2026: 270 exploited CVEs added so far
Every number below is computed from CISA's Known Exploited Vulnerabilities catalog and refreshed daily. That's +30% versus the same period of 2025 (207).
Adds per month
2026 against 2025. Hover a month for exact counts.
How urgent, how dangerous
Shares of the 270 entries added in 2026 so far.
145 with ≤ 7 daysto the federal due date. Median window is 3 days.
27 ransomware-linkedCISA marks known use in ransomware campaigns.
29 old CVEsassigned 2021 or earlier, newly confirmed exploited.
Top vendors in 2026
Most KEV additions. R = ransomware-linked. Click a vendor for every entry.
Plus 92 more vendors. See all vendors.
Old bugs, new exploitation
CVEs from 2021 or earlier added in 2026. Patch backlogs matter.
| CVE | Vendor / product | Age |
|---|---|---|
| CVE-2008-0015 | Microsoft Windows | 18y |
| CVE-2008-4128 | Cisco IOS | 18y |
| CVE-2008-4250 | Microsoft Windows | 18y |
| CVE-2009-0238 | Microsoft Office | 17y |
| CVE-2009-0556 | Microsoft Office | 17y |
| CVE-2009-1537 | Microsoft DirectX | 17y |
| CVE-2009-3459 | Adobe Acrobat and Reader | 17y |
| CVE-2010-0249 | Microsoft Internet Explorer | 16y |
| CVE-2010-0806 | Microsoft Internet Explorer | 16y |
| CVE-2012-1854 | Microsoft Visual Basic for Applications (VBA) | 14y |
| CVE-2015-3246 | Red Hat Libuser | 11y |
| CVE-2015-3306 | ProFTPD ProFTPD | 11y |
| CVE-2015-5287 | Red Hat Automatic Bug Reporting Tool | 11y |
| CVE-2015-5477 | ISC BIND | 11y |
| CVE-2016-3081 | Apache Struts | 10y |
Showing the 15 oldest of 29.
Only see the ones that hit your stack.
Pick your vendors. Get a free weekly digest of new KEV entries for just those.
Method: counts use the catalog's dateAdded; "same period" is Jan 1 – 2025-10-21. Due window = dueDate − dateAdded. Data: CISA Known Exploited Vulnerabilities Catalog (CC0). KEV Watch is not affiliated with or endorsed by CISA. Also available as an RSS feed.