Vendors
Ranked by risk — severity weighted, escalated for confirmed exploitation and exploit probability. Raw counts are shown alongside, because volume alone rewards vendors with weaker disclosure programs. Narrow to a single product line to compare firewalls against firewalls rather than whole portfolios.
Risk-weighted, 2026
Firewall / NGFW
Who finds the vulnerabilities
All years. A vendor that finds its own bugs is doing something different from one whose bugs are found by outsiders — and raw counts cannot tell them apart.
Cisco
57% found in-house · of 935 attributed
- Vendor found 531
- Third party 404
- Unknown 1
- Not disclosed 238
Fortinet
56% found in-house · of 386 attributed
- Vendor found 216
- Third party 170
- Not disclosed 3
Palo Alto Networks
32% found in-house · of 212 attributed
- Vendor found 68
- Third party 131
- Customer 13
- Unknown 21
- Not disclosed 2
Check Point
- Not disclosed 33
Vendor totals, 2026
Firewall / NGFW — set the year, category and comparison above.
| Vendor | Risk | CVEs | Critical | Exploited | All products |
|---|---|---|---|---|---|
| Cisco | 349.5 | 87 | 6 | 2 | 583 |
| Palo Alto Networks | 189.6 | 37 | 1 | 3 | 102 |
| Check Point | 176.1 | 10 | 3 | 2 | 18 |
| Fortinet | 159.1 | 25 | 1 | 4 | 124 |
Risk, CVEs, critical and exploited counts are scoped to the selected category. “All products” is the vendor's whole portfolio for the year, including non-security lines such as routing, switching and collaboration, which never count toward risk. A CVE affecting products in two categories counts in full under each — it is a real vulnerability in both.