Security data
CISA KEV Statistics: Due Dates Under BOD 26-04, Ransomware Use and Time to Listing
How fast CISA lists exploited flaws, how BOD 26-04 cut the time agencies get to fix them, and which vendors dominate the KEV catalogue. Counts update with every sync; merged CSV and JSON free to reuse.
Data status: a source is stale
Last synced CISA catalogue version 2026.11.04 (released 4 November 2026) 1,768 entries Updated manually
- NVD: incremental pull 5 Nov 11:38 UTC
- EPSS: scores of 2026-11-04
- CISA schema: stale, catalogue checked against the copy of 4 Nov
- CISA SSVC: 5 Nov 11:38 UTC
At the last sync, on 5 November 2026, the CISA Known Exploited Vulnerabilities catalogue held 1,768 entries: catalogue version 2026.11.04, released on 4 November 2026 S01. The figures below are recomputed from the catalogue at every sync, together with NVD, EPSS and CISA SSVC data for each entry S03 S04 S05.
Since BOD 26-04 took effect on 10 June 2026, 79 percent of new KEV entries (120 of 151) carry a 3-day due date. Of the entries added from 2022 to 9 June 2026, 78 percent had 21 days S01 S06 derived.
20.4 percent of KEV entries (361 of 1,768) are known to have been used in ransomware campaigns S01.
Open the tracker Every entry with CVSS, EPSS, CISA SSVC and its BOD 26-04 window. Filters run in your browser.
What BOD 26-04 changed
On 10 June 2026 CISA issued Binding Operational Directive 26-04 and revoked BOD 22-01, the directive that created the KEV catalogue in 2021 S06. Under BOD 26-04 the due date follows a table with three questions S06. Can an adversary automate the exploit? Does it give total or partial control of the asset? Is the asset publicly exposed? CISA sets each KEV due date from that table, using its own SSVC answers and its own evidence of exposure S07.
Of the 151 entries CISA added from 10 June 2026 to 5 November 2026, 120 (79 percent) carry a due date 3 days after the date added S01 derived. Another 31 carry 14 days. 97 of the 151 also require a forensic triage under BOD 26-04, on top of the 3-day remediation S01 S06. Before that, from 1 January 2022 to 9 June 2026, CISA added 1,306 entries. 1,025 of them (78 percent) had 21 days and 143 had 14 S01 derived. The median window fell from 21 days to 3 derived.
The due dates bind US federal civilian executive branch agencies only S06. For anyone else they are CISA's own reading of urgency. The same table can be applied to your assets: the tracker shows, for every entry, the window BOD 26-04 would set on an internet-facing system and on an internal one.
- BOD 26-04 revoked BOD 22-01. CISA now sets each due date from its SSVC answers (Automatable, Technical Impact) and its view of whether the flaw sits on publicly exposed assets.
- Due dates bind US federal civilian executive branch agencies only.
| Automatable by an adversary | Technical impact | Publicly exposed asset | Not publicly exposed | KEV entries with these SSVC answers |
|---|---|---|---|---|
| Yes | Total control | 3 days and forensic triage (row 1) | 3 days and forensic triage (row 9) | 576 |
| Yes | Partial control | 3 days (row 2) | 14 days (row 10) | 143 |
| No | Total control | 3 days and forensic triage (row 3) | 14 days (row 11) | 905 |
| No | Partial control | 14 days (row 4) | 14 days (row 12) | 144 |
Read across, 1,624 of the 1,768 KEV entries with CISA SSVC answers (92 percent) would get 3 days on a publicly exposed asset derived. The table's rows 5 to 8 and 13 to 16 cover CVEs that are not in the KEV and are left out here. Days are calendar days and run from the date CISA adds the entry or the date the agency finds the flaw, whichever comes first S06.
How fast exploited flaws reach the catalogue
For the 1,457 entries added since 1 January 2022 that have an NVD record, the median time from NVD publication to the KEV listing is 152 days S01 S03 derived. That median hides two populations: CVEs exploited soon after disclosure, and old CVEs CISA lists when it finds fresh evidence. The yearly medians show the shift. 2022: 1,436 days, 2023: 12 days, 2024: 22 days, 2025: 26 days, 2026: 14 days derived.
Of the 284 entries added in 2026 that have an NVD record, 117 (41 percent) were listed 0 to 7 days after NVD published them, and 4 before NVD published them derived. Across the whole catalogue, 66 entries were listed before NVD published the CVE at all derived. The opening load of 3 November 2021, when CISA listed 287 CVEs on one day, is left out of the chart.
- Median for all entries added since 2022: 152 days. Median for 2026: 14 days (284 entries). Medians are rounded to whole days, halves up.
- The opening load of November 2021 is left out: it listed old CVEs in bulk.
