Authoritative signal

Known exploited

The current CISA KEV catalog, bound to the current snapshot and ordered by catalog date and CASCA priority.

Evidence current through Aug 27, 2026, 6:09 PM UTC

CISA KEV catalog boundaryCatalog silence leaves exploitation status unassessed. Alternate serialization never counts as a second source.1,677 catalog members · showing 1351–1400

1351

CVE-2015-7450CISA KEVSource-reported scopeEvidence supported

IBM WebSphere Application Server and Server Hypervisor Edition Code Injection.

Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products allow remote attackers to execute arbitrary commands

IBMWebSphere Application Server and Server Hypervisor Edition

Required actionApply updates per vendor instructions.

Evidence reason details

Evidence supportedfactor_a_kev

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: Resolve identity

Added: 2022-01-10
Due: 2022-07-10
Priority interval: 89.9–90.8
Coverage: 99%

↗

1352

CVE-2019-10149CISA KEVSource-reported scopeEvidence supported

Exim Mail Transfer Agent (MTA) Improper Input Validation

Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution.

EximMail Transfer Agent (MTA)

Required actionApply updates per vendor instructions.

Evidence reason details

Evidence supportedfactor_a_kev

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: Resolve identity

Added: 2022-01-10
Due: 2022-07-10
Priority interval: 89.8–90.6
Coverage: 97%

↗

1353

CVE-2019-7609CISA KEVSource-reported scopeEvidence supported

Kibana Arbitrary Code Execution

Kibana contain an arbitrary code execution flaw in the Timelion visualizer.

ElasticKibana

Required actionApply updates per vendor instructions.

Evidence reason details

Evidence supportedfactor_a_kev

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: Resolve identity

Added: 2022-01-10
Due: 2022-07-10
Priority interval: 88.2–89.8
Coverage: 97%

↗

1354

CVE-2013-3900CISA KEVAssessments differAssessments differSource-reported scope

Microsoft WinVerifyTrust function Remote Code Execution

A remote code execution vulnerability exists in the way that the WinVerifyTrust function handles Windows Authenticode signature verification for PE files.

MicrosoftWinVerifyTrust function

Required actionApply updates per vendor instructions.

Evidence reason details

Evidence supportedfactor_a_kev

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Assessments differfactor_c_cvss

Eligible assertions materially conflict and remain visible side by side.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: Resolve conflict

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: Resolve identity

Added: 2022-01-10
Due: 2022-07-10
Priority interval: 75.0–88.9
Coverage: 80%

↗

1355

CVE-2019-9670CISA KEVSource-reported scopeEvidence supported

Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity Reference

Synacor Zimbra Collaboration Suite (ZCS) contains an improper restriction of XML external entity (XXE) vulnerability in the mailboxd component.

SynacorZimbra Collaboration Suite (ZCS)

Required actionApply updates per vendor instructions.

Evidence reason details

Evidence supportedfactor_a_kev

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: Resolve identity

Added: 2022-01-10
Due: 2022-07-10
Priority interval: 87.1–88.7
Coverage: 99%

↗

1356

CVE-2017-1000486CISA KEVSource-reported scopeEvidence supported

Primetek Primefaces Remote Code Execution Vulnerability

Primetek Primefaces is vulnerable to a weak encryption flaw resulting in remote code execution

PrimetekPrimefaces Application

Required actionApply updates per vendor instructions.

Evidence reason details

Evidence supportedfactor_a_kev

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: Resolve identity

Added: 2022-01-10
Due: 2022-07-10
Priority interval: 86.5–88.1
Coverage: 96%

↗

1357

CVE-2018-13382CISA KEVKnown ransomwareAssessments differAssessments differSource-reported scope

Fortinet FortiOS and FortiProxy Improper Authorization

An Improper Authorization vulnerability in Fortinet FortiOS and FortiProxy under SSL VPN web portal allows an unauthenticated attacker to modify the password.

FortinetFortiOS and FortiProxy

Required actionApply updates per vendor instructions.

