Exploited Vulnerabilities Added (CISA KEV, Monthly)

## What this measures

The number of vulnerabilities CISA added to its Known Exploited Vulnerabilities (KEV) catalog in each month. An entry needs reliable evidence of active exploitation in the wild and an available fix, so the catalog is the closest public count of attacks actually in use.

## Why it matters

U.S. federal agencies must patch KEV entries by a deadline, and most security teams use the list to decide what to fix first. A rising count means attackers are exploiting more distinct flaws.

## How to read it

Read the 12-month total (cyber.cisa.kev_added_12m): single months are lumpy. September 2026 added 43, the most in any month since 2022. The catalog opened in November 2021 with a large initial load and kept loading older flaws through 2022, so read the series from 2023.

## What it does not say

It counts flaws, not attacks or victims, and it reflects CISA's evidence threshold and capacity as well as attacker activity.

## Source

Cybersecurity and Infrastructure Security Agency (CISA), Known Exploited Vulnerabilities catalog (cisa.gov/known-exploited-vulnerabilities-catalog), JSON feed, counted by the date CISA added each entry. Palanor reads it every day. U.S. government work, public domain.