of catalog version 2026.09.23, released September 23, 2026. 46 were added in the 30 days before that release, and 361 entries (21.0%) are flagged as known to be used in ransomware campaigns.
How many vulnerabilities are in the CISA KEV catalog? CISA’s Known Exploited Vulnerabilities catalog lists 1,721 vulnerabilities as of catalog version 2026.09.23, released September 23, 2026. 46 were added in the 30 days before that release, and 361 entries (21.0%) are flagged as known to be used in ransomware campaigns. Source: https://glide-cleartext.pages.dev/q/how-many-vulnerabilities-are-in-the-cisa-kev-catalog/ (Cleartext, verified 2026-09-24)
Entries by year added #
| Year added | Entries | Marked known ransomware use |
|---|---|---|
| 2021 | 311 | 84 |
| 2022 | 555 | 132 |
| 2023 | 187 | 43 |
| 2024 | 186 | 44 |
| 2025 | 245 | 31 |
| 2026 | 237 | 27 |
The catalog was created in November 2021; the first batch was added on November 3, 2021.
Ransomware use #
CISA marks each entry’s knownRansomwareCampaignUse field as “Known” or “Unknown”. 361 of 1,721 entries (21.0%) are marked “Known”.[1] “Unknown” means CISA has not confirmed ransomware use, not that it has been ruled out.
How these numbers are produced #
Every figure on this page is computed from CISA’s KEV JSON feed[1] when the site is built. The explanation around the numbers is verified by an editor; the numbers themselves change whenever CISA publishes a new catalog version.
Evidence #
Numbers match the citations in the text. Primary sources are the standard, regulation, regulator statement or dataset itself.
What this means for you #
Banks & credit unions
The catalog grows every month. A KEV remediation metric should count open entries that affect your assets, not the catalog’s total.
Fintechs & payment firms
Use the additions in the last 30 days as your weekly review list: they are the entries most likely to be new to your environment.
Developers & identity teams
The counts on this page are generated from CISA’s JSON feed at build time. Fetch the same feed to reproduce or monitor them.
Follow-up questions #
- How often does CISA add entries?
- Irregularly, often several times a week. The feed’s catalog version and release date show when it last changed.
People also ask #
What is the CISA KEV catalog?
The Known Exploited Vulnerabilities (KEV) catalog is CISA’s list of vulnerabilities with reliable evidence of active exploitation. Each entry gives a required action and a due date. US federal civilian agencies must act by that date; other organizations use the list to decide what to patch first. It holds 1,721 entries.
Full answerWhich vendors have the most CISA KEV entries?
Microsoft has the most entries in CISA’s Known Exploited Vulnerabilities catalog, with 388 of 1,721 (22.5%), followed by Cisco (99) and Apple (94), as of catalog 2026.09.23. A high count is not by itself a measure of how secure a vendor’s products are.
Full answerWhat does the due date in the CISA KEV catalog mean?
It is the date by which US federal civilian executive branch agencies must complete the entry’s required action, usually applying the vendor’s update or mitigation, or stop using the product. For entries added in the past year, the median window was 14 days. For everyone else it is a useful deadline, not a legal one.
Full answerDecide and act #
Cite this answer #
Answers change. Include the verification date when you quote this page.
Plain text
Cleartext. “How many vulnerabilities are in the CISA KEV catalog?” Last verified 2026-09-24 (rev. 1). https://glide-cleartext.pages.dev/q/how-many-vulnerabilities-are-in-the-cisa-kev-catalog/
Markdown link
[How many vulnerabilities are in the CISA KEV catalog?](https://glide-cleartext.pages.dev/q/how-many-vulnerabilities-are-in-the-cisa-kev-catalog/) (Cleartext, verified 2026-09-24)
Changelog #
| Date | Revision | Change |
|---|---|---|
| Rev. 1 | First published. Numbers regenerate from the CISA feed on every build. |