Snapshot 10791
Parsed
What we read from this document, as JSON. Each entry names the snapshot it was read from.
{
"entries": [
{
"kind": "vulnerability",
"vendor": "acronis",
"evidence_id": 10791,
"data": {
"cve": "CVE-2026-87886",
"cwes": [
"CWE-276"
],
"name": "Acronis Backup Incorrect Default Permissions Vulnerability",
"source": "cisa_kev",
"vendor": "Acronis",
"product": "Backup",
"date_added": "2026-09-16",
"description": "Acronis Backup plugin for cPanel & WHM and extension for Plesk contains an incorrect default permissions vulnerability that could allow for privilege escalation.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "acronis",
"evidence_id": 10791,
"data": {
"cve": "CVE-2023-45249",
"cwes": [
"CWE-1393"
],
"name": "Acronis Cyber Infrastructure (ACI) Insecure Default Password Vulnerability",
"source": "cisa_kev",
"vendor": "Acronis",
"product": "Cyber Infrastructure (ACI)",
"date_added": "2024-07-29",
"description": "Acronis Cyber Infrastructure (ACI) allows an unauthenticated user to execute commands remotely due to the use of default passwords.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "adobe",
"evidence_id": 10791,
"data": {
"cve": "CVE-2007-5659",
"cwes": [
"CWE-119"
],
"name": "Adobe Acrobat and Reader Buffer Overflow Vulnerability",
"source": "cisa_kev",
"vendor": "Adobe",
"product": "Acrobat and Reader",
"date_added": "2022-06-08",
"description": "Adobe Acrobat and Reader contain a buffer overflow vulnerability that allows remote attackers to execute code via a PDF file with long arguments to unspecified JavaScript methods.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "adobe",
"evidence_id": 10791,
"data": {
"cve": "CVE-2018-4990",
"cwes": [
"CWE-415"
],
"name": "Adobe Acrobat and Reader Double Free Vulnerability",
"source": "cisa_kev",
"vendor": "Adobe",
"product": "Acrobat and Reader",
"date_added": "2022-06-08",
"description": "Adobe Acrobat and Reader have a double free vulnerability that could lead to remote code execution.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "adobe",
"evidence_id": 10791,
"data": {
"cve": "CVE-2009-3459",
"cwes": [
"CWE-119"
],
"name": "Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability",
"source": "cisa_kev",
"vendor": "Adobe",
"product": "Acrobat and Reader",
"date_added": "2026-05-20",
"description": "Adobe Acrobat and Reader contain a heap-based buffer overflow vulnerability which could allow remote attackers to execute arbitrary code via a crafted PDF file that triggers memory corruption.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "adobe",
"evidence_id": 10791,
"data": {
"cve": "CVE-2021-21017",
"cwes": [
"CWE-122"
],
"name": "Adobe Acrobat and Reader Heap-based Buffer Overflow Vulnerability",
"source": "cisa_kev",
"vendor": "Adobe",
"product": "Acrobat and Reader",
"date_added": "2021-11-03",
"description": "Acrobat Acrobat and Reader contain a heap-based buffer overflow vulnerability that could allow an unauthenticated attacker to achieve code execution in the context of the current user.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "adobe",
"evidence_id": 10791,
"data": {
"cve": "CVE-2023-26369",
"cwes": [
"CWE-787"
],
"name": "Adobe Acrobat and Reader Out-of-Bounds Write Vulnerability",
"source": "cisa_kev",
"vendor": "Adobe",
"product": "Acrobat and Reader",
"date_added": "2023-09-14",
"description": "Adobe Acrobat and Reader contains an out-of-bounds write vulnerability that allows for code execution.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "adobe",
"evidence_id": 10791,
"data": {
"cve": "CVE-2026-34621",
"cwes": [
"CWE-1321"
],
"name": "Adobe Acrobat and Reader Prototype Pollution Vulnerability",
"source": "cisa_kev",
"vendor": "Adobe",
"product": "Acrobat and Reader",
"date_added": "2026-04-13",
"description": "Adobe Acrobat and Reader contain a prototype pollution vulnerability that allows for arbitrary code execution.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "adobe",
"evidence_id": 10791,
"data": {
"cve": "CVE-2010-2883",
"cwes": [
"CWE-119"
],
"name": "Adobe Acrobat and Reader Stack-Based Buffer Overflow Vulnerability",
"source": "cisa_kev",
"vendor": "Adobe",
"product": "Acrobat and Reader",
"date_added": "2022-06-08",
"description": "Adobe Acrobat and Reader contain a stack-based buffer overflow vulnerability that allows remote attackers to execute code or cause denial-of-service (DoS).",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "adobe",
"evidence_id": 10791,
"data": {
"cve": "CVE-2009-3953",
"cwes": [
"CWE-119"
],
"name": "Adobe Acrobat and Reader Universal 3D Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Adobe",
"product": "Acrobat and Reader",
"date_added": "2022-06-08",
"description": "Adobe Acrobat and Reader contains an array boundary issue in Universal 3D (U3D) support that could lead to remote code execution.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "adobe",
"evidence_id": 10791,
"data": {
"cve": "CVE-2008-0655",
"name": "Adobe Acrobat and Reader Unspecified Vulnerability",
"source": "cisa_kev",
"vendor": "Adobe",
"product": "Acrobat and Reader",
"date_added": "2022-06-08",
"description": "Adobe Acrobat and Reader contains an unespecified vulnerability described as a design flaw which could allow a specially crafted file to be printed silently an arbitrary number of times.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "adobe",
"evidence_id": 10791,
"data": {
"cve": "CVE-2009-4324",
"cwes": [
"CWE-399"
],
"name": "Adobe Acrobat and Reader Use-After-Free Vulnerability",
"source": "cisa_kev",
"vendor": "Adobe",
"product": "Acrobat and Reader",
"date_added": "2022-06-08",
"description": "Use-after-free vulnerability in Adobe Acrobat and Reader allows remote attackers to execute code via a crafted PDF file.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "adobe",
"evidence_id": 10791,
"data": {
"cve": "CVE-2021-28550",
"cwes": [
"CWE-416"
],
"name": "Adobe Acrobat and Reader Use-After-Free Vulnerability",
"source": "cisa_kev",
"vendor": "Adobe",
"product": "Acrobat and Reader",
"date_added": "2021-11-03",
"description": "Adobe Acrobat and Reader contains a use-after-free vulnerability that could allow an unauthenticated attacker to achieve code execution in the context of the current user.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "adobe",
"evidence_id": 10791,
"data": {
"cve": "CVE-2023-21608",
"cwes": [
"CWE-416"
],
"name": "Adobe Acrobat and Reader Use-After-Free Vulnerability",
"source": "cisa_kev",
"vendor": "Adobe",
"product": "Acrobat and Reader",
"date_added": "2023-10-10",
"description": "Adobe Acrobat and Reader contains a use-after-free vulnerability that allows for code execution in the context of the current user.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "adobe",
"evidence_id": 10791,
"data": {
"cve": "CVE-2009-1862",
"cwes": [
"CWE-94"
],
"name": "Adobe Acrobat and Reader, Flash Player Unspecified Vulnerability",
"source": "cisa_kev",
"vendor": "Adobe",
"product": "Acrobat and Reader, Flash Player",
"date_added": "2022-06-08",
"description": "Adobe Acrobat and Reader and Adobe Flash Player allows remote attackers to execute code or cause denial-of-service (DoS).",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "adobe",
"evidence_id": 10791,
"data": {
"cve": "CVE-2020-9715",
"cwes": [
"CWE-416"
],
"name": "Adobe Acrobat Use-After-Free Vulnerability",
"source": "cisa_kev",
"vendor": "Adobe",
"product": "Acrobat",
"date_added": "2026-04-13",
"description": "Adobe Acrobat contains a use-after-free vulnerability that allows for code execution",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "adobe",
"evidence_id": 10791,
"data": {
"cve": "CVE-2009-3960",
"name": "Adobe BlazeDS Information Disclosure Vulnerability",
"source": "cisa_kev",
"vendor": "Adobe",
"product": "BlazeDS",
"date_added": "2022-03-07",
"description": "Adobe BlazeDS, which is utilized in LifeCycle and Coldfusion, contains a vulnerability that allows for information disclosure.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "adobe",
"evidence_id": 10791,
"data": {
"cve": "CVE-2013-0625",
"cwes": [
"CWE-255"
],
"name": "Adobe ColdFusion Authentication Bypass Vulnerability",
"source": "cisa_kev",
"vendor": "Adobe",
"product": "ColdFusion",
"date_added": "2022-03-07",
"description": "Adobe Coldfusion contains an authentication bypass vulnerability, which could result in an unauthorized user gaining administrative access.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "adobe",
"evidence_id": 10791,
"data": {
"cve": "CVE-2013-0632",
"cwes": [
"CWE-200"
],
"name": "Adobe ColdFusion Authentication Bypass Vulnerability",
"source": "cisa_kev",
"vendor": "Adobe",
"product": "ColdFusion",
"date_added": "2022-03-03",
"description": "An authentication bypass vulnerability exists in Adobe ColdFusion which could result in an unauthorized user gaining administrative access.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "adobe",
"evidence_id": 10791,
"data": {
"cve": "CVE-2018-4939",
"cwes": [
"CWE-502"
],
"name": "Adobe ColdFusion Deserialization of Untrusted Data Vulnerability",
"source": "cisa_kev",
"vendor": "Adobe",
"product": "ColdFusion",
"date_added": "2021-11-03",
"description": "Adobe ColdFusion contains a deserialization of untrusted data vulnerability that could allow for code execution.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "adobe",
"evidence_id": 10791,
"data": {
"cve": "CVE-2023-26359",
"cwes": [
"CWE-502"
],
"name": "Adobe ColdFusion Deserialization of Untrusted Data Vulnerability",
"source": "cisa_kev",
"vendor": "Adobe",
"product": "ColdFusion",
"date_added": "2023-08-21",
"description": "Adobe ColdFusion contains a deserialization of untrusted data vulnerability that could result in code execution in the context of the current user.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "adobe",
"evidence_id": 10791,
"data": {
"cve": "CVE-2023-26360",
"cwes": [
"CWE-284"
],
"name": "Adobe ColdFusion Deserialization of Untrusted Data Vulnerability",
"source": "cisa_kev",
"vendor": "Adobe",
"product": "ColdFusion",
"date_added": "2023-03-15",
"description": "Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for remote code execution.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "adobe",
"evidence_id": 10791,
"data": {
"cve": "CVE-2023-29300",
"cwes": [
"CWE-502"
],
"name": "Adobe ColdFusion Deserialization of Untrusted Data Vulnerability",
"source": "cisa_kev",
"vendor": "Adobe",
"product": "ColdFusion",
"date_added": "2024-01-08",
"description": "Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for code execution.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "adobe",
"evidence_id": 10791,
"data": {
"cve": "CVE-2023-38203",
"cwes": [
"CWE-502"
],
"name": "Adobe ColdFusion Deserialization of Untrusted Data Vulnerability",
"source": "cisa_kev",
"vendor": "Adobe",
"product": "ColdFusion",
"date_added": "2024-01-08",
"description": "Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for code execution.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "adobe",
"evidence_id": 10791,
"data": {
"cve": "CVE-2017-3066",
"cwes": [
"CWE-502"
],
"name": "Adobe ColdFusion Deserialization Vulnerability",
"source": "cisa_kev",
"vendor": "Adobe",
"product": "ColdFusion",
"date_added": "2025-02-24",
"description": "Adobe ColdFusion contains a deserialization vulnerability in the Apache BlazeDS library that allows for arbitrary code execution.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "adobe",
"evidence_id": 10791,
"data": {
"cve": "CVE-2010-2861",
"cwes": [
"CWE-22"
],
"name": "Adobe ColdFusion Directory Traversal Vulnerability",
"source": "cisa_kev",
"vendor": "Adobe",
"product": "ColdFusion",
"date_added": "2022-03-25",
"description": "A directory traversal vulnerability exists in the administrator console in Adobe ColdFusion which allows remote attackers to read arbitrary files.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "adobe",
"evidence_id": 10791,
"data": {
"cve": "CVE-2013-0629",
"cwes": [
"CWE-264"
],
"name": "Adobe ColdFusion Directory Traversal Vulnerability",
"source": "cisa_kev",
"vendor": "Adobe",
"product": "ColdFusion",
"date_added": "2022-03-07",
"description": "Adobe Coldfusion contains a directory traversal vulnerability, which could permit an unauthorized user access to restricted directories.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "adobe",
"evidence_id": 10791,
"data": {
"cve": "CVE-2023-29298",
"cwes": [
"CWE-284"
],
"name": "Adobe ColdFusion Improper Access Control Vulnerability",
"source": "cisa_kev",
"vendor": "Adobe",
"product": "ColdFusion",
"date_added": "2023-07-20",
"description": "Adobe ColdFusion contains an improper access control vulnerability that allows for a security feature bypass.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "adobe",
"evidence_id": 10791,
"data": {
"cve": "CVE-2023-38205",
"cwes": [
"CWE-284"
],
"name": "Adobe ColdFusion Improper Access Control Vulnerability",
"source": "cisa_kev",
"vendor": "Adobe",
"product": "ColdFusion",
"date_added": "2023-07-20",
"description": "Adobe ColdFusion contains an improper access control vulnerability that allows for a security feature bypass.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "adobe",
"evidence_id": 10791,
"data": {
"cve": "CVE-2024-20767",
"cwes": [
"CWE-284"
],
"name": "Adobe ColdFusion Improper Access Control Vulnerability",
"source": "cisa_kev",
"vendor": "Adobe",
"product": "ColdFusion",
"date_added": "2024-12-16",
"description": "Adobe ColdFusion contains an improper access control vulnerability that could allow an attacker to access or modify restricted files via an internet-exposed admin panel.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "adobe",
"evidence_id": 10791,
"data": {
"cve": "CVE-2013-0631",
"cwes": [
"CWE-200"
],
"name": "Adobe ColdFusion Information Disclosure Vulnerability",
"source": "cisa_kev",
"vendor": "Adobe",
"product": "ColdFusion",
"date_added": "2022-03-07",
"description": "Adobe Coldfusion contains an unspecified vulnerability, which could result in information disclosure from a compromised server.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "adobe",
"evidence_id": 10791,
"data": {
"cve": "CVE-2026-48282",
"cwes": [
"CWE-22"
],
"name": "Adobe ColdFusion Path Traversal Vulnerability",
"source": "cisa_kev",
"vendor": "Adobe",
"product": "ColdFusion",
"date_added": "2026-07-07",
"description": "Adobe ColdFusion contains a path traversal vulnerability that could lead to arbitrary code execution in the context of the current user.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "adobe",
"evidence_id": 10791,
"data": {
"cve": "CVE-2018-15961",
"cwes": [
"CWE-434"
],
"name": "Adobe ColdFusion Unrestricted File Upload Vulnerability",
"source": "cisa_kev",
"vendor": "Adobe",
"product": "ColdFusion",
"date_added": "2021-11-03",
"description": "Adobe ColdFusion contains an unrestricted file upload vulnerability that could allow for code execution.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "adobe",
"evidence_id": 10791,
"data": {
"cve": "CVE-2026-75650",
"cwes": [
"CWE-1336"
],
"name": "Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability",
"source": "cisa_kev",
"vendor": "Adobe",
"product": "Commerce and Magento",
"date_added": "2026-09-08",
"description": "Adobe Commerce and Magento Open Source contain an improper neutralization of special elements used in a template engine vulnerability that could allow an attacker to execute arbitrary code.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "adobe",
"evidence_id": 10791,
"data": {
"cve": "CVE-2026-71362",
"cwes": [
"CWE-863"
],
"name": "Adobe Commerce and Magento Incorrect Authorization Vulnerability ",
"source": "cisa_kev",
"vendor": "Adobe",
"product": "Commerce and Magento ",
"date_added": "2026-09-24",
"description": "Adobe Commerce and Magento contains an incorrect authorization vulnerability that could allow an attacker to leverage this vulnerability to gain elevated access to sensitive resources without any user interaction.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "adobe",
"evidence_id": 10791,
"data": {
"cve": "CVE-2022-24086",
"cwes": [
"CWE-20"
],
"name": "Adobe Commerce and Magento Open Source Improper Input Validation Vulnerability",
"source": "cisa_kev",
"vendor": "Adobe",
"product": "Commerce and Magento Open Source",
"date_added": "2022-02-15",
"description": "Adobe Commerce and Magento Open Source contain an improper input validation vulnerability which can allow for arbitrary code execution.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "adobe",
"evidence_id": 10791,
"data": {
"cve": "CVE-2024-34102",
"cwes": [
"CWE-611"
],
"name": "Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE) Vulnerability",
"source": "cisa_kev",
"vendor": "Adobe",
"product": "Commerce and Magento Open Source",
"date_added": "2024-07-17",
"description": "Adobe Commerce and Magento Open Source contain an improper restriction of XML external entity reference (XXE) vulnerability that allows for remote code execution.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "adobe",
"evidence_id": 10791,
"data": {
"cve": "CVE-2025-54236",
"cwes": [
"CWE-20"
],
"name": "Adobe Commerce and Magento Improper Input Validation Vulnerability",
"source": "cisa_kev",
"vendor": "Adobe",
"product": "Commerce and Magento",
"date_added": "2025-10-24",
"description": "Adobe Commerce and Magento Open Source contain an improper input validation vulnerability that could allow an attacker to take over customer accounts through the Commerce REST API.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "adobe",
"evidence_id": 10791,
"data": {
"cve": "CVE-2025-54253",
"name": "Adobe Experience Manager Forms Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Adobe",
"product": "Experience Manager (AEM) Forms",
"date_added": "2025-10-15",
"description": "Adobe Experience Manager Forms in JEE contains an unspecified vulnerability that allows for arbitrary code execution.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "adobe",
"evidence_id": 10791,
"data": {
"cve": "CVE-2016-1010",
"cwes": [
"CWE-190"
],
"name": "Adobe Flash Player and AIR Integer Overflow Vulnerability",
"source": "cisa_kev",
"vendor": "Adobe",
"product": "Flash Player and AIR",
"date_added": "2022-05-25",
"description": "Integer overflow vulnerability in Adobe Flash Player and AIR allows attackers to execute code.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "adobe",
"evidence_id": 10791,
"data": {
"cve": "CVE-2016-0984",
"cwes": [
"CWE-416"
],
"name": "Adobe Flash Player and AIR Use-After-Free Vulnerability",
"source": "cisa_kev",
"vendor": "Adobe",
"product": "Flash Player and AIR",
"date_added": "2022-05-25",
"description": "Use-after-free vulnerability in Adobe Flash Player and Adobe AIR allows attackers to execute code.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "adobe",
"evidence_id": 10791,
"data": {
"cve": "CVE-2012-1535",
"name": "Adobe Flash Player Arbitrary Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Adobe",
"product": "Flash Player",
"date_added": "2022-03-03",
"description": "Unspecified vulnerability in Adobe Flash Player allows remote attackers to execute arbitrary code or cause a denial of service via crafted SWF content.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "adobe",
"evidence_id": 10791,
"data": {
"cve": "CVE-2015-7645",
"name": "Adobe Flash Player Arbitrary Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Adobe",
"product": "Flash Player",
"date_added": "2022-03-03",
"description": "Adobe Flash Player allows remote attackers to execute arbitrary code via a crafted SWF file.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "adobe",
"evidence_id": 10791,
"data": {
"cve": "CVE-2016-1019",
"name": "Adobe Flash Player Arbitrary Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Adobe",
"product": "Flash Player",
"date_added": "2022-03-03",
"description": "Adobe Flash Player allows remote attackers to cause a denial of service or possibly execute arbitrary code.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "adobe",
"evidence_id": 10791,
"data": {
"cve": "CVE-2016-4117",
"name": "Adobe Flash Player Arbitrary Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Adobe",
"product": "Flash Player",
"date_added": "2022-03-03",
"description": "An access of resource using incompatible type vulnerability exists within Adobe Flash Player that allows an attacker to perform remote code execution.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "adobe",
"evidence_id": 10791,
"data": {
"cve": "CVE-2015-0310",
"cwes": [
"CWE-264"
],
"name": "Adobe Flash Player ASLR Bypass Vulnerability",
"source": "cisa_kev",
"vendor": "Adobe",
"product": "Flash Player",
"date_added": "2022-05-25",
"description": "Adobe Flash Player does not properly restrict discovery of memory addresses, which allows attackers to bypass the address space layout randomization (ASLR) protection mechanism.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "adobe",
"evidence_id": 10791,
"data": {
"cve": "CVE-2013-0648",
"name": "Adobe Flash Player Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Adobe",
"product": "Flash Player",
"date_added": "2024-09-17",
"description": "Adobe Flash Player contains an unspecified vulnerability in the ExternalInterface ActionScript functionality that allows a remote attacker to execute arbitrary code via crafted SWF content.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "adobe",
"evidence_id": 10791,
"data": {
"cve": "CVE-2012-0767",
"cwes": [
"CWE-79"
],
"name": "Adobe Flash Player Cross-Site Scripting (XSS) Vulnerability",
"source": "cisa_kev",
"vendor": "Adobe",
"product": "Flash Player",
"date_added": "2022-06-08",
"description": "Adobe Flash Player contains a XSS vulnerability that allows remote attackers to inject web script or HTML.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "adobe",
"evidence_id": 10791,
"data": {
"cve": "CVE-2014-8439",
"cwes": [
"CWE-119"
],
"name": "Adobe Flash Player Dereferenced Pointer Vulnerability",
"source": "cisa_kev",
"vendor": "Adobe",
"product": "Flash Player",
"date_added": "2022-05-25",
"description": "Adobe Flash Player has a vulnerability in the way it handles a dereferenced memory pointer which could lead to code execution.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "adobe",
"evidence_id": 10791,
"data": {
"cve": "CVE-2014-0502",
"cwes": [
"CWE-399"
],
"name": "Adobe Flash Player Double Free Vulnerablity",
"source": "cisa_kev",
"vendor": "Adobe",
"product": "Flash Player",
"date_added": "2024-09-17",
"description": "Adobe Flash Player contains a double free vulnerability that allows a remote attacker to execute arbitrary code.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "adobe",
"evidence_id": 10791,
"data": {
"cve": "CVE-2015-3113",
"cwes": [
"CWE-119"
],
"name": "Adobe Flash Player Heap-Based Buffer Overflow Vulnerability",
"source": "cisa_kev",
"vendor": "Adobe",
"product": "Flash Player",
"date_added": "2022-04-13",
"description": "Heap-based buffer overflow vulnerability in Adobe Flash Player allows remote attackers to execute code.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "adobe",
"evidence_id": 10791,
"data": {
"cve": "CVE-2013-0643",
"cwes": [
"CWE-264"
],
"name": "Adobe Flash Player Incorrect Default Permissions Vulnerability",
"source": "cisa_kev",
"vendor": "Adobe",
"product": "Flash Player",
"date_added": "2024-09-17",
"description": "Adobe Flash Player contains an incorrect default permissions vulnerability in the Firefox sandbox that allows a remote attacker to execute arbitrary code via crafted SWF content.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "adobe",
"evidence_id": 10791,
"data": {
"cve": "CVE-2012-5054",
"cwes": [
"CWE-189"
],
"name": "Adobe Flash Player Integer Overflow Vulnerability",
"source": "cisa_kev",
"vendor": "Adobe",
"product": "Flash Player",
"date_added": "2022-06-08",
"description": "Adobe Flash Player contains an integer overflow vulnerability that allows remote attackers to execute code via malformed arguments.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "adobe",
"evidence_id": 10791,
"data": {
"cve": "CVE-2015-8651",
"cwes": [
"CWE-189"
],
"name": "Adobe Flash Player Integer Overflow Vulnerability",
"source": "cisa_kev",
"vendor": "Adobe",
"product": "Flash Player",
"date_added": "2022-05-25",
"description": "Integer overflow in Adobe Flash Player allows attackers to execute code.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "adobe",
"evidence_id": 10791,
"data": {
"cve": "CVE-2014-0497",
"cwes": [
"CWE-191"
],
"name": "Adobe Flash Player Integer Underflow Vulnerablity",
"source": "cisa_kev",
"vendor": "Adobe",
"product": "Flash Player",
"date_added": "2024-09-17",
"description": "Adobe Flash Player contains an integer underflow vulnerability that allows a remote attacker to execute arbitrary code.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "adobe",
"evidence_id": 10791,
"data": {
"cve": "CVE-2010-1297",
"cwes": [
"CWE-787"
],
"name": "Adobe Flash Player Memory Corruption Vulnerability",
"source": "cisa_kev",
"vendor": "Adobe",
"product": "Flash Player",
"date_added": "2022-06-08",
"description": "Adobe Flash Player contains a memory corruption vulnerability that allows remote attackers to execute code or cause denial-of-service (DoS).",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "adobe",
"evidence_id": 10791,
"data": {
"cve": "CVE-2012-0754",
"cwes": [
"CWE-787"
],
"name": "Adobe Flash Player Memory Corruption Vulnerability",
"source": "cisa_kev",
"vendor": "Adobe",
"product": "Flash Player",
"date_added": "2022-06-08",
"description": "Adobe Flash Player contains a memory corruption vulnerability that allows remote attackers to execute code or cause denial-of-service (DoS).",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "adobe",
"evidence_id": 10791,
"data": {
"cve": "CVE-2012-2034",
"cwes": [
"CWE-119"
],
"name": "Adobe Flash Player Memory Corruption Vulnerability",
"source": "cisa_kev",
"vendor": "Adobe",
"product": "Flash Player",
"date_added": "2022-03-28",
"description": "Adobe Flash Player contains a memory corruption vulnerability that allows for remote code execution or denial-of-service (DoS).",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "adobe",
"evidence_id": 10791,
"data": {
"cve": "CVE-2015-3043",
"cwes": [
"CWE-787"
],
"name": "Adobe Flash Player Memory Corruption Vulnerability",
"source": "cisa_kev",
"vendor": "Adobe",
"product": "Flash Player",
"date_added": "2022-03-03",
"description": "A memory corruption vulnerability exists in Adobe Flash Player that allows an attacker to perform remote code execution.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "adobe",
"evidence_id": 10791,
"data": {
"cve": "CVE-2011-0611",
"cwes": [
"CWE-843"
],
"name": "Adobe Flash Player Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Adobe",
"product": "Flash Player",
"date_added": "2022-03-03",
"description": "Adobe Flash Player contains a vulnerability that allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted Flash content.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "adobe",
"evidence_id": 10791,
"data": {
"cve": "CVE-2015-0311",
"name": "Adobe Flash Player Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Adobe",
"product": "Flash Player",
"date_added": "2022-04-13",
"description": "Unspecified vulnerability in Adobe Flash Player allows remote attackers to execute code.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "adobe",
"evidence_id": 10791,
"data": {
"cve": "CVE-2016-4171",
"name": "Adobe Flash Player Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Adobe",
"product": "Flash Player",
"date_added": "2022-03-25",
"description": "Unspecified vulnerability in Adobe Flash Player allows for remote code execution.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "adobe",
"evidence_id": 10791,
"data": {
"cve": "CVE-2014-9163",
"name": "Adobe Flash Player Stack-Based Buffer Overflow Vulnerability",
"source": "cisa_kev",
"vendor": "Adobe",
"product": "Flash Player",
"date_added": "2022-04-13",
"description": "Stack-based buffer overflow in Adobe Flash Player allows attackers to execute code remotely.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "adobe",
"evidence_id": 10791,
"data": {
"cve": "CVE-2018-5002",
"cwes": [
"CWE-787"
],
"name": "Adobe Flash Player Stack-based Buffer Overflow Vulnerability",
"source": "cisa_kev",
"vendor": "Adobe",
"product": "Flash Player",
"date_added": "2022-05-23",
"description": "Adobe Flash Player have a stack-based buffer overflow vulnerability that could lead to remote code execution.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "adobe",
"evidence_id": 10791,
"data": {
"cve": "CVE-2017-11292",
"cwes": [
"CWE-843"
],
"name": "Adobe Flash Player Type Confusion Vulnerability",
"source": "cisa_kev",
"vendor": "Adobe",
"product": "Flash Player",
"date_added": "2022-03-03",
"description": "Adobe Flash Player contains a type confusion vulnerability which can allow for remote code execution.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "adobe",
"evidence_id": 10791,
"data": {
"cve": "CVE-2011-0609",
"name": "Adobe Flash Player Unspecified Vulnerability",
"source": "cisa_kev",
"vendor": "Adobe",
"product": "Flash Player",
"date_added": "2022-06-08",
"description": "Adobe Flash Player contains an unspecified vulnerability that allows remote attackers to execute code or cause denial-of-service (DoS).",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "adobe",
"evidence_id": 10791,
"data": {
"cve": "CVE-2015-0313",
"cwes": [
"CWE-416"
],
"name": "Adobe Flash Player Use-After-Free Vulnerability",
"source": "cisa_kev",
"vendor": "Adobe",
"product": "Flash Player",
"date_added": "2022-04-13",
"description": "Use-after-free vulnerability in Adobe Flash Player allows remote attackers to execute code.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "adobe",
"evidence_id": 10791,
"data": {
"cve": "CVE-2015-5119",
"cwes": [
"CWE-119"
],
"name": "Adobe Flash Player Use-After-Free Vulnerability",
"source": "cisa_kev",
"vendor": "Adobe",
"product": "Flash Player",
"date_added": "2022-03-03",
"description": "A use-after-free vulnerability exists within the ActionScript 3 ByteArray class in Adobe Flash Player that allows an attacker to perform remote code execution.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "adobe",
"evidence_id": 10791,
"data": {
"cve": "CVE-2015-5122",
"cwes": [
"CWE-416"
],
"name": "Adobe Flash Player Use-After-Free Vulnerability",
"source": "cisa_kev",
"vendor": "Adobe",
"product": "Flash Player",
"date_added": "2022-04-13",
"description": "Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player allows remote attackers to execute code or cause a denial-of-service (DoS).",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "adobe",
"evidence_id": 10791,
"data": {
"cve": "CVE-2015-5123",
"cwes": [
"CWE-416"
],
"name": "Adobe Flash Player Use-After-Free Vulnerability",
"source": "cisa_kev",
"vendor": "Adobe",
"product": "Flash Player",
"date_added": "2022-04-13",
"description": "Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player allows remote attackers to execute code or cause a denial-of-service (DoS).",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "adobe",
"evidence_id": 10791,
"data": {
"cve": "CVE-2016-7855",
"cwes": [
"CWE-416"
],
"name": "Adobe Flash Player Use-After-Free Vulnerability",
"source": "cisa_kev",
"vendor": "Adobe",
"product": "Flash Player",
"date_added": "2022-03-03",
"description": "Use-after-free vulnerability in Adobe Flash Player Windows and OS and Linux allows remote attackers to execute arbitrary code.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "adobe",
"evidence_id": 10791,
"data": {
"cve": "CVE-2016-7892",
"cwes": [
"CWE-416"
],
"name": "Adobe Flash Player Use-After-Free Vulnerability",
"source": "cisa_kev",
"vendor": "Adobe",
"product": "Flash Player",
"date_added": "2022-03-25",
"description": "Adobe Flash Player has an exploitable use-after-free vulnerability in the TextField class.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "adobe",
"evidence_id": 10791,
"data": {
"cve": "CVE-2018-15982",
"cwes": [
"CWE-416"
],
"name": "Adobe Flash Player Use-After-Free Vulnerability",
"source": "cisa_kev",
"vendor": "Adobe",
"product": "Flash Player",
"date_added": "2022-02-15",
"description": "Adobe Flash Player com.adobe.tvsdk.mediacore.metadata Use After Free Vulnerability",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "adobe",
"evidence_id": 10791,
"data": {
"cve": "CVE-2018-4878",
"cwes": [
"CWE-416"
],
