When security products are the attack surface
Of the 1,756 vulnerabilities CISA has confirmed as exploited in the wild, 114 (6.5%) are in security vendors' own products: the firewalls, VPNs and endpoint tools meant to keep attackers out.
38%
of security-vendor KEV entries are known to be used by ransomware
vs 19% for all other vendors
3.5 days
median from CVE publication to confirmed exploitation
vs 8 days for all other vendors*
60%
listed as exploited within a week of publication
vs 49% for all other vendors*
* CVEs published since the KEV catalog launched on Nov 3, 2021 (80 security-vendor and 795 other CVEs). Older CVEs are left out because the launch added a backlog of long-known flaws. How this is measured.
KEV additions per month
Show the data
| Month | KEV added | Security vendors |
|---|---|---|
| 2021-11 | 291 | 19 |
| 2021-12 | 20 | 1 |
| 2022-01 | 40 | 4 |
| 2022-02 | 32 | 0 |
| 2022-03 | 226 | 9 |
| 2022-04 | 45 | 1 |
| 2022-05 | 83 | 0 |
| 2022-06 | 48 | 0 |
| 2022-07 | 3 | 0 |
| 2022-08 | 23 | 2 |
| 2022-09 | 24 | 3 |
| 2022-10 | 12 | 1 |
| 2022-11 | 10 | 0 |
| 2022-12 | 9 | 1 |
| 2023-01 | 5 | 0 |
| 2023-02 | 14 | 1 |
| 2023-03 | 18 | 3 |
| 2023-04 | 17 | 0 |
| 2023-05 | 19 | 1 |
| 2023-06 | 24 | 1 |
| 2023-07 | 16 | 1 |
| 2023-08 | 8 | 0 |
| 2023-09 | 19 | 1 |
| 2023-10 | 18 | 0 |
| 2023-11 | 18 | 1 |
| 2023-12 | 11 | 0 |
| 2024-01 | 21 | 0 |
| 2024-02 | 9 | 1 |
| 2024-03 | 10 | 1 |
| 2024-04 | 10 | 1 |
| 2024-05 | 14 | 1 |
| 2024-06 | 9 | 0 |
| 2024-07 | 14 | 0 |
| 2024-08 | 19 | 0 |
| 2024-09 | 25 | 1 |
| 2024-10 | 17 | 2 |
| 2024-11 | 22 | 5 |
| 2024-12 | 16 | 2 |
| 2025-01 | 14 | 3 |
| 2025-02 | 27 | 5 |
| 2025-03 | 32 | 1 |
| 2025-04 | 15 | 1 |
| 2025-05 | 24 | 2 |
| 2025-06 | 20 | 2 |
| 2025-07 | 20 | 1 |
| 2025-08 | 15 | 1 |
| 2025-09 | 16 | 2 |
| 2025-10 | 31 | 0 |
| 2025-11 | 11 | 3 |
| 2025-12 | 20 | 3 |
| 2026-01 | 17 | 1 |
| 2026-02 | 28 | 2 |
| 2026-03 | 26 | 1 |
| 2026-04 | 31 | 2 |
| 2026-05 | 21 | 3 |
| 2026-06 | 23 | 1 |
| 2026-07 | 26 | 6 |
| 2026-08 | 31 | 0 |
| 2026-09 | 43 | 5 |
| 2026-10 | 26 | 5 |
Security vendors in KEV
| Vendor | KEV entries | Known ransomware use | Products | Most recent |
|---|---|---|---|---|
| Fortinet | 32 | 14 | 10 | Oct 16, 2026 |
| SonicWall | 19 | 13 | 9 | Sep 2, 2026 |
| Palo Alto Networks | 16 | 6 | 2 | Oct 14, 2026 |
| Trend Micro | 12 | 0 | 9 | May 21, 2026 |
| Sophos | 7 | 2 | 6 | Feb 6, 2025 |
| Check Point | 5 | 2 | 4 | Sep 22, 2026 |
| BeyondTrust | 4 | 1 | 3 | Oct 16, 2026 |
| Fortra | 4 | 2 | 2 | Sep 29, 2025 |
| WatchGuard | 4 | 1 | 3 | Dec 19, 2025 |
| Aquasecurity | 1 | 0 | 1 | Mar 26, 2026 |
| Barracuda Networks | 1 | 0 | 1 | May 26, 2023 |
| EG Secure Solutions | 1 | 0 | 1 | Oct 20, 2026 |
| ForgeRock | 1 | 1 | 1 | Nov 3, 2021 |
| Libraesva | 1 | 0 | 1 | Sep 29, 2025 |
| McAfee | 1 | 0 | 1 | Nov 3, 2021 |
| Netwrix | 1 | 1 | 1 | Jul 11, 2023 |
| Pulse Secure | 1 | 0 | 1 | Mar 7, 2022 |
| Symantec | 1 | 0 | 1 | Nov 3, 2021 |
| TeamT5 | 1 | 0 | 1 | Feb 17, 2026 |
| Wazuh | 1 | 0 | 1 | Jun 10, 2025 |
Latest security-vendor additions
| Added | CVE | Vendor | Product | Ransomware | Days from publication |
|---|---|---|---|---|---|
| Oct 20, 2026 | CVE-2026-106931 | EG Secure Solutions | SiteGuard Server Edition | — | 6 |
| Oct 16, 2026 | CVE-2025-61624 | Fortinet | Multiple Products | — | 185 |
| Oct 16, 2026 | CVE-2026-102764 | BeyondTrust | Remote Support | — | 1 |
| Oct 14, 2026 | CVE-2026-0322 | Palo Alto Networks | PAN-OS | — | 0 |
| Oct 1, 2026 | CVE-2026-104286 | Fortinet | FortiMail | — | 0 |
| Sep 22, 2026 | CVE-2026-85102 | Check Point | Multiple Products | — | 13 |
| Sep 22, 2026 | CVE-2026-93616 | Check Point | Multiple Products | — | 0 |
| Sep 9, 2026 | CVE-2025-25249 | Fortinet | Multiple Products | — | 239 |
| Sep 2, 2026 | CVE-2026-83548 | SonicWall | SMA1000 Appliances | — | 1 |
| Sep 2, 2026 | CVE-2026-83549 | SonicWall | SMA1000 Appliances | — | 1 |
| Jul 27, 2026 | CVE-2025-68686 | Fortinet | FortiOS | — | 167 |
| Jul 22, 2026 | CVE-2026-16232 | Check Point | SmartConsole | — | 0 |