Exploited now
Every vulnerability CISA confirms is being exploited in the wild: listed in its Known Exploited Vulnerabilities catalog, or assessed as actively exploited in its Vulnrichment data, often days before the catalog. When it was confirmed, how soon after the CVE went public, and the vendors attackers go after first. Refreshed every ten minutes. Sources.
Updated under an hour ago ()
What this means for you
28 vulnerabilities confirmed exploited in the last 30 days; 38% of the last 12 months' were exploited by the day they were disclosed. Add your stack to see which of them you run.
- Confirmed exploited, last 30 days
- 28
- Show in the list
- Exploited by the day of disclosure, last 12 months
- 38%
- of 295 confirmed
- Show in the list
- Median days from disclosure to confirmed exploitation
- 4
- last 12 months; list sorted fastest first
- Show in the list
- Used in ransomware campaigns, last 12 months
- 25
- Show in the list
What this means for a patch cycle
Half of the vulnerabilities CISA confirmed exploited in the last 12 months were confirmed within 4 days of going public, and 38% by the day they were published. A monthly patch cycle leaves those exposed for weeks. Products from the vendors below, especially internet-facing ones, need an emergency patch path measured in days.
Where attackers strike first
Vendors by vulnerabilities confirmed exploited in the last 24 months; the top five account for 67% of the twelve listed. This counts confirmed attacks, not disclosed flaws, so a vendor is not rewarded for publishing fewer CVEs. Mapped health IT products account for 1 of them.
Are any of these in your stack?
Name the products you run and see every CVE that affects them, with exploited ones first. Free for one product; subscribers add their whole inventory and are emailed the moment one is exploited.
Every confirmed exploitation
Showing: confirmed in 2022 to 2026, CWE-78 OS Command Injection
Confirmed exploited in 2022 to 2026. Weakness: CWE-78 OS Command Injection. Clear these
94 exploited CVEs, showing 51 to 94PreviousPage 2 of 2
| CVE | Vendor and vulnerability | Confirmed exploited | After publication | Severity | EPSS |
|---|---|---|---|---|---|
| CVE-2021-36380 CISA KEV | Sunhillo · SureLine Sunhillo SureLine OS Command Injection VulnerablityCISA remediation due for federal agencies: Mar 26, 2024 | Mar 5, 2024 | 935 days | Critical 9.8 | 98% |
| CVE-2023-49897 CISA KEV | FXC · AE1021, AE1021PE FXC AE1021, AE1021PE OS Command Injection VulnerabilityCISA remediation due for federal agencies: Jan 11, 2024 | Dec 20, 2023 | 14 days | High 8.8 | 50% |
| CVE-2023-47565 CISA KEV | QNAP · VioStor NVR QNAP VioStor NVR OS Command Injection VulnerabilityCISA remediation due for federal agencies: Jan 11, 2024 | Dec 20, 2023 | 12 days | High 8.0 | 73% |
| CVE-2023-20273 CISA KEV | Cisco · Cisco IOS XE Web UI Cisco IOS XE Web UI Command Injection VulnerabilityCISA remediation due for federal agencies: Oct 27, 2023 | Oct 23, 2023 | 1 day before publication | High 7.2 | 93% |
| CVE-2017-6884 CISA KEV Ransomware | Zyxel · EMG2926 Routers Zyxel EMG2926 Routers Command Injection VulnerabilityCISA remediation due for federal agencies: Oct 9, 2023 | Sep 18, 2023 | 2,356 days | High 8.8 | 33% |
| CVE-2017-18368 CISA KEV | Zyxel · P660HN-T1A Routers Zyxel P660HN-T1A Routers Command Injection VulnerabilityCISA remediation due for federal agencies: Aug 28, 2023 | Aug 7, 2023 | 1,558 days | Critical 9.8 | 94% |
| CVE-2022-29303 CISA KEV | SolarView · Compact SolarView Compact Command Injection VulnerabilityCISA remediation due for federal agencies: Aug 3, 2023 | Jul 13, 2023 | 427 days | Critical 9.8 | 98% |
| CVE-2019-20500 CISA KEV | D-Link · DWL-2600AP Access Point D-Link DWL-2600AP Access Point Command Injection VulnerabilityCISA remediation due for federal agencies: Jul 20, 2023 | Jun 29, 2023 | 1,211 days | High 7.8 | 97% |
| CVE-2019-17621 CISA KEV | D-Link · DIR-859 Router D-Link DIR-859 Router Command Execution VulnerabilityCISA remediation due for federal agencies: Jul 20, 2023 | Jun 29, 2023 | 1,277 days | Critical 9.8 | 90% |
