Vendor exploitation scorecard
Every vendor with 3 or more CVEs on CISA's Known Exploited Vulnerabilities catalog, ranked by KEV additions in the last 12 months. "Days to KEV" is how long after NVD published a CVE that CISA listed it as exploited. Repeat products are product families with 3+ exploited CVEs.
| # | Vendor | KEV, 12 mo | KEV, all time | Ransomware use | Median days to KEV | On KEV within 7d | Repeat products |
|---|---|---|---|---|---|---|---|
| 1 | Microsoft | 43 | 391 | 117 | — (n=4) | — | Windows (172), Internet Explorer (36), Office (29), Win32k (25) |
| 2 | Cisco | 20 | 101 | 7 | — (n=4) | — | IOS and IOS XE (21), IOS (12), Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) (10), Catalyst SD-WAN Manager (6) |
| 3 | Fortinet | 12 | 32 | 14 | — | — | FortiOS (9), FortiOS and FortiProxy (6), FortiClient EMS (3), FortiWeb (3) |
| 4 | Apple | 10 | 95 | — | — (n=1) | — | iOS, iPadOS, and macOS (11), iOS (8), macOS (6), iOS and iPadOS (5) |
| 5 | 10 | 75 | — | — (n=2) | — | Chromium V8 (40), Chromium (6), Chromium Blink (3) | |
| 6 | Linux | 8 | 31 | 2 | — | — | Kernel (31) |
| 7 | Adobe | 7 | 82 | 11 | — (n=2) | — | Flash Player (33), Acrobat and Reader (21), ColdFusion (16), Commerce and Magento Open Source (5) |
| 8 | Ivanti | 6 | 36 | 12 | — (n=1) | — | Connect Secure (14), Endpoint Manager Mobile (EPMM) (8), Cloud Services Appliance (CSA) (5), Endpoint Manager (EPM) (5) |
| 9 | Citrix | 6 | 27 | 7 | — (n=4) | — | NetScaler ADC and NetScaler Gateway (12), Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance (4) |
| 10 | Oracle | 5 | 46 | 13 | — | — | Java SE (13), WebLogic Server (13), Fusion Middleware (6), E-Business Suite (4) |
| 11 | SonicWall | 5 | 19 | 13 | — (n=2) | — | SMA100 Appliances (6), SMA1000 Appliances (4), Email Security (3), SonicOS (3) |
| 12 | Synacor | 5 | 19 | 6 | — (n=1) | — | Zimbra Collaboration Suite (ZCS) (19) |
| 13 | SolarWinds | 4 | 11 | 2 | — | — | Web Help Desk (5), Serv-U (4) |
| 14 | Check Point | 4 | 5 | 2 | — (n=2) | — | — |
| 15 | Langflow | 4 | 5 | 1 | — | — | Langflow (5) |
| 16 | Plex | 4 | 5 | — | — (n=4) | — | Media Server (5) |
| 17 | JFrog | 4 | 4 | — | — (n=1) | — | Artifactory (4) |
| 18 | Apache | 3 | 41 | 8 | — | — | Struts (9), Tomcat (6), HTTP Server (4), ActiveMQ (3) |
| 19 | Android | 3 | 17 | — | — | — | Framework (6), Kernel (5), Pixel (4) |
| 20 | Palo Alto Networks | 3 | 16 | 6 | — | — | PAN-OS (13), Expedition (3) |
| 21 | WordPress | 3 | 6 | — | — (n=1) | — | Core (3) |
| 22 | GitLab | 3 | 5 | 1 | — (n=1) | — | CE/EE (3) |
| 23 | MikroTik | 3 | 5 | — | — (n=3) | — | RouterOS (5) |
| 24 | N-able | 3 | 5 | — | — (n=1) | — | N-central (3) |
| 25 | Broadcom | 3 | 4 | — | — | — | — |
| 26 | Gladinet | 3 | 4 | — | — | — | — |
| 27 | Sangoma | 3 | 4 | — | — (n=1) | — | FreePBX (3) |
| 28 | SimpleHelp | 3 | 4 | 3 | — | — | SimpleHelp (3) |
| 29 | Ubiquiti | 3 | 4 | — | — | — | UniFi OS (3) |
| 30 | Arista | 3 | 3 | — | — (n=2) | — | — |
| 31 | BerriAI | 3 | 3 | — | — | — | LiteLLM (3) |
| 32 | SmarterTools | 3 | 3 | 3 | — | — | SmarterMail (3) |
| 33 | TrueConf | 3 | 3 | — | — (n=2) | — | — |
| 34 | D-Link | 2 | 26 | 2 | — | — | Multiple Routers (3) |
| 35 | Samsung | 2 | 15 | — | — | — | Mobile Devices (13) |
| 36 | Roundcube | 2 | 11 | — | — | — | Webmail (11) |
| 37 | Red Hat | 2 | 9 | 4 | — | — | — |
| 38 | F5 | 2 | 8 | 4 | — (n=1) | — | BIG-IP (3) |
| 39 | BeyondTrust | 2 | 4 | 1 | — | — | — |
| 40 | ConnectWise | 2 | 4 | 2 | — (n=1) | — | ScreenConnect (4) |
