⚠
About the KEV Catalog For the benefit of the cybersecurity community and network defenders — and to help every organization better manage vulnerabilities and keep pace with threat activity — CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild. Organizations should use the KEV catalog as an input to their vulnerability management prioritization framework. Per Binding Operational Directive 22-01, all federal civilian executive branch (FCEB) agencies are required to remediate KEV catalog vulnerabilities by their listed due dates. CISA strongly recommends all organizations — including private sector entities — prioritize remediation of KEV catalog vulnerabilities. View the full KEV catalog on CISA.gov →
Total KEVs
1,721
in CISA catalog
Ransomware-Linked
360
21% of catalog
Added Last 30 Days
46
92 in last 90 days
Latest Addition
2026-09-22
most recent entry
Tracked Vendors
20+
top 20 shown

Top Vendors

KEV count 21%+ ransomware-linked 42%+ ransomware-linked N RW · %Ransomware-linked share

Share of each bar's KEVs linked to ransomware. Thresholds track the catalog average of 20.9%, so they stay meaningful as it grows. Bars under 5 KEVs are left uncoloured — too few to rate a share.

388
117 RW · 30%
99
7 RW · 7%
94
81
11 RW · 14%
75
46
13 RW · 28%
40
8 RW · 20%
35
12 RW · 34%
31
2 RW · 6%
30
14 RW · 47%
26
9 RW · 35%
26
2 RW · 8%
24
7 RW · 29%
19
13 RW · 68%
19
6 RW · 32%
17
15
6 RW · 40%
15
SAP
14
3 RW · 21%
13
1 RW · 8%

Top Products

KEV count 21%+ ransomware-linked 42%+ ransomware-linked N RW · %Ransomware-linked share

Share of each bar's KEVs linked to ransomware. Thresholds track the catalog average of 20.9%, so they stay meaningful as it grows. Bars under 5 KEVs are left uncoloured — too few to rate a share.