"name": "Adobe Flash Player Use-After-Free Vulnerability",
"source": "cisa_kev",
"vendor": "Adobe",
"product": "Flash Player",
"date_added": "2021-11-03",
"description": "Adobe Flash Player contains a use-after-free vulnerability that could allow for code execution.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "adobe",
"evidence_id": 10791,
"data": {
"cve": "CVE-2010-0188",
"cwes": [
"CWE-94"
],
"name": "Adobe Reader and Acrobat Arbitrary Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Adobe",
"product": "Reader and Acrobat",
"date_added": "2022-03-03",
"description": "Unspecified vulnerability in Adobe Reader and Acrobat allows attackers to cause a denial of service or possibly execute arbitrary code.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "adobe",
"evidence_id": 10791,
"data": {
"cve": "CVE-2013-2729",
"cwes": [
"CWE-189"
],
"name": "Adobe Reader and Acrobat Arbitrary Integer Overflow Vulnerability",
"source": "cisa_kev",
"vendor": "Adobe",
"product": "Reader and Acrobat",
"date_added": "2022-03-28",
"description": "Integer overflow vulnerability in Adobe Reader and Acrobat allows attackers to execute remote code.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "adobe",
"evidence_id": 10791,
"data": {
"cve": "CVE-2008-2992",
"cwes": [
"CWE-119"
],
"name": "Adobe Reader and Acrobat Input Validation Vulnerability",
"source": "cisa_kev",
"vendor": "Adobe",
"product": "Acrobat and Reader",
"date_added": "2022-03-03",
"description": "Adobe Acrobat and Reader contain an input validation issue in a JavaScript method that could potentially lead to remote code execution.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "adobe",
"evidence_id": 10791,
"data": {
"cve": "CVE-2013-0640",
"cwes": [
"CWE-787"
],
"name": "Adobe Reader and Acrobat Memory Corruption Vulnerability",
"source": "cisa_kev",
"vendor": "Adobe",
"product": "Reader and Acrobat",
"date_added": "2022-03-03",
"description": "An memory corruption vulnerability exists in the acroform.dll in Adobe Reader that allows an attacker to perform remote code execution.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "adobe",
"evidence_id": 10791,
"data": {
"cve": "CVE-2013-3346",
"cwes": [
"CWE-119"
],
"name": "Adobe Reader and Acrobat Memory Corruption Vulnerability",
"source": "cisa_kev",
"vendor": "Adobe",
"product": "Reader and Acrobat",
"date_added": "2022-03-03",
"description": "Adobe Reader and Acrobat contain a memory corruption vulnerability which can allow attackers to execute arbitrary code or cause a denial of service.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "adobe",
"evidence_id": 10791,
"data": {
"cve": "CVE-2014-0546",
"name": "Adobe Reader and Acrobat Sandbox Bypass Vulnerability",
"source": "cisa_kev",
"vendor": "Adobe",
"product": "Reader and Acrobat",
"date_added": "2022-05-25",
"description": "Adobe Reader and Acrobat on Windows allow attackers to bypass a sandbox protection mechanism, and consequently execute native code in a privileged context.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "adobe",
"evidence_id": 10791,
"data": {
"cve": "CVE-2011-2462",
"cwes": [
"CWE-787"
],
"name": "Adobe Reader and Acrobat Universal 3D Memory Corruption Vulnerability",
"source": "cisa_kev",
"vendor": "Adobe",
"product": "Reader and Acrobat",
"date_added": "2022-06-08",
"description": "The Universal 3D (U3D) component in Adobe Reader and Acrobat contains a memory corruption vulnerability which could allow remote attackers to execute code or cause denial-of-service (DoS).",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "adobe",
"evidence_id": 10791,
"data": {
"cve": "CVE-2014-0496",
"cwes": [
"CWE-399"
],
"name": "Adobe Reader and Acrobat Use-After-Free Vulnerability",
"source": "cisa_kev",
"vendor": "Adobe",
"product": "Reader and Acrobat",
"date_added": "2022-03-03",
"description": "Adobe Reader and Acrobat contain a use-after-free vulnerability which can allow for code execution.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "adobe",
"evidence_id": 10791,
"data": {
"cve": "CVE-2009-0927",
"cwes": [
"CWE-20"
],
"name": "Adobe Reader and Adobe Acrobat Stack-Based Buffer Overflow Vulnerability",
"source": "cisa_kev",
"vendor": "Adobe",
"product": "Reader and Acrobat",
"date_added": "2022-03-25",
"description": "Stack-based buffer overflow in Adobe Reader and Adobe Acrobat allows remote attackers to execute arbitrary code.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "adobe",
"evidence_id": 10791,
"data": {
"cve": "CVE-2013-0641",
"cwes": [
"CWE-120"
],
"name": "Adobe Reader Buffer Overflow Vulnerability",
"source": "cisa_kev",
"vendor": "Adobe",
"product": "Reader",
"date_added": "2022-03-03",
"description": "A buffer overflow vulnerability exists in Adobe Reader which allows an attacker to perform remote code execution.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "atlassian",
"evidence_id": 10791,
"data": {
"cve": "CVE-2022-36804",
"cwes": [
"CWE-158",
"CWE-78",
"CWE-88"
],
"name": "Atlassian Bitbucket Server and Data Center Command Injection Vulnerability",
"source": "cisa_kev",
"vendor": "Atlassian",
"product": "Bitbucket Server and Data Center",
"date_added": "2022-09-30",
"description": "Multiple API endpoints of Atlassian Bitbucket Server and Data Center contain a command injection vulnerability where an attacker with access to a public Bitbucket repository, or with read permissions to a private one, can execute code by sending a malicious HTTP request.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "atlassian",
"evidence_id": 10791,
"data": {
"cve": "CVE-2023-22515",
"name": "Atlassian Confluence Data Center and Server Broken Access Control Vulnerability",
"source": "cisa_kev",
"vendor": "Atlassian",
"product": "Confluence Data Center and Server",
"date_added": "2023-10-05",
"description": "Atlassian Confluence Data Center and Server contains a broken access control vulnerability that allows an attacker to create unauthorized Confluence administrator accounts and access Confluence.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "atlassian",
"evidence_id": 10791,
"data": {
"cve": "CVE-2023-22518",
"cwes": [
"CWE-863"
],
"name": "Atlassian Confluence Data Center and Server Improper Authorization Vulnerability",
"source": "cisa_kev",
"vendor": "Atlassian",
"product": "Confluence Data Center and Server",
"date_added": "2023-11-07",
"description": "Atlassian Confluence Data Center and Server contain an improper authorization vulnerability that can result in significant data loss when exploited by an unauthenticated attacker. There is no impact on confidentiality since the attacker cannot exfiltrate any data.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "atlassian",
"evidence_id": 10791,
"data": {
"cve": "CVE-2023-22527",
"cwes": [
"CWE-74"
],
"name": "Atlassian Confluence Data Center and Server Template Injection Vulnerability",
"source": "cisa_kev",
"vendor": "Atlassian",
"product": "Confluence Data Center and Server",
"date_added": "2024-01-24",
"description": "Atlassian Confluence Data Center and Server contain an unauthenticated OGNL template injection vulnerability that can lead to remote code execution.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "atlassian",
"evidence_id": 10791,
"data": {
"cve": "CVE-2021-26084",
"cwes": [
"CWE-917"
],
"name": "Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability",
"source": "cisa_kev",
"vendor": "Atlassian",
"product": "Confluence Server and Data Center",
"date_added": "2021-11-03",
"description": "Atlassian Confluence Server and Data Server contain an Object-Graph Navigation Language (OGNL) injection vulnerability that may allow an unauthenticated attacker to execute code.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "atlassian",
"evidence_id": 10791,
"data": {
"cve": "CVE-2019-3398",
"cwes": [
"CWE-22"
],
"name": "Atlassian Confluence Server and Data Center Path Traversal Vulnerability",
"source": "cisa_kev",
"vendor": "Atlassian",
"product": "Confluence Server and Data Center",
"date_added": "2021-11-03",
"description": "Atlassian Confluence Server and Data Center contain a path traversal vulnerability in the downloadallattachments resource that may allow a privileged, remote attacker to write files. Exploitation can lead to remote code execution.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "atlassian",
"evidence_id": 10791,
"data": {
"cve": "CVE-2022-26134",
"cwes": [
"CWE-917"
],
"name": "Atlassian Confluence Server and Data Center Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Atlassian",
"product": "Confluence Server/Data Center",
"date_added": "2022-06-02",
"description": "Atlassian Confluence Server and Data Center contain a remote code execution vulnerability that allows for an unauthenticated attacker to perform remote code execution.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "atlassian",
"evidence_id": 10791,
"data": {
"cve": "CVE-2019-3396",
"cwes": [
"CWE-22"
],
"name": "Atlassian Confluence Server and Data Center Server-Side Template Injection Vulnerability",
"source": "cisa_kev",
"vendor": "Atlassian",
"product": "Confluence Server and Data Server",
"date_added": "2021-11-03",
"description": "Atlassian Confluence Server and Data Center contain a server-side template injection vulnerability that may allow an attacker to achieve path traversal and remote code execution.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "atlassian",
"evidence_id": 10791,
"data": {
"cve": "CVE-2021-26085",
"cwes": [
"CWE-425"
],
"name": "Atlassian Confluence Server Pre-Authorization Arbitrary File Read Vulnerability",
"source": "cisa_kev",
"vendor": "Atlassian",
"product": "Confluence Server",
"date_added": "2022-03-28",
"description": "Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a pre-authorization arbitrary file read vulnerability in the /s/ endpoint.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "atlassian",
"evidence_id": 10791,
"data": {
"cve": "CVE-2019-11580",
"name": "Atlassian Crowd and Crowd Data Center Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Atlassian",
"product": "Crowd and Crowd Data Center",
"date_added": "2021-11-03",
"description": "Atlassian Crowd and Crowd Data Center contain a remote code execution vulnerability resulting from a pdkinstall development plugin being incorrectly enabled in release builds.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "atlassian",
"evidence_id": 10791,
"data": {
"cve": "CVE-2021-26086",
"cwes": [
"CWE-22"
],
"name": "Atlassian Jira Server and Data Center Path Traversal Vulnerability",
"source": "cisa_kev",
"vendor": "Atlassian",
"product": "Jira Server and Data Center",
"date_added": "2024-11-12",
"description": "Atlassian Jira Server and Data Center contain a path traversal vulnerability that allows a remote attacker to read particular files in the /WEB-INF/web.xml endpoint.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "atlassian",
"evidence_id": 10791,
"data": {
"cve": "CVE-2019-11581",
"cwes": [
"CWE-74"
],
"name": "Atlassian Jira Server and Data Center Server-Side Template Injection Vulnerability",
"source": "cisa_kev",
"vendor": "Atlassian",
"product": "Jira Server and Data Center",
"date_added": "2022-03-07",
"description": "Atlassian Jira Server and Data Center contain a server-side template injection vulnerability which can allow for remote code execution.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "atlassian",
"evidence_id": 10791,
"data": {
"cve": "CVE-2022-26138",
"cwes": [
"CWE-798"
],
"name": "Atlassian Questions For Confluence App Hard-coded Credentials Vulnerability",
"source": "cisa_kev",
"vendor": "Atlassian",
"product": "Confluence",
"date_added": "2022-07-29",
"description": "Atlassian Questions For Confluence App has hard-coded credentials, exposing the username and password in plaintext. A remote unauthenticated attacker can use these credentials to log into Confluence and access all content accessible to users in the confluence-users group.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "aviatrix",
"evidence_id": 10791,
"data": {
"cve": "CVE-2021-40870",
"cwes": [
"CWE-25",
"CWE-96"
],
"name": "Aviatrix Controller Unrestricted Upload of File",
"source": "cisa_kev",
"vendor": "Aviatrix",
"product": "Aviatrix Controller",
"date_added": "2022-01-18",
"description": "Unrestricted upload of a file with a dangerous type is possible, which allows an unauthenticated user to execute arbitrary code via directory traversal.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "aviatrix",
"evidence_id": 10791,
"data": {
"cve": "CVE-2024-50603",
"cwes": [
"CWE-78"
],
"name": "Aviatrix Controllers OS Command Injection Vulnerability",
"source": "cisa_kev",
"vendor": "Aviatrix",
"product": "Controllers",
"date_added": "2025-01-16",
"description": "Aviatrix Controllers contain an OS command injection vulnerability that could allow an unauthenticated attacker to execute arbitrary code. Shell metacharacters can be sent to /v1/api in cloud_type for list_flightpath_destination_instances, or src_cloud_type for flightpath_connection_test.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "barracuda-networks",
"evidence_id": 10791,
"data": {
"cve": "CVE-2023-2868",
"cwes": [
"CWE-20"
],
"name": "Barracuda Networks ESG Appliance Improper Input Validation Vulnerability",
"source": "cisa_kev",
"vendor": "Barracuda Networks",
"product": "Email Security Gateway (ESG) Appliance",
"date_added": "2023-05-26",
"description": "Barracuda Email Security Gateway (ESG) appliance contains an improper input validation vulnerability of a user-supplied .tar file, leading to remote command injection.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "broadcom",
"evidence_id": 10791,
"data": {
"cve": "CVE-2025-1976",
"cwes": [
"CWE-94"
],
"name": "Broadcom Brocade Fabric OS Code Injection Vulnerability",
"source": "cisa_kev",
"vendor": "Broadcom",
"product": "Brocade Fabric OS",
"date_added": "2025-04-28",
"description": "Broadcom Brocade Fabric OS contains a code injection vulnerability that allows a local user with administrative privileges to execute arbitrary code with full root privileges.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "broadcom",
"evidence_id": 10791,
"data": {
"cve": "CVE-2025-41244",
"cwes": [
"CWE-267"
],
"name": "Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability",
"source": "cisa_kev",
"vendor": "Broadcom",
"product": "VMware Aria Operations and VMware Tools",
"date_added": "2025-10-30",
"description": "Broadcom VMware Aria Operations and VMware Tools contain a privilege defined with unsafe actions vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "broadcom",
"evidence_id": 10791,
"data": {
"cve": "CVE-2026-22719",
"cwes": [
"CWE-77"
],
"name": "Broadcom VMware Aria Operations Command Injection Vulnerability",
"source": "cisa_kev",
"vendor": "Broadcom",
"product": "VMware Aria Operations",
"date_added": "2026-03-03",
"description": "Broadcom VMware Aria Operations formerly known as vRealize Operations (vROps) contains a command injection vulnerability that allows an unauthenticated attacker to execute arbitrary commands, potentially leading to remote code execution during support‑assisted product migration.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "broadcom",
"evidence_id": 10791,
"data": {
"cve": "CVE-2026-59310",
"cwes": [
"CWE-22"
],
"name": "Broadcom VMware vCenter Path Traversal Vulnerability",
"source": "cisa_kev",
"vendor": "Broadcom",
"product": "VMware vCenter",
"date_added": "2026-08-18",
"description": "Broadcom VMware vCenter contains a path traversal vulnerability which could allow a threat actor with network access to vCenter to execute arbitrary code.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "broadcom",
"evidence_id": 10791,
"data": {
"cve": "CVE-2024-37079",
"cwes": [
"CWE-787"
],
"name": "Broadcom VMware vCenter Server Out-of-bounds Write Vulnerability",
"source": "cisa_kev",
"vendor": "Broadcom",
"product": "VMware vCenter Server",
"date_added": "2026-01-23",
"description": "Broadcom VMware vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. This could allow a malicious actor with network access to vCenter Server to send specially crafted network packets, potentially leading to remote code execution.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "check-point-software-technologies",
"evidence_id": 10791,
"data": {
"cve": "CVE-2026-85102",
"cwes": [
"CWE-295"
],
"name": "Check Point Multiple Products Improper Certificate Validation Vulnerability",
"source": "cisa_kev",
"vendor": "Check Point",
"product": "Multiple Products",
"date_added": "2026-09-22",
"description": "Check Point Security Gateway and Check Point Spark Firewall using Site to Site VPN or Remote Access VPN contain an improper certificate validation vulnerability which could allow an unauthenticated remote attacker to execute arbitrary code on the Gateway.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "check-point-software-technologies",
"evidence_id": 10791,
"data": {
"cve": "CVE-2026-93616",
"cwes": [
"CWE-22"
],
"name": "Check Point Multiple Products Path Traversal Vulnerability",
"source": "cisa_kev",
"vendor": "Check Point",
"product": "Multiple Products",
"date_added": "2026-09-22",
"description": "Check Point Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent contain a path traversal vulnerability that allows an unauthenticated attacker to upload and execute arbitrary scripts.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "check-point-software-technologies",
"evidence_id": 10791,
"data": {
"cve": "CVE-2024-24919",
"cwes": [
"CWE-200"
],
"name": "Check Point Quantum Security Gateways Information Disclosure Vulnerability",
"source": "cisa_kev",
"vendor": "Check Point",
"product": "Quantum Security Gateways",
"date_added": "2024-05-30",
"description": "Check Point Quantum Security Gateways contain an unspecified information disclosure vulnerability. The vulnerability potentially allows an attacker to access information on Gateways connected to the internet, with IPSec VPN, Remote Access VPN or Mobile Access enabled. This issue affects several product lines from Check Point, including CloudGuard Network, Quantum Scalable Chassis, Quantum Security Gateways, and Quantum Spark Appliances.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "check-point-software-technologies",
"evidence_id": 10791,
"data": {
"cve": "CVE-2026-50751",
"cwes": [
"CWE-287"
],
"name": "Check Point Security Gateway Improper Authentication Vulnerability",
"source": "cisa_kev",
"vendor": "Check Point",
"product": "Security Gateway",
"date_added": "2026-06-08",
"description": "Check Point Security Gateway contains an improper authentication vulnerability in IKEv1 key exchange that could allow an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "check-point-software-technologies",
"evidence_id": 10791,
"data": {
"cve": "CVE-2026-16232",
"cwes": [
"CWE-287"
],
"name": "Check Point SmartConsole Improper Authentication Vulnerability",
"source": "cisa_kev",
"vendor": "Check Point",
"product": "SmartConsole",
"date_added": "2026-07-22",
"description": "Check Point SmartConsole contains an improper authentication vulnerability which could allow an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2016-6367",
"cwes": [
"CWE-77"
],
"name": "Cisco Adaptive Security Appliance (ASA) CLI Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "Adaptive Security Appliance (ASA)",
"date_added": "2022-05-24",
"description": "A vulnerability in the command-line interface (CLI) parser of Cisco ASA software could allow an authenticated, local attacker to create a denial-of-service (DoS) condition or potentially execute code.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2014-2120",
"cwes": [
"CWE-79"
],
"name": "Cisco Adaptive Security Appliance (ASA) Cross-Site Scripting (XSS) Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "Adaptive Security Appliance (ASA)",
"date_added": "2024-11-12",
"description": "Cisco Adaptive Security Appliance (ASA) contains a cross-site scripting (XSS) vulnerability in the WebVPN login page. This vulnerability allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2018-0296",
"cwes": [
"CWE-20"
],
"name": "Cisco Adaptive Security Appliance (ASA) Denial-of-Service Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "Adaptive Security Appliance (ASA)",
"date_added": "2021-11-03",
"description": "Cisco Adaptive Security Appliance (ASA) contains an improper input validation vulnerability with HTTP URLs. Exploitation could allow an attacker to cause a denial-of-service (DoS) condition or information disclosure.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2016-6366",
"cwes": [
"CWE-119"
],
"name": "Cisco Adaptive Security Appliance (ASA) SNMP Buffer Overflow Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "Adaptive Security Appliance (ASA)",
"date_added": "2022-05-24",
"description": "A buffer overflow vulnerability in the Simple Network Management Protocol (SNMP) code of Cisco ASA software could allow an attacker to cause a reload of the affected system or to remotely execute code.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2023-20269",
"cwes": [
"CWE-288"
],
"name": "Cisco Adaptive Security Appliance and Firepower Threat Defense Unauthorized Access Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "Adaptive Security Appliance and Firepower Threat Defense",
"date_added": "2023-09-13",
"description": "Cisco Adaptive Security Appliance and Firepower Threat Defense contain an unauthorized access vulnerability that could allow an unauthenticated, remote attacker to conduct a brute force attack in an attempt to identify valid username and password combinations or establish a clientless SSL VPN session with an unauthorized user.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2020-3433",
"cwes": [
"CWE-427"
],
"name": "Cisco AnyConnect Secure Mobility Client for Windows DLL Hijacking Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "AnyConnect Secure",
"date_added": "2022-10-24",
"description": "Cisco AnyConnect Secure Mobility Client for Windows interprocess communication (IPC) channel allows for insufficient validation of resources that are loaded by the application at run time. An attacker with valid credentials on Windows could execute code on the affected machine with SYSTEM privileges.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2020-3153",
"cwes": [
"CWE-427"
],
"name": "Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "AnyConnect Secure",
"date_added": "2022-10-24",
"description": "Cisco AnyConnect Secure Mobility Client for Windows allows for incorrect handling of directory paths. An attacker with valid credentials on Windows would be able to copy malicious files to arbitrary locations with system level privileges. This could include DLL pre-loading, DLL hijacking, and other related attacks.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2020-3580",
"cwes": [
"CWE-79"
],
"name": "Cisco ASA and FTD Cross-Site Scripting (XSS) Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)",
"date_added": "2021-11-03",
"description": "Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an insufficient input validation vulnerability for user-supplied input by the web services interface. Successful exploitation could allow an attacker to perform cross-site scripting (XSS) in the context of the interface or access sensitive browser-based information.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2024-20353",
"cwes": [
"CWE-835"
],
"name": "Cisco ASA and FTD Denial of Service Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)",
"date_added": "2024-04-24",
"description": "Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an infinite loop vulnerability that can lead to remote denial of service condition.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2024-20481",
"cwes": [
"CWE-772"
],
"name": "Cisco ASA and FTD Denial-of-Service Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)",
"date_added": "2024-10-24",
"description": "Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain a missing release of resource after effective lifetime vulnerability that could allow an unauthenticated, remote attacker to cause a denial-of-service (DoS) of the RAVPN service.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2020-3259",
"cwes": [
"CWE-200"
],
"name": "Cisco ASA and FTD Information Disclosure Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)",
"date_added": "2024-02-15",
"description": "Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an information disclosure vulnerability. An attacker could retrieve memory contents on an affected device, which could lead to the disclosure of confidential information due to a buffer tracking issue when the software parses invalid URLs that are requested from the web services interface. This vulnerability affects only specific AnyConnect and WebVPN configurations.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2024-20359",
"cwes": [
"CWE-94"
],
"name": "Cisco ASA and FTD Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)",
"date_added": "2024-04-24",
"description": "Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain a privilege escalation vulnerability that can allow local privilege escalation from Administrator to root.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2020-3452",
"cwes": [
"CWE-20"
],
"name": "Cisco ASA and FTD Read-Only Path Traversal Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)",
"date_added": "2021-11-03",
"description": "Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an improper input validation vulnerability when HTTP requests process URLs. An attacker could exploit this vulnerability by sending a crafted HTTP request containing directory traversal character sequences to an affected device. A successful exploit could allow the attacker to view arbitrary files within the web services file system on the targeted device.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2017-12238",
"cwes": [
"CWE-399"
],
"name": "Cisco Catalyst 6800 Series Switches VPLS Denial-of-Service Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "Catalyst 6800 Series Switches",
"date_added": "2022-03-03",
"description": "A vulnerability in the Virtual Private LAN Service (VPLS) code of Cisco IOS for Cisco Catalyst 6800 Series Switches could allow an unauthenticated, adjacent attacker to cause a denial of service.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2018-0155",
"cwes": [
"CWE-388"
],
"name": "Cisco Catalyst Bidirectional Forwarding Detection Denial-of-Service Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "Catalyst 4500 Series Switches and Cisco Catalyst 4500-X Series Switches",
"date_added": "2022-03-03",
"description": "A vulnerability in the Bidirectional Forwarding Detection (BFD) offload implementation of Cisco Catalyst 4500 Series Switches and Cisco Catalyst 4500-X Series Switches could allow an unauthenticated, remote attacker to cause a crash of the iosd process, causing a denial-of-service (DoS) condition.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2026-20127",
"cwes": [
"CWE-287"
],
"name": "Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "Catalyst SD-WAN Controller and Manager",
"date_added": "2026-02-25",
"description": "Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, and Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, contain an authentication bypass vulnerability could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system. This vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to an affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration for the SD-WAN fabric.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2026-20182",
"cwes": [
"CWE-287"
],
"name": "Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "Catalyst SD-WAN",
"date_added": "2026-05-14",
"description": "Cisco Catalyst SD-WAN Controller & Manager contain an authentication bypass vulnerability that allows an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2026-20262",
"cwes": [
"CWE-22"
],
"name": "Cisco Catalyst SD-WAN Manager Directory or Path Traversal Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "Catalyst SD-WAN Manager",
"date_added": "2026-06-15",
"description": "Cisco Catalyst SD-WAN Manager contains a directory or path traversal vulnerability that could allow an authenticated, remote attacker to create a file or overwrite any file on the filesystem of an affected system.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2026-20133",
"cwes": [
"CWE-200"
],
"name": "Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "Catalyst SD-WAN Manager",
"date_added": "2026-04-20",
"description": "Cisco Catalyst SD-WAN Manager contains an exposure of sensitive information to an unauthorized actor vulnerability that could allow remote attackers to view sensitive information on affected systems.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2026-20245",
"cwes": [
"CWE-116"
],
"name": "Cisco Catalyst SD-WAN Manager Improper Encoding or Escaping of Output Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "Catalyst SD-WAN Manager",
"date_added": "2026-06-09",
"description": "Cisco Catalyst SD-WAN Manager formerly SD-WAN vManage contains an improper encoding or escaping of output vulnerability. This vulnerability could allow an authenticated, local attacker to execute arbitrary commands as root by supplying a crafted file to the affected system.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2026-20122",
"cwes": [
"CWE-648"
],
"name": "Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "Catalyst SD-WAN Manger",
"date_added": "2026-04-20",
"description": "Cisco Catalyst SD-WAN Manager contains an incorrect use of privileged APIs vulnerability due to improper file handling on the API interface of an affected system. An attacker could exploit this vulnerability by uploading a malicious file on the local file system. A successful exploit could allow the attacker to overwrite arbitrary files on the affected system and gain vmanage user privileges.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2026-20128",
"cwes": [
"CWE-257"
],
"name": "Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "Catalyst SD-WAN Manager",
"date_added": "2026-04-20",
"description": "Cisco Catalyst SD-WAN Manager contains a storing passwords in a recoverable format vulnerability that allows an authenticated, local attacker to gain DCA user privileges by accessing a credential file for the DCA user on the filesystem as a low-privileged user.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2026-20079",
"cwes": [
"CWE-288"
],
"name": "Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management",
"date_added": "2026-09-09",
"description": "Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain an authentication Bypass using an alternate path or channel vulnerability that could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2021-1498",
"cwes": [
"CWE-78"
],
"name": "Cisco HyperFlex HX Data Platform Command Injection Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "HyperFlex HX",
"date_added": "2021-11-03",
"description": "Cisco HyperFlex HX Installer Virtual Machine contains an insufficient input validation vulnerability which could allow an attacker to execute commands on an affected device as the tomcat8 user.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2021-1497",
"cwes": [
"CWE-78"
],
"name": "Cisco HyperFlex HX Installer Virtual Machine Command Injection Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "HyperFlex HX",
"date_added": "2021-11-03",
"description": "Cisco HyperFlex HX Installer Virtual Machine contains an insufficient input validation vulnerability which could allow an attacker to execute commands on an affected device as the root user.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2026-76460",
"cwes": [
"CWE-648"
],
"name": "Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "Identity Services Engine",
"date_added": "2026-09-16",
"description": "Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) contain an incorrect use of privileged APIs vulnerability that could allow an unauthenticated, remote attacker to gain unauthorized access to the affected device by bypassing the web-based management interface.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2025-20281",
"cwes": [
"CWE-74"
],
"name": "Cisco Identity Services Engine Injection Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "Identity Services Engine",
"date_added": "2025-07-28",
