⚠ Known Exploited Vulnerability (KEV) Tracker

CISA KEV Catalog
⚠
About the KEV Catalog For the benefit of the cybersecurity community and network defenders — and to help every organization better manage vulnerabilities and keep pace with threat activity — CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild. Organizations should use the KEV catalog as an input to their vulnerability management prioritization framework. Per Binding Operational Directive 26-04 (issued June 10, 2026, replacing BOD 22-01), federal civilian executive branch (FCEB) agencies must remediate each vulnerability within a timeline set by four factors: whether the asset is publicly exposed, whether the CVE is in the KEV catalog, whether exploitation is automatable, and technical impact. KEV status is now one input rather than the whole rule, and the most dangerous combinations call for remediation in three days plus forensic triage. Listings added before June 10, 2026 carry their original BOD 22-01 due dates. CISA strongly recommends all organizations — including private sector entities — prioritize remediation of KEV catalog vulnerabilities. View the full KEV catalog on CISA.gov →
Total KEVs
1,768
in CISA catalog
Ransomware-Linked
361
20% of catalog
Added Last 30 Days
34
106 in last 90 days
Latest Addition
2026-11-04
most recent entry
Tracked Vendors
20+
top 20 shown

Top Vendors

KEV count 20%+ ransomware-linked 41%+ ransomware-linked N RW · %Ransomware-linked share

Share of each bar's KEVs linked to ransomware. Thresholds track the catalog average of 20.4%, so they stay meaningful as it grows. Bars under 5 KEVs are left uncoloured — too few to rate a share.

Microsoft
390
117 RW · 30%
Cisco
102
7 RW · 7%
Apple
96
Adobe
83
11 RW · 13%
Google
76
Oracle
46
13 RW · 28%
Apache
41
8 RW · 20%
Ivanti
38
12 RW · 32%
Linux
32
2 RW · 6%
Fortinet
32
14 RW · 44%
Citrix
27
7 RW · 26%
VMware
26
9 RW · 35%
D-Link
26
2 RW · 8%
SonicWall
19
13 RW · 68%
Synacor
19
6 RW · 32%
Android
17
Palo Alto Networks
16
6 RW · 38%
Samsung
15
Atlassian
14
8 RW · 57%
SAP
14
3 RW · 21%

Top Products

KEV count 20%+ ransomware-linked 41%+ ransomware-linked N RW · %Ransomware-linked share

Share of each bar's KEVs linked to ransomware. Thresholds track the catalog average of 20.4%, so they stay meaningful as it grows. Bars under 5 KEVs are left uncoloured — too few to rate a share.