Windows · Microsoft
174
49 RW · 28%
Multiple Products · Apple
53
Chromium V8 · Google
41
Internet Explorer · Microsoft
36
6 RW · 17%
Flash Player · Adobe
33
5 RW · 15%
Kernel · Linux
31
2 RW · 6%
Office · Microsoft
29
3 RW · 10%
Win32k · Microsoft
25
11 RW · 44%
Exchange Server · Microsoft
17
13 RW · 76%
Zimbra Collaboration Suite (ZCS) · Synacor
17
5 RW · 29%
ColdFusion · Adobe
16
3 RW · 19%
SharePoint · Microsoft
14
8 RW · 57%
IOS and IOS XE Software · Cisco
14
Acrobat and Reader · Adobe
13
1 RW · 8%
Mobile Devices · Samsung
13
PAN-OS · Palo Alto Networks
12
6 RW · 50%
WebLogic Server · Oracle
12
2 RW · 17%
iOS, iPadOS, and macOS · Apple
11
Multiple Chipsets · Qualcomm
11
NetWeaver · SAP
10
2 RW · 20%
Clear 46 entries
CVE Vendor Product Vulnerability CVSS Added Due per BOD 22-01 Ransomware
CVE-2026-21962 Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in contain an improper access control vulnerability that can result in unauthorized creation, deletion or modification access to critical data as well as unauthorized access to critical data or complete access to all Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in accessible data. 10.0 CNA 2026-08-24 2026-08-27 Unknown
CVE-2026-46817 Oracle E-Business Suite Oracle E-Business Suite Improper Privilege Management Vulnerability Oracle E-Business Suite contains an improper privilege management vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Payments. Successful attacks of this vulnerability can result in takeover of Oracle Payments. 9.8 CNA 2026-07-15 2026-07-18 Unknown
CVE-2026-35273 Oracle PeopleSoft Enterprise PeopleTools Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability Oracle PeopleSoft Enterprise PeopleTools contains a missing authentication for critical function vulnerability which could allow an unauthenticated attacker to obtain takeover of PeopleSoft Enterprise PeopleTools. 9.8 CNA 2026-06-12 2026-06-15 Known
CVE-2024-21182 Oracle WebLogic Server Oracle WebLogic Server Unspecified Vulnerability Oracle WebLogic contains an unspecified vulnerability that could allow an unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. 7.5 CNA 2026-06-01 2026-06-04 Unknown
CVE-2025-61757 Oracle Fusion Middleware Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability Oracle Fusion Middleware contains a missing authentication for critical function vulnerability, allowing unauthenticated remote attackers to take over Identity Manager. 9.8 CNA 2025-11-21 2025-12-12 Unknown
CVE-2025-61884 Oracle E-Business Suite Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability Oracle E-Business Suite contains a server-side request forgery (SSRF) vulnerability in the Runtime component of Oracle Configurator. This vulnerability is remotely exploitable without authentication. 7.5 CNA 2025-10-20 2025-11-10 Known
CVE-2025-61882 Oracle E-Business Suite Oracle E-Business Suite Unspecified Vulnerability Oracle E-Business Suite contains an unspecified vulnerability in the BI Publisher Integration component. The vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Concurrent Processing. Successful attacks can result in takeover of Oracle Concurrent Processing. 9.8 CNA 2025-10-06 2025-10-27 Known
CVE-2024-20953 Oracle Agile Product Lifecycle Management (PLM) Oracle Agile Product Lifecycle Management (PLM) Deserialization Vulnerability Oracle Agile Product Lifecycle Management (PLM) contains a deserialization vulnerability that allows a low-privileged attacker with network access via HTTP to compromise the system. 8.8 CNA 2025-02-24 2025-03-17 Unknown
CVE-2020-2883 Oracle WebLogic Server Oracle WebLogic Server Unspecified Vulnerability Oracle WebLogic Server, a product within the Fusion Middleware suite, contains an unspecified vulnerability exploitable by an unauthenticated attacker with network access via IIOP or T3. 9.8 CNA 2025-01-07 2025-01-28 Unknown
CVE-2024-21287 Oracle Agile Product Lifecycle Management (PLM) Oracle Agile Product Lifecycle Management (PLM) Incorrect Authorization Vulnerability Oracle Agile Product Lifecycle Management (PLM) contains an incorrect authorization vulnerability in the Process Extension component of the Software Development Kit. Successful exploitation of this vulnerability may result in unauthenticated file disclosure. 7.5 CNA 2024-11-21 2024-12-12 Unknown
CVE-2022-21445 Oracle ADF Faces Oracle ADF Faces Deserialization of Untrusted Data Vulnerability Oracle ADF Faces library, included with Oracle JDeveloper Distribution, contains a deserialization of untrusted data vulnerability leading to unauthenticated remote code execution. 9.8 CNA 2024-09-18 2024-10-09 Unknown
CVE-2020-14644 Oracle WebLogic Server Oracle WebLogic Server Remote Code Execution Vulnerability Oracle WebLogic Server, a product within the Fusion Middleware suite, contains a deserialization vulnerability. Unauthenticated attackers with network access via T3 or IIOP can exploit this vulnerability to achieve remote code execution. 9.8 CNA 2024-09-18 2024-10-09 Unknown