| CVE-2023-27992 CISA KEV | Zyxel · Multiple Network-Attached Storage (NAS) Devices Zyxel Multiple NAS Devices Command Injection VulnerabilityCISA remediation due for federal agencies: Jul 14, 2023 | Jun 23, 2023 | 4 days | Critical 9.8 | 83% |
| CVE-2020-12641 CISA KEV | Roundcube · Roundcube Webmail Roundcube Webmail Remote Code Execution VulnerabilityCISA remediation due for federal agencies: Jul 13, 2023 | Jun 22, 2023 | 1,144 days | Critical 9.8 | 84% |
| CVE-2023-28771 CISA KEV | Zyxel · Multiple Firewalls Zyxel Multiple Firewalls OS Command Injection VulnerabilityCISA remediation due for federal agencies: Jun 21, 2023 | May 31, 2023 | 37 days | Critical 9.8 | 99% |
| CVE-2022-33891 CISA KEV | Apache · Spark Apache Spark Command Injection VulnerabilityCISA remediation due for federal agencies: Mar 28, 2023 | Mar 7, 2023 | 233 days | High 8.8 | 93% |
| CVE-2022-44877 CISA KEV | CWP · Control Web Panel CWP Control Web Panel OS Command Injection VulnerabilityCISA remediation due for federal agencies: Feb 7, 2023 | Jan 17, 2023 | 13 days | Critical 9.8 | 100% |
| CVE-2022-36804 CISA KEV | Atlassian · Bitbucket Server and Data Center Atlassian Bitbucket Server and Data Center Command Injection VulnerabilityCISA remediation due for federal agencies: Oct 21, 2022 | Sep 30, 2022 | 36 days | High 8.8 | 99% |
| CVE-2022-26258 CISA KEV | D-Link · DIR-820L D-Link DIR-820L Remote Code Execution VulnerabilityCISA remediation due for federal agencies: Sep 29, 2022 | Sep 8, 2022 | 166 days | Critical 9.8 | 92% |
| CVE-2018-6530 CISA KEV Ransomware | D-Link · Multiple Routers D-Link Multiple Routers OS Command Injection VulnerabilityCISA remediation due for federal agencies: Sep 29, 2022 | Sep 8, 2022 | 1,647 days | Critical 9.8 | 97% |
| CVE-2018-19949 CISA KEV Ransomware | QNAP · Network Attached Storage (NAS) QNAP NAS File Station Command Injection VulnerabilityCISA remediation due for federal agencies: Jun 14, 2022 | May 24, 2022 | 573 days | Critical 9.8 | 29% |
| CVE-2022-30525 CISA KEV | Zyxel · Multiple Firewalls Zyxel Multiple Firewalls OS Command Injection VulnerabilityCISA remediation due for federal agencies: Jun 6, 2022 | May 16, 2022 | 4 days | Critical 9.8 | 100% |
| CVE-2019-16057 CISA KEV Ransomware | D-Link · DNS-320 Storage Device D-Link DNS-320 Remote Code Execution VulnerabilityCISA remediation due for federal agencies: May 6, 2022 | Apr 15, 2022 | 942 days | Critical 9.8 | 86% |
| CVE-2020-2509 CISA KEV | QNAP · QNAP Network-Attached Storage (NAS) QNAP Network-Attached Storage (NAS) Command Injection VulnerabilityCISA remediation due for federal agencies: May 2, 2022 | Apr 11, 2022 | 360 days | Critical 9.8 | 34% |
| CVE-2021-45382 CISA KEV | D-Link · Multiple Routers D-Link Multiple Routers Remote Code Execution VulnerabilityCISA remediation due for federal agencies: Apr 25, 2022 | Apr 4, 2022 | 46 days | Critical 9.8 | 98% |
| CVE-2018-10562 CISA KEV Ransomware | Dasan · Gigabit Passive Optical Network (GPON) Routers Dasan GPON Routers Command Injection VulnerabilityCISA remediation due for federal agencies: Apr 21, 2022 | Mar 31, 2022 | 1,428 days | Critical 9.8 | 100% |
| CVE-2020-9377 CISA KEV | D-Link · DIR-610 Devices D-Link DIR-610 Devices Remote Command ExecutionCISA remediation due for federal agencies: Apr 15, 2022 | Mar 25, 2022 | 624 days | High 8.8 | 21% |
| CVE-2020-9054 CISA KEV | Zyxel · Multiple Network-Attached Storage (NAS) Devices Zyxel Multiple NAS Devices OS Command Injection VulnerabilityCISA remediation due for federal agencies: Apr 15, 2022 | Mar 25, 2022 | 751 days | Critical 9.8 | 100% |
| CVE-2020-25223 CISA KEV | Sophos · SG UTM Sophos SG UTM Remote Code Execution VulnerabilityCISA remediation due for federal agencies: Apr 15, 2022 | Mar 25, 2022 | 547 days | Critical 9.8 | 97% |
| CVE-2020-1956 CISA KEV | Apache · Kylin Apache Kylin OS Command Injection VulnerabilityCISA remediation due for federal agencies: Apr 15, 2022 | Mar 25, 2022 | 672 days | High 8.8 | 97% |
| CVE-2019-16920 CISA KEV | D-Link · Multiple Routers D-Link Multiple Routers Command Injection VulnerabilityCISA remediation due for federal agencies: Apr 15, 2022 | Mar 25, 2022 | 910 days | Critical 9.8 | 100% |
