What the KEV catalogue actually says
Analysis of all 1,769 entries in CISA's Known Exploited Vulnerabilities catalogue. Unlike the rest of this site, nothing here is a summary of someone else's reporting — these are counts taken directly from the catalogue, recomputed on every build.
Source: CISA KEV · analysed 2026-11-09 · figures regenerate each build
How long you actually get
The remediation window is not a sliding scale — it is a handful of discrete policy values. 57.9% of the catalogue carries a 21-day deadline. The 182-day tail is the legacy BOD 22-01 treatment applied to older entries, not a relaxed modern deadline.
| Window | Entries | Share |
|---|---|---|
| 3 days | 151 | 8.5% |
| 7 days | 20 | 1.1% |
| 14 days | 286 | 16.2% |
| 21 days | 1,025 | 57.9% |
| 181 days | 238 | 13.5% |
| 182 days | 11 | 0.6% |
Ransomware labelling has shifted
CISA flags entries known to be used in ransomware campaigns. That share sat near 24.5% across 2021–2024 and is near 10.9% across 2025–2026. Read that as a change in the catalogue, not in the world. `knownRansomwareCampaignUse` is CISA's own annotation, so a change in labelling practice and a change in attacker behaviour look identical from here, and nothing in this dataset separates them.
| Year | Added | Ransomware-linked | Share |
|---|---|---|---|
| 2021 | 311 | 84 | 27.0% |
| 2022 | 555 | 132 | 23.8% |
| 2023 | 187 | 43 | 23.0% |
| 2024 | 186 | 44 | 23.7% |
| 2025 | 245 | 31 | 12.7% |
| 2026 | 285 | 27 | 9.5% |
The catalogue is more concentrated than it looks
291 distinct vendors appear in the catalogue, which suggests breadth. The running total says otherwise: the top ten account for 52.9% of every entry, and Microsoft alone is 22.0%.
| Vendor | Entries | Share | Cumulative |
|---|---|---|---|
| Microsoft | 390 | 22.0% | 22.0% |
| Cisco | 102 | 5.8% | 27.8% |
| Apple | 96 | 5.4% | 33.2% |
| Adobe | 83 | 4.7% | 37.9% |
| 76 | 4.3% | 42.2% | |
| Oracle | 46 | 2.6% | 44.8% |
| Apache | 41 | 2.3% | 47.1% |
| Ivanti | 38 | 2.1% | 49.3% |
| Fortinet | 32 | 1.8% | 51.1% |
| Linux | 32 | 1.8% | 52.9% |
Deadlines still open
6 of 1,769 entries still have a federal remediation deadline in the future as of 2026-11-09. The list is short because the catalogue is overwhelmingly historical — if it is ever long, that is itself the story.
| Due | CVE | Vendor / product |
|---|---|---|
| 2026-11-10 | CVE-2026-48356 | Adobe Commerce and Magento |
| 2026-11-10 | CVE-2026-111497 | Google Brotli |
| 2026-11-11 | CVE-2026-41709 | Broadcom VMware ESX |
| 2026-11-13 | CVE-2026-118527 | Ivanti Connect Secure |
| 2026-11-18 | CVE-2024-27834 | Apple Multiple Products |
| 2026-11-20 | CVE-2026-19868 | SonicWall SonicOS SSLVPN |
How much of this we have covered
This site has published at least one article on 346 of 1,769 catalogue entries — 19.6%. The remaining 1,423 are largely historical entries added before this site existed. Of the 203 covered close to their listing date, 164 were covered within a week and the median gap was 1 day.
Method: every figure is computed at build time from the KEV catalogue snapshot in this repository and from this site's own article corpus — no figure is copied from another publication. Coverage latency is measured only for entries covered from three days before to 400 days after their KEV addition; articles about decade-old entries would otherwise register as years late and mean nothing. Counts change as CISA updates the catalogue. Reuse permitted under CC BY 4.0 with attribution.