Exploited now
Every vulnerability CISA confirms is being exploited in the wild: listed in its Known Exploited Vulnerabilities catalog, or assessed as actively exploited in its Vulnrichment data, often days before the catalog. When it was confirmed, how soon after the CVE went public, and the vendors attackers go after first. Refreshed every ten minutes. Sources.
Updated under an hour ago ()
What this means for you
28 vulnerabilities confirmed exploited in the last 30 days; 38% of the last 12 months' were exploited by the day they were disclosed. Add your stack to see which of them you run.
- Confirmed exploited, last 30 days
- 28
- Show in the list
- Exploited by the day of disclosure, last 12 months
- 38%
- of 295 confirmed
- Show in the list
- Median days from disclosure to confirmed exploitation
- 4
- last 12 months; list sorted fastest first
- Show in the list
- Used in ransomware campaigns, last 12 months
- 25
- Show in the list
What this means for a patch cycle
Half of the vulnerabilities CISA confirmed exploited in the last 12 months were confirmed within 4 days of going public, and 38% by the day they were published. A monthly patch cycle leaves those exposed for weeks. Products from the vendors below, especially internet-facing ones, need an emergency patch path measured in days.
Where attackers strike first
Vendors by vulnerabilities confirmed exploited in the last 24 months; the top five account for 67% of the twelve listed. This counts confirmed attacks, not disclosed flaws, so a vendor is not rewarded for publishing fewer CVEs. Mapped health IT products account for 1 of them.
Are any of these in your stack?
Name the products you run and see every CVE that affects them, with exploited ones first. Free for one product; subscribers add their whole inventory and are emailed the moment one is exploited.
Every confirmed exploitation
Showing: last 12 months, exploited by disclosure day
112 exploited CVEs, showing 1 to 50Page 1 of 3Next
| CVE | Vendor and vulnerability | Confirmed exploited | After publication | Severity | EPSS |
|---|---|---|---|---|---|
| CVE-2025-60710 CISA KEV Ransomware | Microsoft · Windows Microsoft Windows Link Following VulnerabilityCISA remediation due for federal agencies: Apr 27, 2026 | Nov 6, 2025 | 5 days before publication | High 7.8 | 5% |
| CVE-2025-12480 CISA KEV | Gladinet · Triofox Gladinet Triofox Improper Access Control VulnerabilityCISA remediation due for federal agencies: Dec 3, 2025 | Nov 10, 2025 | Same day | Critical 9.1 | 96% |
| CVE-2025-62215 CISA KEV | Microsoft · Windows Microsoft Windows Race Condition VulnerabilityCISA remediation due for federal agencies: Dec 3, 2025 | Nov 11, 2025 | Same day | High 7.0 | 4% |
| CVE-2025-64446 CISA KEV | Fortinet · FortiWeb Fortinet FortiWeb Path Traversal VulnerabilityCISA remediation due for federal agencies: Nov 21, 2025 | Nov 14, 2025 | Same day | Critical 9.4 | 92% |
| CVE-2025-58034 CISA KEV | Fortinet · FortiWeb Fortinet FortiWeb OS Command Injection VulnerabilityCISA remediation due for federal agencies: Nov 25, 2025 | Nov 18, 2025 | Same day | Medium 6.7 | 56% |
| CVE-2025-48633 CISA KEV | Android · Framework Android Framework Information Disclosure VulnerabilityCISA remediation due for federal agencies: Dec 23, 2025 | Dec 2, 2025 | 6 days before publication | Medium 5.5 | 0% |
| CVE-2025-48572 CISA KEV | Android · Framework Android Framework Privilege Escalation VulnerabilityCISA remediation due for federal agencies: Dec 23, 2025 | Dec 2, 2025 | 6 days before publication | High 7.8 | 0% |
