Exploited now
Every vulnerability CISA confirms is being exploited in the wild: listed in its Known Exploited Vulnerabilities catalog, or assessed as actively exploited in its Vulnrichment data, often days before the catalog. When it was confirmed, how soon after the CVE went public, and the vendors attackers go after first. Refreshed every ten minutes. Sources.
Updated under an hour ago ()
What this means for you
28 vulnerabilities confirmed exploited in the last 30 days; 38% of the last 12 months' were exploited by the day they were disclosed. Add your stack to see which of them you run.
- Confirmed exploited, last 30 days
- 28
- Show in the list
- Exploited by the day of disclosure, last 12 months
- 38%
- of 295 confirmed
- Show in the list
- Median days from disclosure to confirmed exploitation
- 4
- last 12 months; list sorted fastest first
- Show in the list
- Used in ransomware campaigns, last 12 months
- 25
- Show in the list
What this means for a patch cycle
Half of the vulnerabilities CISA confirmed exploited in the last 12 months were confirmed within 4 days of going public, and 38% by the day they were published. A monthly patch cycle leaves those exposed for weeks. Products from the vendors below, especially internet-facing ones, need an emergency patch path measured in days.
Where attackers strike first
Vendors by vulnerabilities confirmed exploited in the last 24 months; the top five account for 67% of the twelve listed. This counts confirmed attacks, not disclosed flaws, so a vendor is not rewarded for publishing fewer CVEs. Mapped health IT products account for 1 of them.
Are any of these in your stack?
Name the products you run and see every CVE that affects them, with exploited ones first. Free for one product; subscribers add their whole inventory and are emailed the moment one is exploited.
Every confirmed exploitation
Showing: confirmed in March 2025
Confirmed exploited in March 2025. Clear these
| CVE | Vendor and vulnerability | Confirmed exploited | After publication | Severity | EPSS |
|---|---|---|---|---|---|
| CVE-2024-20439 CISA KEV | Cisco · Smart Licensing Utility Cisco Smart Licensing Utility Static Credential VulnerabilityCISA remediation due for federal agencies: Apr 21, 2025 | Mar 31, 2025 | 208 days | Critical 9.8 | 97% |
| CVE-2025-2783 CISA KEV | Google · Chromium Mojo Google Chromium Mojo Sandbox Escape VulnerabilityCISA remediation due for federal agencies: Apr 17, 2025 | Mar 27, 2025 | 1 day | High 8.3 | 9% |
| CVE-2019-9875 CISA KEV | Sitecore · CMS and Experience Platform (XP) Sitecore CMS and Experience Platform (XP) Deserialization VulnerabilityCISA remediation due for federal agencies: Apr 16, 2025 | Mar 26, 2025 | 2,126 days | High 8.8 | 14% |
| CVE-2019-9874 CISA KEV | Sitecore · CMS and Experience Platform (XP) Sitecore CMS and Experience Platform (XP) Deserialization VulnerabilityCISA remediation due for federal agencies: Apr 16, 2025 | Mar 26, 2025 | 2,126 days | Critical 9.8 | 84% |
| CVE-2025-30154 CISA KEV | reviewdog · action-setup GitHub Action reviewdog/action-setup GitHub Action Embedded Malicious Code VulnerabilityCISA remediation due for federal agencies: Apr 14, 2025 | Mar 24, 2025 | 5 days | High 8.6 | 2% |
| CVE-2025-1316 CISA KEV | Edimax · IC-7100 IP Camera Edimax IC-7100 IP Camera OS Command Injection VulnerabilityCISA remediation due for federal agencies: Apr 9, 2025 | Mar 19, 2025 | 15 days | Critical 9.8 | 74% |
| CVE-2024-48248 CISA KEV | NAKIVO · Backup and Replication NAKIVO Backup and Replication Absolute Path Traversal VulnerabilityCISA remediation due for federal agencies: Apr 9, 2025 | Mar 19, 2025 | 16 days | High 8.6 | 94% |
| CVE-2017-12637 CISA KEV | SAP · NetWeaver SAP NetWeaver Directory Traversal VulnerabilityCISA remediation due for federal agencies: Apr 9, 2025 | Mar 19, 2025 | 2,781 days | High 7.5 | 95% |
| CVE-2025-30066 CISA KEV | tj-actions · changed-files GitHub Action tj-actions/changed-files GitHub Action Embedded Malicious Code VulnerabilityCISA remediation due for federal agencies: Apr 8, 2025 | Mar 18, 2025 | 4 days | High 8.6 | 72% |
| CVE-2025-24201 CISA KEV | Apple · Multiple Products Apple Multiple Products WebKit Out-of-Bounds Write VulnerabilityCISA remediation due for federal agencies: Apr 3, 2025 | Mar 13, 2025 | 2 days | Critical 10.0 | 4% |
| CVE-2025-21590 CISA KEV | Juniper · Junos OS Juniper Junos OS Improper Isolation or Compartmentalization VulnerabilityCISA remediation due for federal agencies: Apr 3, 2025 | Mar 13, 2025 | 1 day | Medium 4.4 | 2% |
| CVE-2025-26633 CISA KEV Ransomware | Microsoft · Windows Microsoft Windows Management Console (MMC) Improper Neutralization VulnerabilityCISA remediation due for federal agencies: Apr 1, 2025 | Mar 11, 2025 | Same day | High 7.0 | 30% |