CVE-2017-3506 Oracle WebLogic Server Oracle WebLogic Server OS Command Injection Vulnerability Oracle WebLogic Server, a product within the Fusion Middleware suite, contains an OS command injection vulnerability that allows an attacker to execute arbitrary code via a specially crafted HTTP request that includes a malicious XML document. 7.4 CISA 2024-06-03 2024-06-24 Unknown
CVE-2020-2551 Oracle Fusion Middleware Oracle Fusion Middleware Unspecified Vulnerability Oracle Fusion Middleware contains an unspecified vulnerability in the WLS Core Components that allows an unauthenticated attacker with network access via IIOP to compromise the WebLogic Server. 9.8 CNA 2023-11-16 2023-12-07 Unknown
CVE-2016-3427 Oracle Java SE and JRockit Oracle Java SE and JRockit Unspecified Vulnerability Oracle Java SE and JRockit contains an unspecified vulnerability that allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Java Management Extensions (JMX). This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. 9.8 CISA 2023-05-12 2023-06-02 Unknown
CVE-2023-21839 Oracle WebLogic Server Oracle WebLogic Server Unspecified Vulnerability Oracle WebLogic Server contains an unspecified vulnerability that allows an unauthenticated attacker with network access via T3, IIOP, to compromise Oracle WebLogic Server. 7.5 CNA 2023-05-01 2023-05-22 Unknown
CVE-2022-21587 Oracle E-Business Suite Oracle E-Business Suite Unspecified Vulnerability Oracle E-Business Suite contains an unspecified vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator. 9.8 CNA 2023-02-02 2023-02-23 Known
CVE-2021-35587 Oracle Fusion Middleware Oracle Fusion Middleware Unspecified Vulnerability Oracle Fusion Middleware Access Manager allows an unauthenticated attacker with network access via HTTP to takeover the Access Manager product. 9.8 CNA 2022-11-28 2022-12-19 Unknown
CVE-2018-2628 Oracle WebLogic Server Oracle WebLogic Server Unspecified Vulnerability Oracle WebLogic Server contains an unspecified vulnerability which can allow an unauthenticated attacker with T3 network access to compromise the server. 9.8 CISA 2022-09-08 2022-09-29 Unknown
CVE-2010-0840 Oracle Java Runtime Environment (JRE) Oracle JRE Unspecified Vulnerability Unspecified vulnerability in the Java Runtime Environment (JRE) in Java SE component allows remote attackers to affect confidentiality, integrity, and availability via Unknown vectors. 9.8 CISA 2022-05-25 2022-06-15 Unknown
CVE-2012-1710 Oracle Fusion Middleware Oracle Fusion Middleware Unspecified Vulnerability Unspecified vulnerability in the Oracle WebCenter Forms Recognition component in Oracle Fusion Middleware allows remote attackers to affect confidentiality, integrity, and availability via Unknown vectors related to Designer. 9.8 CISA 2022-05-25 2022-06-15 Known
CVE-2013-0422 Oracle Java Runtime Environment (JRE) Oracle JRE Remote Code Execution Vulnerability A vulnerability in the way Java restricts the permissions of Java applets could allow an attacker to execute commands on a vulnerable system. 9.8 CISA 2022-05-25 2022-06-15 Known
CVE-2013-0431 Oracle Java Runtime Environment (JRE) Oracle JRE Sandbox Bypass Vulnerability Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle allows remote attackers to bypass the Java security sandbox. 5.3 CISA 2022-05-25 2022-06-15 Known
CVE-2013-2423 Oracle Java Runtime Environment (JRE) Oracle JRE Unspecified Vulnerability Unspecified vulnerability in hotspot for Java Runtime Environment (JRE) allows remote attackers to affect integrity. 3.7 CISA 2022-05-25 2022-06-15 Unknown
CVE-2019-3010 Oracle Solaris Oracle Solaris Privilege Escalation Vulnerability Oracle Solaris component: XScreenSaver contains an unspecified vulnerability that allows for privilege escalation. 8.8 CISA 2022-05-25 2022-06-15 Unknown
CVE-2012-0518 Oracle Fusion Middleware Oracle Fusion Middleware Unspecified Vulnerability Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware allows remote attackers to affect integrity via Unknown vectors 4.7 CISA 2022-03-28 2022-04-18 Unknown
CVE-2012-5076 Oracle Java SE Oracle Java SE Sandbox Bypass Vulnerability The default Java security properties configuration did not restrict access to the com.sun.org.glassfish.external and com.sun.org.glassfish.gmbal packages. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions. 9.8 CISA 2022-03-28 2022-04-18 Unknown
CVE-2013-2465 Oracle Java SE Oracle Java SE Unspecified Vulnerability Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE allows remote attackers to affect confidentiality, integrity, and availability via Unknown vectors related to 2D 9.8 CISA 2022-03-28 2022-04-18 Known
CVE-2019-2616 Oracle BI Publisher (Formerly XML Publisher) Oracle BI Publisher Unauthorized Access Vulnerability Oracle BI Publisher, formerly XML Publisher, contains an unspecified vulnerability that allows for various unauthorized actions. Open-source reporting attributes this vulnerability to allowing for authentication bypass. 7.2 CISA 2022-03-25 2022-04-15 Unknown
