Exploited vulnerabilities

Bugs attackers used at scale: firewalls, VPNs, web frameworks and servers.

October 2026 11

Exploited vulnerabilitiesBriefOn CISA KEV

Cisco ASA / FTD NULL-dereference DoS (CVE-2026-76418)

CVSS 8.6. KEV: 29 Oct 2026 alongside GitLab.

29 Oct 2026CVE-2026-76418 CVE-2026-76519

CriticalVulnerabilityPatch available

PHP2Shell (CVE-2026-109618, CVE-2026-109619): patch the PHP engine, not just your app

Two PHP engine flaws allow unauthenticated code execution on WordPress, Drupal and Joomla. Upgrade to PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12.

21 Oct 2026CVE-2026-109618, CVE-2026-109619PHP

CriticalVulnerabilityPatch available

Node.js October 2026 security release: Brotli RCE now exploited, plus TLS hostname bypasses

Node.js 26.12.1, 24.22.1 and 22.23.4 fix ten CVEs, including a Brotli decoder flaw now on CISA’s exploited list and three TLS certificate checks.

21 Oct 2026CVE-2026-111497, CVE-2026-105482, CVE-2026-105483, CVE-2026-106069, CVE-2026-105481, CVE-2026-106072, CVE-2026-106074, CVE-2026-106070, CVE-2026-106071, CVE-2026-106073Node.js

CriticalVulnerabilityPatch available

GitLab regex RCE (CVE-2026-97229, CVE-2026-110264): the 12 October patch is not enough

Two CVSS 10 regex flaws give unauthenticated code execution on self-managed GitLab; one is exploited. Upgrade to 19.5.1, 19.4.3, 19.3.6 or a 21 Oct backport.

21 Oct 2026CVE-2026-97229, CVE-2026-110264CI/CD Open source

Exploited vulnerabilitiesBriefOn CISA KEV

Plex2Shell, Plex Media Server four-CVE chain (CVE-2026-96652 / -96654 / -96655 / -96656)

Fixed: 1.43.3.10861 (August 2026). PoC 16 Oct.

20 Oct 2026CVE-2026-96652 CVE-2026-96654 CVE-2026-96655 CVE-2026-96656

Exploited vulnerabilitiesBrief

eMudhra intermediate CA compromise

About 17 Oct 2026. Eight intermediate CA keys reportedly generated with almost no randomness, which would let an attacker forge any TLS certificate.

17 Oct 2026

CriticalVulnerabilityPatch available

Next.js October 2026 security release: two critical RCEs, and check your sharp version

Next.js 16.4.1 and 15.5.28 fix an unauthenticated RCE via SVG image optimization, a use cache RCE and a Server Actions DoS. Also check sharp is 0.35.5+.

14 Oct 2026CVE-2026-96889React and Next.js npm

Exploited vulnerabilitiesBriefOn CISA KEV

PAN-OS GlobalProtect auth bypass (CVE-2026-0257)

Fixed 13 May 2026 (PAN-SA-2026-0012). Exploited since at least 17 May.

14 Oct 2026CVE-2026-0257 CVE-2026-0300 CVE-2026-0322

Exploited vulnerabilitiesBriefOn CISA KEV

Ivanti Connect Secure chain (CVE-2026-104935, then CVE-2026-111357 / -118527)

Auth bypass exploited from 1 to 3 Oct (Defused, Volexity UTA0576), chained to root on fully patched devices.

13 Oct 2026CVE-2026-104935 CVE-2026-111357 CVE-2026-118527

CriticalVulnerabilityPatch available

Rejetto HFS CVE-2026-61500: an AI-found bug attacked the day after its write-up

A predictable session key in HFS 3.0.0 to 3.2.0, found with Claude Mythos, lets attackers forge an admin login and run code. Update to 3.2.1 or later.

1 Oct 2026CVE-2026-61500Node.js npm Open source

Exploited vulnerabilitiesBriefOn CISA KEV

Other October 2026 KEV entries

14 Oct: Ahsay AhsayCBS CVE-2026-105133 / -105134.

October 2026CVE-2026-105133 CVE-2026-105134 CVE-2026-106931 CVE-2026-110936

August 2026 5

Exploited vulnerabilitiesBriefOn CISA KEV

Other 2026 Linux kernel KEV additions

CVE-2026-53362 (IPv6): KEV 27 Aug 2026.