| CVE-2025-24993 CISA KEV | Microsoft · Windows Microsoft Windows NTFS Heap-Based Buffer Overflow VulnerabilityCISA remediation due for federal agencies: Apr 1, 2025 | Mar 11, 2025 | Same day | High 7.8 | 2% |
| CVE-2025-24991 CISA KEV | Microsoft · Windows Microsoft Windows NTFS Out-Of-Bounds Read VulnerabilityCISA remediation due for federal agencies: Apr 1, 2025 | Mar 11, 2025 | Same day | Medium 5.5 | 2% |
| CVE-2025-24985 CISA KEV | Microsoft · Windows Microsoft Windows Fast FAT File System Driver Integer Overflow VulnerabilityCISA remediation due for federal agencies: Apr 1, 2025 | Mar 11, 2025 | Same day | High 7.8 | 4% |
| CVE-2025-24984 CISA KEV | Microsoft · Windows Microsoft Windows NTFS Information Disclosure VulnerabilityCISA remediation due for federal agencies: Apr 1, 2025 | Mar 11, 2025 | Same day | Medium 4.6 | 2% |
| CVE-2025-24983 CISA KEV | Microsoft · Windows Microsoft Windows Win32k Use-After-Free VulnerabilityCISA remediation due for federal agencies: Apr 1, 2025 | Mar 11, 2025 | Same day | High 7.0 | 1% |
| CVE-2025-25181 CISA KEV | Advantive · VeraCore Advantive VeraCore SQL Injection VulnerabilityCISA remediation due for federal agencies: Mar 31, 2025 | Mar 10, 2025 | 36 days | Medium 5.8 | 56% |
| CVE-2024-57968 CISA KEV | Advantive · VeraCore Advantive VeraCore Unrestricted File Upload VulnerabilityCISA remediation due for federal agencies: Mar 31, 2025 | Mar 10, 2025 | 36 days | Critical 9.9 | 32% |
| CVE-2024-13161 CISA KEV | Ivanti · Endpoint Manager (EPM) Ivanti Endpoint Manager (EPM) Absolute Path Traversal VulnerabilityCISA remediation due for federal agencies: Mar 31, 2025 | Mar 10, 2025 | 55 days | Critical 9.8 | 90% |
| CVE-2024-13160 CISA KEV | Ivanti · Endpoint Manager (EPM) Ivanti Endpoint Manager (EPM) Absolute Path Traversal VulnerabilityCISA remediation due for federal agencies: Mar 31, 2025 | Mar 10, 2025 | 55 days | Critical 9.8 | 91% |
| CVE-2024-13159 CISA KEV | Ivanti · Endpoint Manager (EPM) Ivanti Endpoint Manager (EPM) Absolute Path Traversal VulnerabilityCISA remediation due for federal agencies: Mar 31, 2025 | Mar 10, 2025 | 55 days | Critical 9.8 | 100% |
| CVE-2025-22226 CISA KEV | VMware · ESXi, Workstation, and Fusion VMware ESXi, Workstation, and Fusion Information Disclosure VulnerabilityCISA remediation due for federal agencies: Mar 25, 2025 | Mar 4, 2025 | Same day | High 7.1 | 2% |
| CVE-2025-22224 CISA KEV | VMware · ESXi and Workstation VMware ESXi and Workstation TOCTOU Race Condition VulnerabilityCISA remediation due for federal agencies: Mar 25, 2025 | Mar 4, 2025 | Same day | Critical 9.3 | 2% |
| CVE-2024-50302 CISA KEV | Linux · Kernel Linux Kernel Use of Uninitialized Resource VulnerabilityCISA remediation due for federal agencies: Mar 25, 2025 | Mar 4, 2025 | 106 days | Medium 5.5 | 1% |
| CVE-2025-22225 CISA KEV Ransomware | VMware · ESXi VMware ESXi Arbitrary Write VulnerabilityCISA remediation due for federal agencies: Mar 25, 2025 | Mar 3, 2025 | 1 day before publication | High 8.2 | 1% |
| CVE-2024-4885 CISA KEV | Progress · WhatsUp Gold Progress WhatsUp Gold Path Traversal VulnerabilityCISA remediation due for federal agencies: Mar 24, 2025 | Mar 3, 2025 | 251 days | Critical 9.8 | 99% |
| CVE-2023-20118 CISA KEV | Cisco · Small Business RV Series Routers Cisco Small Business RV Series Routers Command Injection VulnerabilityCISA remediation due for federal agencies: Mar 24, 2025 | Mar 3, 2025 | 698 days | Medium 6.5 | 54% |
| CVE-2022-43939 CISA KEV | Hitachi Vantara · Pentaho Business Analytics (BA) Server Hitachi Vantara Pentaho BA Server Authorization Bypass VulnerabilityCISA remediation due for federal agencies: Mar 24, 2025 | Mar 3, 2025 | 700 days | High 8.6 | 92% |
| CVE-2022-43769 CISA KEV | Hitachi Vantara · Pentaho Business Analytics (BA) Server Hitachi Vantara Pentaho BA Server Special Element Injection VulnerabilityCISA remediation due for federal agencies: Mar 24, 2025 | Mar 3, 2025 | 700 days | High 8.8 | 98% |
| CVE-2018-8639 CISA KEV Ransomware | Microsoft · Windows Microsoft Windows Win32k Improper Resource Shutdown or Release VulnerabilityCISA remediation due for federal agencies: Mar 24, 2025 | Mar 3, 2025 | 2,274 days | High 8.4 | 22% |
How to read this
"Confirmed exploited" is the date CISA added the CVE to its Known Exploited Vulnerabilities catalog or assessed it as actively exploited, whichever came first. It is when exploitation was confirmed publicly, not when attackers started, so "after publication" is an upper bound: attackers were there at least that soon. "By disclosure day" means confirmed on or before the day the CVE record was published, the closest public measure of a zero-day. Dates are US Eastern, the calendar CISA uses. Vendors are named as CISA's catalog names them, otherwise as the assigning CNA does. EPSS is FIRST's estimate of the chance of exploitation in the next 30 days.