Vulnerabilities exploited in the wild
1,781 vulnerabilities that attackers have used in real attacks, as confirmed by the US Cybersecurity and Infrastructure Security Agency (CISA). If you run an affected product, these come before everything else in your patch queue.
| Score | Vulnerability | Added | Federal deadline | Ransomware use |
|---|---|---|---|---|
| 6.5 Medium severity | Microsoft Office Remote Code Execution CVE-2021-27059 | Nov 3, 2021 | Nov 17, 2021 | Not reported |
| 7.8 High severity | Microsoft Exchange Server Remote Code Execution CVE-2021-26858 | Nov 3, 2021 | May 3, 2022 | Known |
| 7.8 High severity | Microsoft Exchange Server Remote Code Execution CVE-2021-26857 | Nov 3, 2021 | May 3, 2022 | Known |
| 9.8 Critical severity | Microsoft Exchange Server Remote Code Execution CVE-2021-26855 | Nov 3, 2021 | May 3, 2022 | Known |
| 8.8 High severity | Microsoft Internet Explorer Memory Corruption CVE-2021-26411 | Nov 3, 2021 | Nov 17, 2021 | Known |
| 9.8 Critical severity | Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection CVE-2021-26084 | Nov 3, 2021 | Nov 17, 2021 | Known |
| 7.8 High severity | McAfee Total Protection (MTP) Improper Privilege Management CVE-2021-23874 | Nov 3, 2021 | Nov 17, 2021 | Not reported |
| 9.8 Critical severity | F5 BIG-IP and BIG-IQ Centralized Management iControl REST Remote Code Execution CVE-2021-22986 | Nov 3, 2021 | Nov 17, 2021 | Known |
| 7.2 High severity | Ivanti Pulse Connect Secure Unrestricted File Upload CVE-2021-22900 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 8.8 High severity | Ivanti Pulse Connect Secure Command Injection CVE-2021-22899 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 8.8 High severity | Ivanti Pulse Connect Secure Collaboration Suite Buffer Overflow CVE-2021-22894 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 10.0 Critical severity | Ivanti Pulse Connect Secure Use-After-Free CVE-2021-22893 | Nov 3, 2021 | May 3, 2022 | Known |
| 7.5 High severity | Micro Focus Access Manager Information Leakage CVE-2021-22506 | Nov 3, 2021 | Nov 17, 2021 | Not reported |
| 9.8 Critical severity | Micro Focus Operation Bridge Report (OBR) Remote Code Execution CVE-2021-22502 | Nov 3, 2021 | Nov 17, 2021 | Not reported |
| 10.0 Critical severity | GitLab Community and Enterprise Editions Remote Code Execution CVE-2021-22205 | Nov 3, 2021 | Nov 17, 2021 | Known |
| 9.8 Critical severity | VMware vCenter Server File Upload CVE-2021-22005 | Nov 3, 2021 | Nov 17, 2021 | Known |
| 9.8 Critical severity | VMware vCenter Server Improper Input Validation CVE-2021-21985 | Nov 3, 2021 | Nov 17, 2021 | Known |
| 9.8 Critical severity | VMware vCenter Server Remote Code Execution CVE-2021-21972 | Nov 3, 2021 | Nov 17, 2021 | Known |
| 8.8 High severity | Google Chromium V8 Type Confusion CVE-2021-21224 | Nov 3, 2021 | Nov 17, 2021 | Not reported |
| 8.8 High severity | Google Chromium V8 Improper Input Validation CVE-2021-21220 | Nov 3, 2021 | Nov 17, 2021 | Not reported |
| 8.8 High severity | Google Chromium Blink Use-After-Free CVE-2021-21206 | Nov 3, 2021 | Nov 17, 2021 | Not reported |
| 8.8 High severity | Google Chromium Blink Use-After-Free CVE-2021-21193 | Nov 3, 2021 | Nov 17, 2021 | Not reported |
| 8.8 High severity | Google Chromium Race Condition CVE-2021-21166 | Nov 3, 2021 | Nov 17, 2021 | Not reported |
| 8.8 High severity | Google Chromium V8 Heap Buffer Overflow CVE-2021-21148 | Nov 3, 2021 | Nov 17, 2021 | Not reported |
| 6.8 Medium severity | Adobe Acrobat and Reader Heap-based Buffer Overflow CVE-2021-21017 | Nov 3, 2021 | Nov 17, 2021 | Not reported |
| 9.8 Critical severity | Arcadyan Buffalo Firmware Path Traversal CVE-2021-20090 | Nov 3, 2021 | Nov 17, 2021 | Not reported |
| 4.9 Medium severity | SonicWall Email Security Path Traversal CVE-2021-20023 | Nov 3, 2021 | Nov 17, 2021 | Known |
| 7.2 High severity | SonicWall Email Security Unrestricted Upload of File CVE-2021-20022 | Nov 3, 2021 | Nov 17, 2021 | Known |
| 9.8 Critical severity | SonicWall Email Security Improper Privilege Management CVE-2021-20021 | Nov 3, 2021 | Nov 17, 2021 | Known |
| 9.8 Critical severity | SonicWall SSLVPN SMA100 SQL Injection CVE-2021-20016 | Nov 3, 2021 | Nov 17, 2021 | Known |
| 5.5 Medium severity | Qualcomm Multiple Chipsets Detection of Error Condition Without Action CVE-2021-1906 | Nov 3, 2021 | Nov 17, 2021 | Not reported |
| 7.8 High severity | Qualcomm Multiple Chipsets Use-After-Free CVE-2021-1905 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 6.1 Medium severity | Apple iOS, iPadOS, and watchOS WebKit Cross-Site Scripting (XSS) CVE-2021-1879 | Nov 3, 2021 | Nov 17, 2021 | Not reported |
| 9.8 Critical severity | Apple iOS, iPadOS, and macOS WebKit Remote Code Execution CVE-2021-1871 | Nov 3, 2021 | Nov 17, 2021 | Not reported |
| 9.8 Critical severity | Apple iOS, iPadOS, and macOS WebKit Remote Code Execution CVE-2021-1870 | Nov 3, 2021 | Nov 17, 2021 | Not reported |
| 7.0 High severity | Apple Multiple Products Race Condition CVE-2021-1782 | Nov 3, 2021 | Nov 17, 2021 | Not reported |
| 7.8 High severity | Microsoft Win32k Privilege Escalation CVE-2021-1732 | Nov 3, 2021 | Nov 17, 2021 | Known |
| 7.8 High severity | Microsoft Windows Print Spooler Remote Code Execution CVE-2021-1675 | Nov 3, 2021 | Nov 17, 2021 | Known |
| 7.8 High severity | Microsoft Defender Remote Code Execution CVE-2021-1647 | Nov 3, 2021 | Nov 17, 2021 | Not reported |
| 9.8 Critical severity | Cisco HyperFlex HX Data Platform Command Injection CVE-2021-1498 | Nov 3, 2021 | Nov 17, 2021 | Not reported |
About this list
CISA adds a vulnerability to its Known Exploited Vulnerabilities (KEV) catalogue only when there is reliable evidence of exploitation and a clear fix or mitigation. US federal agencies must remediate each entry by the deadline shown; everyone else can treat the list as a short, evidence-based set of must-patch issues.
A vulnerability missing from this list is not proof that it is safe. Many exploited flaws are never catalogued, which is why each of our CVE pages also shows the EPSS exploitation forecast.