Houston Vulnerability Index
Which Software Flaws Attackers Are Using Right Now
Houston Vulnerability Index: 1,447 vulnerabilities CISA has confirmed attackers are exploiting, added January 2022 through 2026-10-26. Published 2026-02-11.
Figures shown are a snapshot from 2026-10-26; live data loads from CISA when this page opens.
What is the Houston Vulnerability Index?
The Houston Vulnerability Index is a live view of the CISA Known Exploited Vulnerabilities (KEV) catalog, the federal government's list of software flaws that attackers are confirmed to be using. CinchOps publishes it so Houston business owners can see which vendors and products are being targeted, how fast the list is growing, and which flaws are tied to ransomware, without reading the raw government feed.
How fast the list grows
New entries by the date CISA added them, split by ransomware link. The line is the running total.
| Added to the catalog | 2022 | 2023 | 2024 | 2025 | 2026 to date |
|---|---|---|---|---|---|
| Exploited vulnerabilities | 555 | 187 | 186 | 245 | 274 |
| Linked to ransomware | 132 | 43 | 44 | 31 | 27 |
| Ransomware share | 23.8% | 23.0% | 23.7% | 12.7% | 9.9% |
Who and what attackers are targeting
Entries added to the catalog in the selected year. Pick a year to compare.
Top 15 vendors
Most targeted products
Most common weakness types
Ransomware share, small-business vendors
Share of each vendor's entries CISA links to ransomware. Vendors with fewer than 5 entries in the period are left out so one or two flaws cannot read as 100%.
Key Findings
The finding: 19.1% of the flaws attackers are exploiting are tied to ransomware, but on firewalls, VPNs and remote-access gateways that share rises to 39.6%. The devices that sit directly on the internet are where ransomware gets in, and 2026 has already added 274 newly exploited flaws, against 245 in all of 2025.
Ransomware is the business end
277 of the 1,447 exploited flaws listed since 2022 are confirmed in ransomware campaigns. These are the ones that end in encrypted servers and a ransom demand, not just a stolen password.
The front door gets hit hardest
106 entries are firewalls, VPNs and remote-access gateways. 39.6% of those are tied to ransomware, against 19.1% across the whole list. The device meant to keep attackers out is often how they get in.
Old flaws never retire
390 of the flaws added since 2022, 27.0%, carry CVE numbers from 2018 or earlier. Attackers keep using a flaw for as long as unpatched copies stay online, however old it is.
It is the software small offices run
58.3% of entries come from 28 vendors found in a typical small or mid-sized office, led by Microsoft with 307. This is not a list about exotic enterprise systems.
The list is still growing
CISA has added 274 confirmed-exploited flaws in 2026 so far, against 245 in all of 2025. Every one of them is a flaw with a fix available that attackers are using against businesses that have not applied it.
What should a Houston business do with this data?
Treat every entry on this list that matches software you run as a patch-now item. Attackers are already using it. The order matters less than the speed, but this order covers the most risk first.
- Start at the edge. Firewalls, VPNs and remote-access tools face the internet directly, and 39.6% of their entries are ransomware linked against 19.1% for the list as a whole. Patch them first, and retire any that the vendor no longer supports.
- Then email and Microsoft 365. Microsoft tops the list, and email is still the most common first step in an attack.
- Then anything on the ransomware list. A flaw CISA links to ransomware goes ahead of everything else in your queue, whatever its severity score says.
- Know what you run. If you cannot say which versions of which products are on your network, that gap is the first thing to fix. When a new entry lands, "do we run that?" has to be answerable in minutes.
How CinchOps Can Help
Vulnerability Scanning
Scheduled scans that check your network against this catalog, so you know which of these flaws you actually have rather than guessing.
Vulnerability scanningNetwork Assessment
A full inventory of what is on your network, what version it runs, and what is exposed to the internet. The answer to "do we run that?" before an alert lands.
Network assessmentPatch Management
Patching ranked by this catalog, so the flaws attackers are actually using go first, then everything else on a steady schedule with testing and verification.
Patch managementManaged Firewall
Firewall and VPN firmware kept current, configuration reviewed, and remote access locked down, because the edge is where the ransomware-linked flaws cluster.
Managed firewallWhat This Index Does Not Measure
This index does not measure your exposure, and it does not grade vendors. A vendor with a long list is usually one that many businesses run and attackers study closely, not one with worse security. Nothing in the catalog is specific to Houston either: CISA's list is national. It is the Houston index because it is published for Houston businesses and focused on the vendors their offices run. Whether any of these flaws are on your network is a question only a scan of your network can answer.
Methodology
- Purpose and intent
- To give Houston area businesses a plain view of the software flaws attackers are confirmed to be using, so patching and security decisions start from real attacks rather than alarm. Published as a service to the Houston business community, not to create fear.
- Source
- The CISA Known Exploited Vulnerabilities catalog, published by the Cybersecurity and Infrastructure Security Agency. The page loads it in your browser each time it opens, from CISA's official GitHub mirror (cisagov/kev-data) first and CISA's own feed as a backup. No surveys, no private data, no vendor participation.
- Coverage
- Entries CISA added from January 1, 2022 onward. The catalog launched in November 2021 with a backlog of older flaws, so earlier entries are left out; the full catalog holds 1,758 entries. March 2022 still shows a spike because CISA was finishing that backlog.
- What counts as an entry
- One CVE listed in the catalog, counted in the year and month CISA added it, under the vendor and product names CISA records. A single entry can affect several product versions, and one patch can fix several entries.
- Ransomware link
- CISA's "known ransomware campaign use" field. "Known" means CISA has evidence the flaw was used in ransomware. Anything else means no confirmed link, not a confirmed absence, and CISA often adds the link months after listing a flaw, so recent years read lower than they will later.
- Small-business vendors
- 28 vendors common in small and mid-sized offices: Microsoft, Apple, Google, Adobe, Fortinet, SonicWall, Cisco, VMware, Ivanti, Zyxel, QNAP, D-Link, Palo Alto Networks, Atlassian, Zoho, Citrix, SolarWinds, Sophos, WatchGuard, Veeam, Kaseya, ConnectWise, WordPress, TP-Link, Barracuda Networks, Samsung, Qualcomm, Netgear. Matched on CISA's exact vendor name.
- Firewalls, VPNs and gateways
- Entries whose vendor or product names firewalls, VPNs, remote-access or security gateways, or edge product lines such as FortiGate, PAN-OS, SonicWall, Cisco ASA, NetScaler and Ivanti Connect Secure. A name match, so it slightly undercounts edge devices with generic product names.
- Weakness types
- The CWE identifiers CISA records for each entry, shown under plain names. An entry can carry more than one weakness type or none.
- Known limitations
- The catalog is a deliberately conservative floor: CISA lists a flaw only with evidence of real-world exploitation, so many attacked flaws never appear. Dates are when CISA listed a flaw, not when attacks began. The current year is partial.
- Revisions
- 2026-02-11: first publication. 2026-10-26: rebuilt in the CinchOps research format; the dashboard moved from embedded frames into the page, and the methodology was rewritten to describe how the figures are actually calculated.
- Refresh
- Live. Figures reload from the catalog each time the page opens. If the catalog cannot be reached, the page shows the snapshot taken when it was last built, dated at the top.