Exploited now
Every vulnerability CISA confirms is being exploited in the wild: listed in its Known Exploited Vulnerabilities catalog, or assessed as actively exploited in its Vulnrichment data, often days before the catalog. When it was confirmed, how soon after the CVE went public, and the vendors attackers go after first. Refreshed every ten minutes. Sources.
Updated under an hour ago ()
What this means for you
28 vulnerabilities confirmed exploited in the last 30 days; 38% of the last 12 months' were exploited by the day they were disclosed. Add your stack to see which of them you run.
- Confirmed exploited, last 30 days
- 28
- Show in the list
- Exploited by the day of disclosure, last 12 months
- 38%
- of 295 confirmed
- Show in the list
- Median days from disclosure to confirmed exploitation
- 4
- last 12 months; list sorted fastest first
- Show in the list
- Used in ransomware campaigns, last 12 months
- 25
- Show in the list
What this means for a patch cycle
Half of the vulnerabilities CISA confirmed exploited in the last 12 months were confirmed within 4 days of going public, and 38% by the day they were published. A monthly patch cycle leaves those exposed for weeks. Products from the vendors below, especially internet-facing ones, need an emergency patch path measured in days.
Where attackers strike first
Vendors by vulnerabilities confirmed exploited in the last 24 months; the top five account for 67% of the twelve listed. This counts confirmed attacks, not disclosed flaws, so a vendor is not rewarded for publishing fewer CVEs. Mapped health IT products account for 1 of them.
Are any of these in your stack?
Name the products you run and see every CVE that affects them, with exploited ones first. Free for one product; subscribers add their whole inventory and are emailed the moment one is exploited.
Every confirmed exploitation
Showing: confirmed in 2022, Operating systems
Confirmed exploited in 2022. Product class: Operating systems (the site's classifier of CISA's product names). Clear these
121 exploited CVEs, showing 1 to 50Page 1 of 3Next
| CVE | Vendor and vulnerability | Confirmed exploited | After publication | Severity | EPSS |
|---|---|---|---|---|---|
| CVE-2022-41049 CISA KEV | Microsoft · Windows Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass VulnerabilityCISA remediation due for federal agencies: Dec 9, 2022 | Nov 14, 2022 | 6 days | Medium 5.4 | 3% |
| CVE-2022-41128 CISA KEV | Microsoft · Windows Microsoft Windows Scripting Languages Remote Code Execution VulnerabilityCISA remediation due for federal agencies: Dec 9, 2022 | Nov 8, 2022 | Same day | High 8.8 | 25% |
| CVE-2022-41125 CISA KEV | Microsoft · Windows Microsoft Windows CNG Key Isolation Service Privilege Escalation VulnerabilityCISA remediation due for federal agencies: Dec 9, 2022 | Nov 8, 2022 | Same day | High 7.8 | 3% |
| CVE-2022-41091 CISA KEV Ransomware | Microsoft · Windows Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass VulnerabilityCISA remediation due for federal agencies: Dec 9, 2022 | Nov 8, 2022 | Same day | Medium 5.4 | 2% |
| CVE-2022-41073 CISA KEV Ransomware | Microsoft · Windows Microsoft Windows Print Spooler Privilege Escalation VulnerabilityCISA remediation due for federal agencies: Dec 9, 2022 | Nov 8, 2022 | Same day | High 7.8 | 2% |
