Domain
Vulnerabilities questions
Exploited vulnerabilities and patch deadlines, answered from CISA's Known Exploited Vulnerabilities catalog.
Questions #
- How many vulnerabilities are in the CISA KEV catalog?
CISA’s Known Exploited Vulnerabilities catalog lists 1,721 vulnerabilities as of catalog version 2026.09.23, released September 23, 2026.
- What does the due date in the CISA KEV catalog mean?
It is the date by which US federal civilian executive branch agencies must complete the entry’s required action, usually applying the vendor’s update or mitigation, or stop using the product.
- What is the CISA KEV catalog?
The Known Exploited Vulnerabilities (KEV) catalog is CISA’s list of vulnerabilities with reliable evidence of active exploitation.
- Which vendors have the most CISA KEV entries?
Microsoft has the most entries in CISA’s Known Exploited Vulnerabilities catalog, with 388 of 1,721 (22.5%), followed by Cisco (99) and Apple (94), as of catalog 2026.09.23.