Evidence reason details

Evidence supportedfactor_a_kev

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Assessments differfactor_c_cvss

Eligible assertions materially conflict and remain visible side by side.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: Resolve conflict

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: Resolve identity

Added: 2022-01-10
Due: 2022-07-10
Priority interval: 80.3–85.6
Coverage: 85%

↗

1358

CVE-2019-1458CISA KEVKnown ransomwareSource-reported scopeEvidence supported

Microsoft Win32k Privilege Escalation Vulnerability

A privilege escalation vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k EoP.

MicrosoftWin32k

Required actionApply updates per vendor instructions.

Evidence reason details

Evidence supportedfactor_a_kev

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: Resolve identity

Added: 2022-01-10
Due: 2022-07-10
Priority interval: 82.7–84.2
Coverage: 98%

↗

1359

CVE-2021-27860CISA KEVAssessments differAssessments differSource-reported scope

FatPipe WARP, IPVPN, and MPVPN Configuration Upload exploit

A vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software allows a remote, unauthenticated attacker to upload a file to any location on the filesystem.

FatPipeWARP, IPVPN, and MPVPN software

Required actionApply updates per vendor instructions.

Evidence reason details

Evidence supportedfactor_a_kev

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Assessments differfactor_c_cvss

Eligible assertions materially conflict and remain visible side by side.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: Resolve conflict

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: Resolve identity

Added: 2022-01-10
Due: 2022-01-24
Priority interval: 78.8–84.0
Coverage: 87%

↗

1360

CVE-2019-1579CISA KEVKnown ransomwareSource-reported scopeEvidence supported

Palo Alto Networks PAN-OS Remote Code Execution Vulnerability

Remote Code Execution in PAN-OS with GlobalProtect Portal or GlobalProtect Gateway Interface enabled.

Palo Alto NetworksPAN-OS

Required actionApply updates per vendor instructions.

Evidence reason details

Evidence supportedfactor_a_kev

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: Resolve identity

Added: 2022-01-10
Due: 2022-07-10
Priority interval: 76.4–78.0
Coverage: 96%

↗

1361

CVE-2020-6572CISA KEVSource-reported scopeEvidence supported

Google Chrome Media Use-After-Free Vulnerability

Google Chrome Media contains a use-after-free vulnerability that allows a remote attacker to execute code via a crafted HTML page.

GoogleChrome Media

Required actionApply updates per vendor instructions.

Evidence reason details

Evidence supportedfactor_a_kev

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: Resolve identity

Added: 2022-01-10
Due: 2022-07-10
Priority interval: 71.1–72.7
Coverage: 93%

↗

1362

CVE-2018-13383CISA KEVKnown ransomwareAssessments differAssessments differSource-reported scope

Fortinet FortiOS and FortiProxy Out-of-bounds Write

A heap buffer overflow in Fortinet FortiOS and FortiProxy may cause the SSL VPN web service termination for logged in users.

FortinetFortiOS and FortiProxy

Required actionApply updates per vendor instructions.

Evidence reason details

Evidence supportedfactor_a_kev

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Assessments differfactor_c_cvss

Eligible assertions materially conflict and remain visible side by side.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: Resolve conflict

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: Resolve identity

Added: 2022-01-10
Due: 2022-07-10
Priority interval: 65.9–72.7
Coverage: 85%

↗

1363

CVE-2021-22017CISA KEVSource-reported scopeEvidence supported

VMware vCenter Server Improper Access Control

Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization.

VMwarevCenter Server

Required actionApply updates per vendor instructions.

Evidence reason details

Evidence supportedfactor_a_kev

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: Resolve identity

Added: 2022-01-10
Due: 2022-01-24
Priority interval: 69.9–71.5
Coverage: 93%

↗

1364

CVE-2021-4102CISA KEVSource-reported scopeEvidence supported

Google Chromium V8 Use-After-Free Vulnerability

Google Chromium V8 Engine contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

GoogleChromium V8

Required actionApply updates per vendor instructions.

