KEV Tracker — CyberzSOC

⚠

About the KEV Catalog For the benefit of the cybersecurity community and network defenders — and to help every organization better manage vulnerabilities and keep pace with threat activity — CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild. Organizations should use the KEV catalog as an input to their vulnerability management prioritization framework. Per Binding Operational Directive 22-01, all federal civilian executive branch (FCEB) agencies are required to remediate KEV catalog vulnerabilities by their listed due dates. CISA strongly recommends all organizations — including private sector entities — prioritize remediation of KEV catalog vulnerabilities. View the full KEV catalog on CISA.gov →

Top Vendors

KEV count 21%+ ransomware-linked 42%+ ransomware-linked N RW · %Ransomware-linked share

Share of each bar's KEVs linked to ransomware. Thresholds track the catalog average of 20.9%, so they stay meaningful as it grows. Bars under 5 KEVs are left uncoloured — too few to rate a share.

Microsoft

388

117 RW · 30%

Cisco

7 RW · 7%

Apple

Adobe

11 RW · 14%

Google

Oracle

13 RW · 28%

Apache

8 RW · 20%

Ivanti

12 RW · 34%

Linux

2 RW · 6%

Fortinet

14 RW · 47%

VMware

9 RW · 35%

D-Link

2 RW · 8%

Citrix

7 RW · 29%

SonicWall

13 RW · 68%

Synacor

6 RW · 32%

Android

Palo Alto Networks

6 RW · 40%

Samsung

SAP

3 RW · 21%

Mozilla

1 RW · 8%

Top Products

KEV count 21%+ ransomware-linked 42%+ ransomware-linked N RW · %Ransomware-linked share

Share of each bar's KEVs linked to ransomware. Thresholds track the catalog average of 20.9%, so they stay meaningful as it grows. Bars under 5 KEVs are left uncoloured — too few to rate a share.

Windows · Microsoft

174

49 RW · 28%

Multiple Products · Apple

Chromium V8 · Google

Internet Explorer · Microsoft

6 RW · 17%

Flash Player · Adobe

5 RW · 15%

Kernel · Linux

2 RW · 6%

Office · Microsoft

3 RW · 10%

Win32k · Microsoft

11 RW · 44%

Exchange Server · Microsoft

13 RW · 76%

Zimbra Collaboration Suite (ZCS) · Synacor

5 RW · 29%

ColdFusion · Adobe

3 RW · 19%

SharePoint · Microsoft

8 RW · 57%

IOS and IOS XE Software · Cisco

Acrobat and Reader · Adobe

1 RW · 8%

Mobile Devices · Samsung

PAN-OS · Palo Alto Networks

6 RW · 50%

WebLogic Server · Oracle

2 RW · 17%

iOS, iPadOS, and macOS · Apple

Multiple Chipsets · Qualcomm

NetWeaver · SAP

2 RW · 20%

CVE	Vendor	Product	Vulnerability	CVSS	Added	Due per BOD 22-01	Ransomware
CVE-2025-14733	WatchGuard	Firebox	WatchGuard Firebox Out of Bounds Write Vulnerability WatchGuard Fireware OS iked process contains an out of bounds write vulnerability in the OS iked process. This vulnerability may allow a remote unauthenticated attacker to execute arbitrary code and affects both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when configured with a dynamic gateway peer.	9.3 CNA	2025-12-19	2025-12-26	Known
CVE-2025-9242	WatchGuard	Firebox	WatchGuard Firebox Out-of-Bounds Write Vulnerability WatchGuard Firebox contains an out-of-bounds write vulnerability in the OS iked process that may allow a remote unauthenticated attacker to execute arbitrary code.	9.3 CNA	2025-11-12	2025-12-03	Unknown
CVE-2022-23176	WatchGuard	Firebox and XTM	WatchGuard Firebox and XTM Privilege Escalation Vulnerability WatchGuard Firebox and XTM appliances allow a remote attacker with unprivileged credentials to access the system with a privileged management session via exposed management access.	8.8 CISA	2022-04-11	2022-05-02	Unknown
CVE-2022-26318	WatchGuard	Firebox and XTM Appliances	WatchGuard Firebox and XTM Appliances Arbitrary Code Execution On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary code.	9.8 CISA	2022-03-25	2022-04-15	Unknown

⚠ Known Exploited Vulnerability (KEV) Tracker

Top Vendors

Top Products