What attackers are exploiting right now: vendors ranked by how many of their vulnerabilities CISA confirmed exploited in the wild in the last 90 days. Updated every day, automatically, from CISA’s Known Exploited Vulnerabilities (KEV) catalog (public US government data).

S4+
Microsoft 8Windows
Cisco 6Secure Email Gateway
Citrix 5NetScaler
Linux 5Kernel
Google 4Chromium V8
JFrog 4Artifactory
Plex 4Media Server
A3
Adobe 3Commerce and Magento
Fortinet 3Multiple Products
MikroTik 3RouterOS
N-able 3N-central
B2
Ahsay 2AhsayCBS
Apache 2Struts
Apple 2Multiple Products
Arista 2VeloCloud Orchestrator
Check Point 2Multiple Products
PHP Group 2PHP
PaperCut 2NG/MF
Red Hat 2Automatic Bug Reporting Tool
SonicWall 2SMA1000 Appliances
TrueConf 2Server
Zammad GmbH 2Zammad

As of 2026-10-28. Source: CISA Known Exploited Vulnerabilities catalog (v2026.10.27). Vendors tiered by vulnerabilities CISA confirmed exploited in the last 90 days (104 entries), relative to the most-exploited vendor; 34 vendors with one entry each are not listed. The product under each vendor is its most-hit one.

Most exploited products

KEV additions, last 90 days

  1. Linux Kernel 5
  2. Plex Media Server 4
  3. Citrix NetScaler 4
  4. JFrog Artifactory 4
  5. Adobe Commerce and Magento 3
  6. Microsoft Windows 3
  7. MikroTik RouterOS 3
  8. N-able N-central 3
  9. PHP Group PHP 2
  10. Arista VeloCloud Orchestrator 2

Used by ransomware

vendors with KEV entries tied to ransomware campaigns

  1. Broadcom 1
  2. JetBrains 1

Newest exploited

latest KEV additions

  1. CVE-2026-48356 2026-10-27 Adobe Commerce and Magento
  2. CVE-2026-111497 2026-10-27 Google Brotli
  3. CVE-2026-109619 2026-10-26 PHP Group PHP
  4. CVE-2026-109618 2026-10-26 PHP Group PHP
  5. CVE-2026-114625 2026-10-23 Arista VeloCloud Orchestrator
  6. CVE-2026-110447 2026-10-23 Collabora Collabora Online – Built-in CODE Server
  7. CVE-2026-96656 2026-10-20 Plex Media Server
  8. CVE-2026-96655 2026-10-20 Plex Media Server
  9. CVE-2026-96654 2026-10-20 Plex Media Server
  10. CVE-2026-96652 2026-10-20 Plex Media Server

How to read it

  • A KEV entry is proof of real attacks, not a theoretical bug: CISA adds a vulnerability only with evidence it is being exploited.
  • Big vendors rank high partly because they’re everywhere. A high tier means “patch these first”, not “this vendor is careless”.
  • For a defender: the S tier is the patch-first list. For a researcher: it shows which software attackers find worth the effort, and where the next bugs are likely to be found.
  • Deep dives into notable incidents: threat intel; each day’s new entries: the KEV watch.

Sources