LiveActive security incident?Get immediate response
Reproducible vulnerability research

CISA KEV exposure brief

Current product, severity, and update signals from source-normalized Known Exploited Vulnerability records.

Browse current KEVVulnerability management
1,722published KEV records in the searchable library
100most recent records in this reproducible view
42critical records in the current sample
8.8median available CVSS in the current sample

What the current sample shows

Known exploitation is the primary signal: CVSS helps explain technical severity but should not replace CISA remediation due dates, asset exposure, compensating controls, or business criticality.

  • high: 43 records
  • critical: 42 records
  • medium: 13 records
  • low: 2 records

Most frequently represented vendors

  1. Microsoft — 252 affected-product references
  2. n/a — 25 affected-product references
  3. ZyXEL — 13 affected-product references
  4. QNAP Systems Inc. — 10 affected-product references
  5. Ivanti — 8 affected-product references
  6. Cisco — 6 affected-product references
  7. NetScaler — 6 affected-product references
  8. Fortinet — 4 affected-product references
  9. Facebook — 3 affected-product references
  10. Meta — 3 affected-product references

Counts describe source records, not installed assets or vendor risk. Product naming differences can split or combine labels.

Recently updated KEV records

Methodology and limitations

  1. Select published records carrying a normalized CISA KEV signal.
  2. Order the public query by the library's current relevance and recency behavior and cap the visible aggregate at 100 records.
  3. Count only explicit normalized severity and affected-vendor fields; missing values are not inferred.
  4. Link every surfaced record to its source-attributed detail page and preserve CISA/CVE citations.

This brief is not an asset-specific remediation list. Validate affected versions, vendor advisories, CISA due dates, exposure, and compensating controls before prioritizing work.