Vulnerabilities exploited in the wild
1,781 vulnerabilities that attackers have used in real attacks, as confirmed by the US Cybersecurity and Infrastructure Security Agency (CISA). If you run an affected product, these come before everything else in your patch queue.
| Score | Vulnerability | Added | Federal deadline | Ransomware use |
|---|---|---|---|---|
| 7.8 High severity | Roundcube Webmail File Disclosure CVE-2017-16651 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 7.8 High severity | Microsoft Office Memory Corruption CVE-2017-11882 | Nov 3, 2021 | May 3, 2022 | Known |
| 7.8 High severity | Microsoft Office Outlook Security Feature Bypass CVE-2017-11774 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 7.8 High severity | Microsoft Office and WordPad Remote Code Execution CVE-2017-0199 | Nov 3, 2021 | May 3, 2022 | Known |
| 8.8 High severity | Microsoft Windows Server Message Block (SMBv1) Remote Code Execution CVE-2017-0143 | Nov 3, 2021 | May 3, 2022 | Known |
| 6.5 Medium severity | SAP NetWeaver XML External Entity (XXE) CVE-2016-9563 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 7.8 High severity | Microsoft Win32k Privilege Escalation CVE-2016-7255 | Nov 3, 2021 | May 3, 2022 | Known |
| 9.8 Critical severity | Apache Shiro Code Execution CVE-2016-4437 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 7.5 High severity | SAP NetWeaver Directory Traversal CVE-2016-3976 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 5.5 Medium severity | ImageMagick Server-Side Request Forgery (SSRF) CVE-2016-3718 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 5.5 Medium severity | ImageMagick Arbitrary File Deletion CVE-2016-3715 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 7.8 High severity | SolarWinds Virtualization Manager Privilege Escalation CVE-2016-3643 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 7.8 High severity | Microsoft Office OLE DLL Side Loading CVE-2016-3235 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 7.8 High severity | Microsoft Windows Media Center Remote Code Execution CVE-2016-0185 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 7.8 High severity | Microsoft Win32k Privilege Escalation CVE-2016-0167 | Nov 3, 2021 | May 3, 2022 | Known |
| 9.8 Critical severity | Oracle WebLogic Server Deserialization of Untrusted Data CVE-2015-4852 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 7.8 High severity | Microsoft Office Memory Corruption CVE-2015-1641 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 9.0 High severity | Microsoft Windows Group Policy Preferences Password Privilege Escalation CVE-2014-1812 | Nov 3, 2021 | May 3, 2022 | Known |
| 9.1 Critical severity | Oracle Fusion Middleware Unspecified CVE-2012-3152 | Nov 3, 2021 | May 3, 2022 | Not reported |
| 8.8 High severity | Microsoft MSCOMCTL.OCX Remote Code Execution CVE-2012-0158 | Nov 3, 2021 | May 3, 2022 | Known |
| 10.0 Critical severity | SAP NetWeaver Remote Code Execution CVE-2010-5326 | Nov 3, 2021 | May 3, 2022 | Not reported |
About this list
CISA adds a vulnerability to its Known Exploited Vulnerabilities (KEV) catalogue only when there is reliable evidence of exploitation and a clear fix or mitigation. US federal agencies must remediate each entry by the deadline shown; everyone else can treat the list as a short, evidence-based set of must-patch issues.
A vulnerability missing from this list is not proof that it is safe. Many exploited flaws are never catalogued, which is why each of our CVE pages also shows the EPSS exploitation forecast.