# Exploited Vulnerability Statistics 2026: 1,769 Analysed

1,769 actively exploited vulnerabilities on CISA’s KEV list as of 6 November 2026; 20% linked to ransomware; Microsoft has the most (390).

## Key findings

- CISA’s Known Exploited Vulnerabilities (KEV) catalogue lists 1,769 vulnerabilities with evidence of exploitation in real attacks, as of 6 November 2026. [Link](https://redteamdaily.com/research/exploited-vulnerabilities#total)
- 361 of 1,769 vulnerabilities on CISA’s KEV list (20%) are known to have been used in ransomware campaigns. [Link](https://redteamdaily.com/research/exploited-vulnerabilities#ransomware)
- Microsoft has the most entries on CISA’s KEV list: 390 of 1,769 (22%), followed by Cisco (102) and Apple (96). [Link](https://redteamdaily.com/research/exploited-vulnerabilities#top-vendor)
- The 5 vendors with the most entries (Microsoft, Cisco, Apple, Adobe and Google) account for 747 of 1,769 KEV vulnerabilities (42%); the other 1,022 come from 286 vendors. [Link](https://redteamdaily.com/research/exploited-vulnerabilities#top-five)
- 30% of Microsoft’s KEV entries (117 of 390) are known to have been used in ransomware, higher than the 20% across the whole list. [Link](https://redteamdaily.com/research/exploited-vulnerabilities#top-vendor-ransomware)
- CISA added 285 vulnerabilities to the KEV list in 2026 up to 6 November 2026, more than the 216 it had added by the same date in 2025 (245 in all of 2025). [Link](https://redteamdaily.com/research/exploited-vulnerabilities#this-year)

## Vendors with the most entries

| Vendor | Entries | Share of list | Known ransomware use |
| --- | ---: | ---: | ---: |
| Microsoft | 390 | 22% | 117 of 390 |
| Cisco | 102 | 6% | 7 of 102 |
| Apple | 96 | 5% | 0 of 96 |
| Adobe | 83 | 5% | 11 of 83 |
| Google | 76 | 4% | 0 of 76 |
| Oracle | 46 | 3% | 13 of 46 |
| Apache | 41 | 2% | 8 of 41 |
| Ivanti | 38 | 2% | 12 of 38 |
| Fortinet | 32 | 2% | 14 of 32 |
| Linux | 32 | 2% | 2 of 32 |
| Citrix | 27 | 2% | 7 of 27 |
| D-Link | 26 | 1% | 2 of 26 |
| VMware | 26 | 1% | 9 of 26 |
| SonicWall | 20 | 1% | 13 of 20 |
| Synacor | 19 | 1% | 6 of 19 |
| Android | 17 | 1% | 0 of 17 |
| Palo Alto Networks | 16 | 1% | 6 of 16 |
| Samsung | 15 | 1% | 0 of 15 |
| Atlassian | 14 | 1% | 8 of 14 |
| SAP | 14 | 1% | 3 of 14 |
| Mozilla | 13 | 1% | 1 of 13 |
| Zyxel | 13 | 1% | 2 of 13 |
| Qualcomm | 12 | 1% | 0 of 12 |
| Trend Micro | 12 | 1% | 0 of 12 |
| QNAP | 11 | 1% | 9 of 11 |

Full ranking: https://redteamdaily.com/research/exploited-vulnerabilities/vendors

## Added per year

| Year | Added |
| --- | ---: |
| 2026 | 285 |
| 2025 | 245 |
| 2024 | 186 |
| 2023 | 187 |
| 2022 | 555 |
| 2021 | 311 |


## Methodology

- Source: the US Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalogue (public domain), downloaded by RedTeamDaily every day. Entries CISA removes are taken out on the next download.
- Severity: the base score the US National Vulnerability Database (NVD) gives each CVE, using the newest CVSS version it has (4.0, 3.1 or 3.0). Entries NVD has not scored are left out of the severity figures only.
- Ransomware: CISA’s own “known ransomware campaign use” field. “Unknown” means CISA has no evidence, not that it never happened.
- Vendors: CISA’s vendor names, grouped regardless of capital letters and spacing. A company that appears under two different names (for example after a takeover) is counted under each name, as CISA lists it.
- Coverage: a CVE counts as covered when a published RedTeamDaily story names it. Counted only for entries CISA added since our first story.
- Thin data: a finding with fewer than 20 entries behind it is not stated, and severity only when at least half the list has an NVD score. Shares are rounded to whole per cent, so they may not add up to exactly 100.
- Updated: the date shown is the newest date CISA added an entry, not the date this page was built.

## Cite this

RedTeamDaily, “Exploited Vulnerability Statistics 2026: 1,769 Analysed”, https://redteamdaily.com/research/exploited-vulnerabilities (data as of 6 November 2026).