| CVE-2021-3493 CISA KEV | Linux · Kernel Linux Kernel Privilege Escalation VulnerabilityCISA remediation due for federal agencies: Nov 10, 2022 | Oct 20, 2022 | 551 days | High 8.8 | 49% |
| CVE-2022-41033 CISA KEV | Microsoft · Windows COM+ Event System Service Microsoft Windows COM+ Event System Service Privilege Escalation VulnerabilityCISA remediation due for federal agencies: Nov 1, 2022 | Oct 11, 2022 | 1 day | High 7.8 | 2% |
| CVE-2013-6282 CISA KEV | Linux · Kernel Linux Kernel Improper Input Validation VulnerabilityCISA remediation due for federal agencies: Oct 6, 2022 | Sep 15, 2022 | 3,222 days | High 8.8 | 40% |
| CVE-2013-2596 CISA KEV | Linux · Kernel Linux Kernel Integer Overflow VulnerabilityCISA remediation due for federal agencies: Oct 6, 2022 | Sep 15, 2022 | 3,443 days | High 7.8 | 3% |
| CVE-2013-2094 CISA KEV | Linux · Kernel Linux Kernel Privilege Escalation VulnerabilityCISA remediation due for federal agencies: Oct 6, 2022 | Sep 15, 2022 | 3,411 days | High 8.4 | 48% |
| CVE-2010-2568 CISA KEV | Microsoft · Windows Microsoft Windows Remote Code Execution VulnerabilityCISA remediation due for federal agencies: Oct 6, 2022 | Sep 15, 2022 | 4,438 days | High 7.8 | 91% |
| CVE-2022-37969 CISA KEV Ransomware | Microsoft · Windows Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation VulnerabilityCISA remediation due for federal agencies: Oct 5, 2022 | Sep 13, 2022 | Same day | High 7.8 | 28% |
| CVE-2022-26923 CISA KEV | Microsoft · Active Directory Microsoft Active Directory Domain Services Privilege Escalation VulnerabilityCISA remediation due for federal agencies: Sep 8, 2022 | Aug 18, 2022 | 100 days | High 8.8 | 84% |
| CVE-2022-21971 CISA KEV | Microsoft · Windows Microsoft Windows Runtime Remote Code Execution VulnerabilityCISA remediation due for federal agencies: Sep 8, 2022 | Aug 18, 2022 | 190 days | High 7.8 | 54% |
| CVE-2022-34713 CISA KEV | Microsoft · Windows Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution VulnerabilityCISA remediation due for federal agencies: Aug 30, 2022 | Aug 9, 2022 | Same day | High 7.8 | 68% |
| CVE-2022-22047 CISA KEV | Microsoft · Windows Microsoft Windows Client Server Runtime Subsystem (CSRSS) Privilege Escalation VulnerabilityCISA remediation due for federal agencies: Aug 2, 2022 | Jul 12, 2022 | Same day | High 7.8 | 19% |
| CVE-2022-26925 CISA KEV | Microsoft · Windows Microsoft Windows LSA Spoofing VulnerabilityCISA remediation due for federal agencies: Jul 22, 2022 | Jul 1, 2022 | 52 days | High 8.1 | 10% |
| CVE-2021-4034 CISA KEV Ransomware | Red Hat · Polkit Red Hat Polkit Out-of-Bounds Read and Write VulnerabilityCISA remediation due for federal agencies: Jul 18, 2022 | Jun 26, 2022 | 150 days | High 7.8 | 95% |
| CVE-2012-0151 CISA KEV | Microsoft · Windows Microsoft Windows Authenticode Signature Verification Remote Code Execution VulnerabilityCISA remediation due for federal agencies: Jun 22, 2022 | Jun 8, 2022 | 3,711 days | High 7.8 | 88% |
| CVE-2022-30190 CISA KEV Ransomware | Microsoft · Windows Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution VulnerabilityCISA remediation due for federal agencies: Jul 5, 2022 | May 30, 2022 | 2 days before publication | High 7.8 | 99% |
| CVE-2019-3010 CISA KEV | Oracle · Solaris Oracle Solaris Privilege Escalation VulnerabilityCISA remediation due for federal agencies: Jun 15, 2022 | May 25, 2022 | 952 days | High 8.8 | 13% |
