Known exploited vulnerabilities, January to March 2026: what the CISA catalogue says about the patching clock

The Cybersecurity and Infrastructure Security Agency in the United States keeps the Known Exploited Vulnerabilities catalogue under a binding directive it issued to federal agencies in November 2021. A vulnerability goes on the list when it has a CVE identifier, there is reliable evidence that it has been exploited against real systems, and the vendor has published a fix or a mitigation. The catalogue carries no severity score. Every entry is past the question of whether an attacker could use it.

The feed records the day CISA added each entry, and that date never changes, so the count of entries added between 1 January and 31 March 2026 is the same in every later version of the catalogue. We counted those entries, grouped by calendar month and by the vendor name the catalogue gives each entry. The vendor count is the number of distinct vendor names; a vendor with several affected products counts once. The ransomware figure is the catalogue’s own flag for entries CISA links to a known ransomware campaign, as it stands in the catalogue version of 28 October 2026; CISA sets the flag when evidence arrives, so the count rises over time.

The date of addition is the day CISA listed the entry. The flaw itself may have been public, and exploited, for weeks or years before that, and the catalogue holds only what CISA has confirmed, so every figure here is a floor. No CVE is named. The point is the volume and where it falls.

The same count is worth running in your own estate every week, against your own inventory. Download the feed, match the vendor and product fields to the software, devices and hosted services you hold, and open a ticket for every match. A match on an online service, an internet-facing server or a network device starts the two-day clock at every maturity level; a match on anything else takes the window the maturity model sets for that class of software, and at Level 3 the critical and exploited flaws in the common desktop applications move to two days as well. The feed carries CISA’s own due date for US agencies; the Essential Eight clock is the one an Australian firm is assessed against.

The match is only as good as the inventory. A feed matched against a spreadsheet of laptops finds Microsoft and Apple and nothing else, because the firewall, the VPN gateway, the mail server and the tools a contractor installed were never written down. Those are the entries in the tail of the vendor table, and they are the ones that go unpatched.