Windows · Microsoft
175
49 RW · 28%
Multiple Products · Apple
55
Chromium V8 · Google
41
Internet Explorer · Microsoft
36
6 RW · 17%
Flash Player · Adobe
33
5 RW · 15%
Kernel · Linux
32
2 RW · 6%
Office · Microsoft
29
3 RW · 10%
Win32k · Microsoft
25
11 RW · 44%
Exchange Server · Microsoft
17
13 RW · 76%
Zimbra Collaboration Suite (ZCS) · Synacor
17
5 RW · 29%
ColdFusion · Adobe
16
3 RW · 19%
SharePoint · Microsoft
15
8 RW · 53%
IOS and IOS XE Software · Cisco
14
Acrobat and Reader · Adobe
13
1 RW · 8%
PAN-OS · Palo Alto Networks
13
6 RW · 46%
Mobile Devices · Samsung
13
WebLogic Server · Oracle
12
2 RW · 17%
iOS, iPadOS, and macOS · Apple
11
Multiple Chipsets · Qualcomm
11
NetWeaver · SAP
10
2 RW · 20%
Clear 151 entries
BOD 26-04 window, if the asset is publicly exposed: 3 days + forensic triage 1466 3 days 151 14 days 151 Not publicly exposed, the 3-day tiers shrink to 14 days except total-control, automatable entries.
CVE Vendor Product Vulnerability CVSS Added Federal due date BOD 26-04 Ransomware
CVE-2024-27834 Apple Multiple Products Apple Multiple Products Improper Authentication Vulnerability Apple iOS, iPadOS, macOS, Safari, tvOS and watchOS 10.5 contain an improper authentication vulnerability which could allow an attacker with arbitrary read and write capability to bypass pointer authentication. 5.5 CISA 2026-11-04 2026-11-18 14 days not automatable · partial Unknown
CVE-2026-118527 Ivanti Connect Secure Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability Ivanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-111357. 4.3 CNA 2026-10-30 2026-11-13 14 days not automatable · partial Unknown
CVE-2026-41709 Broadcom VMware ESX Broadcom VMWare ESX Insufficient Logging Vulnerability Broadcom VMWare ESX contains an insufficient logging vulnerability that could allow a malicious actor with admin access to perform certain operations without being logged. 2.7 CNA 2026-10-28 2026-11-11 14 days not automatable · partial Unknown
CVE-2026-96652 Plex Media Server Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability Plex Media Server contains a server-side request forgery (SSRF) vulnerability which could allow an attacker using any X-Plex-Token value to include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination. This vulnerability can be chained with CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. 4.3 CNA 2026-10-20 2026-11-03 14 days not automatable · partial Unknown
CVE-2026-96655 Plex Media Server Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability Plex Media Server contains a server-side request forgery (SSRF) vulnerability that could allow an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96656. 4.3 CNA 2026-10-20 2026-11-03 14 days not automatable · partial Unknown
CVE-2026-21589 Atlassian Multiple Products Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an unauthenticated attacker to access specific files within the web application root directory in affected versions. 9.3 CNA 2026-10-15 2026-10-18 14 days not automatable · partial Unknown
CVE-2026-65660 Microsoft SharePoint Microsoft SharePoint Code Injection Vulnerability Microsoft SharePoint contains a code injection vulnerability which could allow an authorized attacker to execute code over a network. 8.8 CNA 2026-09-25 2026-09-28 14 days not automatable · partial Unknown
CVE-2026-48710 Kludex Starlette Kludex Starlette HTTP Request/Response Smuggling Vulnerability Kludex Starlette contains a HTTP request/response smuggling vulnerability that could allow attackers to inject paths into the host part, prepending the actual path leading to issues such as authentication bypass when the authentication depends on the reconstructed URL’s path. This vulnerability could be chaned with CVE-2026-42271. 6.5 CNA 2026-09-02 2026-09-16 14 days not automatable · partial Unknown
CVE-2026-66384 JFrog Artifactory JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability JFrog Artifactory contains an improper limitation of a pathname to a restricted directory vulnerability. This can allow an authenticated user to write data outside the intended Docker cache path under specific remote-repository conditions. 5.3 CNA 2026-08-27 2026-09-10 14 days not automatable · partial Unknown
CVE-2015-3246 Red Hat Libuser Red Hat Libuser Race Condition Vulnerability Red Hat libuser contains a race condition vulnerability that allows authenticated local users to corrupt the /etc/passwd file to cause a denial of service or privilege escalation. 5.1 CISA 2026-08-26 2026-09-09 14 days not automatable · partial Unknown
CVE-2025-68686 Fortinet FortiOS Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability Fortinet FortiOS contains an exposure of sensitive information to an unauthorized actor vulnerability. This may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests. An attacker would need first to have compromised the product via another vulnerability, at filesystem level. 5.3 CNA 2026-07-27 2026-08-10 14 days not automatable · partial Unknown