Evidence reason details

Evidence supportedfactor_a_kev

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: Resolve identity

Added: 2021-12-15
Due: 2021-12-29
Priority interval: 70.2–71.8
Coverage: 93%

↗

1365

CVE-2021-43890CISA KEVKnown ransomwareSource-reported scopeEvidence supported

Microsoft Windows AppX Installer Spoofing Vulnerability

Microsoft Windows AppX Installer contains a spoofing vulnerability which has a high impacts to confidentiality, integrity, and availability.

MicrosoftWindows

Required actionApply updates per vendor instructions.

Evidence reason details

Evidence supportedfactor_a_kev

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: Resolve identity

Added: 2021-12-15
Due: 2021-12-29
Priority interval: 64.2–69.4
Coverage: 85%

↗

1366

CVE-2021-44228CISA KEVKnown ransomwareSource-reported scopeEvidence supported

Apache Log4j2 Remote Code Execution Vulnerability

Apache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlled JNDI-related endpoints, allowing for remote code execution.

ApacheLog4j2

Required actionFor all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.

Evidence reason details

Evidence supportedfactor_a_kev

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: Resolve identity

Added: 2021-12-10
Due: 2021-12-24
Priority interval: 99.2–99.3
Coverage: 100%

↗

1367

CVE-2021-44515CISA KEVSource-reported scopeEvidence supported

Zoho Desktop Central Authentication Bypass Vulnerability

Zoho Desktop Central contains an authentication bypass vulnerability that could allow an attacker to execute arbitrary code in the Desktop Central MSP server.

ZohoDesktop Central

Required actionApply updates per vendor instructions.

Evidence reason details

Evidence supportedfactor_a_kev

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: Resolve identity

Added: 2021-12-10
Due: 2021-12-24
Priority interval: 87.1–88.7
Coverage: 97%

↗

1368

CVE-2021-35394CISA KEVSource-reported scopeEvidence supported

Realtek Jungle SDK Remote Code Execution Vulnerability

RealTek Jungle SDK contains multiple memory corruption vulnerabilities which can allow an attacker to perform remote code execution.

RealtekJungle Software Development Kit (SDK)

Required actionApply updates per vendor instructions.

Evidence reason details

Evidence supportedfactor_a_kev

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: Resolve identity

Added: 2021-12-10
Due: 2021-12-24
Priority interval: 87.1–88.7
Coverage: 93%

↗

1369

CVE-2017-12149CISA KEVKnown ransomwareSource-reported scopeEvidence supported

Red Hat JBoss Application Server Remote Code Execution Vulnerability

The JBoss Application Server, shipped with Red Hat Enterprise Application Platform 5.2, allows an attacker to execute arbitrary code via crafted serialized data.

Red HatJBoss Application Server

Required actionApply updates per vendor instructions.

Evidence reason details

Evidence supportedfactor_a_kev

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: Resolve identity

Added: 2021-12-10
Due: 2022-06-10
Priority interval: 86.2–87.7
Coverage: 99%

↗

1370

CVE-2020-17463CISA KEVSource-reported scopeEvidence supported

Fuel CMS SQL Injection Vulnerability

FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items.

Fuel CMSFuel CMS

Required actionApply updates per vendor instructions.

Evidence reason details

Evidence supportedfactor_a_kev

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: Resolve identity

Added: 2021-12-10
Due: 2022-06-10
Priority interval: 86.1–87.6
Coverage: 93%

↗

1371

CVE-2019-10758CISA KEVSource-reported scopeEvidence supported

MongoDB mongo-express Remote Code Execution Vulnerability

mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method.

MongoDBmongo-express

Required actionApply updates per vendor instructions.

Evidence reason details

Evidence supportedfactor_a_kev

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: Resolve identity

Added: 2021-12-10
Due: 2022-06-10
Priority interval: 85.8–87.4
Coverage: 93%

↗

1372

CVE-2010-1871CISA KEVSource-reported scopeEvidence supported

Red Hat Linux JBoss Seam 2 Remote Code Execution Vulnerability

JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, allows attackers to perform remote code execution. This vulnerability can only be exploited when the Java Security Manager is not properly configured.

Red HatJBoss Seam 2

Required actionApply updates per vendor instructions.