"description": "Cisco Identity Services Engine contains an injection vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC due to insufficient validation of user-supplied input allowing an attacker to exploit this vulnerability by submitting a crafted API request. Successful exploitation could allow an attacker to perform remote code execution and obtaining root privileges on an affected device.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2025-20337",
"cwes": [
"CWE-74"
],
"name": "Cisco Identity Services Engine Injection Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "Identity Services Engine",
"date_added": "2025-07-28",
"description": "Cisco Identity Services Engine contains an injection vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC due to insufficient validation of user-supplied input allowing an attacker to exploit this vulnerability by submitting a crafted API request. Successful exploitation could allow an attacker to perform remote code execution and obtaining root privileges on an affected device.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2023-20109",
"cwes": [
"CWE-787"
],
"name": "Cisco IOS and IOS XE Group Encrypted Transport VPN Out-of-Bounds Write Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "IOS and IOS XE",
"date_added": "2023-10-10",
"description": "Cisco IOS and IOS XE contain an out-of-bounds write vulnerability in the Group Encrypted Transport VPN (GET VPN) feature that could allow an authenticated, remote attacker who has administrative control of either a group member or a key server to execute malicious code or cause a device to crash.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2017-3881",
"cwes": [
"CWE-20"
],
"name": "Cisco IOS and IOS XE Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "IOS and IOS XE",
"date_added": "2022-03-25",
"description": "A vulnerability in the Cisco Cluster Management Protocol (CMP) processing code in Cisco IOS and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a reload of an affected device or remotely execute code with elevated privileges.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2017-12240",
"cwes": [
"CWE-20"
],
"name": "Cisco IOS and IOS XE Software DHCP Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "IOS and IOS XE Software",
"date_added": "2022-03-03",
"description": "The Dynamic Host Configuration Protocol (DHCP) relay subsystem of Cisco IOS and Cisco IOS XE Software contains a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code and gain full control of an affected system.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2018-0172",
"cwes": [
"CWE-20"
],
"name": "Cisco IOS and IOS XE Software Improper Input Validation Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "IOS and IOS XE Software",
"date_added": "2022-03-03",
"description": "A vulnerability in the DHCP option 82 encapsulation functionality of Cisco IOS Software and Cisco IOS XE Software could allow for denial-of-service (DoS).",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2018-0173",
"cwes": [
"CWE-20"
],
"name": "Cisco IOS and IOS XE Software Improper Input Validation Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "IOS and IOS XE Software",
"date_added": "2022-03-03",
"description": "A vulnerability in the Cisco IOS Software and Cisco IOS XE Software function that restores encapsulated option 82 information in DHCP Version 4 (DHCPv4) packets can allow for denial-of-service (DoS).",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2017-12237",
"cwes": [
"CWE-399"
],
"name": "Cisco IOS and IOS XE Software Internet Key Exchange Denial-of-Service Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "IOS and IOS XE Software",
"date_added": "2022-03-03",
"description": "A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco IOS and Cisco IOS XE could allow an unauthenticated, remote attacker to cause high CPU utilization, traceback messages, or a reload of an affected device that leads to a denial of service.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2018-0171",
"cwes": [
"CWE-20"
],
"name": "Cisco IOS and IOS XE Software Smart Install Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "IOS and IOS XE",
"date_added": "2021-11-03",
"description": "Cisco IOS and IOS XE Software improperly validates packet data, allowing an unauthenticated, remote attacker to trigger a reload of an affected device, cause a denial-of-service (DoS) condition, or perform code execution on the affected device.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2025-20352",
"cwes": [
"CWE-121"
],
"name": "Cisco IOS and IOS XE Software SNMP Denial of Service and Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "IOS and IOS XE",
"date_added": "2025-09-29",
"description": "Cisco IOS and IOS XE contains a stack-based buffer overflow vulnerability in the Simple Network Management Protocol (SNMP) subsystem that could allow for denial of service or remote code execution. A successful exploit could allow a low-privileged attacker to cause the affected system to reload, resulting in a DoS condition, or allow a high-privileged attacker to execute arbitrary code as the root user and obtain full control of the affected system.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2017-6736",
"cwes": [
"CWE-119"
],
"name": "Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "IOS and IOS XE Software",
"date_added": "2022-03-03",
"description": "The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2017-6737",
"cwes": [
"CWE-119"
],
"name": "Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "IOS and IOS XE Software",
"date_added": "2022-03-03",
"description": "The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2017-6738",
"cwes": [
"CWE-119"
],
"name": "Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "IOS and IOS XE Software",
"date_added": "2022-03-03",
"description": "The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2017-6739",
"cwes": [
"CWE-119"
],
"name": "Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "IOS and IOS XE Software",
"date_added": "2022-03-03",
"description": "The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code on an affected system or cause an affected system to reload.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2017-6740",
"cwes": [
"CWE-119"
],
"name": "Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "IOS and IOS XE Software",
"date_added": "2022-03-03",
"description": "The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code on an affected system or cause an affected system to reload.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2017-6742",
"cwes": [
"CWE-119"
],
"name": "Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "IOS and IOS XE Software",
"date_added": "2023-04-19",
"description": "The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code on an affected system or cause an affected system to reload.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2017-6743",
"cwes": [
"CWE-119"
],
"name": "Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "IOS and IOS XE Software",
"date_added": "2022-03-03",
"description": "The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2018-0158",
"cwes": [
"CWE-20"
],
"name": "Cisco IOS and XE Software Internet Key Exchange Memory Leak Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "IOS Software and Cisco IOS XE Software",
"date_added": "2022-03-03",
"description": "A vulnerability in the implementation of Internet Key Exchange Version 1 (IKEv1) functionality in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial-of-service (DoS) condition.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2018-0159",
"cwes": [
"CWE-20"
],
"name": "Cisco IOS and XE Software Internet Key Exchange Version 1 Denial-of-Service Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "IOS Software and Cisco IOS XE Software",
"date_added": "2022-03-03",
"description": "A vulnerability in the implementation of Internet Key Exchange Version 1 (IKEv1) functionality in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial-of-service (DoS) condition.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2008-4128",
"cwes": [
"CWE-352"
],
"name": "Cisco IOS Cross-Site Request Forgery Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "IOS",
"date_added": "2026-07-13",
"description": "Cisco IOS 12.4 contains multiple cross-site forgery vulnerabilities that allows remote attackers to execute arbitrary commands via (1) a certain \"show privilege\" command to the /level/15/exec/- URI, and (2) a certain \"alias exec\" command to the /level/15/exec/-/configure/http URI.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2004-1464",
"name": "Cisco IOS Denial-of-Service Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "IOS",
"date_added": "2023-05-19",
"description": "Cisco IOS contains an unspecified vulnerability that may block further telnet, reverse telnet, Remote Shell (RSH), Secure Shell (SSH), and in some cases, Hypertext Transport Protocol (HTTP) access to the Cisco device.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2017-6663",
"name": "Cisco IOS Software and Cisco IOS XE Software Denial-of-Service Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "IOS and IOS XE Software",
"date_added": "2022-03-03",
"description": "A vulnerability in the Autonomic Networking feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause autonomic nodes of an affected system to reload, resulting in denial-of-service (DoS).",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2018-0174",
"cwes": [
"CWE-20"
],
"name": "Cisco IOS Software and Cisco IOS XE Software Improper Input Validation Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "IOS XE Software",
"date_added": "2022-03-03",
"description": "A vulnerability in the DHCP option 82 encapsulation functionality of Cisco IOS Software and Cisco IOS XE Software could allow for denial-of-service (DoS).",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2018-0151",
"cwes": [
"CWE-119"
],
"name": "Cisco IOS Software and Cisco IOS XE Software Quality of Service Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "IOS and IOS XE Software",
"date_added": "2022-03-03",
"description": "A vulnerability in the quality of service (QoS) subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or execute arbitrary code with elevated privileges.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2018-0156",
"cwes": [
"CWE-399"
],
"name": "Cisco IOS Software and Cisco IOS XE Software Smart Install Denial-of-Service Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "IOS Software and Cisco IOS XE Software",
"date_added": "2022-03-03",
"description": "A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial-of-service (DoS) condition.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2017-6627",
"cwes": [
"CWE-399"
],
"name": "Cisco IOS Software and Cisco IOS XE Software UDP Packet Processing Denial-of-Service Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "IOS and IOS XE Software",
"date_added": "2022-03-03",
"description": "A vulnerability in the UDP processing code of Cisco IOS and IOS XE could allow an unauthenticated, remote attacker to cause the input queue of an affected system to hold UDP packets, causing an interface queue wedge and denial of service.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2017-12233",
"cwes": [
"CWE-20"
],
"name": "Cisco IOS Software Common Industrial Protocol Request Denial-of-Service Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "IOS software",
"date_added": "2022-03-03",
"description": "There is a vulnerability in the implementation of the Common Industrial Protocol (CIP) feature in Cisco IOS could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2017-12234",
"cwes": [
"CWE-20"
],
"name": "Cisco IOS Software Common Industrial Protocol Request Denial-of-Service Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "IOS software",
"date_added": "2022-03-03",
"description": "There is a vulnerability in the implementation of the Common Industrial Protocol (CIP) feature in Cisco IOS could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2018-0179",
"cwes": [
"CWE-399"
],
"name": "Cisco IOS Software Denial-of-Service Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "IOS Software",
"date_added": "2022-03-03",
"description": "A vulnerability in the Login Enhancements (Login Block) feature of Cisco IOS Software could allow an unauthenticated, remote attacker to trigger a reload of an affected system, resulting in a denial of service (DoS) condition.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2018-0180",
"cwes": [
"CWE-399"
],
"name": "Cisco IOS Software Denial-of-Service Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "IOS Software",
"date_added": "2022-03-03",
"description": "A vulnerability in the Login Enhancements (Login Block) feature of Cisco IOS Software could allow an unauthenticated, remote attacker to trigger a reload of an affected system, resulting in a denial of service (DoS) condition.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2017-12235",
"cwes": [
"CWE-20"
],
"name": "Cisco IOS Software for Cisco Industrial Ethernet Switches PROFINET Denial-of-Service Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "IOS software",
"date_added": "2022-03-03",
"description": "A vulnerability in the implementation of the PROFINET Discovery and Configuration Protocol (PN-DCP) for Cisco IOS could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2017-12232",
"cwes": [
"CWE-399"
],
"name": "Cisco IOS Software for Cisco Integrated Services Routers Denial-of-Service Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "IOS software",
"date_added": "2022-03-03",
"description": "A vulnerability in the implementation of a protocol in Cisco Integrated Services Routers Generation 2 (ISR G2) Routers running Cisco IOS could allow an unauthenticated, adjacent attacker to cause an affected device to reload, resulting in a denial of service.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2018-0154",
"cwes": [
"CWE-399"
],
"name": "Cisco IOS Software Integrated Services Module for VPN Denial-of-Service Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "IOS Software",
"date_added": "2022-03-03",
"description": "A vulnerability in the crypto engine of the Cisco Integrated Services Module for VPN (ISM-VPN) running Cisco IOS Software could allow an unauthenticated, remote attacker to cause a denial-of-service (DoS) condition.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2017-12231",
"cwes": [
"CWE-399"
],
"name": "Cisco IOS Software Network Address Translation Denial-of-Service Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "IOS software",
"date_added": "2022-03-03",
"description": "A vulnerability in the implementation of Network Address Translation (NAT) functionality in Cisco IOS could allow an unauthenticated, remote attacker to cause a denial of service.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2018-0161",
"cwes": [
"CWE-399"
],
"name": "Cisco IOS Software Resource Management Errors Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "IOS Software",
"date_added": "2022-03-03",
"description": "A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS Software running on certain models of Cisco Catalyst Switches could allow an authenticated, remote attacker to cause a denial-of-service (DoS) condition.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2017-6744",
"cwes": [
"CWE-119"
],
"name": "Cisco IOS Software SNMP Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "IOS software",
"date_added": "2022-03-03",
"description": "The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS 1 contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code on an affected system or cause an affected system to reload. An attacker could exploit these vulnerabilities by sending a crafted SNMP packet to an affected system via IPv4 or IPv6.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2017-12319",
"cwes": [
"CWE-20"
],
"name": "Cisco IOS XE Software Ethernet Virtual Private Network Border Gateway Protocol Denial-of-Service Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "IOS XE Software",
"date_added": "2022-03-03",
"description": "A vulnerability in the Border Gateway Protocol (BGP) over an Ethernet Virtual Private Network (EVPN) for Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause the device to reload, resulting in a denial of service (DoS) condition, or potentially corrupt the BGP routing table, which could result in network instability.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2023-20273",
"cwes": [
"CWE-78"
],
"name": "Cisco IOS XE Web UI Command Injection Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "Cisco IOS XE Web UI",
"date_added": "2023-10-23",
"description": "Cisco IOS XE contains a command injection vulnerability in the web user interface. When chained with CVE-2023-20198, the attacker can leverage the new local user to elevate privilege to root and write the implant to the file system. Cisco identified CVE-2023-20273 as the vulnerability exploited to deploy the implant. CVE-2021-1435, previously associated with the exploitation events, is no longer believed to be related to this activity.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2023-20198",
"cwes": [
"CWE-420"
],
"name": "Cisco IOS XE Web UI Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "IOS XE Web UI",
"date_added": "2023-10-16",
"description": "Cisco IOS XE Web UI contains a privilege escalation vulnerability in the web user interface that could allow a remote, unauthenticated attacker to create an account with privilege level 15 access. The attacker can then use that account to gain control of the affected device.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2009-2055",
"cwes": [
"CWE-20"
],
"name": "Cisco IOS XR Border Gateway Protocol (BGP) Denial-of-Service Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "IOS XR",
"date_added": "2022-03-25",
"description": "Cisco IOS XR,when BGP is the configured routing feature, allows remote attackers to cause a denial-of-service (DoS).",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2010-3035",
"cwes": [
"CWE-20"
],
"name": "Cisco IOS XR Border Gateway Protocol (BGP) Denial-of-Service Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "IOS XR",
"date_added": "2022-03-25",
"description": "Cisco IOS XR, when BGP is the configured routing feature, allows remote attackers to cause a denial-of-service (DoS).",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2022-20821",
"cwes": [
"CWE-923"
],
"name": "Cisco IOS XR Open Port Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "IOS XR",
"date_added": "2022-05-23",
"description": "Cisco IOS XR software health check opens TCP port 6379 by default on activation. An attacker can connect to the Redis instance on the open port and allow access to the Redis instance that is running within the NOSi container.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2020-3118",
"cwes": [
"CWE-134"
],
"name": "Cisco IOS XR Software Discovery Protocol Format String Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "IOS XR",
"date_added": "2021-11-03",
"description": "Cisco IOS XR improperly validates string input from certain fields in Cisco Discovery Protocol messages. Exploitation could allow an unauthenticated, adjacent attacker to execute code with administrative privileges or cause a reload on an affected device.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2020-3566",
"cwes": [
"CWE-400"
],
"name": "Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "IOS XR",
"date_added": "2021-11-03",
"description": "Cisco IOS XR Distance Vector Multicast Routing Protocol (DVMRP) incorrectly handles Internet Group Management Protocol (IGMP) packets. Exploitation could allow an unauthenticated, remote attacker to immediately crash the IGMP process or make it consume available memory and eventually crash.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2020-3569",
"cwes": [
"CWE-400"
],
"name": "Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "IOS XR",
"date_added": "2021-11-03",
"description": "Cisco IOS XR Distance Vector Multicast Routing Protocol (DVMRP) incorrectly handles Internet Group Management Protocol (IGMP) packets. Exploitation could allow an unauthenticated, remote attacker to immediately crash the IGMP process or make it consume available memory and eventually crash.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2016-6415",
"cwes": [
"CWE-200"
],
"name": "Cisco IOS, IOS XR, and IOS XE IKEv1 Information Disclosure Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "IOS, IOS XR, and IOS XE",
"date_added": "2023-05-19",
"description": "Cisco IOS, IOS XR, and IOS XE contain insufficient condition checks in the part of the code that handles Internet Key Exchange version 1 (IKEv1) security negotiation requests. contains an information disclosure vulnerability in the Internet Key Exchange version 1 (IKEv1) that could allow an attacker to retrieve memory contents. Successful exploitation could allow the attacker to retrieve memory contents, which can lead to information disclosure.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2018-0167",
"cwes": [
"CWE-119"
],
"name": "Cisco IOS, XR, and XE Software Buffer Overflow Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "IOS, XR, and XE Software",
"date_added": "2022-03-03",
"description": "There is a buffer overflow vulnerability in the Link Layer Discovery Protocol (LLDP) subsystem of Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software which could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition or execute arbitrary code.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2018-0175",
"cwes": [
"CWE-119"
],
"name": "Cisco IOS, XR, and XE Software Buffer Overflow Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "IOS, XR, and XE Software",
"date_added": "2022-03-03",
"description": "Format string vulnerability in the Link Layer Discovery Protocol (LLDP) subsystem of Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition or execute arbitrary code with elevated privileges on an affected device.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2020-3161",
"cwes": [
"CWE-20"
],
"name": "Cisco IP Phones Web Server Remote Code Execution and Denial-of-Service Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "Cisco IP Phones",
"date_added": "2021-11-03",
"description": "Cisco IP Phones contain an improper input validation vulnerability for HTTP requests. Exploitation could allow an attacker to execute code remotely with root privileges or cause a denial-of-service (DoS) condition.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2025-20393",
"cwes": [
"CWE-20"
],
"name": "Cisco Multiple Products Improper Input Validation Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "Multiple Products",
"date_added": "2025-12-17",
"description": "Cisco Secure Email Gateway, Secure Email, AsyncOS Software, and Web Manager appliances contains an improper input validation vulnerability that allows threat actors to execute arbitrary commands with root privileges on the underlying operating system of an affected appliance.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2024-20399",
"cwes": [
"CWE-78"
],
"name": "Cisco NX-OS Command Injection Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "NX-OS",
"date_added": "2024-07-02",
"description": "Cisco NX-OS contains a command injection vulnerability in the command line interface (CLI) that could allow an authenticated, local attacker to execute commands as root on the underlying operating system of an affected device.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2015-0666",
"cwes": [
"CWE-22"
],
"name": "Cisco Prime Data Center Network Manager (DCNM) Directory Traversal Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "Prime Data Center Network Manager (DCNM)",
"date_added": "2022-03-25",
"description": "Directory traversal vulnerability in the fmserver servlet in Cisco Prime Data Center Network Manager (DCNM) allows remote attackers to read arbitrary files.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2019-15271",
"cwes": [
"CWE-502"
],
"name": "Cisco RV Series Routers Deserialization of Untrusted Data Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "RV Series Routers",
"date_added": "2022-06-08",
"description": "A deserialization of untrusted data vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers could allow an attacker to execute code with root privileges.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2022-20775",
"cwes": [
"CWE-25",
"CWE-282"
],
"name": "Cisco SD-WAN Path Traversal Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "SD-WAN",
"date_added": "2026-02-25",
"description": "Cisco SD-WAN CLI contains a path traversal vulnerability that could allow an authenticated local attacker to gain elevated privileges via improper access controls on commands within the application CLI. A successful exploit could allow the attacker to execute arbitrary commands as the root user.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2018-0147",
"cwes": [
"CWE-20"
],
"name": "Cisco Secure Access Control System Java Deserialization Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "Secure Access Control System (ACS)",
"date_added": "2022-03-25",
"description": "A vulnerability in Java deserialization used by Cisco Secure Access Control System (ACS) could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected device. The vulnerability is due to insecure deserialization of user-supplied content by the affected software.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2026-76461",
"cwes": [
"CWE-89"
],
"name": "Cisco Secure Email Gateway SQL Injection Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "Secure Email Gateway",
"date_added": "2026-09-14",
"description": "Cisco AsyncOS software for Cisco Secure Email Gateway (SEG) contains a SQL injection vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2025-20362",
"cwes": [
"CWE-862"
],
"name": "Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Missing Authorization Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense",
"date_added": "2025-09-25",
"description": "Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Software VPN Web Server contain a missing authorization vulnerability. This vulnerability could be chained with CVE-2025-20333.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2025-20333",
"cwes": [
"CWE-120"
],
"name": "Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buffer Overflow Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense",
"date_added": "2025-09-25",
"description": "Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Software VPN Web Server contain a buffer overflow vulnerability that allows for remote code execution. This vulnerability could be chained with CVE-2025-20362.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2026-20349",
"cwes": [
"CWE-244"
],
"name": "Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) ",
"date_added": "2026-08-11",
"description": "Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) contain a heap inspection vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2026-20131",
"cwes": [
"CWE-502"
],
"name": "Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "Secure Firewall Management Center (FMC)",
"date_added": "2026-03-19",
"description": "Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain a deserialization of untrusted data vulnerability in the web-based management interface that could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2026-20316",
"cwes": [
"CWE-259"
],
"name": "Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "Secure Firewall Management Center (FMC)",
"date_added": "2026-07-29",
"description": "Cisco Secure Firewall Management Center (FMC) formerly known as Firepower Management Center contains a use of hard-coded password vulnerability that could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2019-1652",
"cwes": [
"CWE-20"
],
"name": "Cisco Small Business Routers Improper Input Validation Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers",
"date_added": "2022-03-03",
"description": "A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an authenticated, remote attacker with administrative privileges on an affected device to execute arbitrary commands.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2023-20118",
"cwes": [
"CWE-77"
],
"name": "Cisco Small Business RV Series Routers Command Injection Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "Small Business RV Series Routers",
"date_added": "2025-03-03",
"description": "Multiple Cisco Small Business RV Series Routers contains a command injection vulnerability in the web-based management interface. Successful exploitation could allow an authenticated, remote attacker to gain root-level privileges and access unauthorized data.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2022-20699",
"cwes": [
"CWE-785"
],
"name": "Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "Small Business RV160, RV260, RV340, and RV345 Series Routers",
"date_added": "2022-03-03",
"description": "A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS).",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2022-20700",
"cwes": [
"CWE-121"
],
"name": "Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "Small Business RV160, RV260, RV340, and RV345 Series Routers",
"date_added": "2022-03-03",
"description": "A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS).",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2022-20701",
"cwes": [
"CWE-121"
],
"name": "Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "Small Business RV160, RV260, RV340, and RV345 Series Routers",
"date_added": "2022-03-03",
"description": "A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS).",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2022-20703",
"cwes": [
"CWE-347"
],
"name": "Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "Small Business RV160, RV260, RV340, and RV345 Series Routers",
"date_added": "2022-03-03",
"description": "A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS).",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2022-20708",
"cwes": [
"CWE-121"
],
"name": "Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "Small Business RV160, RV260, RV340, and RV345 Series Routers",
"date_added": "2022-03-03",
"description": "A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS).",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2019-1653",
"cwes": [
"CWE-284"
],
"name": "Cisco Small Business RV320 and RV325 Routers Information Disclosure Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "Small Business RV320 and RV325 Routers",
"date_added": "2021-11-03",
"description": "Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers contain improper access controls for URLs. Exploitation could allow an attacker to download the router configuration or detailed diagnostic information.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2024-20439",
"cwes": [
"CWE-912"
],
"name": "Cisco Smart Licensing Utility Static Credential Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "Smart Licensing Utility",
"date_added": "2025-03-31",
"description": "Cisco Smart Licensing Utility contains a static credential vulnerability that allows an unauthenticated, remote attacker to log in to an affected system and gain administrative credentials.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2026-20230",
"cwes": [
"CWE-918"
],
"name": "Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "Unified Communications Manager",
"date_added": "2026-06-25",
"description": "Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) contain a server-side request forgery (SSRF) Vulnerability that could allow an unauthenticated, remote attacker to write files to the underlying operating system that could be used later to elevate to root.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2026-20045",
"cwes": [
"CWE-94"
],
"name": "Cisco Unified Communications Products Code Injection Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "Unified Communications Manager",
"date_added": "2026-01-21",
"description": "Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unity Connection, and Cisco Webex Calling Dedicated Instance contain a code injection vulnerability that could allow the attacker to obtain user-level access to the underlying operating system and then elevate privileges to root.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "cisco",
"evidence_id": 10791,
"data": {
"cve": "CVE-2018-0125",
"cwes": [
"CWE-20"
],
"name": "Cisco VPN Routers Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Cisco",
"product": "VPN Routers",
"date_added": "2022-03-25",