CVE-2008-4128 Cisco IOS Cisco IOS Cross-Site Request Forgery Vulnerability Cisco IOS 12.4 contains multiple cross-site forgery vulnerabilities that allows remote attackers to execute arbitrary commands via (1) a certain "show privilege" command to the /level/15/exec/- URI, and (2) a certain "alias exec" command to the /level/15/exec/-/configure/http URI. 4.3 CISA 2026-07-13 2026-07-16 14 days not automatable · partial Unknown
CVE-2026-20262 Cisco Catalyst SD-WAN Manager Cisco Catalyst SD-WAN Manager Directory or Path Traversal Vulnerability Cisco Catalyst SD-WAN Manager contains a directory or path traversal vulnerability that could allow an authenticated, remote attacker to create a file or overwrite any file on the filesystem of an affected system. 6.5 CNA 2026-06-15 2026-06-29 14 days not automatable · partial Unknown
CVE-2026-45498 Microsoft Defender Microsoft Defender Denial of Service Vulnerability Microsoft Defender contains an unspecified vulnerability that allows for denial of service. 4.0 CNA 2026-05-20 2026-06-03 14 days not automatable · partial Unknown
CVE-2026-32202 Microsoft Windows Microsoft Windows Protection Mechanism Failure Vulnerability Microsoft Windows Shell contains a protection mechanism failure vulnerability that allows an unauthorized attacker to perform spoofing over a network. 4.3 CNA 2026-04-28 2026-05-12 14 days not automatable · partial Unknown
CVE-2025-48700 Synacor Zimbra Collaboration Suite (ZCS) Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability that could allow attackers to execute arbitrary JavaScript within the user's session, potentially leading to unauthorized access to sensitive information. 6.1 CISA 2026-04-20 2026-04-23 14 days not automatable · partial Unknown
CVE-2026-20133 Cisco Catalyst SD-WAN Manager Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor Vulnerability Cisco Catalyst SD-WAN Manager contains an exposure of sensitive information to an unauthorized actor vulnerability that could allow remote attackers to view sensitive information on affected systems. 6.5 CNA 2026-04-20 2026-04-23 14 days not automatable · partial Unknown
CVE-2025-66376 Synacor Zimbra Collaboration Suite (ZCS) Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability in the Classic UI where attackers could abuse Cascading Style Sheets (CSS) @import directives in email HTML. 7.2 CNA 2026-03-18 2026-04-01 14 days not automatable · partial Unknown
CVE-2021-22175 GitLab GitLab GitLab Server-Side Request Forgery (SSRF) Vulnerability GitLab contains a server-side request forgery (SSRF) vulnerability when requests to the internal network for webhooks are enabled. 6.8 CNA 2026-02-18 2026-03-11 14 days not automatable · partial Unknown
CVE-2026-21525 Microsoft Windows Microsoft Windows NULL Pointer Dereference Vulnerability Microsoft Windows Remote Access Connection Manager contains a NULL pointer dereference that could allow an unauthorized attacker to deny service locally. 6.2 CNA 2026-02-10 2026-03-03 14 days not automatable · partial Unknown
CVE-2021-39935 GitLab Community and Enterprise Editions GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) Vulnerability GitLab Community and Enterprise Editions contain a server-side request forgery vulnerability which could allow unauthorized external users to perform Server Side Requests via the CI Lint API. 6.8 CNA 2026-02-03 2026-02-24 14 days not automatable · partial Unknown
CVE-2025-54313 Prettier eslint-config-prettier Prettier eslint-config-prettier Embedded Malicious Code Vulnerability Prettier eslint-config-prettier contains an embedded malicious code vulnerability. Installing an affected package executes an install.js file that launches the node-gyp.dll malware on Windows. 7.5 CNA 2026-01-22 2026-02-12 14 days not automatable · partial Unknown
CVE-2026-20805 Microsoft Windows Microsoft Windows Information Disclosure Vulnerability Microsoft Windows Desktop Windows Manager contains an information disclosure vulnerability that allows an authorized attacker to disclose information locally. 5.5 CNA 2026-01-13 2026-02-03 14 days not automatable · partial Unknown
CVE-2025-48633 Android Framework Android Framework Information Disclosure Vulnerability Android Framework contains an unspecified vulnerability that allows for information disclosure. 5.5 CISA 2025-12-02 2025-12-23 14 days not automatable · partial Unknown
CVE-2021-26829 OpenPLC ScadaBR OpenPLC ScadaBR Cross-site Scripting Vulnerability OpenPLC ScadaBR contains a cross-site scripting vulnerability via system_settings.shtm. 5.4 CISA 2025-11-28 2025-12-19 14 days not automatable · partial Unknown