27 Aug 2026CVE-2026-46300 CVE-2026-53266 CVE-2026-53362

Exploited vulnerabilitiesBriefOn CISA KEV

VMware vCenter Syslog directory traversal to RCE (CVE-2026-59310, plus CVE-2026-59309)

VMSA-2026-0006, 29 Jul 2026. CVSS 9.8.

18 Aug 2026CVE-2026-41709 CVE-2026-59309 CVE-2026-59310

Exploited vulnerabilitiesBriefOn CISA KEV

Windows AFD.sys use-after-free (CVE-2026-68820)

Exploited as a zero-day by Lazarus. August Patch Tuesday, about 400 CVEs.

August 2026CVE-2026-68820

Exploited vulnerabilitiesBrief

SAP Commerce Cloud Data Hub (CVE-2026-58231)

CVSS 10. Actively exploited per Belgium’s CCB.

August 2026CVE-2026-58231

Exploited vulnerabilitiesBriefOn CISA KEV

N-able N-central auth bypass (CVE-2026-18577)

August 2026CVE-2026-18577

July 2026 1

Exploited vulnerabilitiesBriefOn CISA KEV

SharePoint missing authentication (CVE-2026-56164, with CVE-2026-32201 and -45659)

July 2026 Patch Tuesday. KEV: 14 Jul 2026 with a 3-day deadline under BOD 26-04.

14 Jul 2026CVE-2026-32201 CVE-2026-45659 CVE-2026-56164

June 2026 7

Exploited vulnerabilitiesBriefOn CISA KEV

Citrix NetScaler “CitrixBleed 3” (CVE-2026-3055 / -4368) and CVE-2026-8451, Mar and Jun 2026

CVE-2026-3055: SAML-IdP out-of-bounds read.

30 Jun 2026CVE-2026-3055 CVE-2026-4368 CVE-2026-8451 CVE-2026-88779

Exploited vulnerabilitiesBriefOn CISA KEV

Oracle PeopleSoft PeopleTools zero-day (CVE-2026-35273)

Oracle security alert 10 Jun 2026. CVSS 9.8.

10 Jun 2026CVE-2026-35273

Exploited vulnerabilitiesBrief

CISA Binding Operational Directive 26-04 (10 Jun 2026)

Federal remediation for the highest-risk KEV entries cut to 3 days.

10 Jun 2026

Exploited vulnerabilitiesBriefOn CISA KEV

Check Point Remote Access VPN auth bypass (CVE-2026-50751)

IKEv1 certificate-validation logic flaw.

8 Jun 2026CVE-2026-50751

Exploited vulnerabilitiesBrief

Windows Netlogon unauthenticated RCE on domain controllers (CVE-2026-41089)

Exploitation confirmed by Belgium’s CCB.

June 2026CVE-2026-41089

Exploited vulnerabilitiesBriefOn CISA KEV

Splunk Enterprise unauthenticated RCE (CVE-2026-20253)

CVSS 9.8. Splunk confirmed limited exploitation.

June 2026CVE-2026-20253

Exploited vulnerabilitiesBriefOn CISA KEV

Ivanti Sentry (CVE-2026-10520)

Exploited within 24 hours of the PoC. Shadowserver found only 19 vulnerable instances.

June 2026CVE-2026-10520

May 2026 5

Exploited vulnerabilitiesBriefOn CISA KEV

Cisco Catalyst SD-WAN auth bypass (CVE-2026-20127, then CVE-2026-20122 / -20128 / -20182 / -20133)

CVSS 10. Exploited by UAT-8616 since 2023.

14 May 2026CVE-2026-20122 CVE-2026-20127 CVE-2026-20128 CVE-2026-20133 +1

Exploited vulnerabilitiesBriefOn CISA KEV

LiteLLM proxy SQL injection (CVE-2026-42208)

PoC on 5 May. KEV: 8 May 2026.

8 May 2026CVE-2026-42208

Exploited vulnerabilitiesBriefOn CISA KEV

Microsoft Defender local privilege escalation and DoS (CVE-2026-41091 / -45498)

Exploited in the wild. Fixed in Defender platform 4.18.26040.7.

May 2026CVE-2026-41091 CVE-2026-45498

Exploited vulnerabilitiesBriefOn CISA KEV

Linux “Copy Fail” page-cache corruption local root (CVE-2026-31431)

An unprivileged user corrupts the in-memory page cache of any readable file, including setuid binaries, and gets root.

