Patchfirst
Patchfirst

Insights · CISA KEV · data built 31 Oct 2026

Exploitation trends

additions over time, time from disclosure to KEV listing, trending and vendors. Figures come from the CISA Known Exploited Vulnerabilities catalogue joined to Patchfirst’s CVE and ATT&CK data.

KEV additions feed All watch feeds
Time from disclosure to KEV listing 14days Median in 2026, from CVE publication to CISA KEV listing, across 279 CVEs. 2025: 30 days. KEV listing is the date exploitation was confirmed, not the first attack.

KEV additions

Period
Scopes the figures, calendar and monthly chart below.
Added to CISA KEV
313
1 Nov 2025 to 31 Oct 2026
Known ransomware use
299%
of additions in the period
Busiest day
8
20 Apr 2026
Days with an addition
149of 365
2.1 per active day

KEV additions per day

Darker cells mean more CISA KEV additions that day.
CISA KEV additions per day, Last 12 months: 313 in total. The table view below lists every day with an addition. NovDecJanFebMarAprMayJunJulAugSepOct MonWedFri
Each square is a day. Weeks start on Monday. Fewer 01–234–78+ More
Table view
KEV additions per day, Last 12 months, days with at least one addition
DateKEV additions
30 Oct 20262
29 Oct 20262
28 Oct 20262
27 Oct 20262
26 Oct 20262
23 Oct 20262
20 Oct 20266
16 Oct 20262
15 Oct 20261
14 Oct 20264
13 Oct 20262
8 Oct 20265
4 Oct 20261
2 Oct 20262
1 Oct 20261
30 Sep 20261
29 Sep 20261
27 Sep 20262
25 Sep 20263
24 Sep 20262
22 Sep 20264
21 Sep 20261
18 Sep 20263
16 Sep 20263
14 Sep 20261
11 Sep 20264
10 Sep 20262
9 Sep 20264
8 Sep 20264
4 Sep 20261
2 Sep 20267
31 Aug 20262
27 Aug 20263
26 Aug 20266
25 Aug 20261
24 Aug 20261
21 Aug 20261
20 Aug 20262
19 Aug 20261
18 Aug 20264
17 Aug 20261
11 Aug 20263
7 Aug 20261
5 Aug 20261
4 Aug 20263
3 Aug 20261
29 Jul 20261
27 Jul 20262
22 Jul 20262
21 Jul 20264
16 Jul 20263
15 Jul 20262
14 Jul 20264
13 Jul 20261
10 Jul 20262
7 Jul 20264
1 Jul 20261
29 Jun 20261
25 Jun 20262
23 Jun 20264
18 Jun 20261
16 Jun 20261
15 Jun 20262
12 Jun 20261
11 Jun 20261
9 Jun 20263
8 Jun 20262
5 Jun 20261
3 Jun 20261
2 Jun 20262
1 Jun 20261
29 May 20261
27 May 20263
26 May 20261
22 May 20261
21 May 20262
20 May 20267
15 May 20261
14 May 20261
8 May 20261
7 May 20261
6 May 20261
1 May 20261
30 Apr 20261
28 Apr 20262
24 Apr 20264
23 Apr 20261
22 Apr 20261
20 Apr 20268
16 Apr 20261
14 Apr 20262
13 Apr 20267
8 Apr 20261
6 Apr 20261
2 Apr 20261
1 Apr 20261
30 Mar 20261
27 Mar 20261
26 Mar 20261
25 Mar 20261
20 Mar 20265
19 Mar 20261
18 Mar 20262
16 Mar 20261
13 Mar 20262
11 Mar 20261
9 Mar 20263
5 Mar 20265
3 Mar 20262
25 Feb 20262
24 Feb 20261
20 Feb 20262
18 Feb 20262
17 Feb 20264
13 Feb 20261
12 Feb 20264
10 Feb 20266
5 Feb 20262
3 Feb 20264
29 Jan 20261
27 Jan 20261
26 Jan 20265
23 Jan 20261
22 Jan 20264
21 Jan 20261
13 Jan 20261
12 Jan 20261
7 Jan 20262
29 Dec 20251
22 Dec 20251
19 Dec 20251
17 Dec 20253
16 Dec 20251
15 Dec 20252
12 Dec 20252
11 Dec 20251
9 Dec 20252
8 Dec 20252
5 Dec 20251
3 Dec 20251
2 Dec 20252
28 Nov 20251
21 Nov 20251
19 Nov 20251
18 Nov 20251
14 Nov 20251
12 Nov 20253
10 Nov 20251
4 Nov 20252