Evidence reason details

Evidence supportedfactor_a_kev

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: Resolve identity

Added: 2021-12-10
Due: 2022-06-10
Priority interval: 85.6–86.4
Coverage: 97%

↗

1373

CVE-2019-7238CISA KEVSource-reported scopeEvidence supported

Sonatype Nexus Repository Manager Incorrect Access Control Vulnerability

Sonatype Nexus Repository Manager before 3.15.0 has an incorrect access control vulnerability. Exploitation allows for remote code execution.

SonatypeNexus Repository Manager

Required actionApply updates per vendor instructions.

Evidence reason details

Evidence supportedfactor_a_kev

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: Resolve identity

Added: 2021-12-10
Due: 2022-06-10
Priority interval: 84.7–86.3
Coverage: 93%

↗

1374

CVE-2017-17562CISA KEVSource-reported scopeEvidence supported

Embedthis GoAhead Remote Code Execution Vulnerability

Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked.

EmbedthisGoAhead

Required actionApply updates per vendor instructions.

Evidence reason details

Evidence supportedfactor_a_kev

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: Resolve identity

Added: 2021-12-10
Due: 2022-06-10
Priority interval: 84.1–85.2
Coverage: 96%

↗

1375

CVE-2019-13272CISA KEVSource-reported scopeEvidence supported

Linux Kernel Improper Privilege Management Vulnerability

Kernel/ptrace.c in Linux kernel mishandles contains an improper privilege management vulnerability that allows local users to obtain root access.

LinuxKernel

Required actionApply updates per vendor instructions.

Evidence reason details

Evidence supportedfactor_a_kev

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: Resolve identity

Added: 2021-12-10
Due: 2022-06-10
Priority interval: 83.9–84.3
Coverage: 100%

↗

1376

CVE-2019-0193CISA KEVSource-reported scopeEvidence supported

Apache Solr DataImportHandler Code Injection Vulnerability

The optional Apache Solr module DataImportHandler contains a code injection vulnerability.

ApacheSolr

Required actionApply updates per vendor instructions.

Evidence reason details

Evidence supportedfactor_a_kev

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: Resolve identity

Added: 2021-12-10
Due: 2022-06-10
Priority interval: 80.5–81.6
Coverage: 97%

↗

1377

CVE-2020-8816CISA KEVSource-reported scopeEvidence supported

Pi-Hole AdminLTE Remote Code Execution Vulnerability

Pi-hole Web v4.3.2 (aka AdminLTE) allows Remote Code Execution by privileged dashboard users via a crafted DHCP static lease.

Pi-holeAdminLTE

Required actionApply updates per vendor instructions.

Evidence reason details

Evidence supportedfactor_a_kev

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: Resolve identity

Added: 2021-12-10
Due: 2022-06-10
Priority interval: 78.3–79.9
Coverage: 93%

↗

1378

CVE-2021-44168CISA KEVAssessments differAssessments differSource-reported scope

Fortinet FortiOS Arbitrary File Download

Fortinet FortiOS "execute restore src-vis" downloads code without integrity checking, allowing an attacker to arbitrarily download files.

FortinetFortiOS

Required actionApply updates per vendor instructions.

Evidence reason details

Evidence supportedfactor_a_kev

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Assessments differfactor_c_cvss

Eligible assertions materially conflict and remain visible side by side.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: Resolve conflict

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: Resolve identity

Added: 2021-12-10
Due: 2021-12-24
Priority interval: 52.8–65.6
Coverage: 85%

↗

1379

CVE-2021-40438CISA KEVKnown ransomwareSource-reported scopeEvidence supported

Apache HTTP Server-Side Request Forgery (SSRF)

A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.

ApacheApache

Required actionApply updates per vendor instructions.

Evidence reason details

Evidence supportedfactor_a_kev

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: Resolve identity

Added: 2021-12-01
Due: 2021-12-15
Priority interval: 82.5–97.1
Coverage: 85%

↗

1380

CVE-2021-44077CISA KEVSource-reported scopeEvidence supported

Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability

Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution

ZohoManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus

Required actionApply updates per vendor instructions.