1 May 2026CVE-2026-31431

Exploited vulnerabilitiesBrief

Ghost CMS (CVE-2026-26980)

Mass ClickFix and FakeCaptcha site-poisoning campaigns (XLab).

May 2026CVE-2026-26980

March 2026 3

Exploited vulnerabilitiesBrief

FreeBSD RPCSEC_GSS / NFS stack overflow (CVE-2026-4747)

Advisory FreeBSD-SA-26:08, published 26 Mar 2026.

26 Mar 2026CVE-2026-4747

Exploited vulnerabilitiesBriefOn CISA KEV

n8n “Ni8mare” (CVE-2026-21858) chained with CVE-2025-68613

CVSS 10. Unauthenticated file read through form workflows, leading to admin access and then RCE through the expression-injection bug CVE-2025-68613.

11 Mar 2026CVE-2025-68613 CVE-2026-21858

Exploited vulnerabilitiesBrief

nginx-ui “MCPwn” (CVE-2026-33032)

The MCP message endpoint had no authentication, so attackers could take over the web server.

March 2026CVE-2026-33032

February 2026 2

Exploited vulnerabilitiesBriefOn CISA KEV

BeyondTrust Remote Support / PRA pre-auth RCE (CVE-2026-1731)

CVSS 9.9. Affected: RS 25.3.1 and earlier, PRA 24.3.4 and earlier.

February 2026CVE-2026-1731

Exploited vulnerabilitiesBriefOn CISA KEV

Apple 2026 zero-days

CVE-2026-20700: dyld, Feb 2026, used with WebKit CVE-2025-14174 / -43529.

February 2026CVE-2025-14174 CVE-2025-43529 CVE-2026-20700 CVE-2026-86950

January 2026 4

Exploited vulnerabilitiesBriefOn CISA KEV

Ivanti EPMM zero-days (CVE-2026-1281 / -1340)

Disclosed 29 Jan 2026. CVSS 9.8, unauthenticated code injection.

29 Jan 2026CVE-2026-1281 CVE-2026-1340

Exploited vulnerabilitiesBriefOn CISA KEV

FortiCloud SSO auth bypass (CVE-2026-24858)

KEV: 27 Jan 2026, federal deadline 30 Jan.

27 Jan 2026CVE-2026-24858

Exploited vulnerabilitiesBriefOn CISA KEV

Microsoft Office security-feature bypass (CVE-2026-21509)

Out-of-band patch 26 Jan 2026. KEV the same day.

26 Jan 2026CVE-2026-21509

Exploited vulnerabilitiesBriefOn CISA KEV

Chrome 2026 in-the-wild zero-days (seven by September)

CVE-2026-2441 (Feb)

January 2026CVE-2026-2441 CVE-2026-3909 CVE-2026-3910 CVE-2026-5281 +3

December 2025 3

Exploited vulnerabilitiesBriefOn CISA KEV

MongoBleed (CVE-2025-14847)

zlib-compressed message handling leaks uninitialized heap memory without authentication.

29 Dec 2025CVE-2025-14847

CriticalVulnerabilityPatch available

React2Shell (CVE-2025-55182): the React Server Components RCE, and why the December patch is not enough now

An unauthenticated RCE in React Server Components hit Next.js App Router apps by default. Exploited within hours. A related RCE was fixed in October 2026.

3 Dec 2025CVE-2025-55182, CVE-2025-66478, CVE-2025-55184, CVE-2025-67779, CVE-2025-55183, CVE-2026-23864npm React and Next.js

Exploited vulnerabilitiesBriefOn CISA KEV

Gogs symlink RCE (CVE-2025-8110)

Disclosed by Wiz in Dec 2025. Unpatched for weeks.

December 2025CVE-2025-8110

November 2025 3

Exploited vulnerabilitiesBriefOn CISA KEV

FortiWeb path traversal plus command injection (CVE-2025-64446 / -58034)

KEV: 14 Nov 2025 and 18 Nov 2025. Exploited silently before disclosure.

14 Nov 2025CVE-2025-58034 CVE-2025-64446

Exploited vulnerabilitiesBrief

runc container escapes (CVE-2025-31133 / -52565 / -52881)

Fixed: runc 1.2.8, 1.3.3, 1.4.0-rc.3. Not exploited.