| CVE-2019-12991 CISA KEV | Citrix · SD-WAN and NetScaler Citrix SD-WAN and NetScaler Command Injection VulnerabilityCISA remediation due for federal agencies: Apr 15, 2022 | Mar 25, 2022 | 983 days | High 8.8 | 74% |
| CVE-2018-6961 CISA KEV | VMware · SD-WAN Edge VMware SD-WAN Edge by VeloCloud Command Injection VulnerabilityCISA remediation due for federal agencies: Apr 15, 2022 | Mar 25, 2022 | 1,383 days | High 8.1 | 85% |
| CVE-2018-14839 CISA KEV | LG · N1A1 NAS LG N1A1 NAS Remote Command Execution VulnerabilityCISA remediation due for federal agencies: Apr 15, 2022 | Mar 25, 2022 | 1,046 days | Critical 9.8 | 89% |
| CVE-2017-6334 CISA KEV | NETGEAR · DGN2200 Devices NETGEAR DGN2200 Devices OS Command Injection VulnerabilityCISA remediation due for federal agencies: Apr 15, 2022 | Mar 25, 2022 | 1,846 days | High 8.8 | 73% |
| CVE-2016-11021 CISA KEV | D-Link · DCS-930L Devices D-Link DCS-930L Devices OS Command Injection VulnerabilityCISA remediation due for federal agencies: Apr 15, 2022 | Mar 25, 2022 | 747 days | High 7.2 | 69% |
| CVE-2018-11138 CISA KEV Ransomware | Quest · KACE System Management Appliance Quest KACE System Management Appliance Remote Command Execution VulnerabilityCISA remediation due for federal agencies: Apr 15, 2022 | Mar 20, 2022 | 1,389 days | Critical 9.8 | 92% |
| CVE-2019-15107 CISA KEV Ransomware | Webmin · Webmin Webmin Command Injection VulnerabilityCISA remediation due for federal agencies: Apr 15, 2022 | Mar 10, 2022 | 938 days | Critical 9.8 | 100% |
| CVE-2017-6077 CISA KEV | NETGEAR · Wireless Router DGN2200 NETGEAR DGN2200 Remote Code Execution VulnerabilityCISA remediation due for federal agencies: Sep 7, 2022 | Mar 7, 2022 | 1,839 days | Critical 9.8 | 69% |
| CVE-2014-7169 CISA KEV | GNU · Bourne-Again Shell (Bash) GNU Bourne-Again Shell (Bash) Arbitrary Code Execution VulnerabilityCISA remediation due for federal agencies: Jul 28, 2022 | Jan 28, 2022 | 2,683 days | Critical 9.8 | 100% |
| CVE-2014-6271 CISA KEV | GNU · Bourne-Again Shell (Bash) GNU Bourne-Again Shell (Bash) Arbitrary Code Execution VulnerabilityCISA remediation due for federal agencies: Jul 28, 2022 | Jan 28, 2022 | 2,683 days | Critical 9.8 | 100% |
| CVE-2021-25298 CISA KEV | Nagios · Nagios XI Nagios XI OS Command InjectionCISA remediation due for federal agencies: Feb 1, 2022 | Jan 18, 2022 | 338 days | High 8.8 | 74% |
| CVE-2021-25297 CISA KEV | Nagios · Nagios XI Nagios XI OS Command InjectionCISA remediation due for federal agencies: Feb 1, 2022 | Jan 18, 2022 | 338 days | High 8.8 | 57% |
| CVE-2021-21315 CISA KEV | Npm package · System Information Library for Node.JS System Information Library for Node.JS Command InjectionCISA remediation due for federal agencies: Feb 1, 2022 | Jan 18, 2022 | 336 days | High 7.1 | 91% |
| CVE-2020-11978 CISA KEV | Apache · Airflow Apache Airflow Command InjectionCISA remediation due for federal agencies: Jul 18, 2022 | Jan 18, 2022 | 552 days | High 8.8 | 99% |
| CVE-2021-36260 CISA KEV | Hikvision · Security cameras web server Hikvision Improper Input ValidationCISA remediation due for federal agencies: Jan 24, 2022 | Jan 10, 2022 | 110 days | Critical 9.8 | 100% |
| CVE-2019-10149 CISA KEV | Exim · Mail Transfer Agent (MTA) Exim Mail Transfer Agent (MTA) Improper Input ValidationCISA remediation due for federal agencies: Jul 10, 2022 | Jan 10, 2022 | 951 days | Critical 9.0 | 100% |
PreviousPage 2 of 2
How to read this
"Confirmed exploited" is the date CISA added the CVE to its Known Exploited Vulnerabilities catalog or assessed it as actively exploited, whichever came first. It is when exploitation was confirmed publicly, not when attackers started, so "after publication" is an upper bound: attackers were there at least that soon. "By disclosure day" means confirmed on or before the day the CVE record was published, the closest public measure of a zero-day. Dates are US Eastern, the calendar CISA uses. Vendors are named as CISA's catalog names them, otherwise as the assigning CNA does. EPSS is FIRST's estimate of the chance of exploitation in the next 30 days.