| 41 | JetBrains | 2 | 4 | 4 | — | — | TeamCity (3) |
| 42 | WatchGuard | 2 | 4 | 1 | — | — | — |
| 43 | Dassault Systèmes | 2 | 3 | — | — | — | DELMIA Apriso (3) |
| 44 | Atlassian | 1 | 14 | 8 | — | — | Confluence Server and Data Center (9) |
| 45 | Zyxel | 1 | 13 | 2 | — (n=1) | — | Multiple Firewalls (4) |
| 46 | Qualcomm | 1 | 12 | — | — | — | Multiple Chipsets (11) |
| 47 | Trend Micro | 1 | 12 | — | — | — | — |
| 48 | IBM | 1 | 8 | 2 | — (n=1) | — | Data Risk Manager (3) |
| 49 | Drupal | 1 | 5 | 2 | — (n=1) | — | Core (4) |
| 50 | GNU | 1 | 5 | — | — | — | — |
| 51 | RARLAB | 1 | 5 | 4 | — | — | WinRAR (4) |
| 52 | Craft CMS | 1 | 4 | — | — | — | Craft CMS (4) |
| 53 | Kentico | 1 | 4 | — | — | — | — |
| 54 | ASUS | 1 | 3 | — | — | — | — |
| 55 | Laravel | 1 | 3 | 1 | — | — | — |
| 56 | OSGeo | 1 | 3 | — | — | — | — |
| 57 | PaperCut | 1 | 3 | 2 | — | — | — |
| 58 | VMware | 0 | 26 | 9 | — | — | vCenter Server (10), ESXi (3) |
| 59 | SAP | 0 | 14 | 3 | — | — | NetWeaver (10) |
| 60 | Mozilla | 0 | 13 | 1 | — | — | Firefox and Thunderbird (7), Firefox (5) |
| 61 | QNAP | 0 | 11 | 9 | — | — | Network Attached Storage (NAS) (4), Photo Station (4) |
| 62 | Arm | 0 | 9 | — | — | — | Mali Graphics Processing Unit (GPU) (6) |
| 63 | Zoho | 0 | 9 | 2 | — | — | ManageEngine (6) |
| 64 | Juniper | 0 | 8 | — | — | — | Junos OS (7) |
| 65 | NETGEAR | 0 | 8 | — | — | — | — |
| 66 | Mitel | 0 | 7 | 5 | — | — | MiVoice Connect (3) |
| 67 | Progress | 0 | 7 | 3 | — | — | — |
| 68 | Sophos | 0 | 7 | 2 | — | — | — |
| 69 | Jenkins | 0 | 6 | 1 | — | — | — |
| 70 | TP-Link | 0 | 6 | — | — | — | — |
| 71 | DrayTek | 0 | 5 | — | — | — | — |
| 72 | Exim | 0 | 5 | 1 | — | — | Exim (3) |
| 73 | Accellion | 0 | 4 | 4 | — | — | FTA (4) |
| 74 | Fortra | 0 | 4 | 2 | — | — | — |
| 75 | GIGABYTE | 0 | 4 | 4 | — | — | — |
| 76 | Nagios | 0 | 4 | — | — | — | XI (4) |
| 77 | Sitecore | 0 | 4 | 1 | — | — | — |
| 78 | Veeam | 0 | 4 | 4 | — | — | Backup & Replication (4) |
| 79 | CrushFTP | 0 | 3 | 1 | — | — | CrushFTP (3) |
| 80 | DotNetNuke (DNN) | 0 | 3 | 1 | — | — | DotNetNuke (DNN) (3) |
| 81 | Elastic | 0 | 3 | — | — | — | — |
| 82 | ImageMagick | 0 | 3 | — | — | — | ImageMagick (3) |
| 83 | Kaseya | 0 | 3 | 3 | — | — | Virtual System/Server Administrator (VSA) (3) |
| 84 | Meta Platforms | 0 | 3 | — | — | — | WhatsApp (3) |
| 85 | PHP | 0 | 3 | 1 | — | — | — |
| 86 | Qlik | 0 | 3 | 3 | — | — | Sense (3) |
| 87 | Rails | 0 | 3 | — | — | — | Ruby on Rails (3) |
| 88 | Realtek | 0 | 3 | — | — | — | — |
| 89 | SaltStack | 0 | 3 | — | — | — | Salt (3) |
| 90 | SysAid | 0 | 3 | 1 | — | — | — |
| 91 | TeleMessage | 0 | 3 | — | — | — | TM SGNL (3) |
| 92 | Tenda | 0 | 3 | — | — | — | — |
| 93 | Veritas | 0 | 3 | 3 | — | — | Backup Exec Agent (3) |
| 94 | VMware Tanzu | 0 | 3 | 1 | — | — | — |
Methodology. KEV membership, dates and ransomware flags come from CISA's live catalog. Disclosure is the NVD publish date; 51 of 1,755 KEV CVEs have it so far (the rest are being backfilled and show up as the sample sizes grow). A negative "days to KEV" means CISA listed the CVE before NVD published it, typical of exploited zero-days. Medians need at least 5 data points; below that the cell shows the sample size only. Ransomware counts only CVEs CISA marks "Known"; "Unknown" is not counted as no. Vendor names follow CISA's spelling. Patch-timing data from our own reporting is in the JSON (medianDaysDisclosureToPatch) once enough entries carry it.
Free to reuse with credit to 0dayNews.