Edge Devices in CISA’s Exploited-Vulnerabilities List

Home › Guides › Edge Devices in CISA’s Exploited-Vulnerabilities List

✓ checked 14 October 2026 · sources: CISA Known Exploited Vulnerabilities (KEV) catalog, release of 2026-10-13 (CC0), CISA BOD 26-02, VulnCheck report · method · caveats · download the data

CISA’s catalog of vulnerabilities known to be exploited lists 1,741 entries. We sorted them by product and found 292 (16.8%) that are network edge devices: firewalls, VPN gateways, load balancers, routers, small-office and home networking gear, and IP cameras and recorders. We left out management software, storage devices, email gateways and phones.

Read this first. A listing means CISA has evidence the flaw was exploited in the wild. It doesn’t say how many devices were affected, who was behind the attacks, or that any one maker was at fault. The product grouping is ours: the full list and the rules are in the data download.

edge-device entries 292share of the catalog 16.8%consumer/small-office entries with an end-of-life note 26

Headline numbers

1. 292 of 1,741 catalog entries are edge devices. Enterprise edge products account for 200, consumer and small-office networking gear for 71 (from 16 vendors), and IP cameras and recorders for 21.
2. 26 of the 71 consumer and small-office entries carry an end-of-life or end-of-service note in CISA’s description, notes or required action, as do 11 of 21 camera entries and 3 of 200 enterprise entries.
3. 31 of the 71 consumer and small-office entries (44%) are for flaws with CVE numbers from 2019 or earlier. They joined the catalog in 2021 or later.
4. CISA marks 56 of the 200 enterprise edge entries (28%) as used in ransomware campaigns, against 3 of 71 consumer and small-office entries and 0 of 21 camera entries. The “known” flag only records what CISA has seen; it isn’t proof that the others were never used that way.
5. 42 of the 257 entries added in 2026 so far (16.3%) are edge devices.

Entries by device category

Vendors with the most edge-device entries

The count reflects how often exploitation was documented for a vendor’s products, which depends on how many devices are deployed and how closely they are watched, not only on product quality.

By year added

What CISA and others say

CISA’s Binding Operational Directive 26-02, issued 5 February 2026 for federal agencies, says exploitation campaigns “are often enabled by unsupported devices that physically reside on the edge of an organization’s network perimeter”.

Security firm VulnCheck reached a similar conclusion from its own exploitation data: “Botnets disproportionately target unsupported devices: 65% of vulnerabilities exploited by botnets affect end of life or likely end of life products.” It added that “Only five of these CVEs targeted by botnets are included in CISA KEV.” That second point matters for this page: the CISA catalog doesn’t cover every exploited edge-device flaw, so our counts are a floor for what the catalog records, not a census of attacks. We haven’t checked VulnCheck’s figures.

For residential proxy networks built partly on compromised devices, see our botnet timeline. For where automated traffic comes from, see Where Bot Traffic Comes From, and for how home connections reach proxy pools legitimately, The Home-Internet Supply Chain.

Recent additions: Ivanti, MikroTik, Fortinet, F5 and Cisco

MikroTik RouterOS had 3 entries added in September 2026, more than in any earlier year. Between 10 September and 13 October CISA added 9 entries for these five vendors. 6 fall inside our edge-device groups; FortiMail and Cisco’s Secure Email Gateway are email gateways and Identity Services Engine is management software, so they are outside it.

The table below puts the five products in context. KEV counts use CISA’s vendor and product names; NVD counts are CVEs where NVD lists the product’s own CPE as vulnerable.

Ivanti Connect Secure counts include entries CISA files as Pulse Connect Secure, its former name; Ivanti’s newest entry, CVE-2026-104935, added on 13 October, is the only Connect Secure CVE NVD has published in 2026. For F5 the KEV column covers every BIG-IP entry, and the NVD columns use the CPE for BIG-IP Access Policy Manager (APM), which NVD lists on most BIG-IP CVEs; 5 of the 13 NVD-and-KEV matches are bugs in shared components, such as Bash, the Linux kernel and HTTP/2, that CISA files under other vendors. The last two columns don’t have to match the KEV column: NVD can list a product on a CVE that CISA files under another product or vendor name, and the reverse.

Method

Source. The CISA KEV catalog JSON (known_exploited_vulnerabilities.json), catalog version 2026.10.13, released 2026-10-13, downloaded 14 October 2026.

Grouping. We matched each entry’s vendor and product name against a written list of rules (in the CSV notes and our saved script). Entries for management consoles, NAS and storage devices, email gateways, phone systems, SDKs and entries from networking vendors listed only as “Multiple Products” are excluded. The one exception is Hikvision’s “Multiple Products” entry, which we include because Hikvision makes security cameras and recorders. Products that fit two groups (for example a small-business router from an enterprise vendor) are counted once, under consumer and small-office networking.

End-of-life flag. An entry is flagged if CISA’s description, notes or required action contains “end of life”, “end-of-service”, “end of support”, “EoL” or “EoS”. Ransomware. We use CISA’s knownRansomwareCampaignUse field.

Verification. A separate script re-reads the catalog, recomputes every number with its own matching code and checks each quote against the saved sources.

Caveats

• The grouping is our judgement; other reasonable lists would give different counts.
• The catalog records exploitation CISA has evidence of. It misses exploitation that has no public evidence and, per VulnCheck, many botnet-targeted flaws.
• An end-of-life note is only as complete as CISA’s text; devices may be unsupported without the note.
• Counts of entries are not counts of affected devices or attacks.
• Entries added in 2026 cover the period to 13 October.

Download the data

• CISA KEV edge-device entries (CSV): all 292 entries with vendor, product, our category, date added, CVE year, CISA’s ransomware flag and the end-of-life flag.

Cite as: ProxyPicker, “Edge Devices in CISA’s Exploited-Vulnerabilities List”, 14 October 2026, https://proxypicker.com/kev-edge-devices/. Data: CISA KEV catalog (CC0).

Related: Residential proxy botnet timeline · Where Bot Traffic Comes From · The Home-Internet Supply Chain · Proxy & AI Gateway CVE Ledger (proxies, NetScaler and LiteLLM).

Press & data requests: email [email protected] for interviews, the raw data behind this page, or corrections. See also our contact page.