Evidence reason details

Evidence supportedfactor_a_kev

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: Resolve identity

Added: 2021-12-01
Due: 2021-12-15
Priority interval: 88.0–89.1
Coverage: 100%

↗

1381

CVE-2021-37415CISA KEVSource-reported scopeEvidence supported

Zoho ManageEngine ServiceDesk Authentication Bypass Vulnerability

Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authentication

ZohoManageEngine ServiceDesk Plus (SDP)

Required actionApply updates per vendor instructions.

Evidence reason details

Evidence supportedfactor_a_kev

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: Resolve identity

Added: 2021-12-01
Due: 2021-12-15
Priority interval: 87.1–88.7
Coverage: 100%

↗

1382

CVE-2018-14847CISA KEVSource-reported scopeEvidence supported

MikroTik Router OS Directory Traversal Vulnerability

MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write arbitrary files due to a directory traversal vulnerability in the WinBox interface.

MikroTikRouterOS

Required actionApply updates per vendor instructions.

Evidence reason details

Evidence supportedfactor_a_kev

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: Resolve identity

Added: 2021-12-01
Due: 2022-06-01
Priority interval: 85.0–86.5
Coverage: 93%

↗

1383

CVE-2020-11261CISA KEVSource-reported scopeEvidence supported

Qualcomm Multiple Chipsets Improper Input Validation Vulnerability

Memory corruption due to improper check to return error when user application requests memory allocation of a huge size in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

QualcommSnapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

Required actionApply updates per vendor instructions.

Evidence reason details

Evidence supportedfactor_a_kev

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: Resolve identity

Added: 2021-12-01
Due: 2022-06-01
Priority interval: 73.3–74.0
Coverage: 100%

↗

1384

CVE-2021-40449CISA KEVKnown ransomwareSource-reported scopeEvidence supported

Microsoft Windows Win32k Privilege Escalation Vulnerability

Unspecified vulnerability allows for an authenticated user to escalate privileges.

MicrosoftWindows

Required actionApply updates per vendor instructions.

Evidence reason details

Evidence supportedfactor_a_kev

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: Resolve identity

Added: 2021-11-17
Due: 2021-12-01
Priority interval: 84.3–90.1
Coverage: 92%

↗

1385

CVE-2021-42321CISA KEVKnown ransomwareSource-reported scopeEvidence supported

Microsoft Exchange Server Remote Code Execution Vulnerability

An authenticated attacker could leverage improper validation in cmdlet arguments within Microsoft Exchange and perform remote code execution.

MicrosoftExchange

Required actionApply updates per vendor instructions.

Evidence reason details

Evidence supportedfactor_a_kev

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: Resolve identity

Added: 2021-11-17
Due: 2021-12-01
Priority interval: 83.8–88.0
Coverage: 93%

↗

1386

CVE-2021-22204CISA KEVAssessments differAssessments differSource-reported scope

ExifTool Remote Code Execution Vulnerability

Improper neutralization of user data in the DjVu file format in Exiftool versions 7.44 and up allows arbitrary code execution when parsing the malicious image

PerlExiftool

Required actionApply updates per vendor instructions.

Evidence reason details

Evidence supportedfactor_a_kev

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Assessments differfactor_c_cvss

Eligible assertions materially conflict and remain visible side by side.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: Resolve conflict

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: Resolve identity

Added: 2021-11-17
Due: 2021-12-01
Priority interval: 82.3–85.6
Coverage: 85%

↗

1387

CVE-2021-42292CISA KEVSource-reported scopeEvidence supported

Microsoft Excel Security Feature Bypass

A security feature bypass vulnerability in Microsoft Excel would allow a local user to perform arbitrary code execution.

MicrosoftOffice

Required actionApply updates per vendor instructions.

Evidence reason details

Evidence supportedfactor_a_kev

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: Resolve identity

Added: 2021-11-17
Due: 2021-12-01
Priority interval: 77.2–82.3
Coverage: 93%

↗

1388

CVE-2020-0646CISA KEVSource-reported scopeEvidence supported

Microsoft .NET Framework Remote Code Execution Vulnerability

Microsoft .NET Framework contains an improper input validation vulnerability that allows for remote code execution.

Microsoft.NET Framework

Required actionApply updates per vendor instructions.