| CVE-2025-62221 CISA KEV | Microsoft · Windows Microsoft Windows Use After Free VulnerabilityCISA remediation due for federal agencies: Dec 30, 2025 | Dec 9, 2025 | Same day | High 7.8 | 3% |
| CVE-2025-14174 CISA KEV | Google · Chromium Google Chromium Out of Bounds Memory Access VulnerabilityCISA remediation due for federal agencies: Jan 2, 2026 | Dec 12, 2025 | Same day | High 8.8 | 22% |
| CVE-2025-43529 CISA KEV | Apple · Multiple Products Apple Multiple Products Use-After-Free WebKit VulnerabilityCISA remediation due for federal agencies: Jan 5, 2026 | Dec 15, 2025 | 2 days before publication | High 8.8 | 9% |
| CVE-2025-40602 CISA KEV | SonicWall · SMA1000 appliance SonicWall SMA1000 Missing Authorization VulnerabilityCISA remediation due for federal agencies: Dec 24, 2025 | Dec 17, 2025 | 1 day before publication | Medium 6.6 | 3% |
| CVE-2025-20393 CISA KEV | Cisco · Multiple Products Cisco Multiple Products Improper Input Validation VulnerabilityCISA remediation due for federal agencies: Dec 24, 2025 | Dec 17, 2025 | Same day | Critical 10.0 | 32% |
| CVE-2025-14733 CISA KEV Ransomware | WatchGuard · Firebox WatchGuard Firebox Out of Bounds Write VulnerabilityCISA remediation due for federal agencies: Dec 26, 2025 | Dec 18, 2025 | Same day | Critical 9.3 | 27% |
| CVE-2026-20963 CISA KEV | Microsoft · SharePoint Microsoft SharePoint Deserialization of Untrusted Data VulnerabilityCISA remediation due for federal agencies: Mar 21, 2026 | Jan 7, 2026 | 6 days before publication | Critical 9.8 | 29% |
| CVE-2026-20805 CISA KEV | Microsoft · Windows Microsoft Windows Information Disclosure VulnerabilityCISA remediation due for federal agencies: Feb 3, 2026 | Jan 13, 2026 | Same day | Medium 5.5 | 7% |
| CVE-2026-21962 CISA KEV | Oracle · HTTP Server and Oracle Weblogic Server Proxy Plug-in Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control VulnerabilityCISA remediation due for federal agencies: Aug 27, 2026 | Jan 20, 2026 | Same day | Critical 10.0 | 73% |
| CVE-2026-23760 CISA KEV Ransomware | SmarterTools · SmarterMail SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel VulnerabilityCISA remediation due for federal agencies: Feb 16, 2026 | Jan 21, 2026 | 1 day before publication | Critical 9.3 | 97% |
| CVE-2026-20045 CISA KEV | Cisco · Unified Communications Manager Cisco Unified Communications Products Code Injection VulnerabilityCISA remediation due for federal agencies: Feb 11, 2026 | Jan 21, 2026 | Same day | High 8.2 | 5% |
| CVE-2026-0770 CISA KEV | Langflow · Langflow Langflow Inclusion of Functionality from Untrusted Control Sphere VulnerabilityCISA remediation due for federal agencies: Jul 24, 2026 | Jan 22, 2026 | Same day | Critical 9.8 | 63% |
| CVE-2026-21509 CISA KEV | Microsoft · Office Microsoft Office Security Feature Bypass VulnerabilityCISA remediation due for federal agencies: Feb 16, 2026 | Jan 25, 2026 | 1 day before publication | High 7.8 | 71% |
| CVE-2026-24858 CISA KEV | Fortinet · Multiple Products Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel VulnerabilityCISA remediation due for federal agencies: Jan 30, 2026 | Jan 27, 2026 | Same day | Critical 9.4 | 86% |
| CVE-2026-1340 CISA KEV | Ivanti · Endpoint Manager Mobile (EPMM) Ivanti Endpoint Manager Mobile (EPMM) Code Injection VulnerabilityCISA remediation due for federal agencies: Apr 11, 2026 | Jan 28, 2026 | 1 day before publication | Critical 9.8 | 99% |
