Vendor Exploitation Records

Most-exploited vendors (CISA KEV)

Name: Most-exploited vendors (CISA KEV)
Creator: defend.network
License: https://creativecommons.org/licenses/by/4.0/

92 vendors with 3 or more vulnerabilities confirmed exploited in the wild and listed in the CISA Known Exploited Vulnerabilities catalog — 1,498 entries in total. Ranked by KEV count. As of 2026-10-01.

#	Vendor	In KEV	Ransomware
1	Microsoft	389	117
2	Cisco	100	7
3	Apple	95
4	Adobe	82	11
5	Google	75
6	Oracle	46	13
7	Apache	40	8
8	Ivanti	35	12
9	Linux	31	2
10	Fortinet	30	14
11	VMware	29	10
12	Citrix	26	7
13	D-Link	26	2
14	SonicWall	19	13
15	Synacor	19	6
16	Android	17
17	Palo Alto Networks	15	6
18	Samsung	15
19	SAP	14	3
20	Atlassian	13	8
21	Mozilla	13	1
22	Zyxel	13	2
23	QNAP	12	9
24	Qualcomm	12
25	Trend Micro	12
26	Roundcube	11
27	SolarWinds	11	2
28	Arm	9
29	Progress	9	4
30	Red Hat	9	4
31	Zoho	9	2
32	F5	8	4
33	IBM	8	2
34	Juniper	8
35	NETGEAR	8
36	Mitel	7	5
37	Sophos	7	2
38	Jenkins	6	1
39	TP-Link	6
40	WordPress	6
41	Broadcom	5	1
42	Check Point	5	2
43	DrayTek	5
44	Drupal	5	2
45	Exim	5	1
46	GitLab	5	1
47	GNU	5
48	Langflow	5	1
49	MikroTik	5
50	N-able	5
51	PaperCut	5	2
52	RARLAB	5	4
53	Accellion	4	4
54	ConnectWise	4	2
55	Craft CMS	4
56	Fortra	4	2
57	GIGABYTE	4	4
58	Gladinet	4
59	JetBrains	4	4
60	JFrog	4
61	Kentico	4
62	Meta	4	1
63	Nagios	4
64	PHP	4	2
65	Sangoma	4
66	SimpleHelp	4	3
67	Sitecore	4	1
68	Ubiquiti	4
69	Veeam	4	4
70	WatchGuard	4	1
71	Arista	3
72	ASUS	3
73	BerriAI	3
74	BeyondTrust	3	1
75	CrushFTP	3	1
76	Dassault Systèmes	3
77	DotNetNuke (DNN)	3	1
78	Elastic	3
79	ImageMagick	3
80	Kaseya	3	3
81	Laravel	3	1
82	OSGeo	3
83	Qlik	3	3
84	Rails	3
85	Realtek	3
86	SaltStack	3
87	SmarterTools	3	3
88	SysAid	3	1
89	TeleMessage	3
90	Tenda	3
91	TrueConf	3
92	Veritas	3	3

Source: CISA KEV, counted by vendorProject. Only vendors with ≥3 KEV entries are listed. Ransomware column counts entries CISA marks as used in known ransomware campaigns.

Track newly exploited vulnerabilities