"description": "A vulnerability in the web interface of the Cisco VPN Routers could allow an unauthenticated, remote attacker to execute arbitrary code as root and gain full control of an affected system.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "citrix",
"evidence_id": 10791,
"data": {
"cve": "CVE-2020-8193",
"cwes": [
"CWE-284"
],
"name": "Citrix ADC, Gateway, and SD-WAN WANOP Appliance Authorization Bypass Vulnerability",
"source": "cisa_kev",
"vendor": "Citrix",
"product": "Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance",
"date_added": "2021-11-03",
"description": "Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an authorization bypass vulnerability that may allow unauthenticated access to certain URL endpoints. The attacker must have access to the NetScaler IP (NSIP) in order to perform exploitation.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "citrix",
"evidence_id": 10791,
"data": {
"cve": "CVE-2019-19781",
"cwes": [
"CWE-22"
],
"name": "Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Citrix",
"product": "Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance",
"date_added": "2021-11-03",
"description": "Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an unspecified vulnerability that could allow an unauthenticated attacker to perform code execution.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "citrix",
"evidence_id": 10791,
"data": {
"cve": "CVE-2020-8195",
"cwes": [
"CWE-20"
],
"name": "Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability",
"source": "cisa_kev",
"vendor": "Citrix",
"product": "Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance",
"date_added": "2021-11-03",
"description": "Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an information disclosure vulnerability.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "citrix",
"evidence_id": 10791,
"data": {
"cve": "CVE-2020-8196",
"cwes": [
"CWE-284"
],
"name": "Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability",
"source": "cisa_kev",
"vendor": "Citrix",
"product": "Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance",
"date_added": "2021-11-03",
"description": "Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an information disclosure vulnerability.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "citrix",
"evidence_id": 10791,
"data": {
"cve": "CVE-2022-27518",
"cwes": [
"CWE-664"
],
"name": "Citrix Application Delivery Controller (ADC) and Gateway Authentication Bypass Vulnerability",
"source": "cisa_kev",
"vendor": "Citrix",
"product": "Application Delivery Controller (ADC) and Gateway",
"date_added": "2022-12-13",
"description": "Citrix Application Delivery Controller (ADC) and Gateway, when configured with SAML SP or IdP configuration, contain an authentication bypass vulnerability that allows an attacker to execute code as administrator.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "citrix",
"evidence_id": 10791,
"data": {
"cve": "CVE-2023-24489",
"cwes": [
"CWE-284"
],
"name": "Citrix Content Collaboration ShareFile Improper Access Control Vulnerability",
"source": "cisa_kev",
"vendor": "Citrix",
"product": "Content Collaboration",
"date_added": "2023-08-16",
"description": "Citrix Content Collaboration contains an improper access control vulnerability that could allow an unauthenticated attacker to remotely compromise customer-managed ShareFile storage zones controllers.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "citrix",
"evidence_id": 10791,
"data": {
"cve": "CVE-2017-6316",
"cwes": [
"CWE-20"
],
"name": "Citrix Multiple Products Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Citrix",
"product": "NetScaler SD-WAN Enterprise, CloudBridge Virtual WAN, and XenMobile Server",
"date_added": "2022-03-25",
"description": "A vulnerability has been identified in the management interface of Citrix NetScaler SD-WAN Enterprise and Standard Edition and Citrix CloudBridge Virtual WAN Edition that could result in an unauthenticated, remote attacker being able to execute arbitrary code as a root user. This vulnerability also affects XenMobile Server.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "citrix",
"evidence_id": 10791,
"data": {
"cve": "CVE-2025-6543",
"cwes": [
"CWE-119"
],
"name": "Citrix NetScaler ADC and Gateway Buffer Overflow Vulnerability",
"source": "cisa_kev",
"vendor": "Citrix",
"product": "NetScaler ADC and Gateway",
"date_added": "2025-06-30",
"description": "Citrix NetScaler ADC and Gateway contain a buffer overflow vulnerability leading to unintended control flow and Denial of Service. NetScaler must be configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "citrix",
"evidence_id": 10791,
"data": {
"cve": "CVE-2025-5777",
"cwes": [
"CWE-125"
],
"name": "Citrix NetScaler ADC and Gateway Out-of-Bounds Read Vulnerability",
"source": "cisa_kev",
"vendor": "Citrix",
"product": "NetScaler ADC and Gateway",
"date_added": "2025-07-10",
"description": "Citrix NetScaler ADC and Gateway contain an out-of-bounds read vulnerability due to insufficient input validation. This vulnerability can lead to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "citrix",
"evidence_id": 10791,
"data": {
"cve": "CVE-2023-4966",
"cwes": [
"CWE-119"
],
"name": "Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability",
"source": "cisa_kev",
"vendor": "Citrix",
"product": "NetScaler ADC and NetScaler Gateway",
"date_added": "2023-10-18",
"description": "Citrix NetScaler ADC and NetScaler Gateway contain a buffer overflow vulnerability that allows for sensitive information disclosure when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "citrix",
"evidence_id": 10791,
"data": {
"cve": "CVE-2023-6549",
"cwes": [
"CWE-119"
],
"name": "Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability",
"source": "cisa_kev",
"vendor": "Citrix",
"product": "NetScaler ADC and NetScaler Gateway",
"date_added": "2024-01-17",
"description": "Citrix NetScaler ADC and NetScaler Gateway contain a buffer overflow vulnerability that allows for a denial-of-service when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "citrix",
"evidence_id": 10791,
"data": {
"cve": "CVE-2023-3519",
"cwes": [
"CWE-94"
],
"name": "Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability",
"source": "cisa_kev",
"vendor": "Citrix",
"product": "NetScaler ADC and NetScaler Gateway",
"date_added": "2023-07-19",
"description": "Citrix NetScaler ADC and NetScaler Gateway contains a code injection vulnerability that allows for unauthenticated remote code execution.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "citrix",
"evidence_id": 10791,
"data": {
"cve": "CVE-2023-6548",
"cwes": [
"CWE-94"
],
"name": "Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability",
"source": "cisa_kev",
"vendor": "Citrix",
"product": "NetScaler ADC and NetScaler Gateway",
"date_added": "2024-01-17",
"description": "Citrix NetScaler ADC and NetScaler Gateway contain a code injection vulnerability that allows for authenticated remote code execution on the management interface with access to NSIP, CLIP, or SNIP.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "citrix",
"evidence_id": 10791,
"data": {
"cve": "CVE-2026-8452",
"cwes": [
"CWE-119"
],
"name": "Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability",
"source": "cisa_kev",
"vendor": "Citrix",
"product": "NetScaler ADC and NetScaler Gateway",
"date_added": "2026-08-26",
"description": "Citrix NetScaler ADC and NetScaler Gateway contain an improper restriction of operations within the bounds of a memory buffer vulnerability which could lead to denial of service.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "citrix",
"evidence_id": 10791,
"data": {
"cve": "CVE-2026-19490",
"cwes": [
"CWE-288"
],
"name": "Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability",
"source": "cisa_kev",
"vendor": "Citrix",
"product": "NetScaler",
"date_added": "2026-09-09",
"description": "Citrix NetScaler ADC and NetScaler Gateway contain an authentication-bypass vulnerability involving an alternate path or channel. When the NetScaler appliance is configured as an AAA virtual server or as a Gateway (SSL VPN, ICA Proxy, CVPN, or RDP Proxy), an unauthenticated remote threat actor may be able to bypass authentication.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "citrix",
"evidence_id": 10791,
"data": {
"cve": "CVE-2025-7775",
"cwes": [
"CWE-119"
],
"name": "Citrix NetScaler Memory Overflow Vulnerability",
"source": "cisa_kev",
"vendor": "Citrix",
"product": "NetScaler",
"date_added": "2025-08-26",
"description": "Citrix NetScaler ADC and NetScaler Gateway contain a memory overflow vulnerability that could allow for remote code execution and/or denial of service.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "citrix",
"evidence_id": 10791,
"data": {
"cve": "CVE-2026-3055",
"cwes": [
"CWE-125"
],
"name": "Citrix NetScaler Out-of-Bounds Read Vulnerability",
"source": "cisa_kev",
"vendor": "Citrix",
"product": "NetScaler",
"date_added": "2026-03-30",
"description": "Citrix NetScaler ADC (formerly Citrix ADC), NetScaler Gateway (formerly Citrix Gateway) and NetScaler ADC FIPS and NDcPP contain an out-of-bounds reads vulnerability when configured as a SAML IDP leading to memory overread.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "citrix",
"evidence_id": 10791,
"data": {
"cve": "CVE-2019-12991",
"cwes": [
"CWE-78"
],
"name": "Citrix SD-WAN and NetScaler Command Injection Vulnerability",
"source": "cisa_kev",
"vendor": "Citrix",
"product": "SD-WAN and NetScaler",
"date_added": "2022-03-25",
"description": "Authenticated Command Injection in Citrix SD-WAN Appliance and NetScaler SD-WAN Appliance.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "citrix",
"evidence_id": 10791,
"data": {
"cve": "CVE-2019-12989",
"cwes": [
"CWE-89"
],
"name": "Citrix SD-WAN and NetScaler SQL Injection Vulnerability",
"source": "cisa_kev",
"vendor": "Citrix",
"product": "SD-WAN and NetScaler",
"date_added": "2022-03-25",
"description": "Citrix SD-WAN and NetScaler SD-WAN allow SQL Injection.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "citrix",
"evidence_id": 10791,
"data": {
"cve": "CVE-2024-8069",
"cwes": [
"CWE-502"
],
"name": "Citrix Session Recording Deserialization of Untrusted Data Vulnerability",
"source": "cisa_kev",
"vendor": "Citrix",
"product": "Session Recording",
"date_added": "2025-08-25",
"description": "Citrix Session Recording contains a deserialization of untrusted data vulnerability that allows limited remote code execution with privilege of a NetworkService Account access. Attacker must be an authenticated user on the same intranet as the session recording server.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "citrix",
"evidence_id": 10791,
"data": {
"cve": "CVE-2024-8068",
"cwes": [
"CWE-269"
],
"name": "Citrix Session Recording Improper Privilege Management Vulnerability",
"source": "cisa_kev",
"vendor": "Citrix",
"product": "Session Recording",
"date_added": "2025-08-25",
"description": "Citrix Session Recording contains an improper privilege management vulnerability that could allow for privilege escalation to NetworkService Account access. An attacker must be an authenticated user in the same Windows Active Directory domain as the session recording server domain.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "citrix",
"evidence_id": 10791,
"data": {
"cve": "CVE-2021-22941",
"cwes": [
"CWE-284"
],
"name": "Citrix ShareFile Improper Access Control Vulnerability",
"source": "cisa_kev",
"vendor": "Citrix",
"product": "ShareFile",
"date_added": "2022-03-25",
"description": "Improper Access Control in Citrix ShareFile storage zones controller may allow an unauthenticated attacker to remotely compromise the storage zones controller.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "citrix",
"evidence_id": 10791,
"data": {
"cve": "CVE-2019-13608",
"cwes": [
"CWE-611"
],
"name": "Citrix StoreFront Server XML External Entity (XXE) Processing Vulnerability",
"source": "cisa_kev",
"vendor": "Citrix",
"product": "StoreFront Server",
"date_added": "2021-11-03",
"description": "Citrix StoreFront Server contains an XML External Entity (XXE) processing vulnerability that may allow an unauthenticated attacker to retrieve potentially sensitive information.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "citrix",
"evidence_id": 10791,
"data": {
"cve": "CVE-2019-11634",
"name": "Citrix Workspace Application and Receiver for Windows Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Citrix",
"product": "Workspace Application and Receiver for Windows",
"date_added": "2021-11-03",
"description": "Citrix Workspace Application and Receiver for Windows contains remote code execution vulnerability resulting from local drive access preferences not being enforced into the clients' local drives.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "commvault-systems",
"evidence_id": 10791,
"data": {
"cve": "CVE-2025-34028",
"cwes": [
"CWE-22"
],
"name": "Commvault Command Center Path Traversal Vulnerability",
"source": "cisa_kev",
"vendor": "Commvault",
"product": "Command Center",
"date_added": "2025-05-02",
"description": "Commvault Command Center contains a path traversal vulnerability that allows a remote, unauthenticated attacker to execute arbitrary code.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "commvault-systems",
"evidence_id": 10791,
"data": {
"cve": "CVE-2025-3928",
"name": "Commvault Web Server Unspecified Vulnerability",
"source": "cisa_kev",
"vendor": "Commvault",
"product": "Web Server",
"date_added": "2025-04-28",
"description": "Commvault Web Server contains an unspecified vulnerability that allows a remote, authenticated attacker to create and execute webshells.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "dell",
"evidence_id": 10791,
"data": {
"cve": "CVE-2021-21551",
"cwes": [
"CWE-782"
],
"name": "Dell dbutil Driver Insufficient Access Control Vulnerability",
"source": "cisa_kev",
"vendor": "Dell",
"product": "dbutil Driver",
"date_added": "2022-03-31",
"description": "Dell dbutil driver contains an insufficient access control vulnerability which may lead to escalation of privileges, denial-of-service (DoS), or information disclosure.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "dell",
"evidence_id": 10791,
"data": {
"cve": "CVE-2026-22769",
"cwes": [
"CWE-798"
],
"name": "Dell RecoverPoint for Virtual Machines (RP4VMs) Use of Hard-coded Credentials Vulnerability",
"source": "cisa_kev",
"vendor": "Dell",
"product": "RecoverPoint for Virtual Machines (RP4VMs)",
"date_added": "2026-02-18",
"description": "Dell RecoverPoint for Virtual Machines (RP4VMs) contains an use of hard-coded credentials vulnerability that could allow an unauthenticated remote attacker to gain unauthorized access to the underlying operating system and root-level persistence.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "docker",
"evidence_id": 10791,
"data": {
"cve": "CVE-2019-15752",
"cwes": [
"CWE-732"
],
"name": "Docker Desktop Community Edition Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Docker",
"product": "Desktop Community Edition",
"date_added": "2021-11-03",
"description": "Docker Desktop Community Edition contains a vulnerability that may allow local users to escalate privileges by placing a trojan horse docker-credential-wincred.exe file in %PROGRAMDATA%\\DockerDesktop\\version-bin\\.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "elasticsearch",
"evidence_id": 10791,
"data": {
"cve": "CVE-2015-1427",
"cwes": [
"CWE-284"
],
"name": "Elasticsearch Groovy Scripting Engine Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Elastic",
"product": "Elasticsearch",
"date_added": "2022-03-25",
"description": "The Groovy scripting engine in Elasticsearch allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "elasticsearch",
"evidence_id": 10791,
"data": {
"cve": "CVE-2014-3120",
"cwes": [
"CWE-284"
],
"name": "Elasticsearch Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Elastic",
"product": "Elasticsearch",
"date_added": "2022-03-25",
"description": "Elasticsearch enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "elasticsearch",
"evidence_id": 10791,
"data": {
"cve": "CVE-2019-7609",
"cwes": [
"CWE-94"
],
"name": "Kibana Arbitrary Code Execution",
"source": "cisa_kev",
"vendor": "Elastic",
"product": "Kibana",
"date_added": "2022-01-10",
"description": "Kibana contain an arbitrary code execution flaw in the Timelion visualizer.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "fortinet",
"evidence_id": 10791,
"data": {
"cve": "CVE-2026-35616",
"cwes": [
"CWE-284"
],
"name": "Fortinet FortiClient EMS Improper Access Control Vulnerability",
"source": "cisa_kev",
"vendor": "Fortinet",
"product": "FortiClient EMS",
"date_added": "2026-04-06",
"description": "Fortinet FortiClient EMS contains an improper access control vulnerability that may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "fortinet",
"evidence_id": 10791,
"data": {
"cve": "CVE-2023-48788",
"cwes": [
"CWE-89"
],
"name": "Fortinet FortiClient EMS SQL Injection Vulnerability",
"source": "cisa_kev",
"vendor": "Fortinet",
"product": "FortiClient EMS",
"date_added": "2024-03-25",
"description": "Fortinet FortiClient EMS contains a SQL injection vulnerability that allows an unauthenticated attacker to execute commands as SYSTEM via specifically crafted requests.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "fortinet",
"evidence_id": 10791,
"data": {
"cve": "CVE-2026-21643",
"cwes": [
"CWE-89"
],
"name": "Fortinet FortiClient EMS SQL Injection Vulnerability",
"source": "cisa_kev",
"vendor": "Fortinet",
"product": "FortiClient EMS",
"date_added": "2026-04-13",
"description": "Fortinet FortiClient EMS contains a SQL injection vulnerability that may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "fortinet",
"evidence_id": 10791,
"data": {
"cve": "CVE-2024-47575",
"cwes": [
"CWE-306"
],
"name": "Fortinet FortiManager Missing Authentication Vulnerability",
"source": "cisa_kev",
"vendor": "Fortinet",
"product": "FortiManager",
"date_added": "2024-10-23",
"description": "Fortinet FortiManager contains a missing authentication vulnerability in the fgfmd daemon that allows a remote, unauthenticated attacker to execute arbitrary code or commands via specially crafted requests.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "fortinet",
"evidence_id": 10791,
"data": {
"cve": "CVE-2018-13374",
"cwes": [
"CWE-732"
],
"name": "Fortinet FortiOS and FortiADC Improper Access Control Vulnerability",
"source": "cisa_kev",
"vendor": "Fortinet",
"product": "FortiOS and FortiADC",
"date_added": "2022-09-08",
"description": "Fortinet FortiOS and FortiADC contain an improper access control vulnerability that allows attackers to obtain the LDAP server login credentials configured in FortiGate by pointing a LDAP server connectivity test request to a rogue LDAP server.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "fortinet",
"evidence_id": 10791,
"data": {
"cve": "CVE-2024-55591",
"cwes": [
"CWE-288"
],
"name": "Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability",
"source": "cisa_kev",
"vendor": "Fortinet",
"product": "FortiOS and FortiProxy",
"date_added": "2025-01-14",
"description": "Fortinet FortiOS and FortiProxy contain an authentication bypass vulnerability that may allow an unauthenticated, remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "fortinet",
"evidence_id": 10791,
"data": {
"cve": "CVE-2025-24472",
"cwes": [
"CWE-288"
],
"name": "Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability",
"source": "cisa_kev",
"vendor": "Fortinet",
"product": "FortiOS and FortiProxy",
"date_added": "2025-03-18",
"description": "Fortinet FortiOS and FortiProxy contain an authentication bypass vulnerability that allows a remote attacker to gain super-admin privileges via crafted CSF proxy requests.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "fortinet",
"evidence_id": 10791,
"data": {
"cve": "CVE-2018-13382",
"cwes": [
"CWE-285"
],
"name": "Fortinet FortiOS and FortiProxy Improper Authorization",
"source": "cisa_kev",
"vendor": "Fortinet",
"product": "FortiOS and FortiProxy",
"date_added": "2022-01-10",
"description": "An Improper Authorization vulnerability in Fortinet FortiOS and FortiProxy under SSL VPN web portal allows an unauthenticated attacker to modify the password.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "fortinet",
"evidence_id": 10791,
"data": {
"cve": "CVE-2018-13383",
"cwes": [
"CWE-787"
],
"name": "Fortinet FortiOS and FortiProxy Out-of-bounds Write",
"source": "cisa_kev",
"vendor": "Fortinet",
"product": "FortiOS and FortiProxy",
"date_added": "2022-01-10",
"description": "A heap buffer overflow in Fortinet FortiOS and FortiProxy may cause the SSL VPN web service termination for logged in users.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "fortinet",
"evidence_id": 10791,
"data": {
"cve": "CVE-2023-27997",
"cwes": [
"CWE-122"
],
"name": "Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow Vulnerability",
"source": "cisa_kev",
"vendor": "Fortinet",
"product": "FortiOS and FortiProxy SSL-VPN",
"date_added": "2023-06-13",
"description": "Fortinet FortiOS and FortiProxy SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute code or commands via specifically crafted requests.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "fortinet",
"evidence_id": 10791,
"data": {
"cve": "CVE-2021-44168",
"cwes": [
"CWE-494"
],
"name": "Fortinet FortiOS Arbitrary File Download",
"source": "cisa_kev",
"vendor": "Fortinet",
"product": "FortiOS",
"date_added": "2021-12-10",
"description": "Fortinet FortiOS \"execute restore src-vis\" downloads code without integrity checking, allowing an attacker to arbitrarily download files.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "fortinet",
"evidence_id": 10791,
"data": {
"cve": "CVE-2019-5591",
"cwes": [
"CWE-306"
],
"name": "Fortinet FortiOS Default Configuration Vulnerability",
"source": "cisa_kev",
"vendor": "Fortinet",
"product": "FortiOS",
"date_added": "2021-11-03",
"description": "Fortinet FortiOS contains a default configuration vulnerability that may allow an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating the Lightweight Directory Access Protocol (LDAP) server.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "fortinet",
"evidence_id": 10791,
"data": {
"cve": "CVE-2025-68686",
"cwes": [
"CWE-200"
],
"name": "Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability",
"source": "cisa_kev",
"vendor": "Fortinet",
"product": "FortiOS",
"date_added": "2026-07-27",
"description": "Fortinet FortiOS contains an exposure of sensitive information to an unauthorized actor vulnerability. This may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests. An attacker would need first to have compromised the product via another vulnerability, at filesystem level.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "fortinet",
"evidence_id": 10791,
"data": {
"cve": "CVE-2022-42475",
"cwes": [
"CWE-197"
],
"name": "Fortinet FortiOS Heap-Based Buffer Overflow Vulnerability",
"source": "cisa_kev",
"vendor": "Fortinet",
"product": "FortiOS",
"date_added": "2022-12-13",
"description": "Multiple versions of Fortinet FortiOS SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute arbitrary code or commands via specifically crafted requests.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "fortinet",
"evidence_id": 10791,
"data": {
"cve": "CVE-2024-21762",
"cwes": [
"CWE-787"
],
"name": "Fortinet FortiOS Out-of-Bound Write Vulnerability",
"source": "cisa_kev",
"vendor": "Fortinet",
"product": "FortiOS",
"date_added": "2024-02-09",
"description": "Fortinet FortiOS contains an out-of-bound write vulnerability that allows a remote unauthenticated attacker to execute code or commands via specially crafted HTTP requests.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "fortinet",
"evidence_id": 10791,
"data": {
"cve": "CVE-2022-41328",
"cwes": [
"CWE-22"
],
"name": "Fortinet FortiOS Path Traversal Vulnerability",
"source": "cisa_kev",
"vendor": "Fortinet",
"product": "FortiOS",
"date_added": "2023-03-14",
"description": "Fortinet FortiOS contains a path traversal vulnerability that may allow a local privileged attacker to read and write files via crafted CLI commands.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "fortinet",
"evidence_id": 10791,
"data": {
"cve": "CVE-2020-12812",
"cwes": [
"CWE-178",
"CWE-287"
],
"name": "Fortinet FortiOS SSL VPN Improper Authentication Vulnerability",
"source": "cisa_kev",
"vendor": "Fortinet",
"product": "FortiOS",
"date_added": "2021-11-03",
"description": "Fortinet FortiOS SSL VPN contains an improper authentication vulnerability that may allow a user to login successfully without being prompted for the second factor of authentication (FortiToken) if they change the case in their username.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "fortinet",
"evidence_id": 10791,
"data": {
"cve": "CVE-2018-13379",
"cwes": [
"CWE-22"
],
"name": "Fortinet FortiOS SSL VPN Path Traversal Vulnerability",
"source": "cisa_kev",
"vendor": "Fortinet",
"product": "FortiOS",
"date_added": "2021-11-03",
"description": "Fortinet FortiOS SSL VPN web portal contains a path traversal vulnerability that may allow an unauthenticated attacker to download FortiOS system files through specially crafted HTTP resource requests.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "fortinet",
"evidence_id": 10791,
"data": {
"cve": "CVE-2019-6693",
"cwes": [
"CWE-798"
],
"name": "Fortinet FortiOS Use of Hard-Coded Credentials Vulnerability",
"source": "cisa_kev",
"vendor": "Fortinet",
"product": "FortiOS",
"date_added": "2025-06-25",
"description": "Fortinet FortiOS contains a use of hard-coded credentials vulnerability that could allow an attacker to cipher sensitive data in FortiOS configuration backup file via knowledge of the hard-coded key.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "fortinet",
"evidence_id": 10791,
"data": {
"cve": "CVE-2026-25089",
"cwes": [
"CWE-78"
],
"name": "Fortinet FortiSandbox OS Command Injection Vulnerability",
"source": "cisa_kev",
"vendor": "Fortinet",
"product": "FortiSandbox",
"date_added": "2026-07-16",
"description": "Fortinet FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS contain an OS command injection vulnerability that allows an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "fortinet",
"evidence_id": 10791,
"data": {
"cve": "CVE-2026-39808",
"cwes": [
"CWE-78"
],
"name": "Fortinet FortiSandbox OS Command Injection Vulnerability",
"source": "cisa_kev",
"vendor": "Fortinet",
"product": "FortiSandbox",
"date_added": "2026-07-16",
"description": "Fortinet FortiSandbox contains an OS command injection vulnerability that could allow an unauthenticated attacker to execute unauthorized code or commands via crafted HTTP requests.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "fortinet",
"evidence_id": 10791,
"data": {
"cve": "CVE-2025-58034",
"cwes": [
"CWE-78"
],
"name": "Fortinet FortiWeb OS Command Injection Vulnerability",
"source": "cisa_kev",
"vendor": "Fortinet",
"product": "FortiWeb",
"date_added": "2025-11-18",
"description": "Fortinet FortiWeb contains an OS command Injection vulnerability that may allow an authenticated attacker to execute unauthorized code on the underlying system via crafted HTTP requests or CLI commands.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "fortinet",
"evidence_id": 10791,
"data": {
"cve": "CVE-2025-64446",
"cwes": [
"CWE-23"
],
"name": "Fortinet FortiWeb Path Traversal Vulnerability",
"source": "cisa_kev",
"vendor": "Fortinet",
"product": "FortiWeb",
"date_added": "2025-11-14",
"description": "Fortinet FortiWeb contains a relative path traversal vulnerability that may allow an unauthenticated attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "fortinet",
"evidence_id": 10791,
"data": {
"cve": "CVE-2025-25257",
"cwes": [
"CWE-89"
],
"name": "Fortinet FortiWeb SQL Injection Vulnerability",
"source": "cisa_kev",
"vendor": "Fortinet",
"product": "FortiWeb",
"date_added": "2025-07-18",
"description": "Fortinet FortiWeb contains a SQL injection vulnerability that may allow an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "fortinet",
"evidence_id": 10791,
"data": {
"cve": "CVE-2026-24858",
"cwes": [
"CWE-288"
],
"name": "Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability",
"source": "cisa_kev",
"vendor": "Fortinet",
"product": "Multiple Products",
"date_added": "2026-01-27",
"description": "Fortinet FortiAnalyzer, FortiManager, FortiOS, and FortiProxy contain an authentication bypass using an alternate path or channel that could allow an attacker with a FortiCloud account and a registered device to log into other devices registered to other accounts, if FortiCloud SSO authentication is enabled on those devices.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "fortinet",
"evidence_id": 10791,
"data": {
"cve": "CVE-2022-40684",
"cwes": [
"CWE-288"
],
"name": "Fortinet Multiple Products Authentication Bypass Vulnerability",
"source": "cisa_kev",
"vendor": "Fortinet",
"product": "Multiple Products",
"date_added": "2022-10-11",
"description": "Fortinet FortiOS, FortiProxy, and FortiSwitchManager contain an authentication bypass vulnerability that could allow an unauthenticated attacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "fortinet",
"evidence_id": 10791,
"data": {
"cve": "CVE-2024-23113",
"cwes": [
"CWE-134"
],
"name": "Fortinet Multiple Products Format String Vulnerability",
"source": "cisa_kev",
"vendor": "Fortinet",
"product": "Multiple Products",
"date_added": "2024-10-09",
"description": "Fortinet FortiOS, FortiPAM, FortiProxy, and FortiWeb contain a format string vulnerability that allows a remote, unauthenticated attacker to execute arbitrary code or commands via specially crafted requests.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "fortinet",
"evidence_id": 10791,
"data": {
"cve": "CVE-2025-25249",
"cwes": [
"CWE-122",
"CWE-787"
],
"name": "Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability",
"source": "cisa_kev",
"vendor": "Fortinet",
"product": "Multiple Products",
"date_added": "2026-09-09",
"description": "Fortinet FortiOS, FortiSwitchManager, and FortiSASE contain a heap-based buffer overflow vulnerability that allows an attacker to execute unauthorized code or commands via specially crafted packets.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "fortinet",
"evidence_id": 10791,
"data": {
"cve": "CVE-2025-59718",
"cwes": [
"CWE-347"
],
"name": "Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability",
"source": "cisa_kev",
"vendor": "Fortinet",
"product": "Multiple Products",
"date_added": "2025-12-16",
"description": "Fortinet FortiOS, FortiSwitchMaster, FortiProxy, and FortiWeb contain an improper verification of cryptographic signature vulnerability that may allow an unauthenticated attacker to bypass the FortiCloud SSO login authentication via a crafted SAML message. Please be aware that CVE-2025-59719 pertains to the same problem and is mentioned in the same vendor advisory. Ensure to apply all patches mentioned in the advisory.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "fortinet",
"evidence_id": 10791,
"data": {
"cve": "CVE-2025-32756",
"cwes": [
"CWE-124"
],
"name": "Fortinet Multiple Products Stack-Based Buffer Overflow Vulnerability",
"source": "cisa_kev",
"vendor": "Fortinet",
"product": "Multiple Products",
"date_added": "2025-05-14",
"description": "Fortinet FortiFone, FortiVoice, FortiNDR and FortiMail contain a stack-based overflow vulnerability that may allow a remote unauthenticated attacker to execute arbitrary code or commands via crafted HTTP requests.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "gitlab",
"evidence_id": 10791,
"data": {
"cve": "CVE-2023-7028",
"cwes": [
"CWE-284"
],
"name": "GitLab Community and Enterprise Editions Improper Access Control Vulnerability",
"source": "cisa_kev",
"vendor": "GitLab",
"product": "GitLab CE/EE",
"date_added": "2024-05-01",
"description": "GitLab Community and Enterprise Editions contain an improper access control vulnerability. This allows an attacker to trigger password reset emails to be sent to an unverified email address to ultimately facilitate an account takeover.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "gitlab",
"evidence_id": 10791,
"data": {
"cve": "CVE-2021-22205",
"cwes": [
"CWE-20",
"CWE-95"
],
"name": "GitLab Community and Enterprise Editions Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "GitLab",
"product": "Community and Enterprise Editions",
"date_added": "2021-11-03",
