Prolepsia forecastNumber

How many vulnerabilities will CISA add to its Known Exploited Vulnerabilities catalog in calendar year 2027?

As of 5 November 2026, Prolepsia’s median forecast is 388, with an 80% chance it falls between 265 and 530.

388median

Prolepsia’s forecast distributionHow likely each value is for: How many vulnerabilities will CISA add to its Known Exploited Vulnerabilities catalog in calendar year 2027?. Median: 388. 80% range: 265 to 530.
Prolepsia forecast made

How Prolepsia reasons

The report Prolepsia wrote with this forecast.

How forecasts are made · Track record

TL;DR

The forecast for calendar year 2027 is a median of 387.5 distinct CVE entries added to the CISA KEV catalog, with a 10th percentile of 265 and a 90th percentile of 530. The central 80% range reflects both the stronger recent flow of qualifying vulnerabilities and substantial uncertainty about whether CISA sustains that pace.

Key evidence

  • The mature catalog has shifted upward. Annual additions were 187 in 2023, 186 in 2024, and 245 in 2025. By November 4, 2026, additions had reached 284, including 282 during January–October. These counts come from the official catalog snapshot.
  • The recent increase was broad, not simply a backlog batch. September–October 2026 brought 79 additions across 42 vendors; 70 had current-year CVE identifiers. This supports carrying some of the acceleration into the outlook, although identifier year does not establish discovery or exploitation date (official catalog).
  • Institutional signals favor continuity. CISA discontinued its separate weekly Vulnerability Bulletin while directing readers toward KEV and other risk-focused information. That was not an announcement that KEV was ending (CISA bulletin).
  • More CVEs do not automatically mean more KEV entries. Inclusion still requires a CVE identifier, evidence of exploitation, and clear mitigation guidance (CISA criteria reminder).

Uncertainties

The largest unknown is whether late-2026 activity represents a durable increase or a temporary cluster. Only three completed post-launch calendar years provide a clean annual comparison, and October additions were below September's level.

Staffing, validation capacity, reporting coverage, and changes in catalog practices can move the count independently of total vulnerability discovery. Better coordination could increase qualifying intake; operational constraints could reduce throughput.

Resolution counts distinct CVEs with a qualifying dateAdded, not vulnerabilities discovered or first exploited in 2027. The selected January 2028 snapshot governs, so removals and date corrections introduce additional uncertainty. The fractional median summarizes the forecast distribution; the resolved count will be an integer.

Read the full report

TL;DR

The forecast for calendar year 2027 is a median of 387.5 distinct CVE entries added to the CISA KEV catalog, with a 10th percentile of 265 and a 90th percentile of 530. The central 80% range captures continued elevated catalog activity alongside substantial uncertainty about its persistence. The decisive evidence is that the late-2026 increase spans many vendors and mostly current-year CVE identifiers, rather than one old-vulnerability backlog.

Context

This question measures CISA's cataloging activity, not the total number of vulnerabilities discovered, disclosed, or exploited during the year. A vulnerability with an older CVE identifier counts if its qualifying inclusion date falls in 2027. CISA's schema defines dateAdded as the date the vulnerability entered the catalog (official schema).

The forecast is dated November 5, 2026. The latest catalog edition used for the evidence is version 2026.11.04, released November 4, 2026, with 1,768 distinct entries (official catalog). Resolution will use the first qualifying official snapshot published January 8–15, 2028, counting distinct CVE identifiers whose dateAdded falls within calendar year 2027. The median is a distribution summary, not a claim that the realized integer count can contain half an entry.

Evidence

The historical backbone is the catalog's own addition record. Its early years are a poor guide to normal annual throughput: the catalog launched in November 2021, and initial population and backfilling contributed heavily to its early expansion. The full annual history available in the evidence is below (official catalog).

Addition period Distinct CVE entries
November–December 2021 311
Calendar 2022 555
Calendar 2023 187
Calendar 2024 186
Calendar 2025 245
January 1–November 4, 2026 284

These are counts by historical inclusion date among entries retained in the November 4 catalog edition. They are not frozen copies of each year's original published total. That distinction matters because later corrections and removals can alter historical counts.

