Updated under an hour ago ()
Where attackers get in
Which kinds of technology are attackers exploiting to get in, and is the network edge taking over?
CISA confirmed 1,429 vulnerabilities exploited in 2022 to 2026. Web and application servers and frameworks were the largest class (17%), followed by operating systems (17%) and browsers and plug-ins (11%).
What this means for you
Network edge devices (firewalls, VPN gateways, remote access tools, load balancers) went from 6% of confirmed exploitations in 2023 to 13% in 2026. They face the internet by design, so they are the first thing to inventory, patch on an emergency clock and put behind phishing-resistant MFA.
Do this next
This chapter's program actions come with a subscription
a. The mix
Confirmed exploitations by product class, by year
Share of confirmed exploitations by product class, by year confirmed
Web and application servers and frameworks account for the most confirmed exploitations in 2022 to 2026 (17%, 250 of 1,429); network edge devices are 10%.
2021 and 2022 include CISA's launch backlog of older CVEs, so their mix shows what the catalog listed first as well as what attackers used that year. The current year is partial.
Sources: CISA Known Exploited Vulnerabilities catalog; CISA Vulnrichment
Table view
How this is calculated
Each CVE CISA confirms exploited is placed in one product class from CISA's catalog vendor and product names (falling back to the vulnerability name) by the site's documented classifier, lib/cve-analysis/product-class.ts, rules version 2026-10-15.1: ordered keyword rules, first match wins, with the judgement calls listed in the file. Counted in the year CISA confirmed exploitation. 2021 and 2022 include the catalog's launch backlog of older CVEs, so their mix reflects what CISA catalogued first as well as what attackers used that year. Year-on-year comparisons start in 2023, after that backlog, and use years with at least 20 confirmations. Speed columns use CVEs published after the catalog launched (2021-11-03), so the backlog does not read as delay. A count of confirmed exploitation reflects how widely a product is deployed and targeted; it is not a security rating of the vendor.
Subscriber feature · $5 a month or $50 a year
Read the rest of Chapter 11: Where attackers get in
- Is the network edge taking over?
- Speed and ransomware use by product class
- What this means for your program: 4 key points
- 4 program actions mapped to HIPAA and NIST CSF 2.0, starting with “Inventory everything that faces the internet”
- Exam angle for 7 CISSP, CISM and CISA domains, with a study prompt
Included with an ExamPrep subscription or as a DueCare site administrator. How linking works