Of the 686 entries added to the CISA Known Exploited Vulnerabilities (KEV) catalog from 2024 to 2026 (catalogVersion 2026.10.08), operating systems and mobile platforms are the largest product class at 19.1 percent. Network edge devices follow at 18.1 percent. Edge devices went from 17.7 percent of additions in 2024 to 19.2 percent in 2026. Wait times and ransomware use differ a lot by class.
Which kinds of products are in the 686 entries?
We placed every entry added in 2024, 2025 and 2026 into one of nine product classes. Operating systems and mobile platforms hold 131 entries. Network edge devices hold 124. The “Other or unclassified” group holds 121, so our rules could not place about one entry in six (17.6 percent).
Web applications and content management systems hold 81 entries, IT management and remote access tools 78, and mail, collaboration and file transfer servers 75. Browsers hold 30. Office and document software, and cameras, NAS and other IoT, hold 23 each. The table gives counts and shares by year. Shares are of that year’s additions.
| Product class | 2024 | 2025 | 2026 | 2024 to 2026 |
|---|---|---|---|---|
| Operating systems and mobile platforms | 43 (23.1%) | 54 (22.0%) | 34 (13.3%) | 131 (19.1%) |
| Network edge devices | 33 (17.7%) | 42 (17.1%) | 49 (19.2%) | 124 (18.1%) |
| Other or unclassified | 30 (16.1%) | 45 (18.4%) | 46 (18.0%) | 121 (17.6%) |
| Web applications, CMS and frameworks | 19 (10.2%) | 30 (12.2%) | 32 (12.5%) | 81 (11.8%) |
| IT management and remote access tools | 18 (9.7%) | 23 (9.4%) | 37 (14.5%) | 78 (11.4%) |
| Mail, collaboration and file transfer servers | 14 (7.5%) | 26 (10.6%) | 35 (13.7%) | 75 (10.9%) |
| Browsers | 12 (6.5%) | 11 (4.5%) | 7 (2.7%) | 30 (4.4%) |
| Office and document software | 7 (3.8%) | 4 (1.6%) | 12 (4.7%) | 23 (3.4%) |
| Cameras, NAS and other IoT | 10 (5.4%) | 10 (4.1%) | 3 (1.2%) | 23 (3.4%) |
Are network edge devices rising in the KEV catalog?
Slightly, but not in a straight line. The edge share was 17.7 percent in 2024 and 17.1 percent in 2025. In 2026 it is 19.2 percent. That is 1.5 percentage points above 2024. In counts, edge entries went from 33 to 42 to 49, while total additions went from 186 to 245 to 255.
So the edge count grew each year, but its share moved only a little. If we add cameras, NAS and other IoT, the combined share for 2024 to 2026 is 21.4 percent.
- 17.7%Edge share of 2024 additions (33 of 186)Source: CISA KEV catalog, catalogVersion 2026.10.08
- 17.1%Edge share of 2025 additions (42 of 245)Source: CISA KEV catalog, catalogVersion 2026.10.08
- 19.2%Edge share of 2026 additions (49 of 255)Source: CISA KEV catalog, catalogVersion 2026.10.08
- 21.4%Edge plus IoT share, 2024 to 2026Source: CISA KEV catalog, catalogVersion 2026.10.08
What else changed between 2024 and 2026?
The larger move is in other classes. Operating systems and mobile platforms fell from 23.1 percent to 13.3 percent. Browsers fell from 6.5 percent to 2.7 percent. Cameras, NAS and other IoT fell from 5.4 percent to 1.2 percent.
Two classes grew faster than the edge. IT management and remote access tools rose from 9.7 percent to 14.5 percent. Mail, collaboration and file transfer servers rose from 7.5 percent to 13.7 percent. The 2026 figures cover entries up to the 2026.10.08 release, so the year is not complete. A full year could look different.
How long did each class wait to be listed?
We measured the days between the CVE record being published and the entry being added to KEV. The median for all 686 entries is 20.0 days. By class, the medians run from 1 day for operating systems and mobile platforms to 1051 days for cameras, NAS and other IoT.
A median hides a long tail. Network edge devices have a median of 5.5 days, yet 27 of the 124 entries waited more than a year. Of the 124 edge entries, 41 were listed on the same day as the record or earlier. The next table puts wait time next to ransomware use.
| Product class | Median days to listing | Ransomware use share |
|---|---|---|
| Operating systems and mobile platforms | 1 | 18.1% |
| Browsers | 2.5 | 6.0% |
| Network edge devices | 5.5 | 21.6% |
| Mail, collaboration and file transfer servers | 28 | 38.7% |
| IT management and remote access tools | 29.5 | 33.3% |
| Other or unclassified | 36 | 21.7% |
| Web applications, CMS and frameworks | 85 | 20.7% |
| Office and document software | 171 | 12.7% |
| Cameras, NAS and other IoT | 1051 | 12.8% |
Which classes show known ransomware use?
KEV carries a field that marks whether a flaw is known to be used in ransomware campaigns. Across all years and all 1739 entries, 20.8 percent carry that mark. Mail, collaboration and file transfer servers are highest at 38.7 percent (48 of 124). IT management and remote access tools follow at 33.3 percent (40 of 120). Two entries in that class have their own pages, TeamCity (CVE-2024-27198) and PaperCut NG and MF (CVE-2023-27350), and both carry the ransomware mark in KEV.
Network edge devices sit near the overall rate at 21.6 percent (63 of 291). Browsers are lowest at 6.0 percent (9 of 149). The ransomware shares use all years, not only 2024 to 2026, because the per-class counts were taken over the full catalog.
For wider context, see our notes on known exploited vulnerabilities and on ransomware. A sibling study looks at ransomware-linked vulnerabilities in more detail.
Method
We used the CISA KEV catalog, catalogVersion 2026.10.08, released on 2026-10-08 and downloaded on 2026-10-09. It holds 1739 entries. We counted entries by the year in their dateAdded field, and kept those from 2024, 2025 and 2026.
We placed each entry in one product class by keyword rules applied to the vendor, the product and the vulnerability name. The rules are our own heuristic. The nine classes are ours, not CISA’s. We kept “Other or unclassified” and show it. Wait time is the days from the CVE record publication date, taken from the CVE Program records, to the dateAdded date. Related studies cover weakness classes and days from publication to listing.
Limits
The data shows what CISA listed, not all exploitation. Keyword rules misplace some products, and 121 of the 686 entries stayed unclassified. A small class, such as the 23 IoT entries, can swing a lot on a few entries.
Medians for small classes rest on few entries. The ransomware field depends on what CISA knew when it last updated the entry, so a blank is not proof of no ransomware use. None of this shows cause. A higher edge share does not tell us why it moved. For how KEV fits next to other signals, read our note on CVSS, EPSS and KEV. For teams that track these items, vulnerability management and attack surface are the related terms. A question to ask: which products on our network edge or in our mail and remote access tools match these classes?
Related studies in this series: where KEV entries sit on the EPSS scale and KEV due-date windows and pace of additions.