- A CVE can be listed before NVD publishes it, when CISA adds it on the vendor's advisory.
Additions over time
CISA added 284 entries in 2026 up to 5 November 2026, against 245 in all of 2025 S01. By year: 2021: 311, 2022: 555, 2023: 187, 2024: 186, 2025: 245, 2026: 284. In the 30 days to the last sync it added 34, and 4 in the last 7 S01.
- The catalogue opened with 291 entries in November 2021. Busiest month since: March 2022, 226 entries.
- Every month before the current one had at least one addition. November 2026 is partial, to the sync of 5 November 2026.
Vendors
Microsoft has the most entries, 390 of 1,768 (22.1 percent) S01 derived. The ten largest vendors account for 52.9 percent of the catalogue, out of 291 vendor names in all derived. Vendor names are exactly as CISA writes them: Android and Google are separate entries, as are some product lines that share an owner. Vendors with 10 or more entries (27 of them) have their own page.
- Microsoft 390
- Cisco 102
- Apple 96
- Adobe 83
- Google 76
- Oracle 46
- Apache 41
- Ivanti 38
- Fortinet 32
- Linux 32
- Citrix 27
- D-Link 26
- VMware 26
- SonicWall 19
- Synacor 19
- Android 17
- Palo Alto Networks 16
- Samsung 15
- Atlassian 14
- SAP 14
- Mozilla 13
- Zyxel 13
- Qualcomm 12
- Trend Micro 12
- QNAP 11
- Roundcube 11
- SolarWinds 11
- The top 10 vendors account for 52.9 percent of the catalogue. 291 vendor names appear in all.
- CISA lists Android separately from Google; the chart keeps the catalogue's names.
Severity and exploit probability
Of the 1,768 entries with an NVD CVSS score, 36 percent are rated critical (9.0 or more) and 203 (11 percent) score below 7.0 S03 derived. A patch policy that starts at "high" would leave those 203 known exploited flaws for later. EPSS tells a similar story. 25 percent of KEV entries have an EPSS probability under 10 percent, scored on 2026-11-04 S04 derived. The median is 53.5 percent. EPSS predicts exploitation in the next 30 days; a KEV entry has already been exploited, so the two measure different things.
CISA's SSVC answers are what BOD 26-04 actually uses S06. 1,768 entries have a CISA SSVC record S03 S05. 719 of them are rated automatable, and 1,481 give an attacker total control of the asset derived.
Methodology
What runs. A sync (tools/kev_sync.py) downloads the CISA catalogue JSON S01 and validates it against CISA's JSON Schema S02. It stops and keeps the last good data when any check fails: schema validation, a count that matches the entries, unique CVE IDs, real dates, a count drop of no more than 2 percent, and a catalogue version that never goes backwards. It then reads every KEV CVE from the NVD CVE API 2.0 S03: a full pull at least weekly and only changed records in between. It reads EPSS scores for every entry from FIRST S04. CISA's SSVC answers come from the CISA ADP record NVD carries, or from CISA's vulnrichment repository where NVD has none yet S05. If NVD, EPSS or SSVC cannot be reached, the catalogue still updates and the older values stay, marked stale with the time they were fetched.
When. Updated manually. Last sync 5 November 2026, 11:38 UTC, catalogue version 2026.11.04, released by CISA on 4 November 2026. Every date on these pages that depends on "today" (overdue, due soon, new this week) is measured against the sync date, not the day you read it.
Fields. KEV fields are shown exactly as CISA publishes them, punctuation included. CVSS is the newest version NVD holds for the CVE (4.0, then 3.1, 3.0, 2.0), the primary score where there are several. Its scorer is shown as NVD names it: often NVD, sometimes the CVE Numbering Authority. Vendor advisory and patch links are only the references NVD tags Vendor Advisory or Patch, plus the links in CISA's notes field. They are shown exactly as published, with NVD's Broken Link tag beside a link when present. No vendor URL is written or guessed by Sysprobs.
Derived figures. Days from date added to due date are dueDate minus dateAdded. Days to listing are dateAdded minus the NVD published date, in UTC calendar days. Shares are counts divided by the stated base, rounded to whole percent; shares of the whole catalogue (ransomware use, vendors) keep one decimal. Medians of an even count are the mean of the two middle values; medians of days are rounded to whole days, halves up. EPSS and its percentile are truncated, never rounded: FIRST's 0.563 shows as 56.30 percent on a CVE page and 56.3 percent in the tables, and 0.99999 never shows as 100.
Limits. The KEV lists flaws that meet CISA's criteria for evidence of exploitation; it is not every exploited CVE. EPSS is a probability, not a severity, and changes daily S04. NVD can lag, show a CVE as awaiting analysis, or carry a CVSS score from the vendor rather than NVD S03. Known ransomware use is Known or Unknown; Unknown means CISA lacks confirmation S02. BOD 26-04 due dates bind US federal civilian executive branch agencies only S06, and an agency's own exposure answer can change the window for its assets.
