What share of exploited vulnerabilities are used in ransomware?

361 of 1,769 vulnerabilities on CISA’s KEV list (20%) are known to have been used in ransomware campaigns.

Exploited Vulnerability Statistics 2026: 1,769 Analysed

1,769 actively exploited vulnerabilities on CISA’s KEV list as of 6 November 2026; 20% linked to ransomware; Microsoft has the most (390). Data as of 6 November 2026, from CISA’s catalogue and RedTeamDaily’s own coverage.

1,769on the list

20%used in ransomware

291vendors

285added in 2026

Key findings

CISA’s Known Exploited Vulnerabilities (KEV) catalogue lists 1,769 vulnerabilities with evidence of exploitation in real attacks, as of 6 November 2026.
Link to this finding
361 of 1,769 vulnerabilities on CISA’s KEV list (20%) are known to have been used in ransomware campaigns.
Link to this finding
Microsoft has the most entries on CISA’s KEV list: 390 of 1,769 (22%), followed by Cisco (102) and Apple (96).
Link to this finding
The 5 vendors with the most entries (Microsoft, Cisco, Apple, Adobe and Google) account for 747 of 1,769 KEV vulnerabilities (42%); the other 1,022 come from 286 vendors.
Link to this finding
30% of Microsoft’s KEV entries (117 of 390) are known to have been used in ransomware, higher than the 20% across the whole list.
Link to this finding
CISA added 285 vulnerabilities to the KEV list in 2026 up to 6 November 2026, more than the 216 it had added by the same date in 2025 (245 in all of 2025).
Link to this finding

Vendors with the most entries

Vendor	Entries	Share of list	Known ransomware use
Microsoft	390	22%	117 of 390
Cisco	102	6%	7 of 102
Apple	96	5%	0 of 96
Adobe	83	5%	11 of 83
Google	76	4%	0 of 76
Oracle	46	3%	13 of 46
Apache	41	2%	8 of 41
Ivanti	38	2%	12 of 38
Fortinet	32	2%	14 of 32
Linux	32	2%	2 of 32
Citrix	27	2%	7 of 27
D-Link	26	1%	2 of 26
VMware	26	1%	9 of 26
SonicWall	20	1%	13 of 20
Synacor	19	1%	6 of 19

All 27 vendors with 10 or more entries ›

Added per year

Year	Added
2026 (to 6 November 2026)	285
2025	245
2024	186
2023	187
2022	555
2021	311

Questions

What is CISA’s Known Exploited Vulnerabilities list?

It is the catalogue of vulnerabilities that the US Cybersecurity and Infrastructure Security Agency (CISA) has evidence attackers have used in real attacks. It listed 1,769 vulnerabilities as of 6 November 2026. US federal agencies must fix each one by a set date; everyone else can use it to decide what to patch first.

Link to this answer · See the finding

How many vulnerabilities are known to be exploited?

CISA’s Known Exploited Vulnerabilities (KEV) catalogue lists 1,769 vulnerabilities with evidence of exploitation in real attacks, as of 6 November 2026.

Link to this answer · See the finding

Which vendor has the most known exploited vulnerabilities?

Microsoft has the most entries on CISA’s KEV list: 390 of 1,769 (22%), followed by Cisco (102) and Apple (96).

Link to this answer · See the finding

How many vulnerabilities has CISA added to the KEV list in 2026?

CISA added 285 vulnerabilities to the KEV list in 2026 up to 6 November 2026, more than the 216 it had added by the same date in 2025 (245 in all of 2025).

Link to this answer · See the finding

Methodology

Source: the US Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalogue (public domain), downloaded by RedTeamDaily every day. Entries CISA removes are taken out on the next download.
Severity: the base score the US National Vulnerability Database (NVD) gives each CVE, using the newest CVSS version it has (4.0, 3.1 or 3.0). Entries NVD has not scored are left out of the severity figures only.
Ransomware: CISA’s own “known ransomware campaign use” field. “Unknown” means CISA has no evidence, not that it never happened.
Vendors: CISA’s vendor names, grouped regardless of capital letters and spacing. A company that appears under two different names (for example after a takeover) is counted under each name, as CISA lists it.
Coverage: a CVE counts as covered when a published RedTeamDaily story names it. Counted only for entries CISA added since our first story.
Thin data: a finding with fewer than 20 entries behind it is not stated, and severity only when at least half the list has an NVD score. Shares are rounded to whole per cent, so they may not add up to exactly 100.
Updated: the date shown is the newest date CISA added an entry, not the date this page was built.

Source data: CISA Known Exploited Vulnerabilities catalogue. Also as markdown.

Cite this report

RedTeamDaily, “Exploited Vulnerability Statistics 2026: 1,769 Analysed”, https://redteamdaily.com/research/exploited-vulnerabilities (data as of 6 November 2026).