Question Vulnerabilities
Which vendors have the most CISA KEV entries?
Microsoft has the most entries in CISA’s Known Exploited Vulnerabilities catalog, with 388 of 1,721 (22.5%), followed by Cisco (99) and Apple (94), as of catalog 2026.09.23. A high count is not by itself a measure of how secure a vendor’s products are.
Which vendors have the most CISA KEV entries? Microsoft has the most entries in CISA’s Known Exploited Vulnerabilities catalog, with 388 of 1,721 (22.5%), followed by Cisco (99) and Apple (94), as of catalog 2026.09.23. A high count is not by itself a measure of how secure a vendor’s products are. Source: https://glide-cleartext.pages.dev/q/which-vendors-have-the-most-cisa-kev-entries/ (Cleartext, verified 2026-09-24)
Top vendors and projects #
| Rank | Vendor or project | Entries | Share of catalog |
|---|---|---|---|
| 1 | Microsoft | 388 | 22.5% |
| 2 | Cisco | 99 | 5.8% |
| 3 | Apple | 94 | 5.5% |
| 4 | Adobe | 81 | 4.7% |
| 5 | 75 | 4.4% | |
| 6 | Oracle | 46 | 2.7% |
| 7 | Apache | 40 | 2.3% |
| 8 | Ivanti | 35 | 2.0% |
| 9 | Linux | 31 | 1.8% |
| 10 | Fortinet | 30 | 1.7% |
| 11 | D-Link | 26 | 1.5% |
| 12 | VMware | 26 | 1.5% |
| 13 | Citrix | 24 | 1.4% |
| 14 | SonicWall | 19 | 1.1% |
| 15 | Synacor | 19 | 1.1% |
Top products #
| Vendor | Product | Entries |
|---|---|---|
| Microsoft | Windows | 172 |
| Apple | Multiple Products | 53 |
| Chromium V8 | 41 | |
| Microsoft | Internet Explorer | 36 |
| Adobe | Flash Player | 33 |
| Linux | Kernel | 31 |
| Microsoft | Office | 29 |
| Microsoft | Win32k | 25 |
| Microsoft | Exchange Server | 17 |
| Synacor | Zimbra Collaboration Suite (ZCS) | 16 |
How to read these tables #
Counts come straight from the vendorProject and product fields of CISA’s feed[1] and are not normalized: a vendor that changed its name, or a product listed under two spellings, is counted separately. The tables say which products attackers have been seen exploiting, not which vendors are safest.
Evidence #
Numbers match the citations in the text. Primary sources are the standard, regulation, regulator statement or dataset itself.
What this means for you #
Banks & credit unions
Vendor counts are useful for asset-inventory priorities: if you run a lot of a top vendor’s products, KEV monitoring for that vendor is not optional.
Fintechs & payment firms
Look at the product table, not just the vendor table. A single edge device or VPN product can matter more to your exposure than a vendor’s total.
Developers & identity teams
Vendor and product names in the feed are free text and not always consistent. Normalize them before joining against your own inventory.
Follow-up questions #
- Why do big vendors have more entries?
- Widely deployed products attract more attackers and more scrutiny, so they appear more often. The counts don’t adjust for how many products each vendor ships or how many customers use them.
People also ask #
How many vulnerabilities are in the CISA KEV catalog?
CISA’s Known Exploited Vulnerabilities catalog lists 1,721 vulnerabilities as of catalog version 2026.09.23, released September 23, 2026. 46 were added in the 30 days before that release, and 361 entries (21.0%) are flagged as known to be used in ransomware campaigns.
Full answerWhat is the CISA KEV catalog?
The Known Exploited Vulnerabilities (KEV) catalog is CISA’s list of vulnerabilities with reliable evidence of active exploitation. Each entry gives a required action and a due date. US federal civilian agencies must act by that date; other organizations use the list to decide what to patch first. It holds 1,721 entries.
Full answerDecide and act #
Cite this answer #
Answers change. Include the verification date when you quote this page.
Plain text
Cleartext. “Which vendors have the most CISA KEV entries?” Last verified 2026-09-24 (rev. 1). https://glide-cleartext.pages.dev/q/which-vendors-have-the-most-cisa-kev-entries/
Markdown link
[Which vendors have the most CISA KEV entries?](https://glide-cleartext.pages.dev/q/which-vendors-have-the-most-cisa-kev-entries/) (Cleartext, verified 2026-09-24)
Changelog #
| Date | Revision | Change |
|---|---|---|
| Rev. 1 | First published. Numbers regenerate from the CISA feed on every build. |