This product uses data from the NVD API but is not endorsed or certified by the NVD. Source: CISA Known Exploited Vulnerabilities Catalog. CISA does not endorse Sysprobs or this compilation.
Frequently asked questions
What is the CISA KEV catalogue?
The Known Exploited Vulnerabilities catalogue is CISA's list of CVEs it has evidence of being exploited in the wild S08. Each entry names the vendor, product and date added S01. It also gives a due date for US federal agencies, the required action, and whether the flaw is known to have been used in ransomware campaigns S01. CISA asks every organisation to use it as an input to prioritisation S08. It does not list every exploited CVE, only those that meet CISA's criteria.
Do the KEV due dates apply to me?
Only if you are a US federal civilian executive branch agency. The due dates are set under Binding Operational Directive 26-04, which binds those agencies S06. Since 10 June 2026 it replaces BOD 22-01 S06. For everyone else the due date is a useful benchmark. CISA sets it from how easily the flaw can be exploited at scale, how much control an attacker gains, and whether it sits on internet-facing systems S07. A 3-day due date means CISA judged it among the most urgent.
How often is this tracker updated?
Each sync reads the CISA catalogue, validates it against CISA's schema, then pulls NVD, EPSS and CISA SSVC data S01 S02 S03 S04. The page shows the exact time of the last sync and the catalogue version it read, both taken from the sync itself, not from the build. Until a scheduled job has run successfully on its own, the page says it is updated manually. CISA can add entries on any working day, so check CISA's own catalogue for anything urgent S08.
What does known ransomware use mean?
Known means CISA knows the flaw has been used as part of a ransomware campaign. Unknown means CISA lacks confirmation; it does not mean ransomware groups have not used it S02.
What is the difference between EPSS and CVSS?
CVSS measures how severe a flaw is if exploited, from 0 to 10. EPSS estimates the probability that a CVE will be exploited in the wild in the next 30 days, from 0 to 1, with a percentile against all scored CVEs S04. Every KEV entry is already exploited, so a low EPSS score does not make a KEV flaw safe to ignore. CISA's SSVC answers (Automatable, Technical Impact) are the inputs BOD 26-04 uses to set due dates S06.
Sources
Every figure on this page carries a key that links to an entry below. For the live feeds, Retrieved is the time of the last sync that read them successfully; for the directive pages it is the date they were read for this page. Hub-wide rules are on the methodology page.
S01 Cybersecurity and Infrastructure Security Agency (CISA), Known Exploited Vulnerabilities Catalog, JSON feed (cisa.gov)
- Note
- Authoritative for every KEV field on these pages: vendor, product, name, date added, due date, ransomware use, forensic triage, required action, notes. Validated against S02 at every sync. US government work.
- Sponsor
- none stated
- Published
- continuously updated
- Retrieved
- 2026-11-05 11:38 UTC, at the last sync
- Verbatim
"title": "CISA Catalog of Known Exploited Vulnerabilities"
S02 Cybersecurity and Infrastructure Security Agency (CISA), Known Exploited Vulnerabilities Catalog, JSON Schema (cisa.gov)
- Sponsor
- none stated
- Published
- updated 2026-09-02 (as listed on the S08 page)
- Retrieved
- 2026-11-04 12:05 UTC, stale: not fetched at the last sync
Known ransomware campaign use: Known or Unknown.
- Verbatim
'Known' if this vulnerability is known to have been leveraged as part of a ransomware campaign; 'Unknown' if CISA lacks confirmation that the vulnerability has been utilized for ransomware
Forensic triage: Yes or No.
- Verbatim
'Yes' if this vulnerability requires forensic triage per BOD 26-04; 'No' if forensic triage is not required per BOD 26-04
S03 National Institute of Standards and Technology (NIST), National Vulnerability Database, NVD CVE API 2.0 (hasKev) (nvd.nist.gov)
- Note
- NVD published date, status, CVSS (newest version present, primary scorer first), CWE, references tagged Vendor Advisory or Patch, and CISA ADP SSVC as NVD carries it. This product uses data from the NVD API but is not endorsed or certified by the NVD.
- Sponsor
- none stated
- Published
- documentation updated 2025-02-25
- Retrieved
- 2026-11-05 11:38 UTC, at the last sync
- Verbatim
The CVE API is used to easily retrieve information on a single CVE or a collection of CVE from the NVD.