Evidence reason details

Evidence supportedfactor_a_kev

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: Resolve identity

Added: 2021-11-03
Due: 2022-05-03
Priority interval: 87.1–98.1
Coverage: 90%

↗

1389

CVE-2020-1472CISA KEVKnown ransomwareAssessments differAssessments differSource-reported scope

Microsoft Netlogon Privilege Escalation Vulnerability

Microsoft's Netlogon Remote Protocol (MS-NRPC) contains a privilege escalation vulnerability when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller. An attacker who successfully exploits the vulnerability could run a specially crafted application on a device on the network. The vulnerability is also known under the moniker of Zerologon.

MicrosoftNetlogon

Required actionApply updates per vendor instructions.

Evidence reason details

Evidence supportedfactor_a_kev

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Assessments differfactor_c_cvss

Eligible assertions materially conflict and remain visible side by side.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: Resolve conflict

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: Resolve identity

Added: 2021-11-03
Due: 2022-05-03
Priority interval: 83.3–97.3
Coverage: 82%

↗

1390

CVE-2019-0708CISA KEVKnown ransomwareSource-reported scopeEvidence supported

Microsoft Remote Desktop Services Remote Code Execution Vulnerability

Microsoft Remote Desktop Services, formerly known as Terminal Service, contains an unspecified vulnerability that allows an unauthenticated attacker to connect to the target system using RDP and send specially crafted requests. Successful exploitation allows for remote code execution. The vulnerability is also known under the moniker of BlueKeep.

MicrosoftRemote Desktop Services

Required actionApply updates per vendor instructions.

Evidence reason details

Evidence supportedfactor_a_kev

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: Resolve identity

Added: 2021-11-03
Due: 2022-05-03
Priority interval: 95.9–96.6
Coverage: 100%

↗

1391

CVE-2021-26855CISA KEVKnown ransomwareSource-reported scopeEvidence supported

Microsoft Exchange Server Remote Code Execution Vulnerability

Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain.

MicrosoftExchange Server

Required actionApply updates per vendor instructions.

Evidence reason details

Evidence supportedfactor_a_kev

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: Resolve identity

Added: 2021-11-03
Due: 2022-05-03
Priority interval: 85.4–96.6
Coverage: 93%

↗

1392

CVE-2021-38647CISA KEVKnown ransomwareSource-reported scopeEvidence supported

Microsoft Open Management Infrastructure (OMI) Remote Code Execution Vulnerability

Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an unspecified vulnerability allowing remote code execution.

MicrosoftOpen Management Infrastructure (OMI)

Required actionApply updates per vendor instructions.

Evidence reason details

Evidence supportedfactor_a_kev

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: Resolve identity

Added: 2021-11-03
Due: 2021-11-17
Priority interval: 90.8–95.2
Coverage: 93%

↗

1393

CVE-2021-34527CISA KEVKnown ransomwareSource-reported scopeEvidence supported

Microsoft Windows Print Spooler Remote Code Execution Vulnerability

Microsoft Windows Print Spooler contains an unspecified vulnerability due to the Windows Print Spooler service improperly performing privileged file operations. Successful exploitation allows an attacker to perform remote code execution with SYSTEM privileges. The vulnerability is also known under the moniker of PrintNightmare.

MicrosoftWindows

Required actionApply updates per vendor instructions.

Evidence reason details

Evidence supportedfactor_a_kev

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: Resolve identity

Added: 2021-11-03
Due: 2022-05-03
Priority interval: 89.4–95.1
Coverage: 92%

↗

1394

CVE-2021-40444CISA KEVKnown ransomwareAssessments differAssessments differSource-reported scope

Microsoft MSHTML Remote Code Execution Vulnerability

Microsoft MSHTML contains a unspecified vulnerability that allows for remote code execution.

MicrosoftMSHTML

Required actionApply updates per vendor instructions.

