36.5% of KEVs carry a CVSS score of 9.0 or above, while 63.5% are rated high, medium, or lower.

May 31, 2026

36.5% of KEVs carry a CVSS score of 9.0 or above, while 63.5% are rated high, medium, or lower. — This cybersecurity statistic was published by Root Evidence in May 2026. It covers topics including KEV, CVSS. The original data appears in Stop Counting CVEs: What Actually Mattered in Q1 2026 . For the full methodology and detailed findings, refer to the original report.

Source

View Original Report

Published on 5/27/2026

Share or Copy this stat

Frequently Asked Questions

What does this statistic say?

36.5% of KEVs carry a CVSS score of 9.0 or above, while 63.5% are rated high, medium, or lower. This data was published by Root Evidence and covers KEV, CVSS.

Where does this data come from?

This statistic comes from Stop Counting CVEs: What Actually Mattered in Q1 2026 , published by Root Evidence on May 31, 2026. You can view the original report at https://www.rootevidence.com/report.

What cybersecurity topics does this cover?

This statistic relates to KEV, CVSS. Browse more statistics on KEV or from Root Evidence.

CYBERSTATS

36.5% of KEVs carry a CVSS score of 9.0 or above, while 63.5% are rated high, medium, or lower.

Source

Share or Copy this stat

Frequently Asked Questions

Want More Statistics Like This?

Related Statistics

Vulnerabilities added to CISA's Known Exploited Vulnerabilities catalog increased 43% in Q1 2026 compared with Q4 2025.

In 2025, 43% of CISA KEV additions were API-related, making APIs the single largest exploited surface in that dataset.

242 vulnerabilities are added to the CISA Known Exploited Vulnerabilities catalog, a 30% year-over-year increase, and 285 vulnerabilities are added to the Vedere Labs KEV, a 213% year-over-year increase.

71% of exploited vulnerabilities are not in the CISA KEV catalog.

65% of manufacturing companies have at least one vulnerability listed in the CISA Known Exploited Vulnerabilities (KEV) Catalog.

90 third-party vendors are flagged with high-risk threat categories. Among these, 35 vendors are marked with Known Exploited Vulnerabilities (KEV) tags.

Browse by Topic

Stay Ahead of Cyber Threats