The cleaner comparison starts after the launch period. Additions were almost unchanged between 2023 and 2024, then rose in 2025. By early November 2026, the catalog had already added more entries than in all of 2025. The evidence therefore supports an elevated outlook, rather than a simple return to the earlier flat level (official catalog).

The complete monthly history supplied for the mature period makes the change clearer. The table contains all 46 complete monthly observations from January 2023 through October 2026; the final two months of 2026 were not complete at the forecast date (official catalog).

Month 2023 2024 2025 2026
January 5 21 14 17
February 14 9 27 28
March 18 10 32 26
April 17 10 15 31
May 19 14 24 21
June 24 9 20 23
July 16 14 20 26
August 8 19 15 31
September 19 25 16 43
October 18 17 31 36
November 18 22 11 —
December 11 16 20 —

January–October 2026 contributed 282 additions, compared with 214 in the same months of 2025. Two further entries through November 4 reconcile the complete-month total with the 284 year-to-date figure. The acceleration is visible, but so is variation: October's 36 additions were below September's 43 (official catalog).

The composition of the increase is more informative than the headline total. September–October 2026 contained 79 additions across 42 vendors. Of those additions, 70 carried current-year CVE identifiers, while only four had identifiers from 2022 or earlier. The largest vendor contributed six entries. This is evidence against a single-vendor event or a large old-CVE cleanup explaining the entire rise (official catalog).

Batching also fails to explain away the change. August–October 2026 contained 110 additions across 46 addition dates and 56 vendors. Even after excluding the three largest addition dates, 91 entries remained. I read this as evidence of a broader flow of qualifying cases, not merely one exceptional publication day (official catalog). It does not prove that the higher flow will last through the next calendar year.

Policy evidence supports continued use of KEV. FedRAMP's notice on BOD 26-04 retained KEV within the move toward aligned, risk-based vulnerability management (FedRAMP notice). CISA's announcement ending its separate weekly Vulnerability Bulletin explicitly directed readers toward KEV and other risk-focused channels (CISA announcement). These are continuity signals, not numerical targets for additions.

There are also modest signs of a larger intake pipeline. The White House's Gold Eagle announcement described operational vulnerability coordination involving CISA and said intake had begun (White House announcement). NIST reported that first-quarter CVE submissions were nearly one-third above the comparable prior-year period (NIST update). These developments support the possibility of more qualifying cases reaching CISA. Neither establishes how many will enter KEV.

The limiting condition is unchanged: entries require a CVE identifier, evidence of exploitation, and clear mitigation guidance (CISA criteria reminder). More discovery, proof-of-concept code, or scanning does not automatically clear that threshold. The forecast therefore does not translate growth in total vulnerability reports directly into equal growth in KEV additions.

What's non-obvious

The strongest signal is not simply that the catalog is growing faster. It is that recent growth looks different from the launch-era expansion. The early catalog absorbed a large stock of older vulnerabilities. The recent increase is spread across vendors and dominated by current-year identifiers (official catalog). That makes a pure backlog explanation less convincing. But identifier year remains an imperfect proxy: it is not the date of discovery, disclosure, or first exploitation.

A second distinction is between vulnerability supply and catalog throughput. An expanding supply gives CISA more potential candidates, while evidence standards and operational capacity determine how many become entries. Likewise, ending a separate publication is not the same as abandoning KEV. The institutional evidence favors continuity, but continuity alone does not guarantee faster additions. This combination explains the forecast's elevated center and broad range without assuming either unlimited growth or a return to the early mature-catalog level.

Uncertainties

The largest gap is persistence. The strongest acceleration covers only a short period. Broad vendor participation weakens the one-batch explanation, but a temporary wave of exploitation can still affect many vendors. More complete months would show whether additions remain elevated after the late-2026 surge.

Operational capacity is another gap. The evidence includes concerns about CISA-wide staffing losses and service disruption, but no reliable KEV-team staffing or budget series. Agency-wide changes do not establish a proportional change in catalog output. Team-level staffing, validation backlogs, processing times, and automation performance would make this risk easier to assess.

The link between expanded coordination and accepted entries is also unmeasured. No conversion rate from Gold Eagle intake, broader CVE submissions, or AI-assisted discovery into KEV additions is available. Counts of candidates reviewed, rejected, and accepted would help separate growing vulnerability supply from changes in CISA's ability to validate exploitation.