KEV additions by month

Known ransomware use Other KEV additions
Table view
KEV additions by month, Last 12 months
MonthKEV additionsKnown ransomware useShare
Nov 20251100%
Dec 202520210%
Jan 202617212%
Feb 20262827%
Mar 20262628%
Apr 202631929%
May 202621314%
Jun 202623313%
Jul 202626415%
Aug 20263126%
Sep 20264300%
Oct 20263600%

Time from disclosure to KEV listing

Days from CVE publication to CISA KEV listing, by year published. Log scale.
Median Middle half (25th to 75th percentile)

Only CVEs that reached KEV count, so recent years look faster: a 2026 CVE that will be exploited next year is not in the figure yet. KEV began in November 2021, which is why older CVEs show long waits.

Table view
Days from publication to CISA KEV by year published
Year publishedMedian days25th pct75th pctCVEs
2026141165279
2025302316238
2024351369179
2023152433176
20221,4846522,522523
2021468181784306

Trending techniques

KEV additions linked to each technique, last 90 days against the 90 before.
  1. Exploit Public-Facing Application T1190
    76 up 28 against 48 in the previous 90 days
  2. Command and Scripting Interpreter T1059
    53 up 22 against 31 in the previous 90 days
  3. Valid Accounts T1078
    21 up 12 against 9 in the previous 90 days
  4. Exploitation for Privilege Escalation T1068
    18 up 10 against 8 in the previous 90 days
  5. Data from Local System T1005
    8 unchanged 8 against 8 in the previous 90 days
  6. Application or System Exploitation T1499.004
    7 up 6 against 1 in the previous 90 days
  7. Drive-by Compromise T1189
    4 down 1 against 5 in the previous 90 days
  8. Proxy T1090
    3 up 2 against 1 in the previous 90 days
  9. Ingress Tool Transfer T1105
    3 up 2 against 1 in the previous 90 days
  10. Stored Data Manipulation T1565.001
    2 down 1 against 3 in the previous 90 days
  11. Remote Services T1021
    1 up 1 against 0 in the previous 90 days
  12. Network Sniffing T1040
    1 up 1 against 0 in the previous 90 days
Show all 12Show top 5
Last 90 daysPrevious 90 Arrow: change against the previous 90 days.

Most exploited vendors

Top 100 of 286 vendors with a KEV listing. Sort by any column.
Vendors by CISA KEV listings. Column headers sort the table.
#
1 Microsoft 797 390 117 567 13 Oct 2026
2 Cisco 266 102 7 1,074 29 Oct 2026
3 Apple 145 95 0 71 29 Sep 2026
4 Google 195 93 0 26 27 Oct 2026
5 Adobe 154 83 11 2,632 27 Oct 2026
6 Oracle 154 46 13 1,464 24 Aug 2026
7 Apache 232 41 8 503 8 Oct 2026
8 Ivanti 74 39 12 34 30 Oct 2026
9 Fortinet 55 32 14 35 16 Oct 2026
10 Linux 60 32 2 464 28 Oct 2026
11 Citrix 31 27 7 37 4 Oct 2026
12 VMware 29 26 9 82 4 Mar 2025
13 D-Link 63 26 2 926 24 Apr 2026
14 SonicWall 46 19 13 202 2 Sep 2026
15 Synacor 19 19 6 209 21 Aug 2026
16 Palo Alto Networks 20 16 6 10 14 Oct 2026
17 Samsung 16 15 0 616 24 Apr 2026
18 Atlassian 30 14 8 65 15 Oct 2026
19 SAP 28 14 3 1,574 15 May 2025
20 Zyxel 26 13 2 12 21 Sep 2026
21 Mozilla 39 13 1 1,035 6 Oct 2025
22 QNAP 28 12 9 573 21 Dec 2023
23 Qualcomm 13 12 0 0 3 Mar 2026
24 Trend Micro 24 12 0 97 21 May 2026
25 SolarWinds 31 11 2 41 5 Jun 2026
↑ ↓ chooseEnter openEsc close