⚠ Known Exploited Vulnerability (KEV) Tracker

CISA KEV Catalog
⚠
About the KEV Catalog For the benefit of the cybersecurity community and network defenders — and to help every organization better manage vulnerabilities and keep pace with threat activity — CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild. Organizations should use the KEV catalog as an input to their vulnerability management prioritization framework. Per Binding Operational Directive 26-04 (issued June 10, 2026, replacing BOD 22-01), federal civilian executive branch (FCEB) agencies must remediate each vulnerability within a timeline set by four factors: whether the asset is publicly exposed, whether the CVE is in the KEV catalog, whether exploitation is automatable, and technical impact. KEV status is now one input rather than the whole rule, and the most dangerous combinations call for remediation in three days plus forensic triage. Listings added before June 10, 2026 carry their original BOD 22-01 due dates. CISA strongly recommends all organizations — including private sector entities — prioritize remediation of KEV catalog vulnerabilities. View the full KEV catalog on CISA.gov →
Total KEVs — Android
17
for Android
Ransomware-Linked — Android
0
0% of Android's KEVs
Added Last 30 Days — Android
0
0 in last 90 days
Latest Addition — Android
2026-06-02
most recent for this vendor

Top Vendors

KEV count 20%+ ransomware-linked 41%+ ransomware-linked N RW · %Ransomware-linked share

Share of each bar's KEVs linked to ransomware. Thresholds track the catalog average of 20.4%, so they stay meaningful as it grows. Bars under 5 KEVs are left uncoloured — too few to rate a share.

Microsoft
390
117 RW · 30%
Cisco
102
7 RW · 7%
Apple
96
Adobe
83
11 RW · 13%
Google
76
Oracle
46
13 RW · 28%
Apache
41
8 RW · 20%
Ivanti
38
12 RW · 32%
Linux
32
2 RW · 6%
Fortinet
32
14 RW · 44%
Citrix
27
7 RW · 26%
VMware
26
9 RW · 35%
D-Link
26
2 RW · 8%
SonicWall
19
13 RW · 68%
Synacor
19
6 RW · 32%
Android
17
Palo Alto Networks
16
6 RW · 38%
Samsung
15
Atlassian
14
8 RW · 57%
SAP
14
3 RW · 21%

Top Products

KEV count 20%+ ransomware-linked 41%+ ransomware-linked N RW · %Ransomware-linked share

Share of each bar's KEVs linked to ransomware. Thresholds track the catalog average of 20.4%, so they stay meaningful as it grows. Bars under 5 KEVs are left uncoloured — too few to rate a share.