Finally, the selected resolution snapshot governs eligibility. An older vulnerability first listed in 2027 counts; a vulnerability assigned a 2027 identifier but first listed in 2028 does not. Date corrections and removals before the selected snapshot can change the final result. A genuine interruption in cataloging can reduce additions, while an unverifiable official record is handled by the question's annulment rules rather than treated as a low count. The percentile bounds are not hard limits on the outcome.

Forecast history

How Prolepsia’s forecast has movedOne forecast so far: 388 on 5 Nov 2026.
DateForecast
Median 388, 80% range 265 to 530

Sources Prolepsia read

  1. https://raw.githubusercontent.com/cisagov/kev-data/develop/known_exploited_vulnerabilities_schema.jsonraw.githubusercontent.com
  2. https://www.fedramp.gov/notices/0014/www.fedramp.gov
  3. https://content.govdelivery.com/accounts/USDHSCISA/bulletins/42b055bcontent.govdelivery.com
  4. https://www.whitehouse.gov/releases/2026/07/white-house-launches-gold-eagle-initiative-for-unprecedented-cybersecurity-vulnerability-coordination/www.whitehouse.gov
  5. https://www.nist.gov/news-events/news/2026/04/nist-updates-nvd-operations-address-record-cve-growthwww.nist.gov
  6. https://github.com/cisagov/kev-data/blob/develop/known_exploited_vulnerabilities_schema.jsongithub.com
  7. https://www.immunitysec.com/vulnerabilities/kev/statistics/www.immunitysec.com
  8. https://www.dejavu.org/cgi-bin/get.cgi?url=https%3A%2F%2Fwww.cisa.gov%2F%2Fknown-exploited-vulnerabilities-catalog%2Freducing-significant-risk-known-exploited-vulnerabilities&ver=93www.dejavu.org
  9. https://www.warner.senate.gov/newsroom/press-releases/warner-raises-alarm-on-cisa-workforce-and-budget-cuts-that-are-leaving-our-country-vulnerable-to-threats/www.warner.senate.gov

The question

This question asks how many distinct vulnerabilities the U.S. Cybersecurity and Infrastructure Security Agency (CISA) will add to its Known Exploited Vulnerabilities (KEV) catalog during calendar year 2027, from January 1, 2027, through December 31, 2027, inclusive. The outcome is the number of catalog entries whose dateAdded field falls within that period, as recorded in CISA's official public KEV dataset in early January 2028. CISA maintains the KEV catalog to identify cybersecurity vulnerabilities with evidence of exploitation in the wild. The catalog is published in machine-readable JSON and CSV formats, and each entry includes a CVE identifier (cveID) and the date on which the vulnerability was added (dateAdded). CISA also maintains an official GitHub repository, cisagov/kev-data, which mirrors the catalog and preserves a history of updates. CISA states that the GitHub mirror is normally synchronized with the canonical dataset within minutes of an update. The catalog's JSON schema explicitly defines dateAdded as the calendar date on which a vulnerability entered the catalog. Sources: [CISA KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog), [official CISA GitHub repository](https://github.com/cisagov/kev-data), and [official JSON schema](https://github.com/cisagov/kev-data/blob/develop/known_exploited_vulnerabilities_schema.json). Historical context supplied with the question, based on the KEV feed as of November 4, 2026, indicates annual additions of 311 in 2021, 555 in 2022, 187 in 2023, 186 in 2024, 245 in 2025, and 284 through November 4, 2026. These figures are treated as user-supplied historical estimates rather than independently verified totals. The 2021 and 2022 figures should be interpreted cautiously because the catalog was launched in November 2021 and its early expansion included substantial initial population and backfilling. The supplied 2026 monthly counts for January through October are 17, 28, 26, 31, 21, 23, 26, 31, 43, and 36, respectively. These sum to 282, compared with the supplied year-to-date total of 284 through November 4. The figures suggest that annual additions can vary substantially and that the pace of additions increased during parts of 2026. They provide forecasting context but do not affect the resolution procedure. The forecast concerns CISA's cataloging activity during 2027, not the number of vulnerabilities discovered, publicly disclosed, assigned CVE identifiers, exploited for the first time, or remediated during that year. Vulnerabilities originally discovered or exploited in earlier years count if their KEV dateAdded falls in 2027. The question will be resolved using a fixed snapshot of CISA's published catalog in January 2028.

