Exploited now
Every vulnerability CISA confirms is being exploited in the wild: listed in its Known Exploited Vulnerabilities catalog, or assessed as actively exploited in its Vulnrichment data, often days before the catalog. When it was confirmed, how soon after the CVE went public, and the vendors attackers go after first. Refreshed every ten minutes. Sources.
Updated under an hour ago ()
What this means for you
28 vulnerabilities confirmed exploited in the last 30 days; 38% of the last 12 months' were exploited by the day they were disclosed. Add your stack to see which of them you run.
- Confirmed exploited, last 30 days
- 28
- Show in the list
- Exploited by the day of disclosure, last 12 months
- 38%
- of 295 confirmed
- Show in the list
- Median days from disclosure to confirmed exploitation
- 4
- last 12 months; list sorted fastest first
- Show in the list
- Used in ransomware campaigns, last 12 months
- 25
- Show in the list
What this means for a patch cycle
Half of the vulnerabilities CISA confirmed exploited in the last 12 months were confirmed within 4 days of going public, and 38% by the day they were published. A monthly patch cycle leaves those exposed for weeks. Products from the vendors below, especially internet-facing ones, need an emergency patch path measured in days.
Where attackers strike first
Vendors by vulnerabilities confirmed exploited in the last 24 months; the top five account for 67% of the twelve listed. This counts confirmed attacks, not disclosed flaws, so a vendor is not rewarded for publishing fewer CVEs. Mapped health IT products account for 1 of them.
Are any of these in your stack?
Name the products you run and see every CVE that affects them, with exploited ones first. Free for one product; subscribers add their whole inventory and are emailed the moment one is exploited.
Every confirmed exploitation
Showing: confirmed in 2022 to 2026, CWE-77 Command Injection
Confirmed exploited in 2022 to 2026. Weakness: CWE-77 Command Injection. Clear these
| CVE | Vendor and vulnerability | Confirmed exploited | After publication | Severity | EPSS |
|---|---|---|---|---|---|
| CVE-2015-2051 CISA KEV | D-Link · DIR-645 Router D-Link DIR-645 Router Remote Code Execution VulnerabilityCISA remediation due for federal agencies: Aug 10, 2022 | Feb 10, 2022 | 2,544 days | High 8.8 | 97% |
| CVE-2016-1555 CISA KEV | NETGEAR · Wireless Access Point (WAP) Devices NETGEAR Multiple WAP Devices Command Injection VulnerabilityCISA remediation due for federal agencies: Apr 15, 2022 | Mar 25, 2022 | 1,799 days | Critical 9.8 | 98% |
| CVE-2012-1823 CISA KEV | PHP · PHP PHP-CGI Query String Parameter VulnerabilityCISA remediation due for federal agencies: Apr 15, 2022 | Mar 25, 2022 | 3,605 days | Critical 9.8 | 100% |
| CVE-2010-4345 CISA KEV | Exim · Exim Exim Privilege Escalation VulnerabilityCISA remediation due for federal agencies: Apr 15, 2022 | Mar 25, 2022 | 4,119 days | High 7.8 | 18% |
| CVE-2005-2773 CISA KEV | Hewlett Packard (HP) · OpenView Network Node Manager HP OpenView Network Node Manager Remote Code Execution VulnerabilityCISA remediation due for federal agencies: Apr 15, 2022 | Mar 25, 2022 | 6,048 days | Critical 9.8 | 75% |
| CVE-2020-2509 CISA KEV | QNAP · QNAP Network-Attached Storage (NAS) QNAP Network-Attached Storage (NAS) Command Injection VulnerabilityCISA remediation due for federal agencies: May 2, 2022 | Apr 11, 2022 | 360 days | Critical 9.8 | 34% |