Windows · Microsoft
175
49 RW · 28%
Multiple Products · Apple
55
Chromium V8 · Google
41
Internet Explorer · Microsoft
36
6 RW · 17%
Flash Player · Adobe
33
5 RW · 15%
Kernel · Linux
32
2 RW · 6%
Office · Microsoft
29
3 RW · 10%
Win32k · Microsoft
25
11 RW · 44%
Exchange Server · Microsoft
17
13 RW · 76%
Zimbra Collaboration Suite (ZCS) · Synacor
17
5 RW · 29%
ColdFusion · Adobe
16
3 RW · 19%
SharePoint · Microsoft
15
8 RW · 53%
IOS and IOS XE Software · Cisco
14
Acrobat and Reader · Adobe
13
1 RW · 8%
PAN-OS · Palo Alto Networks
13
6 RW · 46%
Mobile Devices · Samsung
13
WebLogic Server · Oracle
12
2 RW · 17%
iOS, iPadOS, and macOS · Apple
11
Multiple Chipsets · Qualcomm
11
NetWeaver · SAP
10
2 RW · 20%
Clear 17 entries
BOD 26-04 window, if the asset is publicly exposed: 3 days + forensic triage 1466 3 days 151 14 days 151 Not publicly exposed, the 3-day tiers shrink to 14 days except total-control, automatable entries.
CVE Vendor Product Vulnerability CVSS Added Federal due date BOD 26-04 Ransomware
CVE-2025-48595 Android Framework Android Framework Integer Overflow Vulnerability Android Framework contains an integer overflow vulnerability that allows for code execution that could allow for local privilege escalation. 8.4 CISA 2026-06-02 2026-06-05 3 days + forensic triage not automatable · total Unknown
CVE-2025-48572 Android Framework Android Framework Privilege Escalation Vulnerability Android Framework contains an unspecified vulnerability that allows for privilege escalation. 7.8 CISA 2025-12-02 2025-12-23 3 days + forensic triage not automatable · total Unknown
CVE-2025-48633 Android Framework Android Framework Information Disclosure Vulnerability Android Framework contains an unspecified vulnerability that allows for information disclosure. 5.5 CISA 2025-12-02 2025-12-23 14 days not automatable · partial Unknown
CVE-2025-48543 Android Runtime Android Runtime Use-After-Free Vulnerability Android Runtime contains a use-after-free vulnerability potentially allowing a chrome sandbox escape leading to local privilege escalation. 8.8 CISA 2025-09-04 2025-09-25 3 days + forensic triage not automatable · total Unknown
CVE-2024-43093 Android Framework Android Framework Privilege Escalation Vulnerability Android Framework contains an unspecified vulnerability that allows for privilege escalation. 7.3 CISA 2024-11-07 2024-11-28 3 days + forensic triage not automatable · total Unknown
CVE-2024-36971 Android Kernel Android Kernel Remote Code Execution Vulnerability Android contains an unspecified vulnerability in the kernel that allows for remote code execution. This vulnerability resides in Linux Kernel and could impact other products, including but not limited to Android OS. 7.8 CISA 2024-08-07 2024-08-28 3 days + forensic triage not automatable · total Unknown
CVE-2024-32896 Android Pixel Android Pixel Privilege Escalation Vulnerability Android Pixel contains an unspecified vulnerability in the firmware that allows for privilege escalation. 8.1 CISA 2024-06-13 2024-07-04 3 days + forensic triage not automatable · total Unknown
CVE-2024-29745 Android Pixel Android Pixel Information Disclosure Vulnerability Android Pixel contains an information disclosure vulnerability in the fastboot firmware used to support unlocking, flashing, and locking affected devices. 5.5 CISA 2024-04-04 2024-04-25 14 days not automatable · partial Unknown
CVE-2024-29748 Android Pixel Android Pixel Privilege Escalation Vulnerability Android Pixel contains a privilege escalation vulnerability that allows an attacker to interrupt a factory reset triggered by a device admin app. 7.8 CISA 2024-04-04 2024-04-25 3 days + forensic triage not automatable · total Unknown
CVE-2023-21237 Android Pixel Android Pixel Information Disclosure Vulnerability Android Pixel contains a vulnerability in the Framework component, where the UI may be misleading or insufficient, providing a means to hide a foreground service notification. This could enable a local attacker to disclose sensitive information. 6.2 CISA 2024-03-05 2024-03-26 14 days not automatable · partial Unknown
CVE-2023-35674 Android Framework Android Framework Privilege Escalation Vulnerability Android Framework contains an unspecified vulnerability that allows for privilege escalation. 8.8 CISA 2023-09-13 2023-10-04 3 days + forensic triage not automatable · total Unknown
CVE-2023-20963 Android Framework Android Framework Privilege Escalation Vulnerability Android Framework contains an unspecified vulnerability that allows for privilege escalation after updating an app to a higher Target SDK with no additional execution privileges needed. 7.8 CISA 2023-04-13 2023-05-04 3 days + forensic triage not automatable · total Unknown
CVE-2011-1823 Android Android OS Android OS Privilege Escalation Vulnerability The vold volume manager daemon in Android kernel trusts messages from a PF_NETLINK socket, which allows an attacker to execute code and gain root privileges. This vulnerability is associated with GingerBreak and Exploit.AndroidOS.Lotoor. 7.8 CISA 2022-09-08 2022-09-29 3 days + forensic triage not automatable · total Unknown
CVE-2021-0920 Android Kernel Android Kernel Race Condition Vulnerability Android kernel contains a race condition, which allows for a use-after-free vulnerability. Exploitation can allow for privilege escalation. 6.4 CISA 2022-05-23 2022-06-13 3 days + forensic triage not automatable · total Unknown
CVE-2021-1048 Android Kernel Android Kernel Use-After-Free Vulnerability Android kernel contains a use-after-free vulnerability that allows for privilege escalation. 7.8 CISA 2022-05-23 2022-06-13 3 days + forensic triage not automatable · total Unknown
CVE-2020-0041 Android Android Kernel Android Kernel Out-of-Bounds Write Vulnerability Android Kernel binder_transaction of binder.c contains an out-of-bounds write vulnerability due to an incorrect bounds check that could allow for local privilege escalation. This vulnerability was observed chained with CVE-2019-2215 and CVE-2020-0069 under exploit chain "AbstractEmu." 7.8 CISA 2021-11-03 2022-05-03 3 days + forensic triage not automatable · total Unknown
CVE-2019-2215 Android Android Kernel Android Kernel Use-After-Free Vulnerability Android Kernel contains a use-after-free vulnerability in binder.c that allows for privilege escalation from an application to the Linux Kernel. This vulnerability was observed chained with CVE-2020-0041 and CVE-2020-0069 under exploit chain "AbstractEmu." 7.8 CISA 2021-11-03 2022-05-03 3 days + forensic triage not automatable · total Unknown