How it resolves

The outcome will equal the number of unique CVE identifiers in CISA's official Known Exploited Vulnerabilities catalog whose dateAdded field is between 2027-01-01 and 2027-12-31, inclusive, as recorded in the first available official dataset snapshot published on or after January 8, 2028, and no later than January 15, 2028. The primary resolution source is CISA's official JSON feed at https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json. If that feed is unavailable, the official CISA-maintained GitHub mirror at https://github.com/cisagov/kev-data/blob/develop/known_exploited_vulnerabilities.json will be used. If both are unavailable, the official CSV feed or an archived version of an official CISA dataset published within the specified resolution window may be used. The snapshot's publication date, catalogVersion, and dateReleased metadata, where available, should be recorded to make the result reproducible. To calculate the outcome, read the vulnerabilities array in the selected JSON dataset, retain entries for which dateAdded is greater than or equal to 2027-01-01 and less than or equal to 2027-12-31, and count the distinct cveID values. If the CSV is used, apply the same filtering and deduplication procedure to its corresponding columns. Each distinct CVE counts once, regardless of the number of affected products, vendors, exploitation incidents, or catalog updates associated with it. The dateAdded field is authoritative for determining the year of addition. The actual publication date of the dataset, the CVE identifier's year, and the original public disclosure date do not determine eligibility. Entries added during 2027 and subsequently revised will count if they remain in the selected resolution snapshot with a qualifying dateAdded. Entries removed before the snapshot will not count unless CISA's official revision history establishes that they were removed solely because of a clerical error or identifier replacement, in which case the corrected entry will be counted once if it retains a qualifying addition date. If CISA retroactively changes an entry's dateAdded before the selected snapshot, the value in that snapshot will govern. Later corrections, additions, or revisions published after the snapshot will not change the resolved outcome. If CISA continues publishing the KEV catalog during 2027 but the primary feed is temporarily unavailable in January 2028, the official GitHub mirror or its historical commits will be used to reconstruct the eligible entries. If no authoritative snapshot or sufficiently complete official historical record is available by January 31, 2028, the question will be annulled rather than resolved using an unverifiable estimate. If CISA permanently discontinues the KEV catalog during 2027 without establishing a direct successor that preserves the dateAdded field or an equivalent date of inclusion, the question will resolve to the number of qualifying entries added before discontinuation, provided that number can be established from an official dataset or official historical record. If CISA transfers the catalog to another government agency or replaces the publication format while preserving substantially the same catalog and entry-level addition dates, the successor dataset will be used to determine the 2027 count.

Fine print

The counting period is the calendar year 2027, not the U.S. federal fiscal year. Dates are interpreted directly from CISA's dateAdded values in YYYY-MM-DD format; no timezone conversion is applied because the relevant field represents a calendar date rather than a timestamp. The outcome measures catalog entries identified by distinct CVE identifiers, rather than vulnerability families, affected software products, individual exploits, or security incidents. A batch addition of multiple CVEs counts as multiple vulnerabilities. A correction to an existing entry does not count as a new addition unless a distinct CVE identifier is introduced with a qualifying dateAdded. The forecast is not limited to vulnerabilities assigned CVE-2027 identifiers. For example, a vulnerability designated CVE-2025-XXXXX that is first included in KEV during 2027 counts toward the outcome. Conversely, a CVE-2027 vulnerability added in January 2028 does not count. The official JSON and CSV feeds should ordinarily produce identical results. If they disagree, the canonical JSON feed takes precedence over the CSV and GitHub mirror, provided its contents are valid and complete. The GitHub commit history may be used to investigate discrepancies, but the selected resolution snapshot remains authoritative except for the explicitly defined treatment of clerical corrections and identifier replacements. The lower and upper bounds define a practical forecasting range rather than a hard cap on CISA's possible activity. Outcomes outside this range remain valid and should be recorded at their actual values. The range accommodates both a substantial slowdown relative to recent years and a large increase in catalog additions, potentially driven by changes in exploitation activity, CISA policy, or catalog maintenance practices.

Analytics cookies

Prolepsia counts visits anonymously unless you accept analytics cookies, which link your visits together.