November 2025CVE-2025-31133 CVE-2025-52565 CVE-2025-52881

Exploited vulnerabilitiesBriefOn CISA KEV

React Native CLI / Metro dev-server RCE (CVE-2025-11953)

The Metro dev server bound to 0.0.0.0, and the `/open-url` endpoint allowed OS command injection.

November 2025CVE-2025-11953

October 2025 3

Exploited vulnerabilitiesBriefOn CISA KEV

Microsoft WSUS deserialization RCE (CVE-2025-59287)

Out-of-band patch 23 Oct 2025. KEV: 24 Oct 2025.

23 Oct 2025CVE-2025-59287

Exploited vulnerabilitiesBriefOn CISA KEV

Oracle E-Business Suite, Cl0p (CVE-2025-61882; also CVE-2025-61884)

Oracle alert 4 Oct 2025. CVSS 9.8, unauthenticated RCE in BI Publisher integration.

4 Oct 2025CVE-2025-61882 CVE-2025-61884

Exploited vulnerabilitiesBrief

Redis “RediShell” Lua use-after-free (CVE-2025-49844)

Disclosed 3 Oct 2025 (Wiz). CVSS 10. A 13-year-old bug.

3 Oct 2025CVE-2025-49844

September 2025 3

Exploited vulnerabilitiesBriefOn CISA KEV

sudo chroot local root (CVE-2025-32463)

Fixed: sudo 1.9.17p1. KEV: 29 Sep 2025.

29 Sep 2025CVE-2025-32463

Exploited vulnerabilitiesBriefOn CISA KEV

GoAnywhere MFT deserialization (CVE-2025-10035)

KEV: 29 Sep 2025. Used by Storm-1175 (Medusa ransomware).

29 Sep 2025CVE-2025-10035

Exploited vulnerabilitiesBriefOn CISA KEV

Cisco ASA / FTD zero-days, ArcaneDoor (CVE-2025-20333 / -20362)

KEV: 25 Sep 2025. Emergency Directive ED 25-03.

25 Sep 2025CVE-2025-20333 CVE-2025-20362

August 2025 3

Exploited vulnerabilitiesBriefOn CISA KEV

Apple 2025 zero-days

CVE-2025-24085, CVE-2025-24200, CVE-2025-31200 / -31201, CVE-2025-43300 (ImageIO, KEV 21 Aug 2025, used against WhatsApp users with CVE-2025-55177)

21 Aug 2025CVE-2025-14174 CVE-2025-24085 CVE-2025-24200 CVE-2025-31200 +4

Exploited vulnerabilitiesBriefOn CISA KEV

WinRAR path traversal (CVE-2025-8088)

RomCom zero-day. Fixed: WinRAR 7.13. KEV: Aug 2025.

August 2025CVE-2025-8088

Exploited vulnerabilitiesBrief

Microsoft Exchange hybrid privilege escalation (CVE-2025-53786)

Emergency Directive ED 25-02. Not exploited.

August 2025CVE-2025-53786

July 2025 5

Exploited vulnerabilitiesBriefOn CISA KEV

Cisco ISE unauthenticated RCE (CVE-2025-20281 / -20337)

CVSS 10. KEV: 28 Jul 2025.

28 Jul 2025CVE-2025-20281 CVE-2025-20337

Exploited vulnerabilitiesBriefOn CISA KEV

SharePoint “ToolShell” (CVE-2025-53770 / -53771; base bugs CVE-2025-49704 / -49706)

Exploited as a zero-day from 18 Jul 2025 (Eye Security).

18 Jul 2025CVE-2025-49704 CVE-2025-49706 CVE-2025-53770 CVE-2025-53771

Exploited vulnerabilitiesBriefOn CISA KEV

CrushFTP auth bypass (CVE-2025-31161, Mar/Apr 2025; CVE-2025-54309, Jul 2025)

CVE-2025-31161: KEV 7 Apr 2025. Disclosure was messy (CVE-2025-2825 dispute).

18 Jul 2025CVE-2025-2825 CVE-2025-31161 CVE-2025-54309

Exploited vulnerabilitiesBriefOn CISA KEV

Citrix NetScaler “CitrixBleed 2” (CVE-2025-5777) plus CVE-2025-6543

Disclosed 17 Jun 2025. Memory over-read leaks session tokens.