Evidence reason details

Evidence supportedfactor_a_kev

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Assessments differfactor_c_cvss

Eligible assertions materially conflict and remain visible side by side.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: Resolve conflict

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: Resolve identity

Added: 2021-11-03
Due: 2021-11-17
Priority interval: 86.6–94.9
Coverage: 79%

↗

1395

CVE-2019-5544CISA KEVKnown ransomwareSource-reported scopeEvidence supported

VMware ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow Vulnerability

VMware ESXi and Horizon Desktop as a Service (DaaS) OpenSLP contains a heap-based buffer overflow vulnerability that allows an attacker with network access to port 427 to overwrite the heap of the OpenSLP service to perform remote code execution.

VMwareVMware ESXi and Horizon DaaS

Required actionApply updates per vendor instructions.

Evidence reason details

Evidence supportedfactor_a_kev

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: Resolve identity

Added: 2021-11-03
Due: 2022-05-03
Priority interval: 93.0–93.4
Coverage: 100%

↗

1396

CVE-2017-5638CISA KEVKnown ransomwareSource-reported scopeEvidence supported

Apache Struts Remote Code Execution Vulnerability

Apache Struts Jakarta Multipart parser allows for malicious file upload using the Content-Type value, leading to remote code execution.

ApacheStruts

Required actionApply updates per vendor instructions.

Evidence reason details

Evidence supportedfactor_a_kev

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: Resolve identity

Added: 2021-11-03
Due: 2022-05-03
Priority interval: 92.9–93.3
Coverage: 99%

↗

1397

CVE-2020-1147CISA KEVSource-reported scopeEvidence supported

Microsoft .NET Framework, SharePoint, and Visual Studio Remote Code Execution Vulnerability

Microsoft .NET Framework, Microsoft SharePoint, and Visual Studio contain a remote code execution vulnerability when the software fails to check the source markup of XML file input. Successful exploitation allows an attacker to execute code in the context of the process responsible for deserialization of the XML content.

Microsoft.NET Framework, SharePoint, Visual Studio

Required actionApply updates per vendor instructions.

Evidence reason details

Evidence supportedfactor_a_kev

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: Resolve identity

Added: 2021-11-03
Due: 2022-05-03
Priority interval: 84.3–93.3
Coverage: 91%

↗

1398

CVE-2021-22205CISA KEVKnown ransomwareSource-reported scopeEvidence supported

GitLab Community and Enterprise Editions Remote Code Execution Vulnerability

GitHub Community and Enterprise Editions that utilize the ability to upload images through GitLab Workhorse are vulnerable to remote code execution. Workhorse passes image file extensions through ExifTool, which improperly validates the image files.

GitLabCommunity and Enterprise Editions

Required actionApply updates per vendor instructions.

Evidence reason details

Evidence supportedfactor_a_kev

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: Resolve identity

Added: 2021-11-03
Due: 2021-11-17
Priority interval: 85.0–92.9
Coverage: 85%

↗

1399

CVE-2020-29583CISA KEVSource-reported scopeEvidence supported

Zyxel Multiple Products Use of Hard-Coded Credentials Vulnerability

Zyxel firewalls (ATP, USG, VM) and AP Controllers (NXC2500 and NXC5500) contain a use of hard-coded credentials vulnerability in an undocumented account ("zyfwp") with an unchangeable password.

ZyxelMultiple Products

Required actionApply updates per vendor instructions.

Evidence reason details

Evidence supportedfactor_a_kev

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: Resolve identity

Added: 2021-11-03
Due: 2022-05-03
Priority interval: 92.1–92.8
Coverage: 100%

↗

1400

CVE-2021-22986CISA KEVKnown ransomwareSource-reported scopeEvidence supported

F5 BIG-IP and BIG-IQ Centralized Management iControl REST Remote Code Execution Vulnerability

F5 BIG-IP and BIG-IQ Centralized Management contain a remote code execution vulnerability in the iControl REST interface that allows unauthenticated attackers with network access to execute system commands, create or delete files, and disable services.

F5BIG-IP and BIG-IQ Centralized Management

Required actionApply updates per vendor instructions.

Evidence reason details

Evidence supportedfactor_a_kev

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: Resolve identity

Added: 2021-11-03
Due: 2021-11-17
Priority interval: 91.6–92.4
Coverage: 100%

↗