Quarterly retrospective
Compare quarterly exploitation and breach trends by source-published event dates, with the current quarter labelled as quarter to date.
Each quarter's numbers are counted by when the event happened, not when the tracker found it: the date the Cybersecurity and Infrastructure Security Agency (CISA) listed a Common Vulnerabilities and Exposures (CVE) record as known exploited, or the date a breach was disclosed. The current quarter is marked quarter to date.
Lead finding: 2026 Q3 added the most CISA Known Exploited Vulnerabilities (KEV) catalog entries in this window (100).
CISA Known Exploited Vulnerabilities added per quarter
New additions to the CISA Known Exploited Vulnerabilities catalog, counted in the quarter CISA listed them.
Quarter by quarter
Known ransomware share is the Cybersecurity and Infrastructure Security Agency's own flag; Unknown means CISA has not confirmed ransomware use, not that none exists. The response window is the median days from a CVE's publication to its CISA KEV listing, an upper bound on defender warning time because a listing lags first in-the-wild use, and is not shown for quarters with fewer than five CVEs. Ransomware claim counts use unverified leak-site posts from RansomLook (CC BY 4.0), with ransomware.live as a failover, credited and linked as its terms require (Source: Ransomware.live).
| Quarter | CISA KEV added | CISA-flagged ransomware use | Leak-site claims (unverified) | Confirmed breaches | Days to KEV listing (median) | Top CISA KEV vendors |
|---|---|---|---|---|---|---|
| 2026 Q4To date: Quarter to date through 2026-11-06 02:52 UTC | 38 | 0 (0%) | 1,626 | 112 | 9 days (n=29) | Plex (4), Ivanti (3), Ahsay (2), Cisco (2), Fortinet (2) |
| 2026 Q3 | 100 | 6 (6%) | 3,856 | 492 | 8 days (n=100) | Microsoft (12), Cisco (7), Linux (5), Citrix (4), Fortinet (4) |
| 2026 Q2 | 75 | 15 (20%) | 3,088 | 427 | 15 days (n=75) | Microsoft (15), Cisco (7), Adobe (3), Ivanti (3), SimpleHelp (3) |
| 2026 Q1 | 71 | 6 (8.5%) | 3,119 | 458 | 33 days (n=71) | Microsoft (12), Apple (7), Cisco (4), Google (3), SmarterTools (3) |
| 2025 Q4 | 62 | 5 (8.1%) | 2,804 | 415 | 45.5 days (n=62) | Microsoft (10), Fortinet (3), Gladinet (3), Oracle (3), Adobe (2) |
| 2025 Q3 | 51 | 6 (11.8%) | 1,826 | 459 | 14 days (n=51) | Cisco (5), Microsoft (5), Citrix (4), D-Link (3), Google (3) |
| 2025 Q2 | 59 | 7 (11.9%) | 1,687 | 479 | 14 days (n=59) | Microsoft (8), Apple (3), Ivanti (3), Linux (3), Qualcomm (3) |
| 2025 Q1 | 73 | 13 (17.8%) | 2,512 | 746 | 29 days (n=73) | Microsoft (16), Ivanti (4), Apple (3), Mitel (3), VMware (3) |
Every metric is bucketed by the source-published event date (the date CISA added a CVE to the Known Exploited Vulnerabilities catalog, or the date a breach was disclosed), never the date the tracker ingested the row, so a late-ingested item lands in the quarter it actually happened. The most recent quarter may still be in progress; compare completed quarters for a trend. The disclosure-to-listing median is an upper bound on defender warning time (a catalog listing lags first in-the-wild use) and abstains below a five-CVE sample. A CISA known-ransomware flag of Unknown means CISA has not confirmed ransomware use, not that none exists. Breaches without a published disclosure date are counted in coverage, not placed in a quarter. This window omits 0 CISA KEV entries and 7 breaches that carry no dated event.