| CVE-2016-7256 CISA KEV | Microsoft · Windows Microsoft Windows Open Type Font Remote Code Execution VulnerabilityCISA remediation due for federal agencies: Jun 15, 2022 | May 25, 2022 | 2,022 days | High 8.8 | 65% |
| CVE-2016-3393 CISA KEV | Microsoft · Windows Microsoft Windows Graphics Device Interface (GDI) Remote Code Execution VulnerabilityCISA remediation due for federal agencies: Jun 15, 2022 | May 25, 2022 | 2,050 days | High 7.8 | 68% |
| CVE-2015-6175 CISA KEV | Microsoft · Windows Microsoft Windows Kernel Privilege Escalation VulnerabilityCISA remediation due for federal agencies: Jun 15, 2022 | May 25, 2022 | 2,359 days | High 7.8 | 5% |
| CVE-2015-2360 CISA KEV | Microsoft · Win32k Microsoft Win32k Privilege Escalation VulnerabilityCISA remediation due for federal agencies: Jun 15, 2022 | May 25, 2022 | 2,542 days | High 8.8 | 15% |
| CVE-2015-1769 CISA KEV | Microsoft · Windows Microsoft Windows Mount Manager Privilege Escalation VulnerabilityCISA remediation due for federal agencies: Jun 15, 2022 | May 25, 2022 | 2,476 days | Medium 6.6 | 4% |
| CVE-2015-1671 CISA KEV | Microsoft · Windows Microsoft Windows Remote Code Execution VulnerabilityCISA remediation due for federal agencies: Jun 15, 2022 | May 25, 2022 | 2,569 days | High 7.8 | 49% |
| CVE-2015-0016 CISA KEV | Microsoft · Windows Microsoft Windows TS WebProxy Directory Traversal VulnerabilityCISA remediation due for federal agencies: Jun 15, 2022 | May 25, 2022 | 2,689 days | High 7.8 | 76% |
| CVE-2014-4148 CISA KEV | Microsoft · Windows Microsoft Windows Remote Code Execution VulnerabilityCISA remediation due for federal agencies: Jun 15, 2022 | May 25, 2022 | 2,779 days | High 8.8 | 60% |
| CVE-2014-4077 CISA KEV | Microsoft · Input Method Editor (IME) Japanese Microsoft IME Japanese Privilege Escalation VulnerabilityCISA remediation due for federal agencies: Jun 15, 2022 | May 25, 2022 | 2,752 days | High 7.8 | 55% |
| CVE-2014-3153 CISA KEV | Linux · Kernel Linux Kernel Privilege Escalation VulnerabilityCISA remediation due for federal agencies: Jun 15, 2022 | May 25, 2022 | 2,909 days | High 7.8 | 37% |
| CVE-2018-8611 CISA KEV | Microsoft · Windows Microsoft Windows Kernel Privilege Escalation VulnerabilityCISA remediation due for federal agencies: Jun 14, 2022 | May 24, 2022 | 1,260 days | High 7.8 | 4% |
| CVE-2017-8543 CISA KEV | Microsoft · Windows Microsoft Windows Search Remote Code Execution VulnerabilityCISA remediation due for federal agencies: Jun 14, 2022 | May 24, 2022 | 1,805 days | Critical 9.8 | 74% |
| CVE-2017-0147 CISA KEV Ransomware Health IT | Microsoft · SMBv1 server Microsoft Windows SMBv1 Information Disclosure VulnerabilityCISA remediation due for federal agencies: Jun 14, 2022 | May 24, 2022 | 1,895 days | High 7.5 | 100% |
| CVE-2017-0005 CISA KEV | Microsoft · Windows Microsoft Windows Graphics Device Interface (GDI) Privilege Escalation VulnerabilityCISA remediation due for federal agencies: Jun 14, 2022 | May 24, 2022 | 1,895 days | High 7.8 | 11% |
| CVE-2020-1027 CISA KEV | Microsoft · Windows Microsoft Windows Kernel Privilege Escalation VulnerabilityCISA remediation due for federal agencies: Jun 13, 2022 | May 23, 2022 | 768 days | High 7.8 | 5% |
| CVE-2020-0638 CISA KEV Ransomware | Microsoft · Update Notification Manager Microsoft Update Notification Manager Privilege Escalation VulnerabilityCISA remediation due for federal agencies: Jun 13, 2022 | May 23, 2022 | 860 days | High 7.8 | 2% |
