Exploited now

Every vulnerability CISA confirms is being exploited in the wild: listed in its Known Exploited Vulnerabilities catalog, or assessed as actively exploited in its Vulnrichment data, often days before the catalog. When it was confirmed, how soon after the CVE went public, and the vendors attackers go after first. Refreshed every ten minutes. Sources.

Updated under an hour ago (2026-10-19 09:40 UTC)

What this means for you

28 vulnerabilities confirmed exploited in the last 30 days; 38% of the last 12 months' were exploited by the day they were disclosed. Add your stack to see which of them you run.

Do this next

Start free and add your stack

Free account, 1 product

Exploited by disclosure day

Confirmed exploited, last 30 days: 28; Show in the list
Exploited by the day of disclosure, last 12 months: 38%; of 295 confirmed; Show in the list
Median days from disclosure to confirmed exploitation: 4; last 12 months; list sorted fastest first; Show in the list
Used in ransomware campaigns, last 12 months: 25; Show in the list

What this means for a patch cycle

Half of the vulnerabilities CISA confirmed exploited in the last 12 months were confirmed within 4 days of going public, and 38% by the day they were published. A monthly patch cycle leaves those exposed for weeks. Products from the vendors below, especially internet-facing ones, need an emergency patch path measured in days.

Where attackers strike first

Vendors by vulnerabilities confirmed exploited in the last 24 months; the top five account for 67% of the twelve listed. This counts confirmed attacks, not disclosed flaws, so a vendor is not rewarded for publishing fewer CVEs. Mapped health IT products account for 1 of them.

Vendors by vulnerabilities confirmed exploited

Microsoft	81	49 (60%)	0	11
Cisco	29	16 (55%)	0	2
Apple	19	2 (11%)	2	0
Fortinet	18	12 (67%)	0	3
Google	15	6 (40%)	1	0
Linux	15	0 (0%)	106	0
Ivanti	13	6 (46%)	2	2
Citrix	11	5 (45%)	5	1
Palo Alto Networks	11	4 (36%)	6	3
Adobe	10	3 (30%)	45	0
Oracle	10	2 (20%)	5	3
SonicWall	9	5 (56%)	-1	4

Are any of these in your stack?

Name the products you run and see every CVE that affects them, with exploited ones first. Free for one product; subscribers add their whole inventory and are emailed the moment one is exploited.

Check your stack

Every confirmed exploitation

Showing: confirmed in 2022 to 2026, CWE-22 Path Traversal

Confirmed exploited in 2022 to 2026. Weakness: CWE-22 Path Traversal. Clear these

