| # | Vendor | In KEV | Ransomware |
|---|---|---|---|
| 1 | Microsoft | 386 | 114 |
| 2 | Cisco | 96 | 6 |
| 3 | Apple | 94 | |
| 4 | Adobe | 80 | 10 |
| 5 | 72 | ||
| 6 | Oracle | 46 | 13 |
| 7 | Apache | 40 | 8 |
| 8 | Ivanti | 35 | 12 |
| 9 | Fortinet | 29 | 14 |
| 10 | VMware | 29 | 10 |
| 11 | Linux | 28 | 2 |
| 12 | D-Link | 26 | 2 |
| 13 | Citrix | 23 | 7 |
| 14 | Synacor | 19 | 5 |
| 15 | Android | 17 | |
| 16 | SonicWall | 17 | 13 |
| 17 | Palo Alto Networks | 15 | 6 |
| 18 | Samsung | 15 | |
| 19 | SAP | 14 | 3 |
| 20 | Atlassian | 13 | 8 |
| 21 | Mozilla | 13 | 1 |
| 22 | QNAP | 12 | 9 |
| 23 | Qualcomm | 12 | |
| 24 | Trend Micro | 12 | |
| 25 | Zyxel | 12 | 2 |
| 26 | Roundcube | 11 | |
| 27 | SolarWinds | 11 | 2 |
| 28 | Arm | 9 | |
| 29 | Progress | 9 | 4 |
| 30 | Red Hat | 9 | 4 |
| 31 | Zoho | 9 | 2 |
| 32 | IBM | 8 | 2 |
| 33 | Juniper | 8 | |
| 34 | NETGEAR | 8 | |
| 35 | F5 | 7 | 4 |
| 36 | Mitel | 7 | 5 |
| 37 | Sophos | 7 | 2 |
| 38 | Jenkins | 6 | 1 |
| 39 | TP-Link | 6 | |
| 40 | Broadcom | 5 | |
| 41 | DrayTek | 5 | |
| 42 | Drupal | 5 | 2 |
| 43 | Exim | 5 | 1 |
| 44 | GNU | 5 | |
| 45 | Langflow | 5 | 1 |
| 46 | RARLAB | 5 | 4 |
| 47 | WordPress | 5 |
Source: CISA KEV, counted by vendorProject. Only vendors with ≥5 KEV entries are listed. Ransomware column counts entries CISA marks as used in known ransomware campaigns.