How many vulnerabilities will CISA add to its Known Exploited Vulnerabilities catalog between 1 January and 31 March 2027?

TL;DR

The median (50th percentile) is 92 distinct CVE identifiers added to CISA KEV January 1–March 31, 2027. The 10th percentile is 63 distinct CVE identifiers added to CISA KEV January 1–March 31, 2027, and the 90th percentile is 129 distinct CVE identifiers added to CISA KEV January 1–March 31, 2027. The central judgment is that the broader late-2026 listing pace carries more weight than a simple repeat of the previous two first quarters.

Context

CISA's Known Exploited Vulnerabilities catalog tracks vulnerabilities with evidence of exploitation in the wild. This question counts distinct CVE identifiers whose recorded dateAdded falls within the target quarter and which remain in the designated April 1, 2027 snapshot. It does not count advisories, exploitation incidents or newly discovered vulnerabilities. The official JSON feed controls resolution, with the official GitHub repository serving as a fallback under the stated rules.

As of the November 5, 2026 forecast date, the latest checked catalog version was 2026.11.04, released November 4 and containing 1,768 entries. It recorded 284 additions during 2026 through November 4. The forecast therefore concerns an entirely future quarter, not the completion of a partly observed period (catalog version and records).

Evidence

The historical backbone is a catalog whose operating pace has changed. The launch-era totals were much larger than the subsequent annual counts. Treating those early years as an ordinary quarterly baseline would confuse initial population of the catalog with its later maintenance rate. The full annual history available here is shown below; the first and last rows cover partial years (historical addition records).

Recorded addition period	Distinct CVEs
November–December 2021	311
2022	555
2023	187
2024	186
2025	245
January 1–November 4, 2026	284

The more relevant history starts after the launch period. It shows growth, but not a smooth rise. First-quarter counts increased from 37 in 2023 to 40 in 2024 and 73 in 2025, then slipped to 71 in 2026. The exceptional Q1 2022 count was 298, reinforcing why the early catalog is a poor ordinary-rate comparison (historical catalog records).

The complete quarterly history supplied for 2023 onward makes the recent shift clearer. The final cell is incomplete and must not be compared as a full quarter (quarterly addition records).

Year	Q1	Q2	Q3	Q4
2023	37	60	43	47
2024	40	33	58	55
2025	73	59	51	62
2026	71	75	100	38 through November 4

The strongest upward evidence is not just that 2026 exceeded 2025. It is that the quarterly pace rose within 2026, and October remained elevated after the strong third quarter. The full monthly history available for the mature-catalog period is below. These are counts grouped by recorded addition date in the checked catalog, not an unrevised archive of every original publication (monthly addition records).

Month	2023	2024	2025	2026
January	5	21	14	17
February	14	9	27	28
March	18	10	32	26
April	17	10	15	31
May	19	14	24	21
June	24	9	20	23
July	16	14	20	26
August	8	19	15	31
September	19	25	16	43
October	18	17	31	36
November	18	22	11	2 through November 4
December	11	16	20	Not yet observed

This history supports a forecast above the last two Q1 totals, but not an assumption of uninterrupted acceleration. September was stronger than October. January has also often been weaker than the following months, although the short history does not establish a stable seasonal discount. The partial November observation adds little information about a full month's pace (monthly records).

The composition of the increase matters. From Q3 2025 to Q3 2026, additions rose from 51 to 100, vendors represented rose from 31 to 48, and active addition dates rose from 24 to 42. The largest daily batch moved only from 6 to 7. That pattern supports a broad increase in activity rather than a single large catalog cleanup (underlying records).

The age mix points in the same direction, with a limit on interpretation. Of the 100 additions in Q3 2026, 86 had 2026 CVE identifiers; in Q3 2025, 36 of 51 had same-year identifiers. This makes a legacy-only explanation less persuasive. But a CVE identifier's year is not its disclosure date or the date exploitation began. It is a useful clue, not a direct measure of discovery-to-listing speed (CVE-level records).

Institutional developments offer weaker support for persistence. CISA's June 10, 2026 BOD 26-04 strengthens risk-based remediation and directs continued KEV maintenance, but contains no numerical additions target. It supports the catalog's continuing role, not a mechanical increase in entries (directive).

FedRAMP's June 16 notice sets mandatory adoption of vulnerability detection and evaluation requirements for December 7, 2026, with a corrective-action grace period ending March 7, 2027. That timing overlaps the forecast window. Better assessment could improve reporting, but it could also mainly improve remediation of vulnerabilities already known (FedRAMP notice).

The July 14, 2026 Gold Eagle announcement describes a vulnerability-intake and coordination clearinghouse. This offers a plausible route to more information reaching defenders. It does not show that more vulnerabilities satisfy KEV's exploitation requirement. Discovery volume and catalog eligibility remain different quantities (White House announcement).

What's non-obvious

The breadth of the rise matters more than the latest peak. A strong quarter caused by one old-vulnerability batch would be a weak reason to expect another strong quarter. More vendors and more active listing dates, with little change in the largest daily batch, are better evidence that the underlying pace has shifted. That is why simply repeating the previous first-quarter totals misses useful information (catalog records).

The opposite mistake is to treat every cybersecurity initiative as an additions multiplier. Risk-based remediation, better vulnerability discovery and stronger reporting can all matter without producing proportionate growth in KEV. The catalog is a filtered measure of documented exploitation, not a census of software flaws. The forecast recognizes the stronger recent pace without assuming that policy attention or discovery announcements translate directly into qualifying entries.

Uncertainties

The largest uncertainty is whether the late-2026 pace persists into the target quarter. The evidence shows a broad increase; it does not establish a permanent rate. Exploitation clusters can raise additions, while verification delays or publication constraints can lower them. The percentile range reflects uncertainty about the quarter's operating pace as well as ordinary variation in counts.

Seasonality remains thinly supported. There are only four completed post-launch first quarters in the more relevant history. More observations would help separate a repeatable January effect from changes in the catalog's overall activity. There is no observed Q1 2027 subtotal at the forecast date.

The historical series is also subject to snapshot effects. Limited checks found the completed Q1 2025 and Q1 2026 totals unchanged across later catalog cuts, and no entries from the checked April 1, 2026 snapshot missing from the current catalog. That supports stability in those cases, not a guarantee against future removals or corrections (official version history).

Finally, resolution follows recorded dates and snapshot membership. A qualifying entry removed before the designated snapshot does not count. An entry introduced after March 31 with a qualifying dateAdded before the snapshot cutoff does count. Later corrections do not change the result. These rules make the resolving catalog snapshot, rather than a tally of announcements, decisive. The forecast is conditional on normal resolution; discontinuation or an unrecoverable authoritative snapshot triggers annulment under the question's rules.