Most exploited CVEs: the top 1,000 known exploited vulnerabilities, ranked by EPSS

The most exploited CVEs, by the measure used here, are the 1,000 entries in CISA's Known Exploited Vulnerabilities (KEV) catalog with the highest EPSS score. As of November 2026, the KEV catalog holds 1,772 entries, so this list covers 56% of it. EPSS scores in the list run from 0.37858 to 0.99999. 489 of the 1,000 score 0.90 or higher.

You can download the full list as CSV and JSON. The summary file holds the counts used in the tables below.

What is the top 1,000 most exploited CVEs list?#

It is a ranked subset of the CISA KEV catalog. KEV is CISA's authoritative list of vulnerabilities with evidence of active exploitation. EPSS is the Exploit Prediction Scoring System from FIRST. It gives each CVE a probability, from 0 to 1, of exploitation activity in the next 30 days, and a percentile that shows where that score sits among all scored CVEs.

We rank in this order:

1. EPSS score, highest first.
2. EPSS percentile, highest first.
3. Date added to KEV, earliest first.
4. CVE ID, as a last tie-breaker so the order is the same on every run.

We chose KEV as the base because every entry has known exploitation. EPSS then orders those entries by how likely activity is to continue. We did not add CVSS severity. KEV has no CVSS field, and the National Vulnerability Database API allows only 5 requests per 30 seconds without a key.

Which data dates and versions does the list use?#

Both sources were read on 9 November 2026.

CISA releases KEV data under the CC0 1.0 license. FIRST publishes EPSS free of charge with no registration and asks for attribution. EPSS data comes from FIRST (https://www.first.org/epss/).

What are the top 25 most exploited CVEs?#

The 25 highest-ranked entries all have an EPSS score of 0.99999, which is the maximum in the data. The order inside the group follows the tie-breakers, so a lower rank does not mean lower risk.

"Ransomware use" is CISA's field knownRansomwareCampaignUse. "Known" means CISA has evidence of use in ransomware campaigns. "Unknown" means CISA has no such evidence on record, which does not make the vulnerability safe.

Which vendors have the most CVEs in the list?#

Microsoft has the most entries, with 207 of 1,000. The ten vendors below hold 496 entries between them. The count is of CVEs, not of products at risk, and it reflects what attackers have used, not how secure a vendor is.

Which weakness types (CWEs) appear most often?#

OS command injection (CWE-78) is the most common weakness tag, on 89 CVEs. CISA assigns the CWE values in KEV, and one CVE can carry several. Because of that, the counts overlap. 84 of the 1,000 CVEs have no CWE in KEV.

Which CWE classes match our vulnerability guides?#

Nine weakness classes in the list match a guide on this site. The table counts CVEs in the top 1,000 that carry the CWE (command injection counts CWE-78 and CWE-77 together). Each guide shows how a tester proves the flaw with evidence and how to fix it in code.

Several large classes have no guide here yet. Code injection (CWE-94) appears on 54 CVEs, authentication flaws (CWE-287, CWE-306) on 63, and memory errors (CWE-119, CWE-787, CWE-416) on 118.

How much of the list has known ransomware use?#

262 of the 1,000 CVEs (26.2%) are marked "Known" for ransomware campaign use in KEV. The other 738 are marked "Unknown". The share is lower for entries added in 2025 and 2026 (about 15%) than for those added in 2021 and 2022 (26% to 35%). Read a recent "Unknown" as "no evidence on record yet", because the field can change when CISA finds evidence.

How many CVEs were added to KEV each year?#

The table groups the 1,000 CVEs by the year CISA added them to KEV. The 2021 count includes the initial batch of entries dated 2021-11-03. The 2026 row covers entries added up to 2026-10-29.

575 CVEs in the list have a CVE ID from 2021 or earlier, and attackers still use them against unpatched systems.

What should a team do with this list?#

Use KEV as your first patch queue, then use EPSS to order the work inside it.

1. Patch or mitigate every KEV entry that matches your assets. KEV means exploitation has happened. CISA sets a due date for US federal agencies. Use the same date as a target if you have no better one.
2. Order the queue by EPSS and exposure. Fix internet-facing systems with a high EPSS score first. Internal-only systems come next.
3. Check the ransomware field. A "Known" entry on an exposed system is a strong reason to move it to the front of the queue.
4. Test for the weakness classes as well as the CVEs. The CWE table shows which classes attackers use again and again. A pentest of your own applications looks for the same classes in your code. See our web application penetration testing page for how we scope that work.
5. Re-run the list on a schedule. Data changes daily. Pull KEV and EPSS again before each patch cycle.

You can filter the CSV by vendor and product to find entries that match your software inventory.

What are the limits of this list?#

• EPSS is a probability. It estimates activity in the next 30 days. It is not a measure of how bad an exploit would be, and it can be wrong for a single CVE.
• KEV covers known exploited vulnerabilities only. A flaw can be exploited and still be absent from KEV. CISA adds entries when it has evidence and a clear remediation.
• The ranking cuts at 1,000. The lowest EPSS score in the list is 0.37858. The remaining 772 KEV entries score lower but are still exploited. Patch them too.
• The data changes daily. This page and the CSV are one snapshot. Use the live CISA catalog and the EPSS API for current values.

We did not add CVSS scores. The vendor and weakness tables count CVEs and do not weigh them by severity.

How do I use the downloads?#

The CSV and JSON have the same 1,000 rows. Columns: rank, cve, vendor, product, vulnerability_name, kev_date_added, kev_due_date, known_ransomware_use, cwes, epss, epss_percentile, epss_date, short_description, nvd_url, cisa_kev_url. In the CSV, several CWEs in one cell are separated by semicolons.

• top-1000-kev-by-epss.csv
• top-1000-kev-by-epss.json
• summary.json

The KEV fields come from CISA under CC0 1.0. The EPSS fields come from FIRST, who ask for attribution: EPSS data from FIRST (https://www.first.org/epss/). Our ranking and summary tables are our own work from those two sources.