# Which vendors have the most CISA KEV entries?

> **Short answer:** Microsoft has the most entries in CISA’s Known Exploited Vulnerabilities catalog, with 388 of 1,721 (22.5%), followed by Cisco (99) and Apple (94), as of catalog 2026.09.23. A high count is not by itself a measure of how secure a vendor’s products are.

- URL: https://glide-cleartext.pages.dev/q/which-vendors-have-the-most-cisa-kev-entries/
- Last verified: 2026-09-24 by [VERIFIER NAME] (revision 1)
- Publisher: Cleartext, owned by [OWNER ENTITY] (see https://glide-cleartext.pages.dev/about/ownership-and-funding/)
- Data: computed from CISA KEV catalog 2026.09.23 at build time (2026-10-20)

## Top vendors and projects

| Rank | Vendor or project | Entries | Share of catalog |
|---|---|---|---|
| 1 | Microsoft | 388 | 22.5% |
| 2 | Cisco | 99 | 5.8% |
| 3 | Apple | 94 | 5.5% |
| 4 | Adobe | 81 | 4.7% |
| 5 | Google | 75 | 4.4% |
| 6 | Oracle | 46 | 2.7% |
| 7 | Apache | 40 | 2.3% |
| 8 | Ivanti | 35 | 2.0% |
| 9 | Linux | 31 | 1.8% |
| 10 | Fortinet | 30 | 1.7% |
| 11 | D-Link | 26 | 1.5% |
| 12 | VMware | 26 | 1.5% |
| 13 | Citrix | 24 | 1.4% |
| 14 | SonicWall | 19 | 1.1% |
| 15 | Synacor | 19 | 1.1% |
Table: Top 15 vendors in CISA KEV catalog 2026.09.23. Computed by Cleartext from the CISA feed.

## Top products

| Vendor | Product | Entries |
|---|---|---|
| Microsoft | Windows | 172 |
| Apple | Multiple Products | 53 |
| Google | Chromium V8 | 41 |
| Microsoft | Internet Explorer | 36 |
| Adobe | Flash Player | 33 |
| Linux | Kernel | 31 |
| Microsoft | Office | 29 |
| Microsoft | Win32k | 25 |
| Microsoft | Exchange Server | 17 |
| Synacor | Zimbra Collaboration Suite (ZCS) | 16 |
Table: Top 10 products in CISA KEV catalog 2026.09.23.

## How to read these tables

Counts come straight from the *vendorProject* and *product* fields of CISA’s feed[^1] and are not normalized: a vendor that changed its name, or a product listed under two spellings, is counted separately. The tables say which products attackers have been seen exploiting, not which vendors are safest.

## What this means for you

### Banks & credit unions

Vendor counts are useful for asset-inventory priorities: if you run a lot of a top vendor’s products, KEV monitoring for that vendor is not optional.

### Fintechs & payment firms

Look at the product table, not just the vendor table. A single edge device or VPN product can matter more to your exposure than a vendor’s total.

### Developers & identity teams

Vendor and product names in the feed are free text and not always consistent. Normalize them before joining against your own inventory.

## Follow-up questions

**Why do big vendors have more entries?**

Widely deployed products attract more attackers and more scrutiny, so they appear more often. The counts don’t adjust for how many products each vendor ships or how many customers use them.


## Sources

[^1]: Known Exploited Vulnerabilities catalog (JSON feed). CISA. https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
[^2]: Known Exploited Vulnerabilities Catalog. CISA. https://www.cisa.gov/known-exploited-vulnerabilities-catalog

## Related questions

- [How many vulnerabilities are in the CISA KEV catalog?](https://glide-cleartext.pages.dev/q/how-many-vulnerabilities-are-in-the-cisa-kev-catalog/)
- [What is the CISA KEV catalog?](https://glide-cleartext.pages.dev/q/what-is-the-cisa-kev-catalog/)

## Cite

Cleartext. “Which vendors have the most CISA KEV entries?” Last verified 2026-09-24 (rev. 1). https://glide-cleartext.pages.dev/q/which-vendors-have-the-most-cisa-kev-entries/

## Changelog

- 2026-09-24: First published. Numbers regenerate from the CISA feed on every build.