10 Jul 2025CVE-2025-5777 CVE-2025-6543 CVE-2025-7775

Exploited vulnerabilitiesBriefOn CISA KEV

Git submodule CR/LF arbitrary write (CVE-2025-48384)

Disclosed 8 Jul 2025. `git clone --recursive` of a malicious repo leads to hook execution (macOS and Linux).

8 Jul 2025CVE-2025-48384

May 2025 3

Exploited vulnerabilitiesBriefOn CISA KEV

Ivanti EPMM chain (CVE-2025-4427 / -4428)

KEV: 19 May 2025. Expression-language injection originating in an open-source library.

19 May 2025CVE-2025-4427 CVE-2025-4428

Exploited vulnerabilitiesBriefOn CISA KEV

Langflow unauthenticated code injection (CVE-2025-3248)

Pre-auth `exec()` in `/api/v1/validate/code`.

5 May 2025CVE-2025-3248

Exploited vulnerabilitiesBriefOn CISA KEV

Commvault Command Center RCE (CVE-2025-34028) and the Metallic/Azure webshell (CVE-2025-3928)

KEV: CVE-2025-3928 on 28 Apr 2025. CVE-2025-34028 on 2 May 2025.

2 May 2025CVE-2025-3928 CVE-2025-34028

April 2025 2

Exploited vulnerabilitiesBriefOn CISA KEV

SAP NetWeaver Visual Composer unrestricted upload (CVE-2025-31324)

Disclosed 24 Apr 2025. CVSS 10. Exploited as a zero-day.

24 Apr 2025CVE-2025-31324 CVE-2025-42999

Exploited vulnerabilitiesBriefOn CISA KEV

Erlang/OTP SSH pre-auth RCE (CVE-2025-32433)

Disclosed 16 Apr 2025. CVSS 10. Unauthenticated SSH connection-protocol messages lead to RCE.

16 Apr 2025CVE-2025-32433

March 2025 4

Exploited vulnerabilitiesBrief

Ingress-NightMare, Kubernetes ingress-nginx (CVE-2025-1974 plus -1097, -1098, -24514, -24513)

Disclosed 24 Mar 2025 by Wiz. Unauthenticated RCE through the admission controller, which can lead to cluster takeover.

24 Mar 2025CVE-2025-1974

Exploited vulnerabilitiesBrief

Next.js middleware authorization bypass (CVE-2025-29927)

Disclosed 21 Mar 2025. A spoofed `x-middleware-subrequest` header skips middleware entirely.

21 Mar 2025CVE-2025-29927

Exploited vulnerabilitiesBriefOn CISA KEV

Apache Tomcat partial-PUT RCE (CVE-2025-24813)

Disclosed 10 Mar 2025. Exploited within about 30 hours of the PoC.

10 Mar 2025CVE-2025-24813

Exploited vulnerabilitiesBriefOn CISA KEV

Chrome 2025 in-the-wild zero-days

CVE-2025-2783 (Mojo sandbox escape, Mar 2025, Operation ForumTroll; KEV 27 Mar)

March 2025CVE-2025-2783 CVE-2025-4664 CVE-2025-5419 CVE-2025-6554 +3

February 2025 2

Exploited vulnerabilitiesBriefOn CISA KEV

Palo Alto PAN-OS management auth bypass (CVE-2025-0108)

Disclosed 12 Feb 2025 (Assetnote). KEV: 18 Feb 2025.

12 Feb 2025CVE-2024-9474 CVE-2025-0108

Exploited vulnerabilitiesBriefOn CISA KEV

Windows / Linux kernel 2025 KEV highlights

Windows: CLFS CVE-2025-29824 (KEV 8 Apr, ransomware).

5 Feb 2025CVE-2023-0386 CVE-2024-1086 CVE-2024-53104 CVE-2025-29824

January 2025 2

Exploited vulnerabilitiesBriefOn CISA KEV

FortiOS / FortiProxy auth bypass (CVE-2024-55591)

Disclosed 14 Jan 2025. Node.js websocket module auth bypass to super-admin.

14 Jan 2025CVE-2024-55591

Exploited vulnerabilitiesBriefOn CISA KEV

Ivanti Connect Secure zero-day (CVE-2025-0282)

Disclosed and patched: 8 Jan 2025. Stack overflow, unauthenticated RCE.

8 Jan 2025CVE-2025-0282 CVE-2025-0283 CVE-2025-22457