64 exploited CVEs, showing 1 to 50Page 1 of 2Next

CVE	Vendor and vulnerability	Confirmed exploited	After publication	Severity	EPSS
CVE-2025-61624 CISA KEV	Fortinet · Multiple Products Fortinet Multiple Products Path Traversal Vulnerability CISA remediation due for federal agencies: Oct 19, 2026	Oct 14, 2026	183 days	Medium 5.4	1%
CVE-2021-3199 CISA KEV	ONLYOFFICE · Docs ONLYOFFICE Docs Server Path Traversal Vulnerability CISA remediation due for federal agencies: Oct 11, 2026	Oct 7, 2026	2,085 days	Critical 9.8	20%
CVE-2026-104286 CISA KEV	Fortinet · FortiMail Fortinet FortiMail Path Traversal Vulnerability CISA remediation due for federal agencies: Oct 4, 2026	Oct 1, 2026	Same day	Critical 9.8	2%
CVE-2026-93616 CISA KEV	Check Point · Multiple Products Check Point Multiple Products Path Traversal Vulnerability CISA remediation due for federal agencies: Sep 25, 2026	Sep 21, 2026	1 day before publication	Critical 9.8	76%
CVE-2026-85706 CISA KEV	GitLab · Community Edition and Enterprise Edition GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability CISA remediation due for federal agencies: Sep 14, 2026	Sep 11, 2026	Same day	Critical 10.0	93%
CVE-2026-66384 CISA KEV	JFrog · Artifactory JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability CISA remediation due for federal agencies: Sep 10, 2026	Aug 26, 2026	14 days	Medium 5.3	1%
CVE-2026-59310 CISA KEV Ransomware	Broadcom · VMware vCenter Broadcom VMware vCenter Path Traversal Vulnerability CISA remediation due for federal agencies: Aug 21, 2026	Jul 28, 2026	2 days before publication	Critical 9.8	3%
CVE-2026-48282 CISA KEV	Adobe · ColdFusion Adobe ColdFusion Path Traversal Vulnerability CISA remediation due for federal agencies: Jul 10, 2026	Jul 7, 2026	7 days	Critical 10.0	42%
CVE-2026-34909 CISA KEV	Ubiquiti · UniFi OS Ubiquiti UniFi OS Path Traversal Vulnerability CISA remediation due for federal agencies: Jun 26, 2026	Jun 22, 2026	32 days	Critical 10.0	2%
CVE-2026-20262 CISA KEV	Cisco · Catalyst SD-WAN Manager Cisco Catalyst SD-WAN Manager Directory or Path Traversal Vulnerability CISA remediation due for federal agencies: Jun 29, 2026	Jun 14, 2026	1 day before publication	Medium 6.5	28%
CVE-2024-7399 CISA KEV	Samsung · MagicINFO 9 Server Samsung MagicINFO 9 Server Path Traversal Vulnerability CISA remediation due for federal agencies: May 8, 2026	Apr 24, 2026	623 days	High 8.8	92%
CVE-2024-57728 CISA KEV Ransomware	SimpleHelp · SimpleHelp SimpleHelp Path Traversal Vulnerability CISA remediation due for federal agencies: May 8, 2026	Apr 23, 2026	464 days	High 7.2	65%
CVE-2025-2749 CISA KEV	Kentico · Kentico Xperience Kentico Xperience Path Traversal Vulnerability CISA remediation due for federal agencies: May 4, 2026	Apr 19, 2026	391 days	High 7.2	4%
CVE-2025-8110 CISA KEV	Gogs · Gogs Gogs Path Traversal Vulnerability CISA remediation due for federal agencies: Feb 2, 2026	Jan 12, 2026	33 days	High 8.7	85%
CVE-2025-6218 CISA KEV	RARLAB · WinRAR RARLAB WinRAR Path Traversal Vulnerability CISA remediation due for federal agencies: Dec 30, 2025	Dec 9, 2025	172 days	High 7.8	90%
CVE-2025-61884 CISA KEV Ransomware	Oracle · E-Business Suite Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability CISA remediation due for federal agencies: Nov 10, 2025	Oct 16, 2025	5 days	High 7.5	96%
CVE-2021-43798 CISA KEV	Grafana Labs · Grafana Grafana Path Traversal Vulnerability CISA remediation due for federal agencies: Oct 30, 2025	Oct 8, 2025	1,401 days	High 7.5	89%
CVE-2019-5418 CISA KEV	Rails · Ruby on Rails Rails Ruby on Rails Path Traversal Vulnerability CISA remediation due for federal agencies: Jul 28, 2025	Jul 7, 2025	2,294 days	High 7.5	99%
