Most actively-exploited software, right now
Ranked from the U.S. CISA Known Exploited Vulnerabilities catalog — the authoritative list of software being exploited in the wild. A measure of where attacker attention concentrates, not a verdict on vendor quality.
1,739 exploited vulnerabilities · 288 vendors · 609 in software we track at version level
Microsoft accounts for 389 of CISA's 1,739 actively-exploited vulnerabilities (22%), led by Windows with 174. Cisco (100), Apple (95), Adobe (82) follow. 361 (21%) are tied to known ransomware campaigns. IsItPatched analyses 650 of these products at the individual-version level, covering 609 of the exploited CVEs in depth.
How this leaderboard is calculated
- Source: the U.S. CISA KEV catalog — vulnerabilities confirmed exploited in the wild — re-read on every data sync.
- Products rank by their number of KEV entries; vendors by the total across all their products.
- Ransomware counts use CISA's
knownRansomwareCampaignUseflag. - Tracked → rows link to our version-level analysis (safe version, open CVEs, EOL); others are shown for completeness.
- It counts historical exploitation, so widely-deployed platforms rank highest — a signal of attacker focus, not vendor quality.
Most-exploited products
By number of entries in CISA's KEV catalog. Linked rows are tracked at version level.
Most-exploited vendors
By total KEV entries across all their products.
Tracked in depth — worst first
Of the 650 products we analyse at the individual-version level, ranked by active exploitation + open critical CVEs. Every row links to a full breakdown.
Read this fairly: the ranking simply counts entries in the U.S. government's CISA Known Exploited Vulnerabilities catalog (public, factual) — a cumulative, historical tally that skews toward the most widely-deployed, most-researched platforms. A higher position reflects how much attacker and researcher attention a product has drawn over time; it is not a statement about a product's current security, a vendor's competence, or which software is "safer". Many entries are long-since patched. Use it to prioritise patching — start with what's actively exploited — not to choose or rank vendors. Source: CISA KEV · how we score.
Frequently asked
Where does this ranking come from?
It is built from the U.S. CISA Known Exploited Vulnerabilities (KEV) catalog — the authoritative government list of vulnerabilities confirmed to be exploited in the wild. It currently holds 1739 vulnerabilities across 288 vendors. Products are ranked by how many KEV entries they have. It rebuilds with every data sync.
Does a high ranking mean the software is bad?
No. It reflects how often a product has been exploited historically (per CISA), which correlates with how widely deployed and heavily targeted it is — not vendor quality. Mature, ubiquitous platforms naturally accumulate more entries. Use it to understand where attacker attention concentrates, and to prioritise patching.
Why are some products linked and others not?
IsItPatched analyses 650 products at the individual-version level — those rows link to a full breakdown (safe version, open CVEs, EOL). Other entries in CISA's catalog are shown for completeness but we don't yet track them version-by-version; 609 of CISA's 1739 exploited CVEs fall in software we track in depth.