"description": "GitHub Community and Enterprise Editions that utilize the ability to upload images through GitLab Workhorse are vulnerable to remote code execution. Workhorse passes image file extensions through ExifTool, which improperly validates the image files.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "gitlab",
"evidence_id": 10791,
"data": {
"cve": "CVE-2021-39935",
"cwes": [
"CWE-918"
],
"name": "GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) Vulnerability",
"source": "cisa_kev",
"vendor": "GitLab",
"product": "Community and Enterprise Editions",
"date_added": "2026-02-03",
"description": "GitLab Community and Enterprise Editions contain a server-side request forgery vulnerability which could allow unauthorized external users to perform Server Side Requests via the CI Lint API.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "gitlab",
"evidence_id": 10791,
"data": {
"cve": "CVE-2026-85706",
"cwes": [
"CWE-35"
],
"name": "GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability",
"source": "cisa_kev",
"vendor": "GitLab",
"product": "Community Edition and Enterprise Edition",
"date_added": "2026-09-11",
"description": "GitLab Community Edition and Enterprise Edition contains a path traversal vulnerability that allows an unauthenticated user to read arbitrary files due to an improper path confinement and missing authentication enforcement in the repository commits API.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "gitlab",
"evidence_id": 10791,
"data": {
"cve": "CVE-2021-22175",
"cwes": [
"CWE-918"
],
"name": "GitLab Server-Side Request Forgery (SSRF) Vulnerability",
"source": "cisa_kev",
"vendor": "GitLab",
"product": "GitLab",
"date_added": "2026-02-18",
"description": "GitLab contains a server-side request forgery (SSRF) vulnerability when requests to the internal network for webhooks are enabled.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "grafana",
"evidence_id": 10791,
"data": {
"cve": "CVE-2021-39226",
"cwes": [
"CWE-287"
],
"name": "Grafana Authentication Bypass Vulnerability",
"source": "cisa_kev",
"vendor": "Grafana Labs",
"product": "Grafana",
"date_added": "2022-08-25",
"description": "Grafana contains an authentication bypass vulnerability that allows authenticated and unauthenticated users to view and delete all snapshot data, potentially resulting in complete snapshot data loss.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "grafana",
"evidence_id": 10791,
"data": {
"cve": "CVE-2021-43798",
"cwes": [
"CWE-22"
],
"name": "Grafana Path Traversal Vulnerability",
"source": "cisa_kev",
"vendor": "Grafana Labs",
"product": "Grafana",
"date_added": "2025-10-09",
"description": "Grafana contains a path traversal vulnerability that could allow access to local files.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "ibm",
"evidence_id": 10791,
"data": {
"cve": "CVE-2022-47986",
"cwes": [
"CWE-502"
],
"name": "IBM Aspera Faspex Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "IBM",
"product": "Aspera Faspex",
"date_added": "2023-02-21",
"description": "IBM Aspera Faspex could allow a remote attacker to execute code on the system, caused by a YAML deserialization flaw.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "ibm",
"evidence_id": 10791,
"data": {
"cve": "CVE-2020-4430",
"cwes": [
"CWE-22"
],
"name": "IBM Data Risk Manager Directory Traversal Vulnerability",
"source": "cisa_kev",
"vendor": "IBM",
"product": "Data Risk Manager",
"date_added": "2021-11-03",
"description": "IBM Data Risk Manager contains a directory traversal vulnerability that could allow a remote authenticated attacker to traverse directories and send a specially crafted URL request to download arbitrary files from the system.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "ibm",
"evidence_id": 10791,
"data": {
"cve": "CVE-2020-4428",
"cwes": [
"CWE-78"
],
"name": "IBM Data Risk Manager Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "IBM",
"product": "Data Risk Manager",
"date_added": "2021-11-03",
"description": "IBM Data Risk Manager contains an unspecified vulnerability which could allow a remote, authenticated attacker to execute commands on the system.�",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "ibm",
"evidence_id": 10791,
"data": {
"cve": "CVE-2020-4427",
"name": "IBM Data Risk Manager Security Bypass Vulnerability",
"source": "cisa_kev",
"vendor": "IBM",
"product": "Data Risk Manager",
"date_added": "2021-11-03",
"description": "IBM Data Risk Manager contains a security bypass vulnerability that could allow a remote attacker to bypass security restrictions when configured with SAML authentication. By sending a specially crafted HTTP request, an attacker could exploit this vulnerability to bypass the authentication process and gain full administrative access to the system.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "ibm",
"evidence_id": 10791,
"data": {
"cve": "CVE-2013-3993",
"cwes": [
"CWE-264"
],
"name": "IBM InfoSphere BigInsights Invalid Input Vulnerability",
"source": "cisa_kev",
"vendor": "IBM",
"product": "InfoSphere BigInsights",
"date_added": "2022-05-25",
"description": "Certain APIs within BigInsights can take invalid input that might allow attackers unauthorized access to read, write, modify, or delete data.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "ibm",
"evidence_id": 10791,
"data": {
"cve": "CVE-2026-9198",
"cwes": [
"CWE-94"
],
"name": "IBM Langflow Code Injection Vulnerability",
"source": "cisa_kev",
"vendor": "IBM",
"product": "Langflow",
"date_added": "2026-08-04",
"description": "Langflow contains a code injection vulnerability that allows unauthenticated attackers to achieve full remote code execution on default Langflow deployments.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "ibm",
"evidence_id": 10791,
"data": {
"cve": "CVE-2019-4716",
"cwes": [
"CWE-94"
],
"name": "IBM Planning Analytics Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "IBM",
"product": "Planning Analytics",
"date_added": "2021-11-03",
"description": "IBM Planning Analytics is vulnerable to a configuration overwrite that allows an unauthenticated user to login as \"admin\", and then execute code as root or SYSTEM via TM1 scripting.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "ibm",
"evidence_id": 10791,
"data": {
"cve": "CVE-2015-7450",
"cwes": [
"CWE-94"
],
"name": "IBM WebSphere Application Server and Server Hypervisor Edition Code Injection.",
"source": "cisa_kev",
"vendor": "IBM",
"product": "WebSphere Application Server and Server Hypervisor Edition",
"date_added": "2022-01-10",
"description": "Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products allow remote attackers to execute arbitrary commands",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "jetbrains",
"evidence_id": 10791,
"data": {
"cve": "CVE-2023-42793",
"cwes": [
"CWE-288"
],
"name": "JetBrains TeamCity Authentication Bypass Vulnerability",
"source": "cisa_kev",
"vendor": "JetBrains",
"product": "TeamCity",
"date_added": "2023-10-04",
"description": "JetBrains TeamCity contains an authentication bypass vulnerability that allows for remote code execution on TeamCity Server.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "jetbrains",
"evidence_id": 10791,
"data": {
"cve": "CVE-2024-27198",
"cwes": [
"CWE-288"
],
"name": "JetBrains TeamCity Authentication Bypass Vulnerability",
"source": "cisa_kev",
"vendor": "JetBrains",
"product": "TeamCity",
"date_added": "2024-03-07",
"description": "JetBrains TeamCity contains an authentication bypass vulnerability that allows an attacker to perform admin actions.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "jetbrains",
"evidence_id": 10791,
"data": {
"cve": "CVE-2026-63077",
"cwes": [
"CWE-502"
],
"name": "JetBrains TeamCity Deserialization of Untrusted Data Vulnerability",
"source": "cisa_kev",
"vendor": "JetBrains",
"product": "TeamCity",
"date_added": "2026-08-05",
"description": "JetBrains TeamCity contains a deserialization of untrusted data vulnerability that could allow unauthenticated remote code execution via the agent polling protocol.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "jetbrains",
"evidence_id": 10791,
"data": {
"cve": "CVE-2024-27199",
"cwes": [
"CWE-23"
],
"name": "JetBrains TeamCity Relative Path Traversal Vulnerability",
"source": "cisa_kev",
"vendor": "JetBrains",
"product": "TeamCity",
"date_added": "2026-04-20",
"description": "JetBrains TeamCity contains a relative path traversal vulnerability that could allow limited admin actions to be performed.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "jfrog",
"evidence_id": 10791,
"data": {
"cve": "CVE-2026-42018",
"cwes": [
"CWE-287"
],
"name": "JFrog Artifactory Improper Authentication Vulnerability",
"source": "cisa_kev",
"vendor": "JFrog",
"product": "Artifactory",
"date_added": "2026-09-11",
"description": "JFrog Artifactory contains an improper authentication vulnerability that could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "jfrog",
"evidence_id": 10791,
"data": {
"cve": "CVE-2026-82329",
"cwes": [
"CWE-287"
],
"name": "JFrog Artifactory Improper Authentication Vulnerability",
"source": "cisa_kev",
"vendor": "JFrog",
"product": "Artifactory",
"date_added": "2026-09-02",
"description": "JFrog Artifactory contains an improper authentication vulnerability that under default configuration can allow an unauthenticated attacker with network access to obtain administrative privileges.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "jfrog",
"evidence_id": 10791,
"data": {
"cve": "CVE-2026-66384",
"cwes": [
"CWE-22"
],
"name": "JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability",
"source": "cisa_kev",
"vendor": "JFrog",
"product": "Artifactory",
"date_added": "2026-08-27",
"description": "JFrog Artifactory contains an improper limitation of a pathname to a restricted directory vulnerability. This can allow an authenticated user to write data outside the intended Docker cache path under specific remote-repository conditions.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "jfrog",
"evidence_id": 10791,
"data": {
"cve": "CVE-2026-42016",
"cwes": [
"CWE-863"
],
"name": "JFrog Artifactory Incorrect Authorization Vulnerability",
"source": "cisa_kev",
"vendor": "JFrog",
"product": "Artifactory",
"date_added": "2026-09-11",
"description": "JFrog Artifactory contains an incorrect authorization vulnerability that leads to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "kaseya",
"evidence_id": 10791,
"data": {
"cve": "CVE-2021-30116",
"cwes": [
"CWE-522"
],
"name": "Kaseya Virtual System/Server Administrator (VSA) Information Disclosure Vulnerability",
"source": "cisa_kev",
"vendor": "Kaseya",
"product": "Virtual System/Server Administrator (VSA)",
"date_added": "2021-11-03",
"description": "Kaseya Virtual System/Server Administrator (VSA) contains an information disclosure vulnerability allowing an attacker to obtain the sessionId that can be used to execute further attacks against the system.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "kaseya",
"evidence_id": 10791,
"data": {
"cve": "CVE-2018-20753",
"name": "Kaseya VSA Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Kaseya",
"product": "Virtual System/Server Administrator (VSA)",
"date_added": "2022-04-13",
"description": "Kaseya VSA RMM allows unprivileged remote attackers to execute PowerShell payloads on all managed devices.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "kaseya",
"evidence_id": 10791,
"data": {
"cve": "CVE-2017-18362",
"cwes": [
"CWE-89"
],
"name": "Kaseya VSA SQL Injection Vulnerability",
"source": "cisa_kev",
"vendor": "Kaseya",
"product": "Virtual System/Server Administrator (VSA)",
"date_added": "2022-05-24",
"description": "ConnectWise ManagedITSync integration for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct access to the Kaseya VSA database.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "lg-electronics",
"evidence_id": 10791,
"data": {
"cve": "CVE-2018-14839",
"cwes": [
"CWE-78"
],
"name": "LG N1A1 NAS Remote Command Execution Vulnerability",
"source": "cisa_kev",
"vendor": "LG",
"product": "N1A1 NAS",
"date_added": "2022-03-25",
"description": "LG N1A1 NAS 3718.510 is affected by a remote code execution vulnerability.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "marimo",
"evidence_id": 10791,
"data": {
"cve": "CVE-2026-39987",
"cwes": [
"CWE-306"
],
"name": "Marimo Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Marimo",
"product": "Marimo",
"date_added": "2026-04-23",
"description": "Marimo contains an pre-authorization remote code execution vulnerability, allowing an unauthenticated attacked to shell access and execute arbitrary system commands.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "meta",
"evidence_id": 10791,
"data": {
"cve": "CVE-2025-55177",
"cwes": [
"CWE-863"
],
"name": "Meta Platforms WhatsApp Incorrect Authorization Vulnerability",
"source": "cisa_kev",
"vendor": "Meta Platforms",
"product": "WhatsApp",
"date_added": "2025-09-02",
"description": "Meta Platforms WhatsApp contains an incorrect authorization vulnerability due to an incomplete authorization of linked device synchronization messages. This vulnerability could allow an unrelated user to trigger processing of content from an arbitrary URL on a target’s device.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "meta",
"evidence_id": 10791,
"data": {
"cve": "CVE-2025-55182",
"name": "Meta React Server Components Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Meta",
"product": "React Server Components",
"date_added": "2025-12-05",
"description": "Meta React Server Components contains a remote code execution vulnerability that could allow unauthenticated remote code execution by exploiting a flaw in how React decodes payloads sent to React Server Function endpoints. Please note CVE-2025-66478 has been rejected, but it is associated with CVE-2025- 55182.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "meta",
"evidence_id": 10791,
"data": {
"cve": "CVE-2019-18426",
"cwes": [
"CWE-79"
],
"name": "WhatsApp Cross-Site Scripting Vulnerability",
"source": "cisa_kev",
"vendor": "Meta Platforms",
"product": "WhatsApp",
"date_added": "2022-05-23",
"description": "A vulnerability in WhatsApp Desktop when paired with WhatsApp for iPhone allows cross-site scripting and local file reading.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "meta",
"evidence_id": 10791,
"data": {
"cve": "CVE-2019-3568",
"cwes": [
"CWE-122"
],
"name": "WhatsApp VOIP Stack Buffer Overflow Vulnerability",
"source": "cisa_kev",
"vendor": "Meta Platforms",
"product": "WhatsApp",
"date_added": "2022-04-19",
"description": "A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of RTCP packets sent to a target phone number.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "metabase",
"evidence_id": 10791,
"data": {
"cve": "CVE-2021-41277",
"cwes": [
"CWE-200"
],
"name": "Metabase GeoJSON API Local File Inclusion Vulnerability",
"source": "cisa_kev",
"vendor": "Metabase",
"product": "Metabase",
"date_added": "2024-11-12",
"description": "Metabase contains a local file inclusion vulnerability in the custom map support in the API to read GeoJSON formatted data.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "metabase",
"evidence_id": 10791,
"data": {
"cve": "CVE-2026-72898",
"cwes": [
"CWE-89"
],
"name": "Metabase SQL Injection Vulnerability",
"source": "cisa_kev",
"vendor": "Metabase",
"product": "Metabase",
"date_added": "2026-08-11",
"description": "Metabase contains a SQL Injection vulnerability that allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, which can give them administrator access to the instance. From there, the attacker could change the application configuration, steal stored credentials for the connected databases, read any data accessible through those connections, and export data.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2024-30051",
"cwes": [
"CWE-122"
],
"name": " Microsoft DWM Core Library Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "DWM Core Library",
"date_added": "2024-05-14",
"description": "Microsoft DWM Core Library contains a privilege escalation vulnerability that allows an attacker to gain SYSTEM privileges.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2025-33053",
"cwes": [
"CWE-73"
],
"name": " Microsoft Windows External Control of File Name or Path Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2025-06-10",
"description": "Microsoft Windows contains an external control of file name or path vulnerability that could allow an attacker to execute code from a remote WebDAV location specified by the WorkingDirectory attribute of Internet Shortcut files.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2008-0015",
"name": " Microsoft Windows Video ActiveX Control Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2026-02-17",
"description": "Microsoft Windows Video ActiveX Control contains a remote code execution vulnerability. An attacker could exploit the vulnerability by constructing a specially crafted Web page. When a user views the Web page, the vulnerability could allow remote code execution. An attacker who successfully exploited this vulnerability could gain the same user rights as the logged-on user.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2023-38180",
"name": "Microsoft .NET Core and Visual Studio Denial-of-Service Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": ".NET Core and Visual Studio",
"date_added": "2023-08-09",
"description": "Microsoft .NET Core and Visual Studio contain an unspecified vulnerability that allows for denial-of-service (DoS).",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2024-29059",
"cwes": [
"CWE-209"
],
"name": "Microsoft .NET Framework Information Disclosure Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": ".NET Framework",
"date_added": "2025-02-04",
"description": "Microsoft .NET Framework contains an information disclosure vulnerability that exposes the ObjRef URI to an attacker, ultimately enabling remote code execution.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2017-8759",
"cwes": [
"CWE-20"
],
"name": "Microsoft .NET Framework Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": ".NET Framework",
"date_added": "2021-11-03",
"description": "Microsoft .NET Framework contains a remote code execution vulnerability when processing untrusted input that could allow an attacker to take control of an affected system.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2020-0646",
"cwes": [
"CWE-91"
],
"name": "Microsoft .NET Framework Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": ".NET Framework",
"date_added": "2021-11-03",
"description": "Microsoft .NET Framework contains an improper input validation vulnerability that allows for remote code execution.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2020-1147",
"name": "Microsoft .NET Framework, SharePoint, and Visual Studio Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": ".NET Framework, SharePoint, Visual Studio",
"date_added": "2021-11-03",
"description": "Microsoft .NET Framework, Microsoft SharePoint, and Visual Studio contain a remote code execution vulnerability when the software fails to check the source markup of XML file input. Successful exploitation allows an attacker to execute code in the context of the process responsible for deserialization of the XML content.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2021-42278",
"cwes": [
"CWE-20"
],
"name": "Microsoft Active Directory Domain Services Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Active Directory",
"date_added": "2022-04-11",
"description": "Microsoft Active Directory Domain Services contains an unspecified vulnerability that allows for privilege escalation.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2021-42287",
"cwes": [
"CWE-269"
],
"name": "Microsoft Active Directory Domain Services Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Active Directory",
"date_added": "2022-04-11",
"description": "Microsoft Active Directory Domain Services contains an unspecified vulnerability that allows for privilege escalation.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2022-26923",
"cwes": [
"CWE-295"
],
"name": "Microsoft Active Directory Domain Services Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Active Directory",
"date_added": "2022-08-18",
"description": "An authenticated user could manipulate attributes on computer accounts they own or manage, and acquire a certificate from Active Directory Certificate Services that would allow for privilege escalation to SYSTEM.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2026-56155",
"cwes": [
"CWE-1220"
],
"name": "Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability ",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Active Directory Federation Services",
"date_added": "2026-07-14",
"description": "Microsoft Active Directory Federation Services contains an insufficient granularity of access control vulnerability that allows an authorized attacker to elevate privileges locally.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2011-2005",
"cwes": [
"CWE-264"
],
"name": "Microsoft Ancillary Function Driver (afd.sys) Improper Input Validation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Ancillary Function Driver (afd.sys)",
"date_added": "2022-03-28",
"description": "afd.sys in the Ancillary Function Driver in Microsoft Windows does not properly validate user-mode input passed to kernel mode, which allows local users to gain privileges via a crafted application.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2015-2387",
"cwes": [
"CWE-264"
],
"name": "Microsoft ATM Font Driver Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "ATM Font Driver",
"date_added": "2022-03-03",
"description": "ATMFD.DLL in the Adobe Type Manager Font Driver in Microsoft Windows Server allows local users to gain privileges via a crafted application.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2018-0824",
"cwes": [
"CWE-502"
],
"name": "Microsoft COM for Windows Deserialization of Untrusted Data Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2024-08-05",
"description": "Microsoft COM for Windows contains a deserialization of untrusted data vulnerability that allows for privilege escalation and remote code execution via a specially crafted file or script.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2024-43468",
"cwes": [
"CWE-89"
],
"name": "Microsoft Configuration Manager SQL Injection Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Configuration Manager",
"date_added": "2026-02-12",
"description": "Microsoft Configuration Manager contains an SQL injection vulnerability. An unauthenticated attacker could exploit this vulnerability by sending specially crafted requests to the target environment which are processed in an unsafe manner enabling the attacker to execute commands on the server and/or underlying database.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2026-45498",
"name": "Microsoft Defender Denial of Service Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Defender",
"date_added": "2026-05-20",
"description": "Microsoft Defender contains an unspecified vulnerability that allows for denial of service.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2026-33825",
"cwes": [
"CWE-1220"
],
"name": "Microsoft Defender Insufficient Granularity of Access Control Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Defender",
"date_added": "2026-04-22",
"description": "Microsoft Defender contains an insufficient granularity of access control vulnerability that could allow an authorized attacker to escalate privileges locally.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2026-41091",
"cwes": [
"CWE-59"
],
"name": "Microsoft Defender Link Following Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Defender",
"date_added": "2026-05-20",
"description": "Microsoft Defender contains a link following vulnerability that allows an authorized attacker to elevate privileges locally.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2021-1647",
"cwes": [
"CWE-122",
"CWE-1285"
],
"name": "Microsoft Defender Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Defender",
"date_added": "2021-11-03",
"description": "Microsoft Defender contains an unspecified vulnerability that allows for remote code execution.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2022-44698",
"cwes": [
"CWE-755"
],
"name": "Microsoft Defender SmartScreen Security Feature Bypass Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Defender",
"date_added": "2022-12-13",
"description": "Microsoft Defender SmartScreen contains a security feature bypass vulnerability that could allow an attacker to evade Mark of the Web (MOTW) defenses via a specially crafted malicious file.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2021-33739",
"name": "Microsoft Desktop Window Manager (DWM) Core Library Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2021-11-03",
"description": "Microsoft Desktop Window Manager (DWM) Core Library contains an unspecified vulnerability that allows for privilege escalation.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2018-8405",
"cwes": [
"CWE-404"
],
"name": "Microsoft DirectX Graphics Kernel Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "DirectX Graphics Kernel (DXGKRNL)",
"date_added": "2022-03-28",
"description": "An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2018-8406",
"cwes": [
"CWE-404"
],
"name": "Microsoft DirectX Graphics Kernel Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "DirectX Graphics Kernel (DXGKRNL)",
"date_added": "2022-03-28",
"description": "An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2009-1537",
"name": "Microsoft DirectX NULL Byte Overwrite Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "DirectX",
"date_added": "2026-05-20",
"description": "Microsoft DirectX contains a NULL byte overwrite vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow which could allow remote attackers to execute arbitrary code via a crafted QuickTime media file.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2020-0878",
"cwes": [
"CWE-787"
],
"name": "Microsoft Edge and Internet Explorer Memory Corruption Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Edge and Internet Explorer",
"date_added": "2021-11-03",
"description": "Microsoft Edge and Internet Explorer contain a memory corruption vulnerability that allows attackers to execute code in the context of the current user.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2017-0037",
"cwes": [
"CWE-704"
],
"name": "Microsoft Edge and Internet Explorer Type Confusion Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Edge and Internet Explorer",
"date_added": "2022-03-28",
"description": "Microsoft Edge and Internet Explorer have a type confusion vulnerability in mshtml.dll, which allows remote code execution.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2016-7200",
"cwes": [
"CWE-119"
],
"name": "Microsoft Edge Memory Corruption Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Edge",
"date_added": "2022-03-28",
"description": "The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute remote code or cause a denial of service (memory corruption) via a crafted web site.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2016-7201",
"cwes": [
"CWE-119"
],
"name": "Microsoft Edge Memory Corruption Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Edge",
"date_added": "2022-03-28",
"description": "The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute remote code or cause a denial of service (memory corruption) via a crafted web site.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2021-31199",
"name": "Microsoft Enhanced Cryptographic Provider Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Enhanced Cryptographic Provider",
"date_added": "2021-11-03",
"description": "Microsoft Enhanced Cryptographic Provider contains an unspecified vulnerability that allows for privilege escalation.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2021-31201",
"name": "Microsoft Enhanced Cryptographic Provider Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Enhanced Cryptographic Provider",
"date_added": "2021-11-03",
"description": "Microsoft Enhanced Cryptographic Provider contains an unspecified vulnerability that allows for privilege escalation.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2009-3129",
"cwes": [
"CWE-94"
],
"name": "Microsoft Excel Featheader Record Memory Corruption Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Excel",
"date_added": "2022-03-03",
"description": "Microsoft Office Excel allows remote attackers to execute arbitrary code via a spreadsheet with a FEATHEADER record containing an invalid cbHdrData size element that affects a pointer offset.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2019-1297",
"name": "Microsoft Excel Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Excel",
"date_added": "2022-03-03",
"description": "A remote code execution vulnerability exists in Microsoft Excel when the software fails to properly handle objects in memory.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2021-42292",
"cwes": [
"CWE-357"
],
"name": "Microsoft Excel Security Feature Bypass",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Office",
"date_added": "2021-11-17",
"description": "A security feature bypass vulnerability in Microsoft Excel would allow a local user to perform arbitrary code execution.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2026-42897",
"cwes": [
"CWE-79"
],
"name": "Microsoft Exchange Server Cross-Site Scripting Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Microsoft",
"date_added": "2026-05-15",
"description": "Microsoft Exchange Server contains a cross-site scripting vulnerability during web page generation in Outlook Web Access and when certain interaction conditions are met, arbitrary JavaScript can be executed in the browser context.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2023-21529",
"cwes": [
"CWE-502"
],
"name": "Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Exchange Server",
"date_added": "2026-04-13",
"description": "Microsoft Exchange Server contains a deserialization of untrusted data that allows an authenticated attacker to achieve remote code execution.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2021-33766",
"cwes": [
"CWE-287"
],
"name": "Microsoft Exchange Server Information Disclosure",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Exchange Server",
"date_added": "2022-01-18",
"description": "Microsoft Exchange Server contains an information disclosure vulnerability which can allow an unauthenticated attacker to steal email traffic from target.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2021-31196",
"name": "Microsoft Exchange Server Information Disclosure Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Exchange Server",
"date_added": "2024-08-21",
"description": "Microsoft Exchange Server contains an information disclosure vulnerability that allows for remote code execution.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2018-8581",
"name": "Microsoft Exchange Server Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Exchange Server",
"date_added": "2022-03-03",
"description": "A privilege escalation vulnerability exists in Microsoft Exchange Server. An attacker who successfully exploited this vulnerability could attempt to impersonate any other user of the Exchange server.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2021-34523",
"cwes": [
"CWE-287"
],
"name": "Microsoft Exchange Server Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Exchange Server",
"date_added": "2021-11-03",
"description": "Microsoft Exchange Server contains an unspecified vulnerability that allows for privilege escalation.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2022-41080",
"name": "Microsoft Exchange Server Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Exchange Server",
"date_added": "2023-01-10",
"description": "Microsoft Exchange Server contains an unspecified vulnerability that allows for privilege escalation. This vulnerability is chainable with CVE-2022-41082, which allows for remote code execution.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2024-21410",
"cwes": [
"CWE-287"
],
"name": "Microsoft Exchange Server Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Exchange Server",
"date_added": "2024-02-15",
"description": "Microsoft Exchange Server contains an unspecified vulnerability that allows for privilege escalation.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2020-17144",
"cwes": [
"CWE-502"
],