CVE-2024-0769 CISA KEV	D-Link · DIR-859 Router D-Link DIR-859 Router Path Traversal Vulnerability CISA remediation due for federal agencies: Jul 16, 2025	Jun 25, 2025	521 days	Medium 5.3	83%
CVE-2025-4632 CISA KEV	Samsung · MagicINFO 9 Server Samsung MagicINFO 9 Server Path Traversal Vulnerability CISA remediation due for federal agencies: Jun 12, 2025	May 22, 2025	9 days	Critical 9.8	24%
CVE-2023-38950 CISA KEV	ZKTeco · BioTime ZKTeco BioTime Path Traversal Vulnerability CISA remediation due for federal agencies: Jun 9, 2025	May 19, 2025	656 days	High 7.5	92%
CVE-2025-34028 CISA KEV	Commvault · Command Center Commvault Command Center Path Traversal Vulnerability CISA remediation due for federal agencies: May 23, 2025	May 2, 2025	10 days	Critical 9.3	98%
CVE-2017-12637 CISA KEV	SAP · NetWeaver SAP NetWeaver Directory Traversal Vulnerability CISA remediation due for federal agencies: Apr 9, 2025	Mar 19, 2025	2,781 days	High 7.5	95%
CVE-2024-4885 CISA KEV	Progress · WhatsUp Gold Progress WhatsUp Gold Path Traversal Vulnerability CISA remediation due for federal agencies: Mar 24, 2025	Mar 3, 2025	251 days	Critical 9.8	99%
CVE-2024-57727 CISA KEV Ransomware	SimpleHelp · SimpleHelp SimpleHelp Path Traversal Vulnerability CISA remediation due for federal agencies: Mar 6, 2025	Feb 12, 2025	29 days	Critical 9.1	97%
CVE-2024-55550 CISA KEV Ransomware	Mitel · MiCollab Mitel MiCollab Path Traversal Vulnerability CISA remediation due for federal agencies: Jan 28, 2025	Jan 7, 2025	29 days	Medium 4.4	38%
CVE-2024-41713 CISA KEV Ransomware	Mitel · MiCollab Mitel MiCollab Path Traversal Vulnerability CISA remediation due for federal agencies: Jan 28, 2025	Dec 5, 2024	46 days	Critical 9.1	97%
CVE-2024-11667 CISA KEV Ransomware	Zyxel · Multiple Firewalls Zyxel Multiple Firewalls Path Traversal Vulnerability CISA remediation due for federal agencies: Dec 24, 2024	Dec 3, 2024	6 days	High 7.5	3%
CVE-2021-26086 CISA KEV	Atlassian · Jira Server and Data Center Atlassian Jira Server and Data Center Path Traversal Vulnerability CISA remediation due for federal agencies: Dec 3, 2024	Nov 12, 2024	1,185 days	Medium 5.3	100%
CVE-2019-16278 CISA KEV	Nostromo · nhttpd Nostromo nhttpd Directory Traversal Vulnerability CISA remediation due for federal agencies: Nov 28, 2024	Nov 7, 2024	1,851 days	Critical 9.8	99%
CVE-2024-8963 CISA KEV	Ivanti · Cloud Services Appliance (CSA) Ivanti Cloud Services Appliance (CSA) Path Traversal Vulnerability CISA remediation due for federal agencies: Oct 10, 2024	Sep 19, 2024	Same day	Critical 9.4	99%
CVE-2021-20124 CISA KEV	DrayTek · VigorConnect Draytek VigorConnect Path Traversal Vulnerability CISA remediation due for federal agencies: Sep 24, 2024	Sep 3, 2024	1,056 days	High 7.5	96%
CVE-2021-20123 CISA KEV	DrayTek · VigorConnect Draytek VigorConnect Path Traversal Vulnerability CISA remediation due for federal agencies: Sep 24, 2024	Sep 3, 2024	1,056 days	High 7.5	90%
CVE-2024-7262 CISA KEV	Kingsoft · WPS Office Kingsoft WPS Office Path Traversal Vulnerability CISA remediation due for federal agencies: Sep 24, 2024	Aug 30, 2024	15 days	Critical 9.3	3%
CVE-2024-32113 CISA KEV	Apache · OFBiz Apache OFBiz Path Traversal Vulnerability CISA remediation due for federal agencies: Aug 28, 2024	Aug 7, 2024	91 days	Critical 9.1	100%
CVE-2024-28995 CISA KEV	SolarWinds · Serv-U SolarWinds Serv-U Path Traversal Vulnerability CISA remediation due for federal agencies: Aug 7, 2024	Jul 17, 2024	41 days	High 8.6	100%