S04 Forum of Incident Response and Security Teams (FIRST), Exploit Prediction Scoring System (EPSS) API (first.org)
- Sponsor
- none stated
- Published
- continuously updated
- Retrieved
- 2026-11-05 11:38 UTC, at the last sync
EPSS is a probability of exploitation in the next 30 days, not a severity.
- Verbatim
estimates the probability that a published CVE will be exploited in the wild in the next 30 days
S05 Cybersecurity and Infrastructure Security Agency (CISA), Vulnrichment (CISA ADP SSVC and CVSS records) (github.com)
- Note
- Used only for a KEV entry whose NVD record carries no CISA ADP SSVC answer. A missing file means no CISA SSVC record; nothing is guessed.
- Sponsor
- none stated
- Published
- continuously updated
- Retrieved
- 2026-11-05 11:38 UTC, at the last sync
- Verbatim
The CISA Vulnrichment project is the public repository of CISA's enrichment of public CVE records through CISA's ADP (Authorized Data Publisher) container.
S06 Cybersecurity and Infrastructure Security Agency (CISA), BOD 26-04: Prioritizing Security Updates Based on Risk (cisa.gov)
- Sponsor
- none stated
- Published
- 2026-06-10
- Retrieved
- 2026-11-03
BOD 26-04 revoked BOD 22-01, which created the KEV catalogue in 2021.
- Verbatim
This Directive supersedes and hereby revokes ... BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities (Nov. 3, 2021).
A Binding Operational Directive binds federal executive branch departments and agencies.
- Verbatim
A Binding Operational Directive is a compulsory direction to federal, executive branch, departments, and agencies
Table 1 is an image on the page. Its KEV rows, cell by cell (row, publicly exposed, in the KEV, automatable, technical impact, timeline), transcribed for the tracker's BOD 26-04 window.
- Verbatim
1 Yes Yes Yes Total control 3 days & forensic triage; 2 Yes Yes Yes Partial control 3 days; 3 Yes Yes No Total control 3 days & forensic triage; 4 Yes Yes No Partial control 14 days; 9 No Yes Yes Total control 3 days & forensic triage; 10 No Yes Yes Partial control 14 days; 11 No Yes No Total control 14 days; 12 No Yes No Partial control 14 days
Timelines start when CISA adds the vulnerability to the KEV, or when the agency finds it, whichever comes first.
- Verbatim
The timelines defined in Table 1 begin when either (1) CISA adds the vulnerability to the KEV Catalog, or (2) ... Whichever event occurs first starts the remediation timeline.
S07 Cybersecurity and Infrastructure Security Agency (CISA), BOD 26-04: Implementation Guidance for Prioritizing Security Updates Based on Risk (cisa.gov)
- Sponsor
- none stated
- Published
- 2026-06-10 (updated 2026-08-25)
- Retrieved
- 2026-11-03
The KEV dueDate is set from the BOD 26-04 timeline table, with CISA's own view of public exposure.
- Verbatim
CISA calculates the due date according to the Vulnerability Response Timeline Table using available data to determine whether there is evidence that the vulnerability is present in a publicly exposed asset.
Example: exposed, total control and automatable gives a 3-day due date.
- Verbatim
if CISA determines that the vulnerability is present in a publicly exposed asset, the technical impact is total, and that it is automatable by an adversary, the KEV’s due date will reflect a 3-day patching deadline.
S08 Cybersecurity and Infrastructure Security Agency (CISA), Known Exploited Vulnerabilities Catalog (web page) (cisa.gov)
- Sponsor
- none stated
- Published
- not stated
- Retrieved
- 2026-11-03
CISA describes the catalogue as an input to prioritisation.
- Verbatim
Organizations should use the KEV catalog as an input to their vulnerability management prioritization framework.
Figures marked derived are computed from the catalogue and the sources beside them at every sync; each formula is stated in the methodology section.
Cite this page
Data on this page is published under CC BY 4.0. Use any figure, chart or table with a link back to this page.
- Plain text
Sysprobs Data (2026). CISA KEV Statistics: Due Dates Under BOD 26-04, Ransomware Use and Time to Listing. Edited by Dinesh Kumar. https://sysprobs.com/data/cisa-kev-tracker/ (updated 5 November 2026, accessed [date accessed]).- HTML
- APA
Sysprobs Data. (2026, November 5). CISA KEV Statistics: Due Dates Under BOD 26-04, Ransomware Use and Time to Listing. Retrieved [date accessed], from https://sysprobs.com/data/cisa-kev-tracker/
Quoting one figure: name CISA as the source of the catalogue, and NVD, FIRST or CISA SSVC for a score, then link here. The source panel above gives the publisher, the retrieval time and a verbatim line for every key.
Changelog
- : First version: tracker, per-CVE and per-vendor pages, charts, CSV and JSON downloads, RSS feed and widget. Catalogue changes from each sync are listed on the tracker page.