"name": "Microsoft Exchange Server Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Exchange Server",
"date_added": "2021-11-03",
"description": "Microsoft Exchange Server improperly validates cmdlet arguments which allow an attacker to perform remote code execution.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2021-26855",
"cwes": [
"CWE-918"
],
"name": "Microsoft Exchange Server Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Exchange Server",
"date_added": "2021-11-03",
"description": "Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2021-26857",
"cwes": [
"CWE-502"
],
"name": "Microsoft Exchange Server Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Exchange Server",
"date_added": "2021-11-03",
"description": "Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2021-26858",
"name": "Microsoft Exchange Server Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Exchange Server",
"date_added": "2021-11-03",
"description": "Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2021-27065",
"cwes": [
"CWE-39"
],
"name": "Microsoft Exchange Server Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Exchange Server",
"date_added": "2021-11-03",
"description": "Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2021-34473",
"cwes": [
"CWE-918"
],
"name": "Microsoft Exchange Server Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Exchange Server",
"date_added": "2021-11-03",
"description": "Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2021-42321",
"cwes": [
"CWE-184",
"CWE-502"
],
"name": "Microsoft Exchange Server Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Exchange",
"date_added": "2021-11-17",
"description": "An authenticated attacker could leverage improper validation in cmdlet arguments within Microsoft Exchange and perform remote code execution.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2022-41082",
"cwes": [
"CWE-502"
],
"name": "Microsoft Exchange Server Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Exchange Server",
"date_added": "2022-09-30",
"description": "Microsoft Exchange Server contains an unspecified vulnerability that allows for authenticated remote code execution. Dubbed \"ProxyNotShell,\" this vulnerability is chainable with CVE-2022-41040 which allows for the remote code execution.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2021-31207",
"cwes": [
"CWE-20",
"CWE-434"
],
"name": "Microsoft Exchange Server Security Feature Bypass Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Exchange Server",
"date_added": "2021-11-03",
"description": "Microsoft Exchange Server contains an unspecified vulnerability that allows for security feature bypass.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2022-41040",
"cwes": [
"CWE-918"
],
"name": "Microsoft Exchange Server Server-Side Request Forgery Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Exchange Server",
"date_added": "2022-09-30",
"description": "Microsoft Exchange Server allows for server-side request forgery. Dubbed \"ProxyNotShell,\" this vulnerability is chainable with CVE-2022-41082 which allows for remote code execution.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2020-0688",
"cwes": [
"CWE-287"
],
"name": "Microsoft Exchange Server Validation Key Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Exchange Server",
"date_added": "2021-11-03",
"description": "Microsoft Exchange Server Validation Key fails to properly create unique keys at install time, allowing for remote code execution.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2011-1889",
"cwes": [
"CWE-119"
],
"name": "Microsoft Forefront TMG Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Forefront Threat Management Gateway (TMG)",
"date_added": "2022-03-03",
"description": "A remote code execution vulnerability exists in the Forefront Threat Management Gateway (TMG) Firewall Client Winsock provider that could allow code execution in the security context of the client application.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2019-0903",
"name": "Microsoft GDI Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Graphics Device Interface (GDI)",
"date_added": "2022-03-25",
"description": "A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory. An attacker who successfully exploited this vulnerability could take control of the affected system.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2013-3906",
"cwes": [
"CWE-94"
],
"name": "Microsoft Graphics Component Memory Corruption Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Graphics Component",
"date_added": "2022-02-15",
"description": "Microsoft Graphics Component contains a memory corruption vulnerability which can allow for remote code execution.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2017-0001",
"name": "Microsoft Graphics Device Interface (GDI) Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Graphics Device Interface (GDI)",
"date_added": "2022-03-03",
"description": "The Graphics Device Interface (GDI) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607 allows local users to gain privileges",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2021-31166",
"cwes": [
"CWE-416"
],
"name": "Microsoft HTTP Protocol Stack Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "HTTP Protocol Stack",
"date_added": "2022-04-06",
"description": "Microsoft HTTP Protocol Stack contains a vulnerability in http.sys that allows for remote code execution.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2015-1635",
"cwes": [
"CWE-94"
],
"name": "Microsoft HTTP.sys Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "HTTP.sys",
"date_added": "2022-02-10",
"description": "Microsoft HTTP protocol stack (HTTP.sys) contains a vulnerability that allows for remote code execution.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2020-1040",
"cwes": [
"CWE-20"
],
"name": "Microsoft Hyper-V RemoteFX vGPU Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Hyper-V RemoteFX",
"date_added": "2021-11-03",
"description": "Microsoft Hyper-V RemoteFX vGPU contains an improper input validation vulnerability due to the host server failing to properly validate input from an authenticated user on a guest operating system. Successful exploitation allows for remote code execution on the host operating system.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2014-4077",
"cwes": [
"CWE-264"
],
"name": "Microsoft IME Japanese Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Input Method Editor (IME) Japanese",
"date_added": "2022-05-25",
"description": "Microsoft Input Method Editor (IME) Japanese is a keyboard with Japanese characters that can be enabled on Windows systems as it is included by default (with the default set as disabled). IME Japanese contains an unspecified vulnerability when IMJPDCT.EXE (IME for Japanese) is installed which allows attackers to bypass a sandbox and perform privilege escalation.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2016-3351",
"cwes": [
"CWE-200"
],
"name": "Microsoft Internet Explorer and Edge Information Disclosure Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Internet Explorer and Edge",
"date_added": "2022-05-24",
"description": "An information disclosure vulnerability exists in the way that certain functions in Internet Explorer and Edge handle objects in memory. The vulnerability could allow an attacker to detect specific files on the user's computer.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2015-0071",
"cwes": [
"CWE-264"
],
"name": "Microsoft Internet Explorer ASLR Bypass Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Internet Explorer",
"date_added": "2022-05-25",
"description": "Microsoft Internet Explorer allows remote attackers to bypass the address space layout randomization (ASLR) protection mechanism via a crafted web site.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2013-7331",
"cwes": [
"CWE-200"
],
"name": "Microsoft Internet Explorer Information Disclosure Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Internet Explorer",
"date_added": "2022-05-25",
"description": "An information disclosure vulnerability exists in Internet Explorer which allows resources loaded into memory to be queried. This vulnerability could allow an attacker to detect anti-malware applications.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2016-0162",
"cwes": [
"CWE-200"
],
"name": "Microsoft Internet Explorer Information Disclosure Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Internet Explorer",
"date_added": "2022-05-24",
"description": "An information disclosure vulnerability exists when Internet Explorer does not properly handle JavaScript. The vulnerability could allow an attacker to detect specific files on the user's computer.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2017-0059",
"cwes": [
"CWE-200"
],
"name": "Microsoft Internet Explorer Information Disclosure Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Internet Explorer",
"date_added": "2022-03-28",
"description": "Microsoft Internet Explorer allow remote attackers to obtain sensitive information from process memory via a crafted web site.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2019-0676",
"name": "Microsoft Internet Explorer Information Disclosure Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Internet Explorer",
"date_added": "2022-05-23",
"description": "An information disclosure vulnerability exists when Internet Explorer improperly handles objects in memory. An attacker who successfully exploited this vulnerability could test for the presence of files on disk.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2013-3163",
"cwes": [
"CWE-94"
],
"name": "Microsoft Internet Explorer Memory Corruption Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Internet Explorer",
"date_added": "2023-03-30",
"description": "Microsoft Internet Explorer contains a memory corruption vulnerability that allows remote attackers to execute code or cause a denial of service via a crafted website.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2014-1776",
"cwes": [
"CWE-416"
],
"name": "Microsoft Internet Explorer Memory Corruption Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Internet Explorer",
"date_added": "2022-01-28",
"description": "Microsoft Internet Explorer contains a memory corruption vulnerability that allows remote attackers to execute code in the context of the current user.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2015-2419",
"cwes": [
"CWE-119"
],
"name": "Microsoft Internet Explorer Memory Corruption Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Internet Explorer",
"date_added": "2022-03-28",
"description": "JScript in Microsoft Internet Explorer allows remote attackers to execute remote code or cause a denial of service (memory corruption) via a crafted web site.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2015-2425",
"cwes": [
"CWE-119"
],
"name": "Microsoft Internet Explorer Memory Corruption Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Internet Explorer",
"date_added": "2022-05-25",
"description": "Microsoft Internet Explorer contains a memory corruption vulnerability that allows remote attackers to execute code or cause denial-of-service (DoS).",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2015-2502",
"cwes": [
"CWE-119"
],
"name": "Microsoft Internet Explorer Memory Corruption Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Internet Explorer",
"date_added": "2022-04-13",
"description": "Microsoft Internet Explorer contains a memory corruption vulnerability that allows an attacker to execute code or cause a denial-of-service (DoS).",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2016-0189",
"cwes": [
"CWE-119"
],
"name": "Microsoft Internet Explorer Memory Corruption Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Internet Explorer",
"date_added": "2022-03-28",
"description": "The Microsoft JScript nd VBScript engines, as used in Internet Explorer and other products, allow attackers to execute remote code or cause a denial of service (memory corruption) via a crafted web site.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2017-0149",
"cwes": [
"CWE-119"
],
"name": "Microsoft Internet Explorer Memory Corruption Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Internet Explorer",
"date_added": "2022-05-24",
"description": "Microsoft Internet Explorer contains a memory corruption vulnerability that allows remote attackers to execute code or cause a denial-of-service (DoS) via a crafted website.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2021-26411",
"cwes": [
"CWE-416"
],
"name": "Microsoft Internet Explorer Memory Corruption Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Internet Explorer",
"date_added": "2021-11-03",
"description": "Microsoft Internet Explorer contains an unspecified vulnerability that allows for memory corruption.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2016-3298",
"cwes": [
"CWE-200"
],
"name": "Microsoft Internet Explorer Messaging API Information Disclosure Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Internet Explorer",
"date_added": "2022-05-24",
"description": "An information disclosure vulnerability exists when the Microsoft Internet Messaging API improperly handles objects in memory. An attacker who successfully exploited this vulnerability could allow the attacker to test for the presence of files on disk.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2014-2817",
"cwes": [
"CWE-264"
],
"name": "Microsoft Internet Explorer Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Internet Explorer",
"date_added": "2022-05-25",
"description": "Microsoft Internet Explorer cotains an unspecified vulnerability that allows remote attackers to gain privileges via a crafted web site.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2014-4123",
"cwes": [
"CWE-264"
],
"name": "Microsoft Internet Explorer Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Internet Explorer",
"date_added": "2022-05-25",
"description": "Microsoft Internet Explorer contains an unspecified vulnerability that allows remote attackers to gain privileges via a crafted web site.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2017-0210",
"name": "Microsoft Internet Explorer Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Internet Explorer",
"date_added": "2022-05-24",
"description": "A privilege escalation vulnerability exists when Internet Explorer does not properly enforce cross-domain policies, which could allow an attacker to access information.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2013-1347",
"cwes": [
"CWE-94"
],
"name": "Microsoft Internet Explorer Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Internet Explorer",
"date_added": "2022-03-03",
"description": "This vulnerability may corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user within Internet Explorer.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2017-0222",
"cwes": [
"CWE-119"
],
"name": "Microsoft Internet Explorer Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Internet Explorer",
"date_added": "2022-02-25",
"description": "A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2021-27085",
"name": "Microsoft Internet Explorer Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Internet Explorer",
"date_added": "2021-11-03",
"description": "Microsoft Internet Explorer contains an unspecified vulnerability that allows for remote code execution.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2013-3893",
"cwes": [
"CWE-399"
],
"name": "Microsoft Internet Explorer Resource Management Errors Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Internet Explorer",
"date_added": "2025-08-12",
"description": "Microsoft Internet Explorer contains a memory corruption vulnerability that allows for remote code execution. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2018-8653",
"cwes": [
"CWE-787"
],
"name": "Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Internet Explorer",
"date_added": "2021-11-03",
"description": "Microsoft Internet Explorer contains a memory corruption vulnerability due to how the Scripting Engine handles objects in memory, leading to remote code execution.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2019-1367",
"cwes": [
"CWE-787"
],
"name": "Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Internet Explorer",
"date_added": "2021-11-03",
"description": "Microsoft Internet Explorer contains a memory corruption vulnerability in how the scripting engine handles objects in memory. Successful exploitation allows for remote code execution in the context of the current user.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2019-1429",
"cwes": [
"CWE-416",
"CWE-787"
],
"name": "Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Internet Explorer",
"date_added": "2021-11-03",
"description": "Microsoft Internet Explorer contains a memory corruption vulnerability which can allow for remote code execution in the context of the current user.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2020-0674",
"cwes": [
"CWE-416"
],
"name": "Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Internet Explorer",
"date_added": "2021-11-03",
"description": "Microsoft Internet Explorer contains a memory corruption vulnerability due to the way the Scripting Engine handles objects in memory. Successful exploitation could allow remote code execution in the context of the current user.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2020-0968",
"cwes": [
"CWE-787"
],
"name": "Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Internet Explorer",
"date_added": "2021-11-03",
"description": "Microsoft Internet Explorer contains a memory corruption vulnerability due to how the Scripting Engine handles objects in memory, leading to remote code execution.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2020-1380",
"cwes": [
"CWE-787"
],
"name": "Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Internet Explorer",
"date_added": "2021-11-03",
"description": "Microsoft Internet Explorer contains a memory corruption vulnerability which can allow for remote code execution in the context of the current user.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2019-0752",
"cwes": [
"CWE-843"
],
"name": "Microsoft Internet Explorer Type Confusion Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Internet Explorer",
"date_added": "2022-02-15",
"description": "A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2010-3962",
"name": "Microsoft Internet Explorer Uninitialized Memory Corruption Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Internet Explorer",
"date_added": "2025-10-06",
"description": "Microsoft Internet Explorer contains an uninitialized memory corruption vulnerability that could allow for remote code execution. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2010-0249",
"cwes": [
"CWE-416"
],
"name": "Microsoft Internet Explorer Use-After-Free Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Internet Explorer",
"date_added": "2026-05-20",
"description": "Microsoft Internet Explorer contains an use-after-free vulnerability that could allow remote attackers to execute arbitrary code by accessing a pointer associated with a deleted object. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2010-0806",
"cwes": [
"CWE-399"
],
"name": "Microsoft Internet Explorer Use-After-Free Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Internet Explorer",
"date_added": "2026-05-20",
"description": "Microsoft Internet Explorer contains an use-after-free vulnerability that could allow remote attackers to execute arbitrary code via vectors involving access to an invalid pointer after the deletion of an object. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2012-4792",
"cwes": [
"CWE-416"
],
"name": "Microsoft Internet Explorer Use-After-Free Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Internet Explorer",
"date_added": "2024-07-23",
"description": "Microsoft Internet Explorer contains a use-after-free vulnerability that allows a remote attacker to execute arbitrary code via a crafted web site that triggers access to an object that (1) was not properly allocated or (2) is deleted, as demonstrated by a CDwnBindInfo object.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2012-4969",
"name": "Microsoft Internet Explorer Use-After-Free Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Internet Explorer",
"date_added": "2022-06-08",
"description": "Microsoft Internet Explorer contains a use-after-free vulnerability that allows remote attackers to execute code via a crafted web site.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2013-2551",
"cwes": [
"CWE-416"
],
"name": "Microsoft Internet Explorer Use-After-Free Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Internet Explorer",
"date_added": "2022-03-28",
"description": "Use-after-free vulnerability in Microsoft Internet Explorer allows remote attackers to execute remote code via a crafted web site that triggers access to a deleted object.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2013-3897",
"cwes": [
"CWE-399"
],
"name": "Microsoft Internet Explorer Use-After-Free Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Internet Explorer",
"date_added": "2022-03-03",
"description": "A use-after-free vulnerability exists within CDisplayPointer in Microsoft Internet Explorer that allows an attacker to remotely execute arbitrary code.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2014-0322",
"cwes": [
"CWE-416"
],
"name": "Microsoft Internet Explorer Use-After-Free Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Internet Explorer",
"date_added": "2022-05-04",
"description": "Use-after-free vulnerability in Microsoft Internet Explorer allows remote attackers to execute code.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2026-33824",
"cwes": [
"CWE-415"
],
"name": "Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Internet Key Exchange (IKE) Service Extensions",
"date_added": "2026-08-18",
"description": "Microsoft Internet Key Exchange (IKE) Service Extensions contains a double free vulnerability that could enable remote code execution.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2014-6324",
"cwes": [
"CWE-264"
],
"name": "Microsoft Kerberos Key Distribution Center (KDC) Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Kerberos Key Distribution Center (KDC)",
"date_added": "2022-03-25",
"description": "The Kerberos Key Distribution Center (KDC) in Microsoft allows remote authenticated domain users to obtain domain administrator privileges.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2017-8540",
"cwes": [
"CWE-119"
],
"name": "Microsoft Malware Protection Engine Improper Restriction of Operations Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Malware Protection Engine",
"date_added": "2022-03-03",
"description": "The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016, Microsoft Exchange Server 2013 and 2016, does not properly scan a specially crafted file leading to memory corruption. aka \"Microsoft Malware Protection Engine Remote Code Execution Vulnerability\".",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2012-0158",
"cwes": [
"CWE-94"
],
"name": "Microsoft MSCOMCTL.OCX Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "MSCOMCTL.OCX",
"date_added": "2021-11-03",
"description": "Microsoft MSCOMCTL.OCX contains an unspecified vulnerability that allows for remote code execution, allowing an attacker to take complete control of an affected system under the context of the current user.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2026-21513",
"cwes": [
"CWE-693"
],
"name": "Microsoft MSHTML Framework Protection Mechanism Failure Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2026-02-10",
"description": "Microsoft MSHTML Framework contains a protection mechanism failure vulnerability that could allow an unauthorized attacker to bypass a security feature over a network.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2019-0541",
"cwes": [
"CWE-77"
],
"name": "Microsoft MSHTML Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "MSHTML",
"date_added": "2021-11-03",
"description": "Microsoft MSHTML engine contains an improper input validation vulnerability that allows for remote code execution vulnerability.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2021-40444",
"cwes": [
"CWE-22"
],
"name": "Microsoft MSHTML Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "MSHTML",
"date_added": "2021-11-03",
"description": "Microsoft MSHTML contains a unspecified vulnerability that allows for remote code execution.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2020-1472",
"cwes": [
"CWE-330"
],
"name": "Microsoft Netlogon Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Netlogon",
"date_added": "2021-11-03",
"description": "Microsoft's Netlogon Remote Protocol (MS-NRPC) contains a privilege escalation vulnerability when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller. An attacker who successfully exploits the vulnerability could run a specially crafted application on a device on the network. The vulnerability is also known under the moniker of Zerologon.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2021-38646",
"name": "Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Office",
"date_added": "2022-03-28",
"description": "Microsoft Office Access Connectivity Engine contains an unspecified vulnerability which can allow for remote code execution.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2017-0199",
"name": "Microsoft Office and WordPad Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Office and WordPad",
"date_added": "2021-11-03",
"description": "Microsoft Office and WordPad contain an unspecified vulnerability due to the way the applications parse specially crafted files. Successful exploitation allows for remote code execution.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2009-0563",
"cwes": [
"CWE-119"
],
"name": "Microsoft Office Buffer Overflow Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Office",
"date_added": "2022-06-08",
"description": "Microsoft Office contains a buffer overflow vulnerability that allows remote attackers to execute code via a Word document with a crafted tag containing an invalid length field.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2013-1331",
"cwes": [
"CWE-119"
],
"name": "Microsoft Office Buffer Overflow Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Office",
"date_added": "2022-06-08",
"description": "Microsoft Office contains a buffer overflow vulnerability that allows remote attackers to execute code via crafted PNG data in an Office document.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2007-0671",
"name": "Microsoft Office Excel Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Office",
"date_added": "2025-08-12",
"description": "Microsoft Office Excel contains a remote code execution vulnerability that can be exploited when a specially crafted Excel file is opened. This malicious file could be delivered as an email attachment or hosted on a malicious website. An attacker could leverage this vulnerability by creating a specially crafted Excel file, which, when opened, allowing an attacker to execute remote code on the affected system.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2015-2545",
"cwes": [
"CWE-20"
],
"name": "Microsoft Office Malformed EPS File Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Office",
"date_added": "2022-03-03",
"description": "Microsoft Office allows remote attackers to execute arbitrary code via a crafted EPS image.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2015-1641",
"cwes": [
"CWE-399"
],
"name": "Microsoft Office Memory Corruption Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Office",
"date_added": "2021-11-03",
"description": "Microsoft Office contains a memory corruption vulnerability due to failure to properly handle rich text format files in memory. Successful exploitation allows for remote code execution in the context of the current user.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2015-1642",
"cwes": [
"CWE-119"
],
"name": "Microsoft Office Memory Corruption Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Office",
"date_added": "2022-03-03",
"description": "Microsoft Office contains a memory corruption vulnerability that allows remote attackers to execute arbitrary code via a crafted document.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2016-7193",
"cwes": [
"CWE-119"
],
"name": "Microsoft Office Memory Corruption Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Office",
"date_added": "2022-03-03",
"description": "Microsoft Office contains a memory corruption vulnerability which can allow for remote code execution.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2017-11882",
"cwes": [
"CWE-119"
],
"name": "Microsoft Office Memory Corruption Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Office",
"date_added": "2021-11-03",
"description": "Microsoft Office contains a memory corruption vulnerability that allows remote code execution in the context of the current user.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2018-0798",
"cwes": [
"CWE-787"
],
"name": "Microsoft Office Memory Corruption Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Office",
"date_added": "2021-11-03",
"description": "Microsoft Office contains a memory corruption vulnerability due to the way objects are handled in memory. Successful exploitation allows for remote code execution in the context of the current user. This vulnerability is known to be chained with CVE-2018-0802.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2018-0802",
"cwes": [
"CWE-787"
],
"name": "Microsoft Office Memory Corruption Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Office",
"date_added": "2021-11-03",
"description": "Microsoft Office contains a memory corruption vulnerability due to the way objects are handled in memory. Successful exploitation allows for remote code execution in the context of the current user. This vulnerability is known to be chained with CVE-2018-0798.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2012-1856",
"cwes": [
"CWE-94"
],
"name": "Microsoft Office MSCOMCTL.OCX Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Office",
"date_added": "2022-03-03",
"description": "The TabStrip ActiveX control in the Common Controls in MSCOMCTL.OCX in Microsoft Office allows remote attackers to execute arbitrary code via a crafted (1) document or (2) web page that triggers system-state corruption.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2009-0557",
"cwes": [
"CWE-94"
],
"name": "Microsoft Office Object Record Corruption Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Office",
"date_added": "2022-06-08",
"description": "Microsoft Office contains an object record corruption vulnerability that allows remote attackers to execute code via a crafted Excel file with a malformed record object.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2016-3235",
"cwes": [
"CWE-264"
],
"name": "Microsoft Office OLE DLL Side Loading Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Office",
"date_added": "2021-11-03",
"description": "Microsoft Office Object Linking & Embedding (OLE) dynamic link library (DLL) contains a side loading vulnerability due to it improperly validating input before loading libraries. Successful exploitation allows for remote code execution.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2023-23397",
"cwes": [
"CWE-294"
],
"name": "Microsoft Office Outlook Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Office",
"date_added": "2023-03-14",
"description": "Microsoft Office Outlook contains a privilege escalation vulnerability that allows for a NTLM Relay attack against another service to authenticate as the user.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2017-11774",
"cwes": [
"CWE-119"
],
"name": "Microsoft Office Outlook Security Feature Bypass Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Office",
"date_added": "2021-11-03",
"description": "Microsoft Office Outlook contains a security feature bypass vulnerability due to improperly handling objects in memory. Successful exploitation allows an attacker to execute commands.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2009-0556",
"cwes": [
"CWE-94"
],
"name": "Microsoft Office PowerPoint Code Injection Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Office",
"date_added": "2026-01-07",
"description": "Microsoft Office PowerPoint contains a code injection vulnerability that allows remote attackers to execute arbitrary code via a PowerPoint file with an OutlineTextRefAtom containing an invalid index value that triggers memory corruption.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2023-21715",
