Why do attackers keep targeting Microsoft flaws every year?
Microsoft's software is everywhere, which makes it a constant target. Windows, Office, Remote Desktop Services and the Windows Shell all appear repeatedly in the known exploited vulnerabilities catalog: in February, CISA added six Microsoft flaws at once, covering the Windows Shell, MSHTML, Office Word, Windows Type Confusion, a NULL Pointer Dereference and Remote Desktop Services elevation of privilege.1 These types of vulnerabilities are, in CISA's own words, "frequent attack vectors for malicious cyber actors" that "pose significant risks to the federal enterprise."1
The sheer volume of Microsoft code also means more bugs are found. Microsoft credits large language models for the jump in bug discovery, and AI-assisted research contributed to October's record patch batch.3 Satnam Narang at Tenable noted that October alone, with more than 1,400 fixes, beats the 1,261 flaws Microsoft patched across all of 2020, the previous record year, and that Microsoft has now crossed 4,000 CVEs patched with two months still to go.3 More bugs found and fixed means more confirmed exploits for CISA to track, keeping Microsoft at the top of the KEV rankings year after year.
Is CISA still relevant?
CISA and its known exploited vulnerabilities catalog remain a practical tool for security teams. The catalog has evolved: Binding Operational Directive 26-04, which replaced BOD 22-01, now requires federal agencies to prioritize rapid remediation of high-risk KEV entries on publicly exposed assets that grant total control post-exploitation, while allowing lower-risk items to be deferred.2, 5 It also sets expectations for agencies to check whether attackers compromised a system before a patch was applied.2
Beyond federal agencies, the KEV is widely used. According to runZero's analysis by Tod Beardsley, former CISA Section Chief for the KEV, the catalog has been adopted by state, local, tribal and territorial governments, critical infrastructure operators, foreign governments and private-sector defenders, and has become a broadly reused signal for "things that matter right now."4 Tyler Reguly of Fortra told Krebs on Security that security teams would do well to prioritize the 26 Microsoft KEV entries confirmed so far this year above the broader patch load.3 "Security leaders should focus on exploitable risk, and ask whether their teams have the clarity, capacity and support to act," Reguly said.3
Who is most at risk from the vulnerabilities on the KEV list?
Federal civilian agencies face the clearest legal obligation: BOD 26-04 requires them to remediate high-risk KEV entries on publicly exposed assets and to check for compromise before patching.2, 5 But the risk extends well beyond government. RunZero's analysis notes the catalog has been adopted by critical infrastructure operators and private-sector defenders worldwide, and CISA encourages all organizations to prioritize KEV remediation as part of their vulnerability management practice.4, 2
The chart shows that the risk is not limited to Windows users. Cisco reached 19 entries in 2026, its highest since 50 in 2022. Fortinet has been in the top four for two years running, with 8 entries in 2025 and 9 in 2026. Organizations running network edge devices, including firewalls, VPN gateways and SD-WAN systems, face real exposure. In September, CISA added flaws in Check Point products, an Arista VeloCloud Orchestrator and an F5 BIG-IP APM to the catalog, all of them network or security appliances.5 Runzero's research also finds that only 32% of KEV-listed vulnerabilities are immediately exploitable for initial access, meaning defenders can use that signal to focus effort where the actual entry-point risk is highest.4
What is the CISA KEV remediation timeline?
The remediation timeline for known exploited vulnerabilities is set by Binding Operational Directive 26-04 for federal civilian agencies, which requires prioritized rapid remediation of high-risk KEV entries on publicly exposed assets that could grant an attacker total control, while allowing lower-risk items to be addressed more slowly.2 The directive also requires agencies to determine whether a system was compromised before a patch was applied.2
For everyone else, CISA sets no mandatory deadline but strongly encourages timely patching. RunZero's analysis by Tod Beardsley explains that the KEV was designed as an operational prioritization tool, not a compliance checklist, and that commodity exploit tooling often predates KEV additions by days, weeks or even years, meaning the window to patch before attackers have working tools can be very short.4 In at least one case, a CVE record, a KEV entry and public exploit tooling all appeared on the same day.4 Patch Tuesdays, including the November 10 release still to come, are the practical forcing function for most organizations.
Will edge devices like firewalls keep climbing the exploited flaws rankings?
The chart data suggests edge devices have already climbed the rankings and stayed there. Fortinet rose from 15th in 2021 to the top four in both 2025 and 2026, with 8 entries in 2025 and 9 in 2026. Cisco jumped from joint third in 2025 with 8 entries to second in 2026 with 19. In September, CISA added flaws in Check Point products, an Arista VeloCloud Orchestrator and an F5 BIG-IP APM, all network or security appliances, to the known exploited vulnerabilities catalog.5
Whether that trend continues is a possibility rather than a certainty. CISA's catalog only lists vulnerabilities with confirmed exploitation, a reasonable mitigation and a CVE identifier, so new edge-device entries depend on observed attacks being reported through trusted channels.4 RunZero's analysis notes that the KEV continues to grow in "size, scope, and technological diversity," which could bring more appliance vendors into the rankings as coverage broadens.4 The November 10 Patch Tuesday will add to Microsoft's 2026 count, but whether edge-device vendors close the gap further depends on which attacks CISA confirms before year end.