Skip to content

The 24-hour reporting duty is in force. Check whether it applies to you

Exploited catalogue · September 2026

43 additions to the exploited list

Added this month
43
In watched inventories
0
Catalogue at month end
1,730

43 vulnerabilities were added to the CISA Known Exploited Vulnerabilities catalogue in September 2026.

None of them is in a component that appears in an inventory watched here.

The catalogue stood at 1,730 entries at the end of the month.

A component on the list is a reason to assess whether a product is affected. It is not by itself a reportable event under Article 14.

The duty is Article 14; a catalogue entry starts the assessment, not the clock.Art. 14⁠(1)⁠

Get next month’s by email

One email a month: how many vulnerabilities were added to the CISA exploited catalogue, and how many of them sit in components that appear in real inventories. Counts only. It is not a list, and nothing else is sent.

Every issue is kept at its own address. All issues.

This produces evidence, timelines and drafts. It is not legal advice, and you remain the party responsible for reporting.