27 Vendors With the Most Exploited Bugs (2026)

27 vendors have 10 or more vulnerabilities on CISA’s Known Exploited Vulnerabilities list, ranked by number of entries: the median among them is 20, and together they account for 69% of the list. The top three are Microsoft (390), Cisco (102) and Apple (96). Data as of 6 November 2026.

Rank	Vendor	Entries	Known ransomware use
1	Microsoft	390	117 of 390
2	Cisco	102	7 of 102
3	Apple	96	0 of 96
4	Adobe	83	11 of 83
5	Google	76	0 of 76
6	Oracle	46	13 of 46
7	Apache	41	8 of 41
8	Ivanti	38	12 of 38
9	Fortinet	32	14 of 32
10	Linux	32	2 of 32
11	Citrix	27	7 of 27
12	D-Link	26	2 of 26
13	VMware	26	9 of 26
14	SonicWall	20	13 of 20
15	Synacor	19	6 of 19
16	Android	17	0 of 17
17	Palo Alto Networks	16	6 of 16
18	Samsung	15	0 of 15
19	Atlassian	14	8 of 14
20	SAP	14	3 of 14
21	Mozilla	13	1 of 13
22	Zyxel	13	2 of 13
23	Qualcomm	12	0 of 12
24	Trend Micro	12	0 of 12
25	QNAP	11	9 of 11
26	Roundcube	11	0 of 11
27	SolarWinds	11	2 of 11

Source: CISA Known Exploited Vulnerabilities catalogue, as of 6 November 2026. Vendor names as CISA writes them. Methodology · Full report