KEV Tracker — CyberzSOC

⚠

About the KEV Catalog For the benefit of the cybersecurity community and network defenders — and to help every organization better manage vulnerabilities and keep pace with threat activity — CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild. Organizations should use the KEV catalog as an input to their vulnerability management prioritization framework. Per Binding Operational Directive 22-01, all federal civilian executive branch (FCEB) agencies are required to remediate KEV catalog vulnerabilities by their listed due dates. CISA strongly recommends all organizations — including private sector entities — prioritize remediation of KEV catalog vulnerabilities. View the full KEV catalog on CISA.gov →

Total KEVs

1,721

in CISA catalog

Ransomware-Linked

360

21% of catalog

Added Last 30 Days

92 in last 90 days

Latest Addition

2026-09-22

most recent entry

Tracked Vendors

20+

top 20 shown

Top Vendors

KEV count 21%+ ransomware-linked 42%+ ransomware-linked N RW · %Ransomware-linked share

Share of each bar's KEVs linked to ransomware. Thresholds track the catalog average of 20.9%, so they stay meaningful as it grows. Bars under 5 KEVs are left uncoloured — too few to rate a share.

Microsoft

388

117 RW · 30%

Cisco

7 RW · 7%

Apple

Adobe

11 RW · 14%

Google

Oracle

13 RW · 28%

Apache

8 RW · 20%

Ivanti

12 RW · 34%

Linux

2 RW · 6%

Fortinet

14 RW · 47%

VMware

9 RW · 35%

D-Link

2 RW · 8%

Citrix

7 RW · 29%

SonicWall

13 RW · 68%

Synacor

6 RW · 32%

Android

Palo Alto Networks

6 RW · 40%

Samsung

SAP

3 RW · 21%

Mozilla

1 RW · 8%

Top Products

KEV count 21%+ ransomware-linked 42%+ ransomware-linked N RW · %Ransomware-linked share

Share of each bar's KEVs linked to ransomware. Thresholds track the catalog average of 20.9%, so they stay meaningful as it grows. Bars under 5 KEVs are left uncoloured — too few to rate a share.

Windows · Microsoft

174

49 RW · 28%

Multiple Products · Apple

Chromium V8 · Google

Internet Explorer · Microsoft

6 RW · 17%

Flash Player · Adobe

5 RW · 15%

Kernel · Linux

2 RW · 6%

Office · Microsoft

3 RW · 10%

Win32k · Microsoft

11 RW · 44%

Exchange Server · Microsoft

13 RW · 76%

Zimbra Collaboration Suite (ZCS) · Synacor

5 RW · 29%

ColdFusion · Adobe

3 RW · 19%

SharePoint · Microsoft

8 RW · 57%

IOS and IOS XE Software · Cisco

Acrobat and Reader · Adobe

1 RW · 8%

Mobile Devices · Samsung

PAN-OS · Palo Alto Networks

6 RW · 50%

WebLogic Server · Oracle

2 RW · 17%

iOS, iPadOS, and macOS · Apple

Multiple Chipsets · Qualcomm

NetWeaver · SAP

2 RW · 20%

Clear 9 entries

CVE	Vendor	Product	Vulnerability	CVSS	Added	Due per BOD 22-01	Ransomware
CVE-2022-28810	Zoho	ManageEngine	Zoho ManageEngine ADSelfService Plus Remote Code Execution Vulnerability Zoho ManageEngine ADSelfService Plus contains an unspecified vulnerability allowing for remote code execution when performing a password change or reset.	6.8 CISA	2023-03-07	2023-03-28	Unknown
CVE-2022-47966	Zoho	ManageEngine	Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability Multiple Zoho ManageEngine products contain an unauthenticated remote code execution vulnerability due to the usage of an outdated third-party dependency, Apache Santuario.	9.8 CISA	2023-01-23	2023-02-13	Known 2023 Top Routinely Exploited Vulnerabilities North Korea Cyber Group Conducts Global Espionage Campaign to Advance Regime’s Military and Nuclear Programs North Korea Cyber Group Conducts Global Espionage Campaign to Advance Regime's Military and Nuclear Programs
CVE-2022-35405	Zoho	ManageEngine	Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability Zoho ManageEngine PAM360, Password Manager Pro, and Access Manager Plus contain an unspecified vulnerability that allows for remote code execution.	9.8 CISA	2022-09-22	2022-10-13	Unknown
CVE-2021-44515	Zoho	Desktop Central	Zoho Desktop Central Authentication Bypass Vulnerability Zoho Desktop Central contains an authentication bypass vulnerability that could allow an attacker to execute arbitrary code in the Desktop Central MSP server.	9.8 CISA	2021-12-10	2021-12-24	Unknown
CVE-2021-44077	Zoho	ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus	Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution	9.8 CISA	2021-12-01	2021-12-15	Unknown
CVE-2021-37415	Zoho	ManageEngine ServiceDesk Plus (SDP)	Zoho ManageEngine ServiceDesk Authentication Bypass Vulnerability Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authentication	9.8 CISA	2021-12-01	2021-12-15	Unknown
CVE-2019-8394	Zoho	ManageEngine	Zoho ManageEngine ServiceDesk Plus (SDP) File Upload Vulnerability Zoho ManageEngine ServiceDesk Plus (SDP) contains an unspecified vulnerability that allows remote users to upload files via login page customization.	7.5 CISA	2021-11-03	2022-05-03	Unknown
CVE-2020-10189	Zoho	ManageEngine	Zoho ManageEngine Desktop Central File Upload Vulnerability Zoho ManageEngine Desktop Central contains a file upload vulnerability that allows for unauthenticated remote code execution.	9.8 CNA	2021-11-03	2022-05-03	Unknown
CVE-2021-40539	Zoho	ManageEngine	Zoho ManageEngine ADSelfService Plus Authentication Bypass Vulnerability Zoho ManageEngine ADSelfService Plus contains an authentication bypass vulnerability affecting the REST API URLs which allow for remote code execution.	9.8 CISA	2021-11-03	2021-11-17	Known 2023 Top Routinely Exploited Vulnerabilities

⚠ Known Exploited Vulnerability (KEV) Tracker

Top Vendors

Top Products