| CVE-2026-1281 CISA KEV | Ivanti · Endpoint Manager Mobile (EPMM) Ivanti Endpoint Manager Mobile (EPMM) Code Injection VulnerabilityCISA remediation due for federal agencies: Feb 1, 2026 | Jan 29, 2026 | Same day | Critical 9.8 | 99% |
| CVE-2026-21643 CISA KEV | Fortinet · FortiClient EMS Fortinet FortiClient EMS SQL Injection VulnerabilityCISA remediation due for federal agencies: Apr 16, 2026 | Feb 5, 2026 | 1 day before publication | Critical 9.1 | 94% |
| CVE-2026-21533 CISA KEV | Microsoft · Windows Microsoft Windows Improper Privilege Management VulnerabilityCISA remediation due for federal agencies: Mar 3, 2026 | Feb 10, 2026 | Same day | High 7.8 | 4% |
| CVE-2026-21525 CISA KEV | Microsoft · Windows Microsoft Windows NULL Pointer Dereference VulnerabilityCISA remediation due for federal agencies: Mar 3, 2026 | Feb 10, 2026 | Same day | Medium 6.2 | 5% |
| CVE-2026-21519 CISA KEV | Microsoft · Windows Microsoft Windows Type Confusion VulnerabilityCISA remediation due for federal agencies: Mar 3, 2026 | Feb 10, 2026 | Same day | High 7.8 | 2% |
| CVE-2026-21514 CISA KEV | Microsoft · Office Microsoft Office Word Reliance on Untrusted Inputs in a Security Decision VulnerabilityCISA remediation due for federal agencies: Mar 3, 2026 | Feb 10, 2026 | Same day | High 7.8 | 2% |
| CVE-2026-21513 CISA KEV | Microsoft · Windows Microsoft MSHTML Framework Protection Mechanism Failure VulnerabilityCISA remediation due for federal agencies: Mar 3, 2026 | Feb 10, 2026 | Same day | High 8.8 | 16% |
| CVE-2026-21510 CISA KEV | Microsoft · Windows Microsoft Windows Shell Protection Mechanism Failure VulnerabilityCISA remediation due for federal agencies: Mar 3, 2026 | Feb 10, 2026 | Same day | High 8.8 | 25% |
| CVE-2026-22719 CISA KEV | Broadcom · VMware Aria Operations Broadcom VMware Aria Operations Command Injection VulnerabilityCISA remediation due for federal agencies: Mar 24, 2026 | Feb 23, 2026 | 2 days before publication | High 8.1 | 18% |
| CVE-2026-20128 CISA KEV | Cisco · Catalyst SD-WAN Manager Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format VulnerabilityCISA remediation due for federal agencies: Apr 23, 2026 | Feb 24, 2026 | 1 day before publication | High 7.5 | 7% |
| CVE-2026-20127 CISA KEV | Cisco · Catalyst SD-WAN Controller and Manager Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass VulnerabilityCISA remediation due for federal agencies: Feb 27, 2026 | Feb 25, 2026 | Same day | Critical 10.0 | 88% |
| CVE-2026-21385 CISA KEV | Qualcomm · Multiple Chipsets Qualcomm Multiple Chipsets Memory Corruption VulnerabilityCISA remediation due for federal agencies: Mar 24, 2026 | Mar 1, 2026 | 1 day before publication | High 7.8 | 1% |
| CVE-2026-20131 CISA KEV Ransomware | Cisco · Secure Firewall Management Center (FMC) Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data VulnerabilityCISA remediation due for federal agencies: Mar 22, 2026 | Mar 3, 2026 | 1 day before publication | Critical 10.0 | 43% |
| CVE-2026-3910 CISA KEV | Google · Chromium V8 Google Chromium V8 Improper Restriction of Operations Within the Bounds of a Memory Buffer VulnerabilityCISA remediation due for federal agencies: Mar 27, 2026 | Mar 12, 2026 | Same day | High 8.8 | 1% |
| CVE-2026-3909 CISA KEV | Google · Skia Google Skia Out-of-Bounds Write VulnerabilityCISA remediation due for federal agencies: Mar 27, 2026 | Mar 12, 2026 | Same day | High 8.8 | 2% |
| CVE-2026-3055 CISA KEV | Citrix · NetScaler Citrix NetScaler Out-of-Bounds Read VulnerabilityCISA remediation due for federal agencies: Apr 2, 2026 | Mar 22, 2026 | 1 day before publication | Critical 9.3 | 4% |
