A third of what attackers exploit today is older than 2020

558 of the 1,769 vulnerabilities CISA has confirmed under active exploitation carry a CVE identifier from before 2020. The oldest is from 2002. While every vendor newsletter chases this week's CVE, almost a third of the observed attacks are against flaws that have had a patch for seven years or more.

31.5%of actively exploited CVEs predate 2020
2002the oldest one still being exploited
20.4%tied to a known ransomware campaign

Get the file

$29 one time. Instant download, no account, no subscription.
Full refund within 14 days, no questions asked.

Check the claim before you pay

CISA publishes its Known Exploited Vulnerabilities catalogue free, as a JSON file, and anyone can count it. Catalogue version 2026.11.06, released 6 November 2026, holds 1,769 entries. 558 of them carry a CVE identifier from before 2020.

CISA adds an entry only when exploitation has been observed in the wild. These are not theoretical and they are not scored by a model. Someone was attacked with each one.

We say plainly that the underlying data is free. What this file sells is the cut, the age analysis, the ransomware cross reference and a table that works offline.

Why the newest CVE is the wrong thing to chase

Patch prioritisation runs on severity scores and publication dates, so attention follows whatever was disclosed most recently. The catalogue of what is actually being exploited does not move the same way. The median entry was added more than a year after its identifier year.

The practical consequence is that a team can be fully current on this quarter's advisories while leaving the things actually being used against them untouched, because they were filed years ago and fell off the list.

What you get

data.csv, all 1,769 entries in 12 columns, with the CVE year, the age in years and an age band added to CISA's own fields. Sort and filter against your own inventory.
report.html, the age bands with their ransomware share, the fifteen vendors carrying the most pre-2020 entries, the forty oldest listed by name, and the method behind every figure.
README.txt, every column defined, every known limit stated.

What this does not tell you

It says what is being exploited in the wild. It does not say what you are exposed to, which depends on what you run. Cross the vendor and product columns against your own inventory, that is what the CSV is for.

Age is the year in the CVE identifier, which is when the identifier was assigned, not when the flaw was introduced or disclosed. It is the only age the catalogue carries and the report says so rather than using it silently.

Vendor counts are catalogue entries, not installed instances. A large vendor appears more often because it ships more software.

A dated snapshot of 6 November 2026. CISA updates the catalogue continuously, and absence from it is not safety.

Get the file

$29 one time. Instant download, no account, no subscription.
Full refund within 14 days, no questions asked.

Not what you were looking for

The whole index is free and needs no account. 12,255 companies, one page each, with the figures as published and a link to every source.