CVE-2008-3431 Oracle VirtualBox Oracle VirtualBox Insufficient Input Validation Vulnerability An input validation vulnerability exists in the VBoxDrv.sys driver of Sun xVM VirtualBox which allows attackers to locally execute arbitrary code. 8.8 CISA 2022-03-03 2022-03-24 Unknown
CVE-2011-3544 Oracle Java SE JDK and JRE Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability An access control vulnerability exists in the Applet Rhino Script Engine component of Oracle's Java Runtime Environment allows an attacker to remotely execute arbitrary code. 9.8 CISA 2022-03-03 2022-03-24 Unknown
CVE-2012-0507 Oracle Java SE Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability An incorrect type vulnerability exists in the Concurrency component of Oracle's Java Runtime Environment allows an attacker to remotely execute arbitrary code. 9.8 CISA 2022-03-03 2022-03-24 Known
CVE-2012-1723 Oracle Java SE Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE allows remote attackers to affect confidentiality, integrity, and availability via Unknown vectors related to Hotspot. 9.8 CISA 2022-03-03 2022-03-24 Known
CVE-2012-4681 Oracle Java SE Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability The Java Runtime Environment (JRE) component in Oracle Java SE allow for remote code execution. 9.8 CISA 2022-03-03 2022-03-24 Known
CVE-2015-2590 Oracle Java SE Oracle Java SE and Java SE Embedded Remote Code Execution Vulnerability An unspecified vulnerability exists within Oracle Java Runtime Environment that allows an attacker to perform remote code execution. 9.8 CISA 2022-03-03 2022-03-24 Unknown
CVE-2015-4902 Oracle Java SE Oracle Java SE Integrity Check Vulnerability Unspecified vulnerability in Oracle Java SE allows remote attackers to affect integrity via Unknown vectors related to deployment. 5.3 CISA 2022-03-03 2022-03-24 Unknown
CVE-2017-10271 Oracle WebLogic Server Oracle Corporation WebLogic Server Remote Code Execution Vulnerability Oracle Corporation WebLogic Server contains a vulnerability that allows for remote code execution. 7.5 CISA 2022-02-10 2022-08-10 Known
CVE-2020-14864 Oracle Intelligence Enterprise Edition Oracle Business Intelligence Enterprise Edition Path Transversal Path traversal vulnerability, where an attacker can target the preview FilePath parameter of the getPreviewImage function to get access to arbitrary system file. 7.5 CNA 2022-01-18 2022-07-18 Unknown
CVE-2019-2725 Oracle WebLogic Server Oracle WebLogic Server, Injection Injection vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). 7.5 CNA 2022-01-10 2022-07-10 Known
CVE-2020-14883 Oracle WebLogic Server Oracle WebLogic Server Unspecified Vulnerability Oracle WebLogic Server contains an unspecified vulnerability in the Console component with high impacts to confidentilaity, integrity, and availability. 7.2 CNA 2021-11-03 2022-05-03 Unknown
CVE-2020-14882 Oracle WebLogic Server Oracle WebLogic Server Remote Code Execution Vulnerability Oracle WebLogic Server contains an unspecified vulnerability, which is assessed to allow for remote code execution, based on this vulnerability being related to CVE-2020-14750. 9.8 CNA 2021-11-03 2022-05-03 Unknown
CVE-2020-14750 Oracle WebLogic Server Oracle WebLogic Server Remote Code Execution Vulnerability Oracle WebLogic Server contains an unspecified vulnerability allowing an unauthenticated attacker to perform remote code execution. This vulnerability is related to CVE-2020-14882. 9.8 CNA 2021-11-03 2022-05-03 Unknown
CVE-2015-4852 Oracle WebLogic Server Oracle WebLogic Server Deserialization of Untrusted Data Vulnerability Oracle WebLogic Server contains a deserialization of untrusted data vulnerability within Apache Commons, which can allow for for remote code execution. 9.8 CISA 2021-11-03 2022-05-03 Unknown
CVE-2020-14871 Oracle Solaris and Zettabyte File System (ZFS) Oracle Solaris and Zettabyte File System (ZFS) Unspecified Vulnerability Oracle Solaris and Oracle ZFS Storage Appliance Kit contain an unspecified vulnerability causing high impacts to confidentiality, integrity, and availability of affected systems. 10.0 CNA 2021-11-03 2022-05-03 Unknown
CVE-2012-3152 Oracle Fusion Middleware Oracle Fusion Middleware Unspecified Vulnerability Oracle Fusion Middleware Reports Developer contains an unspecified vulnerability that allows remote attackers to affect confidentiality and integrity of affected systems. 9.1 CISA 2021-11-03 2022-05-03 Unknown
CVE-2020-2555 Oracle Multiple Products Oracle Multiple Products Remote Code Execution Vulnerability Multiple Oracle products contain a remote code execution vulnerability that allows an unauthenticated attacker with network access via T3 or HTTP to takeover the affected system. Impacted Oracle products: Oracle Coherence in Fusion Middleware, Oracle Utilities Framework, Oracle Retail Assortment Planning, Oracle Commerce, Oracle Communications Diameter Signaling Router (DSR). 9.8 CNA 2021-11-03 2022-05-03 Unknown