"cwes": [
"CWE-863"
],
"name": "Microsoft Office Publisher Security Feature Bypass Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Office",
"date_added": "2023-02-14",
"description": "Microsoft Office Publisher contains a security feature bypass vulnerability that allows for a local, authenticated attack on a targeted system.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2009-0238",
"cwes": [
"CWE-94"
],
"name": "Microsoft Office Remote Code Execution",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Office",
"date_added": "2026-04-14",
"description": "Microsoft Office Excel contains a remote code execution vulnerability that could allow an attacker to take complete control of an affected system if a user opens a specially crafted Excel file that includes a malformed object.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2017-0262",
"name": "Microsoft Office Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Office",
"date_added": "2022-02-10",
"description": "A remote code execution vulnerability exists in Microsoft Office.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2017-11826",
"cwes": [
"CWE-119"
],
"name": "Microsoft Office Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Office",
"date_added": "2022-03-03",
"description": "A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2017-8570",
"name": "Microsoft Office Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Office",
"date_added": "2022-02-25",
"description": "A remote code execution vulnerability exists in Microsoft Office software when it fails to properly handle objects in memory.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2021-27059",
"name": "Microsoft Office Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Office",
"date_added": "2021-11-03",
"description": "Microsoft Office contains an unspecified vulnerability that allows for remote code execution.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2016-7262",
"cwes": [
"CWE-20"
],
"name": "Microsoft Office Security Feature Bypass Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Excel",
"date_added": "2022-03-03",
"description": "A security feature bypass vulnerability exists when Microsoft Office improperly handles input. An attacker who successfully exploited the vulnerability could execute arbitrary commands.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2026-21509",
"cwes": [
"CWE-807"
],
"name": "Microsoft Office Security Feature Bypass Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Office",
"date_added": "2026-01-26",
"description": "Microsoft Office contains a security feature bypass vulnerability in which reliance on untrusted inputs in a security decision in Microsoft Office could allow an unauthorized attacker to bypass a security feature locally. Some of the impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2010-3333",
"cwes": [
"CWE-119"
],
"name": "Microsoft Office Stack-based Buffer Overflow Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Office",
"date_added": "2022-03-03",
"description": "A stack-based buffer overflow vulnerability exists in the parsing of RTF data in Microsoft Office and earlier allows an attacker to perform remote code execution.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2015-1770",
"cwes": [
"CWE-19"
],
"name": "Microsoft Office Uninitialized Memory Use Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Office",
"date_added": "2022-03-28",
"description": "Microsoft Office allows remote attackers to execute arbitrary code via a crafted Office document.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2017-0261",
"cwes": [
"CWE-416"
],
"name": "Microsoft Office Use-After-Free Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Office",
"date_added": "2022-03-03",
"description": "Microsoft Office contains a use-after-free vulnerability which can allow for remote code execution.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2026-21514",
"cwes": [
"CWE-807"
],
"name": "Microsoft Office Word Reliance on Untrusted Inputs in a Security Decision Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Office",
"date_added": "2026-02-10",
"description": "Microsoft Office Word contains a reliance on untrusted inputs in a security decision vulnerability that could allow an authorized attacker to elevate privileges locally.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2021-38645",
"name": "Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Open Management Infrastructure (OMI)",
"date_added": "2021-11-03",
"description": "Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an unspecified vulnerability that allows for privilege escalation.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2021-38648",
"cwes": [
"CWE-1390"
],
"name": "Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Open Management Infrastructure (OMI)",
"date_added": "2021-11-03",
"description": "Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an unspecified vulnerability allowing privilege escalation.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2021-38649",
"name": "Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Open Management Infrastructure (OMI)",
"date_added": "2021-11-03",
"description": "Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an unspecified vulnerability allowing privilege escalation.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2021-38647",
"cwes": [
"CWE-1390"
],
"name": "Microsoft Open Management Infrastructure (OMI) Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Open Management Infrastructure (OMI)",
"date_added": "2021-11-03",
"description": "Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an unspecified vulnerability allowing remote code execution.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2024-21413",
"cwes": [
"CWE-20"
],
"name": "Microsoft Outlook Improper Input Validation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Office Outlook",
"date_added": "2025-02-06",
"description": "Microsoft Outlook contains an improper input validation vulnerability that allows for remote code execution. Successful exploitation of this vulnerability would allow an attacker to bypass the Office Protected View and open in editing mode rather than protected mode.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2023-35311",
"cwes": [
"CWE-367"
],
"name": "Microsoft Outlook Security Feature Bypass Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Outlook",
"date_added": "2023-07-11",
"description": "Microsoft Outlook contains a security feature bypass vulnerability that allows an attacker to bypass the Microsoft Outlook Security Notice prompt.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2024-49035",
"cwes": [
"CWE-269"
],
"name": "Microsoft Partner Center Improper Access Control Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Partner Center",
"date_added": "2025-02-25",
"description": "Microsoft Partner Center contains an improper access control vulnerability that allows an attacker to escalate privileges.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2025-24989",
"cwes": [
"CWE-284"
],
"name": "Microsoft Power Pages Improper Access Control Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Power Pages",
"date_added": "2025-02-21",
"description": "Microsoft Power Pages contains an improper access control vulnerability that allows an unauthorized attacker to elevate privileges over a network potentially bypassing the user registration control.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2010-2572",
"cwes": [
"CWE-119"
],
"name": "Microsoft PowerPoint Buffer Overflow Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "PowerPoint",
"date_added": "2022-06-08",
"description": "Microsoft PowerPoint contains a buffer overflow vulnerability that alllows for remote code execution.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2015-2424",
"cwes": [
"CWE-119"
],
"name": "Microsoft PowerPoint Memory Corruption Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "PowerPoint",
"date_added": "2022-03-03",
"description": "Microsoft PowerPoint allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2024-38189",
"cwes": [
"CWE-20"
],
"name": "Microsoft Project Remote Code Execution Vulnerability ",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Project",
"date_added": "2024-08-13",
"description": "Microsoft Project contains an unspecified vulnerability that allows for remote code execution via a malicious file.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2024-38226",
"cwes": [
"CWE-693"
],
"name": "Microsoft Publisher Protection Mechanism Failure Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Publisher",
"date_added": "2024-09-10",
"description": "Microsoft Publisher contains a protection mechanism failure vulnerability that allows attacker to bypass Office macro policies used to block untrusted or malicious files.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2019-0708",
"cwes": [
"CWE-416"
],
"name": "Microsoft Remote Desktop Services Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Remote Desktop Services",
"date_added": "2021-11-03",
"description": "Microsoft Remote Desktop Services, formerly known as Terminal Service, contains an unspecified vulnerability that allows an unauthenticated attacker to connect to the target system using RDP and send specially crafted requests. Successful exploitation allows for remote code execution. The vulnerability is also known under the moniker of BlueKeep.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2018-8373",
"cwes": [
"CWE-787"
],
"name": "Microsoft Scripting Engine Memory Corruption Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Internet Explorer Scripting Engine",
"date_added": "2022-03-25",
"description": "A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2025-49704",
"cwes": [
"CWE-94"
],
"name": "Microsoft SharePoint Code Injection Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "SharePoint",
"date_added": "2025-07-22",
"description": "Microsoft SharePoint contains a code injection vulnerability that could allow an authorized attacker to execute code over a network. This vulnerability could be chained with CVE-2025-49706. CVE-2025-53770 is a patch bypass for CVE-2025-49704, and the updates for CVE-2025-53770 include more robust protection than those for CVE-2025-49704.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2026-65660",
"cwes": [
"CWE-94"
],
"name": "Microsoft SharePoint Code Injection Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "SharePoint",
"date_added": "2026-09-25",
"description": "Microsoft SharePoint contains a code injection vulnerability which could allow an authorized attacker to execute code over a network.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2025-53770",
"cwes": [
"CWE-502"
],
"name": "Microsoft SharePoint Deserialization of Untrusted Data Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "SharePoint",
"date_added": "2025-07-20",
"description": "Microsoft SharePoint Server on-premises contains a deserialization of untrusted data vulnerability that could allow an unauthorized attacker to execute code over a network. This vulnerability could be chained with CVE-2025-53771. CVE-2025-53770 is a patch bypass for CVE-2025-49704, and the updates for CVE-2025-53770 include more robust protection than those for CVE-2025-49704.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2026-20963",
"cwes": [
"CWE-502"
],
"name": "Microsoft SharePoint Deserialization of Untrusted Data Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "SharePoint",
"date_added": "2026-03-18",
"description": "Microsoft SharePoint contains a deserialization of untrusted data vulnerability that allows an unauthorized attacker to execute code over a network.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2026-58644",
"cwes": [
"CWE-502"
],
"name": "Microsoft SharePoint Deserialization of Untrusted Data Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "SharePoint",
"date_added": "2026-07-16",
"description": "Microsoft SharePoint contains a deserialization of untrusted data vulnerability that allows an unauthorized attacker to execute code over a network.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2026-50522",
"cwes": [
"CWE-502"
],
"name": "Microsoft SharePoint Deserialization of Untrusted Data Vulnerability ",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "SharePoint",
"date_added": "2026-07-22",
"description": "Microsoft SharePoint contains a deserialization of untrusted data vulnerability which could allow an unauthorized attacker to execute code over a network.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2024-38094",
"cwes": [
"CWE-502"
],
"name": "Microsoft SharePoint Deserialization Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "SharePoint",
"date_added": "2024-10-22",
"description": "Microsoft SharePoint contains a deserialization vulnerability that allows for remote code execution.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2025-49706",
"cwes": [
"CWE-287"
],
"name": "Microsoft SharePoint Improper Authentication Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "SharePoint",
"date_added": "2025-07-22",
"description": "Microsoft SharePoint contains an improper authentication vulnerability that allows an authorized attacker to perform spoofing over a network. Successfully exploitation could allow an attacker to view sensitive information and make some changes to disclosed information. This vulnerability could be chained with CVE-2025-49704. CVE-2025-53771 is a patch bypass for CVE-2025-49706, and the updates for CVE-2025-53771 include more robust protection than those for CVE-2025-49706.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2019-0604",
"cwes": [
"CWE-20"
],
"name": "Microsoft SharePoint Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "SharePoint",
"date_added": "2021-11-03",
"description": "Microsoft SharePoint fails to check the source markup of an application package. An attacker who successfully exploits the vulnerability could run remote code in the context of the SharePoint application pool and the SharePoint server farm account.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2023-24955",
"cwes": [
"CWE-94"
],
"name": "Microsoft SharePoint Server Code Injection Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "SharePoint Server",
"date_added": "2024-03-26",
"description": "Microsoft SharePoint Server contains a code injection vulnerability that allows an authenticated attacker with Site Owner privileges to execute code remotely.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2026-45659",
"cwes": [
"CWE-502"
],
"name": "Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "SharePoint Server",
"date_added": "2026-07-01",
"description": "Microsoft SharePoint Server contains a deserialization of untrusted data vulnerability which allows an authorized attacker to execute code over a network.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2026-32201",
"cwes": [
"CWE-20"
],
"name": "Microsoft SharePoint Server Improper Input Validation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "SharePoint Server",
"date_added": "2026-04-14",
"description": "Microsoft SharePoint Server contains an improper input validation vulnerability that allows an unauthorized attacker to perform spoofing over a network.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2026-56164",
"cwes": [
"CWE-306"
],
"name": "Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "SharePoint Server",
"date_added": "2026-07-14",
"description": "Microsoft SharePoint contains a missing authentication for critical function vulnerability that allows an unauthorized attacker to elevate privileges over a network.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2023-29357",
"cwes": [
"CWE-303"
],
"name": "Microsoft SharePoint Server Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "SharePoint Server",
"date_added": "2024-01-10",
"description": "Microsoft SharePoint Server contains an unspecified vulnerability that allows an unauthenticated attacker, who has gained access to spoofed JWT authentication tokens, to use them for executing a network attack. This attack bypasses authentication, enabling the attacker to gain administrator privileges.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2026-55040",
"cwes": [
"CWE-1390"
],
"name": "Microsoft SharePoint Weak Authentication Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "SharePoint",
"date_added": "2026-08-18",
"description": "Microsoft SharePoint contains a weak authentication vulnerability which allows an unauthorized attacker to bypass a security feature over a network.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2013-0074",
"name": "Microsoft Silverlight Double Dereference Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Silverlight",
"date_added": "2022-05-25",
"description": "Microsoft Silverlight does not properly validate pointers during HTML object rendering, which allows remote attackers to execute code via a crafted Silverlight application.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2013-3896",
"cwes": [
"CWE-20"
],
"name": "Microsoft Silverlight Information Disclosure Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Silverlight",
"date_added": "2022-05-25",
"description": "Microsoft Silverlight does not properly validate pointers during access to Silverlight elements, which allows remote attackers to obtain sensitive information via a crafted Silverlight application.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2016-0034",
"cwes": [
"CWE-20"
],
"name": "Microsoft Silverlight Runtime Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Silverlight",
"date_added": "2022-05-25",
"description": "Microsoft Silverlight mishandles negative offsets during decoding, which allows attackers to execute remote code or cause a denial-of-service (DoS).",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2023-41763",
"cwes": [
"CWE-918"
],
"name": "Microsoft Skype for Business Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Skype for Business",
"date_added": "2023-10-10",
"description": "Microsoft Skype for Business contains an unspecified vulnerability that allows for privilege escalation.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2024-29988",
"cwes": [
"CWE-693"
],
"name": "Microsoft SmartScreen Prompt Security Feature Bypass Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "SmartScreen Prompt",
"date_added": "2024-04-30",
"description": "Microsoft SmartScreen Prompt contains a security feature bypass vulnerability that allows an attacker to bypass the Mark of the Web (MotW) feature. This vulnerability can be chained with CVE-2023-38831 and CVE-2024-21412 to execute a malicious file.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2017-0144",
"cwes": [
"CWE-20"
],
"name": "Microsoft SMBv1 Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "SMBv1",
"date_added": "2022-02-10",
"description": "The SMBv1 server in multiple Microsoft Windows versions allows remote attackers to execute arbitrary code via crafted packets.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2017-0145",
"cwes": [
"CWE-20"
],
"name": "Microsoft SMBv1 Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "SMBv1",
"date_added": "2022-02-10",
"description": "The SMBv1 server in multiple Microsoft Windows versions allows remote attackers to execute arbitrary code via crafted packets.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2017-0148",
"cwes": [
"CWE-20"
],
"name": "Microsoft SMBv1 Server Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "SMBv1 server",
"date_added": "2022-04-06",
"description": "The SMBv1 server in Microsoft allows remote attackers to execute arbitrary code via crafted packets.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2020-0796",
"cwes": [
"CWE-119"
],
"name": "Microsoft SMBv3 Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "SMBv3",
"date_added": "2022-02-10",
"description": "A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests. An attacker who successfully exploited the vulnerability could gain the ability to execute code on the target server or client.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2019-1068",
"name": "Microsoft SQL Server Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "SQL Server",
"date_added": "2026-08-26",
"description": "Microsoft SQL Server contains a remote code execution vulnerability that could allow an attacker to execute code in the context of the SQL Server Database Engine service account.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2020-0618",
"cwes": [
"CWE-502"
],
"name": "Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "SQL Server",
"date_added": "2024-09-18",
"description": "Microsoft SQL Server Reporting Services contains a deserialization vulnerability when handling page requests incorrectly. An authenticated attacker can exploit this vulnerability to execute code in the context of the Report Server service account.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2023-36802",
"cwes": [
"CWE-416"
],
"name": "Microsoft Streaming Service Proxy Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Streaming Service Proxy",
"date_added": "2023-09-12",
"description": "Microsoft Streaming Service Proxy contains an unspecified vulnerability that allows for privilege escalation.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2023-29360",
"cwes": [
"CWE-822"
],
"name": "Microsoft Streaming Service Untrusted Pointer Dereference Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Streaming Service",
"date_added": "2024-02-29",
"description": "Microsoft Streaming Service contains an untrusted pointer dereference vulnerability that allows for privilege escalation, enabling a local attacker to gain SYSTEM privileges.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2019-1069",
"cwes": [
"CWE-59"
],
"name": "Microsoft Task Scheduler Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Task Scheduler",
"date_added": "2022-03-15",
"description": "A privilege escalation vulnerability exists in the way the Task Scheduler Service validates certain file operations.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2020-0638",
"name": "Microsoft Update Notification Manager Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Update Notification Manager",
"date_added": "2022-05-23",
"description": "Microsoft Update Notification Manager contains an unspecified vulnerability that allows for privilege escalation.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2012-1854",
"cwes": [
"CWE-426"
],
"name": "Microsoft Visual Basic for Applications Insecure Library Loading Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Visual Basic for Applications (VBA)",
"date_added": "2026-04-13",
"description": "Microsoft Visual Basic for Applications (VBA) contains an insecure library loading vulnerability that could allow for remote code execution.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2015-2546",
"cwes": [
"CWE-119"
],
"name": "Microsoft Win32k Memory Corruption Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Win32k",
"date_added": "2022-03-15",
"description": "The kernel-mode driver in Microsoft Windows OS and Server allows local users to gain privileges via a crafted application.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2013-3660",
"cwes": [
"CWE-119"
],
"name": "Microsoft Win32k Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Win32k",
"date_added": "2022-03-28",
"description": "The EPATHOBJ::pprFlattenRec function in win32k.sys in the kernel-mode drivers in Microsoft does not properly initialize a pointer for the next object in a certain list, which allows local users to gain privileges.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2014-4113",
"cwes": [
"CWE-264"
],
"name": "Microsoft Win32k Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Win32k",
"date_added": "2022-05-04",
"description": "Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2015-1701",
"cwes": [
"CWE-264"
],
"name": "Microsoft Win32k Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Win32k",
"date_added": "2022-03-03",
"description": "An unspecified vulnerability exists in the Win32k.sys kernel-mode driver in Microsoft Windows Server that allows a local attacker to execute arbitrary code with elevated privileges.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2015-2360",
"cwes": [
"CWE-119"
],
"name": "Microsoft Win32k Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Win32k",
"date_added": "2022-05-25",
"description": "Win32k.sys in the kernel-mode drivers in Microsoft Windows allows local users to gain privileges or cause denial-of-service (DoS).",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2016-0165",
"cwes": [
"CWE-264"
],
"name": "Microsoft Win32k Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Win32k",
"date_added": "2023-06-22",
"description": "Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2016-0167",
"cwes": [
"CWE-264"
],
"name": "Microsoft Win32k Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Win32k",
"date_added": "2021-11-03",
"description": "Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation via a crafted application",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2016-7255",
"cwes": [
"CWE-264"
],
"name": "Microsoft Win32k Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Win32k",
"date_added": "2021-11-03",
"description": "Microsoft Win32k kernel-mode driver fails to properly handle objects in memory which allows for privilege escalation. Successful exploitation allows an attacker to run code in kernel mode.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2017-0263",
"cwes": [
"CWE-416"
],
"name": "Microsoft Win32k Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Win32k",
"date_added": "2022-02-10",
"description": "Microsoft Win32k contains a privilege escalation vulnerability due to the Windows kernel-mode driver failing to properly handle objects in memory.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2018-8120",
"cwes": [
"CWE-404"
],
"name": "Microsoft Win32k Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Win32k",
"date_added": "2022-03-15",
"description": "A privilege escalation vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2018-8453",
"cwes": [
"CWE-404"
],
"name": "Microsoft Win32k Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Win32k",
"date_added": "2022-01-21",
"description": "Microsoft Windows Win32k contains a vulnerability that allows an attacker to escalate privileges.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2018-8589",
"name": "Microsoft Win32k Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Win32k",
"date_added": "2022-05-23",
"description": "A privilege escalation vulnerability exists when Windows improperly handles calls to Win32k.sys. An attacker who successfully exploited this vulnerability could run remote code in the security context of the local system.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2019-0797",
"name": "Microsoft Win32k Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Win32k",
"date_added": "2021-11-03",
"description": "Microsoft Win32k contains a privilege escalation vulnerability when the Win32k component fails to properly handle objects in memory. Successful exploitation allows an attacker to execute code in kernel mode.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2019-0803",
"name": "Microsoft Win32k Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Win32k",
"date_added": "2021-11-03",
"description": "Microsoft Win32k contains an unspecified vulnerability due to it failing to properly handle objects in memory causing privilege escalation. Successful exploitation allows an attacker to run code in kernel mode.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2019-0808",
"name": "Microsoft Win32k Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Win32k",
"date_added": "2021-11-03",
"description": "Microsoft Win32k contains a privilege escalation vulnerability due to the component failing to properly handle objects in memory. Successful exploitation allows an attacker to run code in kernel mode.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2019-0859",
"name": "Microsoft Win32k Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Win32k",
"date_added": "2021-11-03",
"description": "Microsoft Win32k fails to properly handle objects in memory causing privilege escalation. Successful exploitation allows an attacker to run code in kernel mode.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2019-1132",
"name": "Microsoft Win32k Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Win32k",
"date_added": "2022-03-15",
"description": "A privilege escalation vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2019-1458",
"name": "Microsoft Win32k Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Win32k",
"date_added": "2022-01-10",
"description": "A privilege escalation vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k EoP.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2020-1054",
"cwes": [
"CWE-787"
],
"name": "Microsoft Win32k Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Win32k",
"date_added": "2021-11-03",
"description": "Microsoft Win32k contains a privilege escalation vulnerability when the Windows kernel-mode driver fails to properly handle objects in memory. Successful exploitation allows an attacker to execute code in kernel mode.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2021-1732",
"cwes": [
"CWE-787"
],
"name": "Microsoft Win32k Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Win32k",
"date_added": "2021-11-03",
"description": "Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2021-28310",
"cwes": [
"CWE-787"
],
"name": "Microsoft Win32k Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Win32k",
"date_added": "2021-11-03",
"description": "Microsoft Windows Win32k contains an unspecified vulnerability that allows for privilege escalation.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2021-40450",
"name": "Microsoft Win32k Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Win32k",
"date_added": "2022-04-25",
"description": "Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2021-41357",
"name": "Microsoft Win32k Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Win32k",
"date_added": "2022-04-25",
"description": "Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2022-21882",
"cwes": [
"CWE-787"
],
"name": "Microsoft Win32k Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Win32k",
"date_added": "2022-02-04",
"description": "Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2023-29336",
"cwes": [
"CWE-416"
],
"name": "Microsoft Win32K Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Win32k",
"date_added": "2023-05-09",
"description": "Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation up to SYSTEM privileges.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2020-0938",
"cwes": [
"CWE-787"
],
"name": "Microsoft Windows Adobe Font Manager Library Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2021-11-03",
"description": "Microsoft Windows Adobe Font Manager Library contains an unspecified vulnerability when handling specially crafted multi-master fonts (Adobe Type 1 PostScript format) that allows for remote code execution for all systems except Windows 10. For systems running Windows 10, an attacker who successfully exploited the vulnerability could execute code in an AppContainer sandbox context with limited privileges and capabilities.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2020-1020",
"cwes": [
"CWE-787"
],
"name": "Microsoft Windows Adobe Font Manager Library Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2021-11-03",
"description": "Microsoft Windows Adobe Font Manager Library contains an unspecified vulnerability when handling specially crafted multi-master fonts (Adobe Type 1 PostScript format) that allows for remote code execution for all systems except Windows 10. For systems running Windows 10, an attacker who successfully exploited the vulnerability could execute code in an AppContainer sandbox context with limited privileges and capabilities.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2015-2426",
"cwes": [
"CWE-119"
],
"name": "Microsoft Windows Adobe Type Manager Library Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2022-03-28",
"description": "A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles specially crafted OpenType fonts.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2023-21674",