CVE-2024-1708 CISA KEV Ransomware	ConnectWise · ScreenConnect ConnectWise ScreenConnect Path Traversal Vulnerability CISA remediation due for federal agencies: May 12, 2026	Feb 20, 2024	1 day before publication	High 8.4	95%
CVE-2023-41266 CISA KEV Ransomware	Qlik · Sense Qlik Sense Path Traversal Vulnerability CISA remediation due for federal agencies: Dec 28, 2023	Nov 28, 2023	92 days	High 8.2	85%
CVE-2023-47246 CISA KEV Ransomware	SysAid · SysAid Server SysAid Server Path Traversal Vulnerability CISA remediation due for federal agencies: Dec 4, 2023	Nov 8, 2023	1 day before publication	Critical 9.8	99%
CVE-2023-32315 CISA KEV	Ignite Realtime · Openfire Ignite Realtime Openfire Path Traversal Vulnerability CISA remediation due for federal agencies: Sep 14, 2023	Aug 24, 2023	90 days	High 8.6	100%
CVE-2023-35081 CISA KEV	Ivanti · Endpoint Manager Mobile (EPMM) Ivanti Endpoint Manager Mobile (EPMM) Path Traversal Vulnerability CISA remediation due for federal agencies: Aug 21, 2023	Jul 31, 2023	3 days before publication	High 7.2	64%
CVE-2022-41328 CISA KEV	Fortinet · FortiOS Fortinet FortiOS Path Traversal Vulnerability CISA remediation due for federal agencies: Apr 4, 2023	Mar 14, 2023	7 days	Medium 6.5	11%
CVE-2018-18809 CISA KEV	TIBCO · JasperReports TIBCO JasperReports Library Directory Traversal Vulnerability CISA remediation due for federal agencies: Jan 19, 2023	Dec 29, 2022	1,393 days	Critical 9.9	79%
CVE-2022-26500 CISA KEV Ransomware	Veeam · Backup & Replication Veeam Backup & Replication Remote Code Execution Vulnerability CISA remediation due for federal agencies: Jan 3, 2023	Dec 13, 2022	271 days	High 8.8	6%
CVE-2022-41352 CISA KEV Ransomware	Synacor · Zimbra Collaboration Suite (ZCS) Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability CISA remediation due for federal agencies: Nov 10, 2022	Oct 6, 2022	11 days	Critical 9.8	95%
CVE-2022-27925 CISA KEV Ransomware	Synacor · Zimbra Collaboration Suite (ZCS) Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability CISA remediation due for federal agencies: Sep 1, 2022	Aug 11, 2022	113 days	High 7.2	99%
CVE-2022-37042 CISA KEV Ransomware	Synacor · Zimbra Collaboration Suite (ZCS) Synacor Zimbra Collaboration Suite (ZCS) Authentication Bypass Vulnerability CISA remediation due for federal agencies: Sep 1, 2022	Aug 9, 2022	2 days before publication	Critical 9.8	92%
CVE-2022-30333 CISA KEV Ransomware	RARLAB · UnRAR RARLAB UnRAR Directory Traversal Vulnerability CISA remediation due for federal agencies: Aug 30, 2022	Aug 9, 2022	93 days	Critical 9.8	99%
CVE-2021-38163 CISA KEV	SAP · NetWeaver SAP NetWeaver Unrestricted File Upload Vulnerability CISA remediation due for federal agencies: Jun 30, 2022	Jun 9, 2022	268 days	Critical 9.9	37%
CVE-2019-7195 CISA KEV Ransomware	QNAP · Photo Station QNAP Photo Station Path Traversal Vulnerability CISA remediation due for federal agencies: Jun 22, 2022	Jun 8, 2022	916 days	Critical 9.8	90%

Page 1 of 2Next

How to read this

"Confirmed exploited" is the date CISA added the CVE to its Known Exploited Vulnerabilities catalog or assessed it as actively exploited, whichever came first. It is when exploitation was confirmed publicly, not when attackers started, so "after publication" is an upper bound: attackers were there at least that soon. "By disclosure day" means confirmed on or before the day the CVE record was published, the closest public measure of a zero-day. Dates are US Eastern, the calendar CISA uses. Vendors are named as CISA's catalog names them, otherwise as the assigning CNA does. EPSS is FIRST's estimate of the chance of exploitation in the next 30 days.