| CVE-2010-5330 CISA KEV | Ubiquiti · AirOS Ubiquiti AirOS Command Injection VulnerabilityCISA remediation due for federal agencies: May 6, 2022 | Apr 15, 2022 | 1,039 days | Critical 9.8 | 40% |
| CVE-2007-3010 CISA KEV | Alcatel · OmniPCX Enterprise Alcatel OmniPCX Enterprise Remote Code Execution VulnerabilityCISA remediation due for federal agencies: May 6, 2022 | Apr 15, 2022 | 5,323 days | Critical 9.8 | 97% |
| CVE-2018-19949 CISA KEV Ransomware | QNAP · Network Attached Storage (NAS) QNAP NAS File Station Command Injection VulnerabilityCISA remediation due for federal agencies: Jun 14, 2022 | May 24, 2022 | 573 days | Critical 9.8 | 29% |
| CVE-2016-6367 CISA KEV | Cisco · Adaptive Security Appliance (ASA) Cisco Adaptive Security Appliance (ASA) CLI Remote Code Execution VulnerabilityCISA remediation due for federal agencies: Jun 14, 2022 | May 24, 2022 | 2,105 days | High 7.8 | 23% |
| CVE-2022-40765 CISA KEV Ransomware | Mitel · MiVoice Connect Mitel MiVoice Connect Command Injection VulnerabilityCISA remediation due for federal agencies: Mar 14, 2023 | Feb 21, 2023 | 92 days | Medium 6.8 | 11% |
| CVE-2023-1389 CISA KEV | TP-Link · Archer AX21 TP-Link Archer AX-21 Command Injection VulnerabilityCISA remediation due for federal agencies: May 22, 2023 | May 1, 2023 | 48 days | High 8.8 | 100% |
| CVE-2023-20887 CISA KEV | VMware · Aria Operations for Networks Vmware Aria Operations for Networks Command Injection VulnerabilityCISA remediation due for federal agencies: Jul 13, 2023 | Jun 22, 2023 | 15 days | Critical 9.8 | 98% |
| CVE-2023-1671 CISA KEV | Sophos · Web Appliance Sophos Web Appliance Command Injection VulnerabilityCISA remediation due for federal agencies: Dec 7, 2023 | Nov 16, 2023 | 227 days | Critical 9.8 | 100% |
| CVE-2016-20017 CISA KEV | D-Link · DSL-2750B Devices D-Link DSL-2750B Devices Command Injection VulnerabilityCISA remediation due for federal agencies: Jan 29, 2024 | Jan 5, 2024 | 444 days | Critical 9.8 | 67% |
| CVE-2024-21887 CISA KEV Ransomware | Ivanti · Connect Secure and Policy Secure Ivanti Connect Secure and Policy Secure Command Injection VulnerabilityCISA remediation due for federal agencies: Jan 22, 2024 | Jan 9, 2024 | 3 days before publication | Critical 9.1 | 100% |
| CVE-2024-3273 CISA KEV | D-Link · Multiple NAS Devices D-Link Multiple NAS Devices Command Injection VulnerabilityCISA remediation due for federal agencies: May 2, 2024 | Apr 11, 2024 | 8 days | High 7.3 | 100% |
| CVE-2024-3400 CISA KEV Ransomware | Palo Alto Networks · PAN-OS Palo Alto Networks PAN-OS Command Injection VulnerabilityCISA remediation due for federal agencies: Apr 19, 2024 | Apr 12, 2024 | Same day | Critical 10.0 | 100% |
| CVE-2024-9380 CISA KEV | Ivanti · Cloud Services Appliance (CSA) Ivanti Cloud Services Appliance (CSA) OS Command Injection VulnerabilityCISA remediation due for federal agencies: Oct 30, 2024 | Oct 9, 2024 | 1 day | High 7.2 | 60% |
| CVE-2024-55956 CISA KEV Ransomware | Cleo · Multiple Products Cleo Multiple Products Unauthenticated File Upload VulnerabilityCISA remediation due for federal agencies: Jan 7, 2025 | Dec 15, 2024 | 3 days | Critical 9.8 | 94% |
| CVE-2024-12356 CISA KEV | BeyondTrust · Privileged Remote Access (PRA) and Remote Support (RS) BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) Command Injection VulnerabilityCISA remediation due for federal agencies: Dec 27, 2024 | Dec 19, 2024 | 3 days | Critical 9.8 | 87% |
| CVE-2023-20118 CISA KEV | Cisco · Small Business RV Series Routers Cisco Small Business RV Series Routers Command Injection VulnerabilityCISA remediation due for federal agencies: Mar 24, 2025 | Mar 3, 2025 | 698 days | Medium 6.5 | 54% |