| CVE-2019-1385 CISA KEV Ransomware | Microsoft · Windows Microsoft Windows AppX Deployment Extensions Privilege Escalation VulnerabilityCISA remediation due for federal agencies: Jun 13, 2022 | May 23, 2022 | 923 days | High 7.8 | 4% |
| CVE-2019-1130 CISA KEV Ransomware | Microsoft · Windows Microsoft Windows AppX Deployment Service Privilege Escalation VulnerabilityCISA remediation due for federal agencies: Jun 13, 2022 | May 23, 2022 | 1,029 days | High 7.8 | 2% |
| CVE-2019-0880 CISA KEV | Microsoft · Windows Microsoft Windows Privilege Escalation VulnerabilityCISA remediation due for federal agencies: Jun 13, 2022 | May 23, 2022 | 1,043 days | High 7.8 | 2% |
| CVE-2019-0703 CISA KEV | Microsoft · Windows Microsoft Windows SMB Information Disclosure VulnerabilityCISA remediation due for federal agencies: Jun 13, 2022 | May 23, 2022 | 1,141 days | Medium 6.5 | 10% |
| CVE-2018-8589 CISA KEV | Microsoft · Win32k Microsoft Win32k Privilege Escalation VulnerabilityCISA remediation due for federal agencies: Jun 13, 2022 | May 23, 2022 | 1,287 days | High 7.8 | 3% |
| CVE-2014-4113 CISA KEV | Microsoft · Win32k Microsoft Win32k Privilege Escalation VulnerabilityCISA remediation due for federal agencies: May 25, 2022 | May 4, 2022 | 2,758 days | High 7.8 | 87% |
| CVE-2022-26904 CISA KEV | Microsoft · Windows Microsoft Windows User Profile Service Privilege Escalation VulnerabilityCISA remediation due for federal agencies: May 16, 2022 | Apr 25, 2022 | 10 days | High 7.0 | 17% |
| CVE-2022-21919 CISA KEV | Microsoft · Windows Microsoft Windows User Profile Service Privilege Escalation VulnerabilityCISA remediation due for federal agencies: May 16, 2022 | Apr 25, 2022 | 104 days | High 7.0 | 2% |
| CVE-2022-0847 CISA KEV | Linux · Kernel Linux Kernel Privilege Escalation VulnerabilityCISA remediation due for federal agencies: May 16, 2022 | Apr 25, 2022 | 50 days | High 7.8 | 93% |
| CVE-2021-41357 CISA KEV | Microsoft · Win32k Microsoft Win32k Privilege Escalation VulnerabilityCISA remediation due for federal agencies: May 16, 2022 | Apr 25, 2022 | 195 days | High 7.8 | 2% |
| CVE-2021-40450 CISA KEV | Microsoft · Win32k Microsoft Win32k Privilege Escalation VulnerabilityCISA remediation due for federal agencies: May 16, 2022 | Apr 25, 2022 | 195 days | High 7.8 | 2% |
| CVE-2022-22718 CISA KEV | Microsoft · Windows Microsoft Windows Print Spooler Privilege Escalation VulnerabilityCISA remediation due for federal agencies: May 10, 2022 | Apr 19, 2022 | 69 days | High 7.8 | 18% |
| CVE-2022-24521 CISA KEV Ransomware | Microsoft · Windows Microsoft Windows CLFS Driver Privilege Escalation VulnerabilityCISA remediation due for federal agencies: May 4, 2022 | Apr 13, 2022 | 2 days before publication | High 7.8 | 7% |
Page 1 of 3Next
How to read this
"Confirmed exploited" is the date CISA added the CVE to its Known Exploited Vulnerabilities catalog or assessed it as actively exploited, whichever came first. It is when exploitation was confirmed publicly, not when attackers started, so "after publication" is an upper bound: attackers were there at least that soon. "By disclosure day" means confirmed on or before the day the CVE record was published, the closest public measure of a zero-day. Dates are US Eastern, the calendar CISA uses. Vendors are named as CISA's catalog names them, otherwise as the assigning CNA does. EPSS is FIRST's estimate of the chance of exploitation in the next 30 days.