CISA KEV · November 2026
In November 2026 so far (to 3 Nov 2026), CISA added 1 vulnerability to its Known Exploited Vulnerabilities (KEV) catalog (36 in all of October 2026). None are known to be used in ransomware campaigns. The most affected vendors were WordPress (1). Every entry below has reliable evidence of exploitation in the wild, so if you run the product, patch or mitigate it first. This page updates as CISA adds entries during the month.
| Added | CVE | Vulnerability | Federal due |
|---|---|---|---|
| 3 Nov 2026 | CVE-2026-119977 | WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition VulnerabilityWordPress · WordPress Core |
Run your vendors and products through stack check, pre-filled with this month's vendors; it also gives you an RSS feed for new additions. The long-run picture is on CVE Trends.
Week-by-week detail, with EPSS scores and CISA's required action for each entry, is in the KEV digests: 30–1 Nov.
1 vulnerability so far, up to 3 Nov 2026. In October 2026 it added 36.
WordPress, with 1 entry.
It is the US Cybersecurity and Infrastructure Security Agency's list of vulnerabilities with reliable evidence of exploitation in the wild, currently 1,767 entries. US federal agencies must fix listed vulnerabilities by the due date; for everyone else it is the best public list of what to patch first.
How this is made: generated automatically from the CISA KEV catalog, grouped by the date CISA added each entry. Vulnerability names are CISA's. Federal due dates apply to US agencies under BOD 22-01; for everyone else they are a sensible upper bound.
We wire CISA KEV and EPSS into your scanner, SIEM and ticketing, so your team sees the few entries that match your estate, with deadlines an auditor accepts.
Get in touch →