CVE-2025-47827 IGEL IGEL OS IGEL OS Use of a Key Past its Expiration Date Vulnerability IGEL OS contains a use of a key past its expiration date vulnerability that allows for Secure Boot bypass. The igel-flash-driver module improperly verifies a cryptographic signature. Ultimately, a crafted root filesystem can be mounted from an unverified SquashFS image. 4.6 CISA 2025-10-14 2025-11-04 14 days not automatable · partial Unknown
CVE-2023-50224 TP-Link TL-WR841N TP-Link TL-WR841N Authentication Bypass by Spoofing Vulnerability TP-Link TL-WR841N contains an authentication bypass by spoofing vulnerability within the httpd service, which listens on TCP port 80 by default, leading to the disclose of stored credentials. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. 6.5 CNA 2025-09-03 2025-09-24 14 days not automatable · partial Unknown
CVE-2025-49706 Microsoft SharePoint Microsoft SharePoint Improper Authentication Vulnerability Microsoft SharePoint contains an improper authentication vulnerability that allows an authorized attacker to perform spoofing over a network. Successfully exploitation could allow an attacker to view sensitive information and make some changes to disclosed information. This vulnerability could be chained with CVE-2025-49704. CVE-2025-53771 is a patch bypass for CVE-2025-49706, and the updates for CVE-2025-53771 include more robust protection than those for CVE-2025-49706. 6.5 CNA 2025-07-22 2025-07-23 14 days not automatable · partial Known
CISA Releases Malware Analysis Report Associated with Microsoft SharePoint Vulnerabilities MAR-251132.c1.v1 Exploitation of SharePoint Vulnerabilities 2025-027: Critical Vulnerabilities in Microsoft SharePoint UPDATE: Microsoft Releases Guidance on Exploitation of SharePoint Vulnerabilities
CVE-2025-48928 TeleMessage TM SGNL TeleMessage TM SGNL Exposure of Core Dump File to an Unauthorized Control Sphere Vulnerability TeleMessage TM SGNL contains an exposure of core dump file to an unauthorized control sphere Vulnerability. This vulnerability is based on a JSP application in which the heap content is roughly equivalent to a "core dump" in which a password previously sent over HTTP would be included in this dump. 4.0 CNA 2025-07-01 2025-07-22 14 days not automatable · partial Unknown
CVE-2019-6693 Fortinet FortiOS Fortinet FortiOS Use of Hard-Coded Credentials Vulnerability Fortinet FortiOS contains a use of hard-coded credentials vulnerability that could allow an attacker to cipher sensitive data in FortiOS configuration backup file via knowledge of the hard-coded key. 6.5 CISA 2025-06-25 2025-07-16 14 days not automatable · partial Known
CVE-2025-43200 Apple Multiple Products Apple Multiple Products Unspecified Vulnerability Apple iOS, iPadOS, macOS, watchOS, and visionOS, contain an unspecified vulnerability when processing a maliciously crafted photo or video shared via an iCloud Link. 4.2 CISA 2025-06-16 2025-07-07 14 days not automatable · partial Unknown
CVE-2025-47729 TeleMessage TM SGNL TeleMessage TM SGNL Hidden Functionality Vulnerability TeleMessage TM SGNL contains a hidden functionality vulnerability in which the archiving backend holds cleartext copies of messages from TM SGNL application users. 1.9 CNA 2025-05-12 2025-06-02 14 days not automatable · partial Unknown
CVE-2025-24054 Microsoft Windows Microsoft Windows NTLM Hash Disclosure Spoofing Vulnerability Microsoft Windows NTLM contains an external control of file name or path vulnerability that allows an unauthorized attacker to perform spoofing over a network. 6.5 CNA 2025-04-17 2025-05-08 14 days not automatable · partial Unknown
CVE-2024-53150 Linux Kernel Linux Kernel Out-of-Bounds Read Vulnerability Linux Kernel contains an out-of-bounds read vulnerability in the USB-audio driver that allows a local, privileged attacker to obtain potentially sensitive information. 7.1 CISA 2025-04-09 2025-04-30 14 days not automatable · partial Unknown
CVE-2025-24984 Microsoft Windows Microsoft Windows NTFS Information Disclosure Vulnerability Microsoft Windows New Technology File System (NTFS) contains an insertion of sensitive Information into log file vulnerability that allows an unauthorized attacker to disclose information with a physical attack. An attacker who successfully exploited this vulnerability could potentially read portions of heap memory. 4.6 CNA 2025-03-11 2025-04-01 14 days not automatable · partial Unknown
CVE-2025-24991 Microsoft Windows Microsoft Windows NTFS Out-Of-Bounds Read Vulnerability Microsoft Windows New Technology File System (NTFS) contains an out-of-bounds read vulnerability that allows an authorized attacker to disclose information locally. 5.5 CNA 2025-03-11 2025-04-01 14 days not automatable · partial Unknown
CVE-2024-50302 Linux Kernel Linux Kernel Use of Uninitialized Resource Vulnerability The Linux kernel contains a use of uninitialized resource vulnerability that allows an attacker to leak kernel memory via a specially crafted HID report. 5.5 CISA 2025-03-04 2025-03-25 14 days not automatable · partial Unknown