| CVE-2026-33634 CISA KEV | Aquasecurity · Trivy Aquasecurity Trivy Embedded Malicious Code VulnerabilityCISA remediation due for federal agencies: Apr 9, 2026 | Mar 23, 2026 | Same day | Critical 9.4 | 2% |
| CVE-2026-3502 CISA KEV | TrueConf · Client TrueConf Client Download of Code Without Integrity Check VulnerabilityCISA remediation due for federal agencies: Apr 16, 2026 | Mar 30, 2026 | Same day | High 7.8 | 0% |
| CVE-2026-5281 CISA KEV | Google · Dawn Google Dawn Use-After-Free VulnerabilityCISA remediation due for federal agencies: Apr 15, 2026 | Mar 31, 2026 | 1 day before publication | High 8.8 | 1% |
| CVE-2026-35616 CISA KEV | Fortinet · FortiClient EMS Fortinet FortiClient EMS Improper Access Control VulnerabilityCISA remediation due for federal agencies: Apr 9, 2026 | Apr 2, 2026 | 1 day before publication | Critical 9.1 | 9% |
| CVE-2026-32201 CISA KEV | Microsoft · SharePoint Server Microsoft SharePoint Server Improper Input Validation VulnerabilityCISA remediation due for federal agencies: Apr 28, 2026 | Apr 8, 2026 | 6 days before publication | Medium 6.5 | 43% |
| CVE-2026-34621 CISA KEV | Adobe · Acrobat and Reader Adobe Acrobat and Reader Prototype Pollution VulnerabilityCISA remediation due for federal agencies: Apr 27, 2026 | Apr 10, 2026 | 1 day before publication | High 8.6 | 2% |
| CVE-2026-33824 CISA KEV | Microsoft · Internet Key Exchange (IKE) Service Extensions Microsoft Internet Key Exchange (IKE) Service Extensions Double Free VulnerabilityCISA remediation due for federal agencies: Aug 21, 2026 | Apr 12, 2026 | 2 days before publication | Critical 9.8 | 2% |
| CVE-2026-39808 CISA KEV | Fortinet · FortiSandbox Fortinet FortiSandbox OS Command Injection VulnerabilityCISA remediation due for federal agencies: Jul 19, 2026 | Apr 13, 2026 | 1 day before publication | Critical 9.1 | 47% |
| CVE-2026-41940 CISA KEV Ransomware | WebPros · cPanel & WHM and WP2 (WordPress Squared) WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function VulnerabilityCISA remediation due for federal agencies: May 3, 2026 | Apr 28, 2026 | 1 day before publication | Critical 9.8 | 99% |
| CVE-2026-0300 CISA KEV | Palo Alto Networks · PAN-OS Palo Alto Networks PAN-OS Out-of-bounds Write VulnerabilityCISA remediation due for federal agencies: May 9, 2026 | May 5, 2026 | 1 day before publication | Critical 9.3 | 32% |
| CVE-2026-6973 CISA KEV | Ivanti · Endpoint Manager Mobile (EPMM) Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation VulnerabilityCISA remediation due for federal agencies: May 10, 2026 | May 6, 2026 | 1 day before publication | High 7.2 | 3% |
| CVE-2026-42271 CISA KEV | BerriAI · LiteLLM BerriAI LiteLLM Command Injection VulnerabilityCISA remediation due for federal agencies: Jun 22, 2026 | May 7, 2026 | Same day | High 8.7 | 93% |
Page 1 of 3Next
How to read this
"Confirmed exploited" is the date CISA added the CVE to its Known Exploited Vulnerabilities catalog or assessed it as actively exploited, whichever came first. It is when exploitation was confirmed publicly, not when attackers started, so "after publication" is an upper bound: attackers were there at least that soon. "By disclosure day" means confirmed on or before the day the CVE record was published, the closest public measure of a zero-day. Dates are US Eastern, the calendar CISA uses. Vendors are named as CISA's catalog names them, otherwise as the assigning CNA does. EPSS is FIRST's estimate of the chance of exploitation in the next 30 days.