Vendor History
What does it mean when your vendor is on CISA's KEV list?
Updated
CISA's Known Exploited Vulnerabilities (KEV) catalog is the US government's list of software flaws that attackers are known to be using. If a product you use has a flaw on the list, install the fix. A listing does not mean the vendor itself was hacked. In the 12 months to Oct 26, 2026, CISA added 190 flaws in products from 36 of the 112 vendors Vendor History tracks. Microsoft (42), Cisco (20) and Google (13) had the most.
How a flaw gets on the list
CISA, the US Cybersecurity and Infrastructure Security Agency, adds a flaw only when three things are true (CISA):
- The flaw has a CVE ID, the public tracking number security flaws get.
- There is reliable evidence that attackers are actively using it.
- There is a clear way to fix it, such as an update from the vendor.
Each entry names the vendor and product, the date CISA added it and a required action. In CISA's catalog of Oct 23, 2026, the most common required action was "Apply updates per vendor instructions." Some entries add "or discontinue use of the product if mitigations are unavailable" (KEV catalog). CISA also marks whether a flaw is known to be used in ransomware campaigns.
What a listing means, and what it doesn't
A listing means attackers have used that flaw against real systems. If you run the product and haven't installed the fix, you're open to an attack that's already known to work.
It doesn't mean the vendor was breached or that your data was taken. That would show up as a breach notice or an SEC filing, which Vendor History tracks separately.
The counts aren't a safety ranking either. A company that makes lots of widely used products has more chances to show up. Read a high count as "you'll be installing a lot of updates," not as a grade for the company.
Which vendors had the most flaws added this year
This table is rebuilt from CISA's catalog every day. Each vendor links to its page, which lists every flaw with a link to its public record.
| Vendor | Last 12 months | Of those, CISA says used in ransomware | All time (since Nov 2021) |
|---|---|---|---|
| Microsoft (Microsoft 365, Windows) | 42 | 4 | 390 |
| Cisco | 20 | 2 | 101 |
| Google (Workspace, Chrome, Android) | 13 | 0 | 92 |
| Fortinet | 12 | 0 | 32 |
| Apple | 10 | 0 | 95 |
| Adobe | 6 | 0 | 82 |
| Citrix | 6 | 0 | 27 |
| Ivanti | 6 | 0 | 36 |
| Oracle | 5 | 1 | 46 |
| SonicWall | 5 | 2 | 19 |
| Zimbra (Synacor) | 5 | 0 | 19 |
| Check Point | 4 | 1 | 5 |
| SolarWinds | 4 | 1 | 11 |
| VMware (Broadcom) | 4 | 1 | 34 |
| Gladinet (CentreStack) | 3 | 0 | 4 |
See firewalls, VPNs and routers and IT management, remote access and backup for the kinds of products most small businesses install themselves.
Who has to act on the list
US federal civilian agencies must fix flaws on the list by set deadlines. That rule is now Binding Operational Directive 26-04, issued June 10, 2026, which replaced BOD 22-01 from Nov 3, 2021. Private businesses don't have to follow it, but CISA "strongly recommends all organizations review and monitor the KEV catalog" (CISA).
What a small business can do
- List the products you install and update yourself. Firewalls, VPNs, remote access tools, file transfer servers, email servers and phone systems. These are the products you have to keep updated yourself.
- Look up each vendor here. Search all vendors and open the flaws section on each page.
- Ask whoever runs your IT whether the fixes for those flaws are installed. If a product is too old to get updates, plan to replace it.
- Turn on automatic updates wherever the product offers them.
This is general information, not security advice for your setup. A flaw being on CISA's list doesn't tell you whether your copy of the product is affected. Check the vendor's notice for the versions involved.