CVE-2025-22226 VMware ESXi, Workstation, and Fusion VMware ESXi, Workstation, and Fusion Information Disclosure Vulnerability VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read in HGFS. Successful exploitation allows an attacker with administrative privileges to a virtual machine to leak memory from the vmx process. 7.1 CNA 2025-03-04 2025-03-25 14 days not automatable · partial Unknown
CVE-2025-0111 Palo Alto Networks PAN-OS Palo Alto Networks PAN-OS File Read Vulnerability Palo Alto Networks PAN-OS contains an external control of file name or path vulnerability. Successful exploitation enables an authenticated attacker with network access to the management web interface to read files on the PAN-OS filesystem that are readable by the “nobody” user. 7.1 CNA 2025-02-20 2025-03-13 14 days not automatable · partial Unknown
CVE-2025-24200 Apple iOS and iPadOS Apple iOS and iPadOS Incorrect Authorization Vulnerability Apple iOS and iPadOS contains an incorrect authorization vulnerability that allows a physical attacker to disable USB Restricted Mode on a locked device. 6.1 CISA 2025-02-12 2025-03-05 14 days not automatable · partial Unknown
CVE-2025-21391 Microsoft Windows Microsoft Windows Storage Link Following Vulnerability Microsoft Windows Storage contains a link following vulnerability that could allow for privilege escalation. This vulnerability could allow an attacker to delete data including data that results in the service being unavailable. 7.1 CNA 2025-02-11 2025-03-04 14 days not automatable · partial Unknown
CVE-2020-11023 JQuery JQuery JQuery Cross-Site Scripting (XSS) Vulnerability JQuery contains a persistent cross-site scripting (XSS) vulnerability. When passing maliciously formed, untrusted input enclosed in HTML tags, JQuery's DOM manipulators can execute untrusted code in the context of the user's browser. 6.9 CNA 2025-01-23 2025-02-13 14 days not automatable · partial Unknown
CVE-2024-44309 Apple Multiple Products Apple Multiple Products Cross-Site Scripting (XSS) Vulnerability Apple iOS, macOS, and other Apple products contain an unspecified vulnerability when processing maliciously crafted web content that may lead to a cross-site scripting (XSS) attack. 6.3 CISA 2024-11-21 2024-12-12 14 days not automatable · partial Unknown
CVE-2024-43451 Microsoft Windows Microsoft Windows NTLMv2 Hash Disclosure Spoofing Vulnerability Microsoft Windows contains an NTLMv2 hash spoofing vulnerability that could result in disclosing a user's NTLMv2 hash to an attacker via a file open operation. The attacker could then leverage this hash to impersonate that user. 6.5 CNA 2024-11-12 2024-12-03 14 days not automatable · partial Unknown
CVE-2024-37383 Roundcube Webmail RoundCube Webmail Cross-Site Scripting (XSS) Vulnerability RoundCube Webmail contains a cross-site scripting (XSS) vulnerability in the handling of SVG animate attributes that allows a remote attacker to run malicious JavaScript code. 6.1 CISA 2024-10-24 2024-11-14 14 days not automatable · partial Unknown
CVE-2024-9379 Ivanti Cloud Services Appliance (CSA) Ivanti Cloud Services Appliance (CSA) SQL Injection Vulnerability Ivanti Cloud Services Appliance (CSA) contains a SQL injection vulnerability in the admin web console in versions prior to 5.0.2, which can allow a remote attacker authenticated as administrator to run arbitrary SQL statements. 6.5 CNA 2024-10-09 2024-10-30 14 days not automatable · partial Unknown
CVE-2024-43573 Microsoft Windows Microsoft Windows MSHTML Platform Spoofing Vulnerability Microsoft Windows MSHTML Platform contains an unspecified spoofing vulnerability which can lead to a loss of confidentiality. 6.5 CNA 2024-10-08 2024-10-29 14 days not automatable · partial Unknown
CVE-2024-38217 Microsoft Windows Microsoft Windows Mark of the Web (MOTW) Protection Mechanism Failure Vulnerability Microsoft Windows Mark of the Web (MOTW) contains a protection mechanism failure vulnerability that allows an attacker to bypass MOTW-based defenses. This can result in a limited loss of integrity and availability of security features such as Protected View in Microsoft Office, which rely on MOTW tagging. 5.4 CNA 2024-09-10 2024-10-01 14 days not automatable · partial Unknown
CVE-2024-38213 Microsoft Windows Microsoft Windows SmartScreen Security Feature Bypass Vulnerability Microsoft Windows SmartScreen contains a security feature bypass vulnerability that allows an attacker to bypass the SmartScreen user experience via a malicious file. 6.5 CNA 2024-08-13 2024-09-03 14 days not automatable · partial Unknown
CVE-2020-13965 Roundcube Webmail Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability Roundcube Webmail contains a cross-site scripting (XSS) vulnerability that allows a remote attacker to manipulate data via a malicious XML attachment. 6.3 CISA 2024-06-26 2024-07-17 14 days not automatable · partial Unknown