Vendor Exploitation Records

Most-exploited vendors (CISA KEV)

Name: Most-exploited vendors (CISA KEV)
Creator: defend.network
License: https://creativecommons.org/licenses/by/4.0/

89 vendors with 3 or more vulnerabilities confirmed exploited in the wild and listed in the CISA Known Exploited Vulnerabilities catalog — 1,458 entries in total. Ranked by KEV count. As of 2026-09-04.

#	Vendor	In KEV	Ransomware
1	Microsoft	386	114
2	Cisco	96	6
3	Apple	94
4	Adobe	80	10
5	Google	72
6	Oracle	46	13
7	Apache	40	8
8	Ivanti	35	12
9	Fortinet	29	14
10	VMware	29	10
11	Linux	28	2
12	D-Link	26	2
13	Citrix	23	7
14	SonicWall	19	13
15	Synacor	19	5
16	Android	17
17	Palo Alto Networks	15	6
18	Samsung	15
19	SAP	14	3
20	Atlassian	13	8
21	Mozilla	13	1
22	QNAP	12	9
23	Qualcomm	12
24	Trend Micro	12
25	Zyxel	12	2
26	Roundcube	11
27	SolarWinds	11	2
28	Arm	9
29	Progress	9	4
30	Red Hat	9	4
31	Zoho	9	2
32	IBM	8	2
33	Juniper	8
34	NETGEAR	8
35	F5	7	4
36	Mitel	7	5
37	Sophos	7	2
38	Jenkins	6	1
39	TP-Link	6
40	Broadcom	5
41	DrayTek	5
42	Drupal	5	2
43	Exim	5	1
44	GNU	5
45	Langflow	5	1
46	PaperCut	5	2
47	RARLAB	5	4
48	WordPress	5
49	Accellion	4	4
50	Craft CMS	4
51	Fortra	4	2
52	GIGABYTE	4	4
53	GitLab	4	1
54	Gladinet	4
55	JetBrains	4	3
56	Kentico	4
57	Meta	4	1
58	N-able	4
59	Nagios	4
60	PHP	4	2
61	Sangoma	4
62	SimpleHelp	4	3
63	Sitecore	4	1
64	Ubiquiti	4
65	Veeam	4	4
66	WatchGuard	4
67	ASUS	3
68	BerriAI	3
69	BeyondTrust	3	1
70	Check Point	3	2
71	ConnectWise	3	2
72	CrushFTP	3	1
73	Dassault Systèmes	3
74	DotNetNuke (DNN)	3	1
75	Elastic	3
76	ImageMagick	3
77	Kaseya	3	3
78	Laravel	3	1
79	OSGeo	3
80	Qlik	3	3
81	Rails	3
82	Realtek	3
83	SaltStack	3
84	SmarterTools	3	3
85	SysAid	3	1
86	TeleMessage	3
87	Tenda	3
88	TrueConf	3
89	Veritas	3	3

Source: CISA KEV, counted by vendorProject. Only vendors with ≥3 KEV entries are listed. Ransomware column counts entries CISA marks as used in known ransomware campaigns.

Track newly exploited vulnerabilities