Most actively-exploited software, right now
Ranked from the U.S. CISA Known Exploited Vulnerabilities catalog — the authoritative list of software being exploited in the wild. A measure of where attacker attention concentrates, not a verdict on vendor quality.
1,621 exploited vulnerabilities · 266 vendors · 1046 in software we track at version level
Microsoft accounts for 377 of CISA's 1,621 actively-exploited vulnerabilities (23%), led by Windows with 172. Apple (93), Cisco (92), Adobe (79) follow. 327 (20%) are tied to known ransomware campaigns. IsItPatched analyses 613 of these products at the individual-version level, covering 1046 of the exploited CVEs in depth.
How this leaderboard is calculated
- Source: the U.S. CISA KEV catalog — vulnerabilities confirmed exploited in the wild — re-read on every data sync.
- Products rank by their number of KEV entries; vendors by the total across all their products.
- Ransomware counts use CISA's
knownRansomwareCampaignUseflag. - Tracked → rows link to our version-level analysis (safe version, open CVEs, EOL); others are shown for completeness.
- It counts historical exploitation, so widely-deployed platforms rank highest — a signal of attacker focus, not vendor quality.
Most-exploited products
By number of entries in CISA's KEV catalog. Linked rows are tracked at version level.
Most-exploited vendors
By total KEV entries across all their products.
Tracked in depth — worst first
Of the 613 products we analyse at the individual-version level, ranked by active exploitation + open critical CVEs. Every row links to a full breakdown.
Read this fairly: the ranking simply counts entries in the U.S. government's CISA Known Exploited Vulnerabilities catalog (public, factual) — a cumulative, historical tally that skews toward the most widely-deployed, most-researched platforms. A higher position reflects how much attacker and researcher attention a product has drawn over time; it is not a statement about a product's current security, a vendor's competence, or which software is "safer". Many entries are long-since patched. Use it to prioritise patching — start with what's actively exploited — not to choose or rank vendors. Source: CISA KEV · how we score.
Frequently asked
Where does this ranking come from?
It is built from the U.S. CISA Known Exploited Vulnerabilities (KEV) catalog — the authoritative government list of vulnerabilities confirmed to be exploited in the wild. It currently holds 1621 vulnerabilities across 266 vendors. Products are ranked by how many KEV entries they have. It rebuilds with every data sync.
Does a high ranking mean the software is bad?
No. It reflects how often a product has been exploited historically (per CISA), which correlates with how widely deployed and heavily targeted it is — not vendor quality. Mature, ubiquitous platforms naturally accumulate more entries. Use it to understand where attacker attention concentrates, and to prioritise patching.
Why are some products linked and others not?
IsItPatched analyses 613 products at the individual-version level — those rows link to a full breakdown (safe version, open CVEs, EOL). Other entries in CISA's catalog are shown for completeness but we don't yet track them version-by-version; 1046 of CISA's 1621 exploited CVEs fall in software we track in depth.