| CVE-2024-12987 CISA KEV | DrayTek · Vigor Routers DrayTek Vigor Routers OS Command Injection VulnerabilityCISA remediation due for federal agencies: Jun 5, 2025 | May 15, 2025 | 139 days | High 7.3 | 98% |
| CVE-2023-33538 CISA KEV | TP-Link · Multiple Routers TP-Link Multiple Routers Command Injection VulnerabilityCISA remediation due for federal agencies: Jul 7, 2025 | Jun 15, 2025 | 740 days | High 8.8 | 42% |
| CVE-2020-25079 CISA KEV | D-Link · DCS-2530L and DCS-2670L Devices D-Link DCS-2530L and DCS-2670L Command Injection VulnerabilityCISA remediation due for federal agencies: Aug 26, 2025 | Aug 4, 2025 | 1,797 days | High 8.8 | 54% |
| CVE-2025-10035 CISA KEV Ransomware | Fortra · GoAnywhere MFT Fortra GoAnywhere MFT Deserialization of Untrusted Data VulnerabilityCISA remediation due for federal agencies: Oct 20, 2025 | Sep 18, 2025 | Same day | Critical 10.0 | 100% |
| CVE-2025-59689 CISA KEV | Libraesva · Email Security Gateway Libraesva Email Security Gateway Command Injection VulnerabilityCISA remediation due for federal agencies: Oct 20, 2025 | Sep 26, 2025 | 8 days | Medium 6.1 | 2% |
| CVE-2025-4008 CISA KEV | Smartbedded · Meteobridge Smartbedded Meteobridge Command Injection VulnerabilityCISA remediation due for federal agencies: Oct 23, 2025 | Oct 1, 2025 | 133 days | High 8.7 | 93% |
| CVE-2026-22719 CISA KEV | Broadcom · VMware Aria Operations Broadcom VMware Aria Operations Command Injection VulnerabilityCISA remediation due for federal agencies: Mar 24, 2026 | Feb 23, 2026 | 2 days before publication | High 8.1 | 18% |
| CVE-2025-29635 CISA KEV | D-Link · DIR-823X D-Link DIR-823X Command Injection VulnerabilityCISA remediation due for federal agencies: May 8, 2026 | Apr 23, 2026 | 395 days | High 7.2 | 88% |
| CVE-2026-42271 CISA KEV | BerriAI · LiteLLM BerriAI LiteLLM Command Injection VulnerabilityCISA remediation due for federal agencies: Jun 22, 2026 | May 7, 2026 | Same day | High 8.7 | 93% |
| CVE-2026-8037 CISA KEV | Progress · LoadMaster Progress LoadMaster Command Injection VulnerabilityCISA remediation due for federal agencies: Aug 10, 2026 | Aug 7, 2026 | 64 days | Critical 9.6 | 77% |
| CVE-2026-96951 CISA KEV | Microsoft · Windows Microsoft Windows Command Injection VulnerabilityCISA remediation due for federal agencies: Oct 16, 2026 | Oct 7, 2026 | 6 days before publication | High 8.8 | 2% |
| CVE-2016-3081 CISA KEV | Apache · Struts Apache Struts Command Injection VulnerabilityCISA remediation due for federal agencies: Oct 11, 2026 | Oct 7, 2026 | 3,816 days | High 8.1 | 96% |
| CVE-2026-105134 CISA KEV | Ahsay · AhsayCBS Ahsay AhsayCBS Command Injection VulnerabilityCISA remediation due for federal agencies: Oct 17, 2026 | Oct 13, 2026 | 9 days | Critical 10.0 | 5% |
How to read this
"Confirmed exploited" is the date CISA added the CVE to its Known Exploited Vulnerabilities catalog or assessed it as actively exploited, whichever came first. It is when exploitation was confirmed publicly, not when attackers started, so "after publication" is an upper bound: attackers were there at least that soon. "By disclosure day" means confirmed on or before the day the CVE record was published, the closest public measure of a zero-day. Dates are US Eastern, the calendar CISA uses. Vendors are named as CISA's catalog names them, otherwise as the assigning CNA does. EPSS is FIRST's estimate of the chance of exploitation in the next 30 days.