"cwes": [
"CWE-416"
],
"name": "Microsoft Windows Advanced Local Procedure Call (ALPC) Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2023-01-10",
"description": "Microsoft Windows Advanced Local Procedure Call (ALPC) contains an unspecified vulnerability that allows for privilege escalation.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2025-21418",
"cwes": [
"CWE-122"
],
"name": "Microsoft Windows Ancillary Function Driver for WinSock Heap-Based Buffer Overflow Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2025-02-11",
"description": "Microsoft Windows Ancillary Function Driver for WinSock contains a heap-based buffer overflow vulnerability that allows for privilege escalation, enabling a local attacker to gain SYSTEM privileges.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2024-38193",
"cwes": [
"CWE-416"
],
"name": "Microsoft Windows Ancillary Function Driver for WinSock Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2024-08-13",
"description": "Microsoft Windows Ancillary Function Driver for WinSock contains an unspecified vulnerability that allows for privilege escalation, enabling a local attacker to gain SYSTEM privileges.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2025-32709",
"cwes": [
"CWE-416"
],
"name": "Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2025-05-13",
"description": "Microsoft Windows Ancillary Function Driver for WinSock contains a use-after-free vulnerability that allows an authorized attacker to escalate privileges to administrator.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2026-68820",
"cwes": [
"CWE-416"
],
"name": "Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows Ancillary Function Driver for WinSock ",
"date_added": "2026-08-11",
"description": "Microsoft Windows Ancillary Function Driver for WinSock contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2019-1385",
"cwes": [
"CWE-59"
],
"name": "Microsoft Windows AppX Deployment Extensions Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2022-05-23",
"description": "A privilege escalation vulnerability exists when the Windows AppX Deployment Extensions improperly performs privilege management, resulting in access to system files.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2019-1253",
"cwes": [
"CWE-59"
],
"name": "Microsoft Windows AppX Deployment Server Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2022-03-15",
"description": "A privilege escalation vulnerability exists when the Windows AppX Deployment Server improperly handles junctions.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2019-0841",
"cwes": [
"CWE-59"
],
"name": "Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2022-03-15",
"description": "A privilege escalation vulnerability exists when Windows AppXSVC improperly handles hard links. An attacker who successfully exploited this vulnerability could run processes in an elevated context.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2019-1064",
"cwes": [
"CWE-59"
],
"name": "Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2022-03-15",
"description": "A privilege escalation vulnerability exists when Windows AppXSVC improperly handles hard links. An attacker who successfully exploited this vulnerability could run processes in an elevated context.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2019-1129",
"cwes": [
"CWE-59"
],
"name": "Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2022-03-15",
"description": "A privilege escalation vulnerability exists when Windows AppXSVC improperly handles hard links. An attacker who successfully exploited this vulnerability could run processes in an elevated context.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2019-1130",
"cwes": [
"CWE-59"
],
"name": "Microsoft Windows AppX Deployment Service Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2022-05-23",
"description": "A privilege escalation vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2021-43890",
"name": "Microsoft Windows AppX Installer Spoofing Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2021-12-15",
"description": "Microsoft Windows AppX Installer contains a spoofing vulnerability which has a high impacts to confidentiality, integrity, and availability.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2012-0151",
"cwes": [
"CWE-20"
],
"name": "Microsoft Windows Authenticode Signature Verification Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2022-06-08",
"description": "The Authenticode Signature Verification function in Microsoft Windows (WinVerifyTrust) does not properly validate the digest of a signed portable executable (PE) file, which allows user-assisted remote attackers to execute code.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2020-0787",
"cwes": [
"CWE-269",
"CWE-59"
],
"name": "Microsoft Windows Background Intelligent Transfer Service (BITS) Improper Privilege Management Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2022-01-28",
"description": "Microsoft Windows BITS is vulnerable to to a privilege elevation vulnerability if it improperly handles symbolic links. An actor can exploit this vulnerability to execute arbitrary code with system-level privileges.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2008-4250",
"cwes": [
"CWE-94"
],
"name": "Microsoft Windows Buffer Overflow Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2026-05-20",
"description": "Microsoft Windows contains a buffer overflow vulnerability in the Windows Server Service that allows remote attackers to execute arbitrary code via a crafted RPC request that triggers an overflow during path canonicalization.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2019-1388",
"cwes": [
"CWE-269"
],
"name": "Microsoft Windows Certificate Dialog Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2023-04-07",
"description": "Microsoft Windows Certificate Dialog contains a privilege escalation vulnerability, allowing attackers to run processes in an elevated context.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2022-24521",
"cwes": [
"CWE-1285",
"CWE-787"
],
"name": "Microsoft Windows CLFS Driver Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2022-04-13",
"description": "Microsoft Windows Common Log File System (CLFS) Driver contains an unspecified vulnerability that allows for privilege escalation.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2022-22047",
"cwes": [
"CWE-426"
],
"name": "Microsoft Windows Client Server Runtime Subsystem (CSRSS) Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2022-07-12",
"description": "Microsoft Windows CSRSS contains an unspecified vulnerability that allows for privilege escalation to SYSTEM privileges.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2023-36036",
"cwes": [
"CWE-122"
],
"name": "Microsoft Windows Cloud Files Mini Filter Driver Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2023-11-14",
"description": "Microsoft Windows Cloud Files Mini Filter Driver contains a privilege escalation vulnerability that could allow an attacker to gain SYSTEM privileges.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2022-41125",
"cwes": [
"CWE-787"
],
"name": "Microsoft Windows CNG Key Isolation Service Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2022-11-08",
"description": "Microsoft Windows Cryptographic Next Generation (CNG) Key Isolation Service contains an unspecified vulnerability that allows an attacker to gain SYSTEM-level privileges.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2023-28229",
"cwes": [
"CWE-591"
],
"name": "Microsoft Windows CNG Key Isolation Service Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows CNG Key Isolation Service",
"date_added": "2023-10-04",
"description": "Microsoft Windows Cryptographic Next Generation (CNG) Key Isolation Service contains an unspecified vulnerability that allows an attacker to gain specific limited SYSTEM privileges.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2014-6352",
"cwes": [
"CWE-94"
],
"name": "Microsoft Windows Code Injection Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2022-02-25",
"description": "Microsoft Windows allow remote attackers to execute arbitrary code via a crafted OLE object.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2022-41033",
"cwes": [
"CWE-843"
],
"name": "Microsoft Windows COM+ Event System Service Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows COM+ Event System Service",
"date_added": "2022-10-11",
"description": "Microsoft Windows COM+ Event System Service contains an unspecified vulnerability that allows for privilege escalation.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2024-49138",
"cwes": [
"CWE-122"
],
"name": "Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2024-12-10",
"description": "Microsoft Windows Common Log File System (CLFS) driver contains a heap-based buffer overflow vulnerability that allows a local attacker to escalate privileges.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2025-32706",
"cwes": [
"CWE-122"
],
"name": "Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2025-05-13",
"description": "Microsoft Windows Common Log File System (CLFS) Driver contains a heap-based buffer overflow vulnerability that allows an authorized attacker to elevate privileges locally.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2021-36955",
"name": "Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2021-11-03",
"description": "Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2022-37969",
"cwes": [
"CWE-20",
"CWE-787"
],
"name": "Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2022-09-14",
"description": "Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2023-23376",
"cwes": [
"CWE-122"
],
"name": "Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2023-02-14",
"description": "Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2023-28252",
"cwes": [
"CWE-122"
],
"name": "Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2023-04-11",
"description": "Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2025-29824",
"cwes": [
"CWE-416"
],
"name": "Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2025-04-08",
"description": "Microsoft Windows Common Log File System (CLFS) Driver contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2025-32701",
"cwes": [
"CWE-416"
],
"name": "Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2025-05-13",
"description": "Microsoft Windows Common Log File System (CLFS) Driver contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2020-0601",
"cwes": [
"CWE-295"
],
"name": "Microsoft Windows CryptoAPI Spoofing Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2021-11-03",
"description": "Microsoft Windows CryptoAPI (Crypt32.dll) contains a spoofing vulnerability in the way it validates Elliptic Curve Cryptography (ECC) certificates. An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source. A successful exploit could also allow the attacker to conduct man-in-the-middle attacks and decrypt confidential information on user connections to the affected software. The vulnerability is also known under the moniker of CurveBall.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2016-0151",
"cwes": [
"CWE-264"
],
"name": "Microsoft Windows CSRSS Security Feature Bypass Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Client-Server Run-time Subsystem (CSRSS)",
"date_added": "2022-03-28",
"description": "The Client-Server Run-time Subsystem (CSRSS) in Microsoft mismanages process tokens, which allows local users to gain privileges via a crafted application.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2023-32049",
"name": "Microsoft Windows Defender SmartScreen Security Feature Bypass Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2023-07-11",
"description": "Microsoft Windows Defender SmartScreen contains a security feature bypass vulnerability that allows an attacker to bypass the Open File - Security Warning prompt.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2023-36033",
"cwes": [
"CWE-822"
],
"name": "Microsoft Windows Desktop Window Manager (DWM) Core Library Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2023-11-14",
"description": "Microsoft Windows Desktop Window Manager (DWM) Core Library contains an unspecified vulnerability that allows for privilege escalation.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2020-1350",
"name": "Microsoft Windows DNS Server Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2021-11-03",
"description": "Microsoft Windows DNS Servers fail to properly handle requests, allowing an attacker to perform remote code execution in the context of the Local System Account. The vulnerability is also known under the moniker of SIGRed.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2025-30400",
"cwes": [
"CWE-416"
],
"name": "Microsoft Windows DWM Core Library Use-After-Free Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2025-05-13",
"description": "Microsoft Windows DWM Core Library contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2019-0863",
"name": "Microsoft Windows Error Reporting (WER) Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2021-11-03",
"description": "Microsoft Windows Error Reporting (WER) contains a privilege escalation vulnerability due to the way it handles files, allowing for code execution in kernel mode.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2019-1315",
"cwes": [
"CWE-59"
],
"name": "Microsoft Windows Error Reporting Manager Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2022-03-15",
"description": "A privilege escalation vulnerability exists when Windows Error Reporting manager improperly handles hard links. An attacker who successfully exploited this vulnerability could overwrite a targeted file leading to an elevated status.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2024-26169",
"cwes": [
"CWE-269"
],
"name": "Microsoft Windows Error Reporting Service Improper Privilege Management Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2024-06-13",
"description": "Microsoft Windows Error Reporting Service contains an improper privilege management vulnerability that allows a local attacker with user permissions to gain SYSTEM privileges.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2023-36874",
"cwes": [
"CWE-59"
],
"name": "Microsoft Windows Error Reporting Service Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2023-07-11",
"description": "Microsoft Windows Error Reporting Service contains an unspecified vulnerability that allows for privilege escalation.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2021-34486",
"cwes": [
"CWE-416"
],
"name": "Microsoft Windows Event Tracing Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2022-03-28",
"description": "Microsoft Windows Event Tracing contains an unspecified vulnerability which can allow for privilege escalation.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2025-24985",
"cwes": [
"CWE-122",
"CWE-190"
],
"name": "Microsoft Windows Fast FAT File System Driver Integer Overflow Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2025-03-11",
"description": "Microsoft Windows Fast FAT File System Driver contains an integer overflow or wraparound vulnerability that allows an unauthorized attacker to execute code locally.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2023-21823",
"cwes": [
"CWE-190"
],
"name": "Microsoft Windows Graphic Component Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2023-02-14",
"description": "Microsoft Windows Graphic Component contains an unspecified vulnerability that allows for privilege escalation.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2017-0005",
"cwes": [
"CWE-119"
],
"name": "Microsoft Windows Graphics Device Interface (GDI) Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2022-05-24",
"description": "The Graphics Device Interface (GDI) in Microsoft Windows allows local users to gain privileges via a crafted application.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2016-3393",
"cwes": [
"CWE-284"
],
"name": "Microsoft Windows Graphics Device Interface (GDI) Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2022-05-25",
"description": "A remote code execution vulnerability exists due to the way the Windows GDI component handles objects in the memory. An attacker who successfully exploits this vulnerability could take control of the affected system.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2014-1812",
"cwes": [
"CWE-255"
],
"name": "Microsoft Windows Group Policy Preferences Password Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2021-11-03",
"description": "Microsoft Windows Active Directory contains a privilege escalation vulnerability due to the way it distributes passwords that are configured using Group Policy preferences. An authenticated attacker who successfully exploits the vulnerability could decrypt the passwords and use them to elevate privileges on the domain.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2026-85880",
"cwes": [
"CWE-122",
"CWE-908"
],
"name": "Microsoft Windows Heap-Based Buffer Overflow Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2026-09-08",
"description": "Microsoft Windows Advanced Local Procedure Call contains a heap-based buffer overflow vulnerability that allows an attacker to elevate privileges locally.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2025-21333",
"cwes": [
"CWE-122"
],
"name": "Microsoft Windows Hyper-V NT Kernel Integration VSP Heap-based Buffer Overflow Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2025-01-14",
"description": "Microsoft Windows Hyper-V NT Kernel Integration VSP contains a heap-based buffer overflow vulnerability that allows a local attacker to gain SYSTEM privileges.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2025-21334",
"cwes": [
"CWE-416"
],
"name": "Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-Free Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2025-01-14",
"description": "Microsoft Windows Hyper-V NT Kernel Integration VSP contains a use-after-free vulnerability that allows a local attacker to gain SYSTEM privileges.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2025-21335",
"cwes": [
"CWE-416"
],
"name": "Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-Free Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2025-01-14",
"description": "Microsoft Windows Hyper-V NT Kernel Integration VSP contains a use-after-free vulnerability that allows a local attacker to gain SYSTEM privileges.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2024-38080",
"cwes": [
"CWE-190"
],
"name": "Microsoft Windows Hyper-V Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows ",
"date_added": "2024-07-09",
"description": "Microsoft Windows Hyper-V contains a privilege escalation vulnerability that allows a local attacker with user permissions to gain SYSTEM privileges.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2025-59230",
"cwes": [
"CWE-284"
],
"name": "Microsoft Windows Improper Access Control Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2025-10-14",
"description": "Microsoft Windows contains an improper access control vulnerability in Windows Remote Access Connection Manager which could allow an authorized attacker to elevate privileges locally.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2009-1123",
"cwes": [
"CWE-20"
],
"name": "Microsoft Windows Improper Input Validation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2022-03-03",
"description": "The kernel in Microsoft Windows does not properly validate changes to unspecified kernel objects, which allows local users to gain privileges via a crafted application.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2026-21533",
"cwes": [
"CWE-269"
],
"name": "Microsoft Windows Improper Privilege Management Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2026-02-10",
"description": "Microsoft Windows Remote Desktop Services contains an improper privilege management vulnerability that could allow an authorized attacker to elevate privileges locally.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2026-20805",
"cwes": [
"CWE-200"
],
"name": "Microsoft Windows Information Disclosure Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2026-01-13",
"description": "Microsoft Windows Desktop Windows Manager contains an information disclosure vulnerability that allows an authorized attacker to disclose information locally.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2024-38014",
"cwes": [
"CWE-269"
],
"name": "Microsoft Windows Installer Improper Privilege Management Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2024-09-10",
"description": "Microsoft Windows Installer contains an improper privilege management vulnerability that could allow an attacker to gain SYSTEM privileges.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2020-0683",
"name": "Microsoft Windows Installer Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2021-11-03",
"description": "Microsoft Windows Installer contains a privilege escalation vulnerability when MSI packages process symbolic links, which allows attackers to bypass access restrictions to add or remove files.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2021-41379",
"cwes": [
"CWE-1386"
],
"name": "Microsoft Windows Installer Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2022-03-03",
"description": "Microsoft Windows Installer contains an unspecified vulnerability that allows for privilege escalation.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2024-21412",
"cwes": [
"CWE-693"
],
"name": "Microsoft Windows Internet Shortcut Files Security Feature Bypass Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2024-02-13",
"description": "Microsoft Windows Internet Shortcut Files contains an unspecified vulnerability that allows for a security feature bypass.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2010-0232",
"cwes": [
"CWE-264"
],
"name": "Microsoft Windows Kernel Exception Handler Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2022-03-03",
"description": "The kernel in Microsoft Windows, when access to 16-bit applications is enabled on a 32-bit x86 platform, does not properly validate certain BIOS calls, which allows local users to gain privileges.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2024-21338",
"cwes": [
"CWE-822"
],
"name": "Microsoft Windows Kernel Exposed IOCTL with Insufficient Access Control Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2024-03-04",
"description": "Microsoft Windows Kernel contains an exposed IOCTL with insufficient access control vulnerability within the IOCTL (input and output control) dispatcher in appid.sys that allows a local attacker to achieve privilege escalation.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2021-31955",
"cwes": [
"CWE-497"
],
"name": "Microsoft Windows Kernel Information Disclosure Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2021-11-03",
"description": "Microsoft Windows Kernel contains an unspecified vulnerability that allows for information disclosure. Successful exploitation allows attackers to read the contents of kernel memory from a user-mode process.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2013-5065",
"cwes": [
"CWE-20"
],
"name": "Microsoft Windows Kernel Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2022-03-03",
"description": "Microsoft Windows NDProxy.sys in the kernel contains an improper input validation vulnerability which can allow a local attacker to escalate privileges.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2015-6175",
"cwes": [
"CWE-264"
],
"name": "Microsoft Windows Kernel Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2022-05-25",
"description": "The kernel in Microsoft Windows contains a vulnerability that allows local users to gain privileges via a crafted application.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2016-0040",
"cwes": [
"CWE-264"
],
"name": "Microsoft Windows Kernel Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2022-03-28",
"description": "The kernel in Microsoft Windows allows local users to gain privileges via a crafted application.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2016-3309",
"cwes": [
"CWE-264"
],
"name": "Microsoft Windows Kernel Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2022-03-15",
"description": "A privilege escalation vulnerability exists when the Windows kernel fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2018-8611",
"cwes": [
"CWE-404"
],
"name": "Microsoft Windows Kernel Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2022-05-24",
"description": "A privilege escalation vulnerability exists when the Windows kernel fails to properly handle objects in memory.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2020-0986",
"cwes": [
"CWE-787"
],
"name": "Microsoft Windows Kernel Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2021-11-03",
"description": "Microsoft Windows kernel contains an unspecified vulnerability when handling objects in memory that allows attackers to escalate privileges and execute code in kernel mode.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2020-1027",
"cwes": [
"CWE-787"
],
"name": "Microsoft Windows Kernel Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2022-05-23",
"description": "An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory. An attacker who successfully exploited the vulnerability could execute code with elevated permissions.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2020-17087",
"cwes": [
"CWE-131"
],
"name": "Microsoft Windows Kernel Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2021-11-03",
"description": "Microsoft Windows kernel contains an unspecified vulnerability that allows for privilege escalation.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2021-31979",
"cwes": [
"CWE-119"
],
"name": "Microsoft Windows Kernel Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2021-11-03",
"description": "Microsoft Windows kernel contains an unspecified vulnerability that allows for privilege escalation.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2021-33771",
"cwes": [
"CWE-119"
],
"name": "Microsoft Windows Kernel Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2021-11-03",
"description": "Microsoft Windows kernel contains an unspecified vulnerability that allows for privilege escalation.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2024-38106",
"cwes": [
"CWE-591"
],
"name": "Microsoft Windows Kernel Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2024-08-13",
"description": "Microsoft Windows Kernel contains an unspecified vulnerability that allows for privilege escalation, enabling a local attacker to gain SYSTEM privileges. Successful exploitation of this vulnerability requires an attacker to win a race condition.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2010-4398",
"cwes": [
"CWE-119"
],
"name": "Microsoft Windows Kernel Stack-Based Buffer Overflow Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2022-03-28",
"description": "Stack-based buffer overflow in the RtlQueryRegistryValues function in win32k.sys in Microsoft Windows allows local users to gain privileges, and bypass the User Account Control (UAC) feature.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2024-30088",
"cwes": [
"CWE-367"
],
"name": "Microsoft Windows Kernel TOCTOU Race Condition Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows ",
"date_added": "2024-10-15",
"description": "Microsoft Windows Kernel contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability that could allow for privilege escalation.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2024-35250",
"cwes": [
"CWE-822"
],
"name": "Microsoft Windows Kernel-Mode Driver Untrusted Pointer Dereference Vulnerability ",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2024-12-16",
"description": "Microsoft Windows Kernel-Mode Driver contains an untrusted pointer dereference vulnerability that allows a local attacker to escalate privileges.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2025-60710",
"cwes": [
"CWE-59"
],
"name": "Microsoft Windows Link Following Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2026-04-13",
"description": "Microsoft Windows contains a link following vulnerability that allows for privilege escalation",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2026-81963",
"cwes": [
"CWE-284",
"CWE-59"
],
"name": "Microsoft Windows Link Following Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2026-09-08",
"description": "Microsoft Windows Update Stack contains a link following vulnerability that allows a local attacker to escalate privileges locally up to SYSTEM.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2021-36942",
"cwes": [
"CWE-749"
],
"name": "Microsoft Windows Local Security Authority (LSA) Spoofing Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2021-11-03",
"description": "Microsoft Windows Local Security Authority (LSA) contains a spoofing vulnerability allowing an unauthenticated attacker to call a method on the LSARPC interface and coerce the domain controller to authenticate against another server using NTLM.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2022-26925",
"cwes": [
"CWE-306"
],
"name": "Microsoft Windows LSA Spoofing Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2022-07-01",
"description": "Microsoft Windows Local Security Authority (LSA) contains a spoofing vulnerability where an attacker can coerce the domain controller to authenticate to the attacker using NTLM.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2025-26633",
"cwes": [
"CWE-707"
],
"name": "Microsoft Windows Management Console (MMC) Improper Neutralization Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2025-03-11",
"description": "Microsoft Windows Management Console (MMC) contains an improper neutralization vulnerability that allows an unauthorized attacker to bypass a security feature locally.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2024-43572",
"cwes": [
"CWE-707"
],
"name": "Microsoft Windows Management Console Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2024-10-08",
"description": "Microsoft Windows Management Console contains unspecified vulnerability that allows for remote code execution.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2024-38217",
"cwes": [
"CWE-693"
],
"name": "Microsoft Windows Mark of the Web (MOTW) Protection Mechanism Failure Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2024-09-10",
"description": "Microsoft Windows Mark of the Web (MOTW) contains a protection mechanism failure vulnerability that allows an attacker to bypass MOTW-based defenses. This can result in a limited loss of integrity and availability of security features such as Protected View in Microsoft Office, which rely on MOTW tagging.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2022-41049",
"cwes": [
"CWE-274"
],
"name": "Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2022-11-14",
"description": "Microsoft Windows Mark of the Web (MOTW) contains a security feature bypass vulnerability resulting in a limited loss of integrity and availability of security features.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2022-41091",
"cwes": [
"CWE-863"
],
"name": "Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2022-11-08",
"description": "Microsoft Windows Mark of the Web (MOTW) contains a security feature bypass vulnerability resulting in a limited loss of integrity and availability of security features.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2023-36584",
"name": "Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2023-11-16",
"description": "Microsoft Windows Mark of the Web (MOTW) contains a security feature bypass vulnerability resulting in a limited loss of integrity and availability of security features.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2016-0185",
"cwes": [
"CWE-20"
],
"name": "Microsoft Windows Media Center Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2021-11-03",
"description": "Microsoft Windows Media Center contains a remote code execution vulnerability when Windows Media Center opens a specially crafted Media Center link (.mcl) file that references malicious code.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2015-1769",
"cwes": [
"CWE-264"
],
"name": "Microsoft Windows Mount Manager Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2022-05-25",
"description": "A privilege escalation vulnerability exists when the Windows Mount Manager component improperly processes symbolic links.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2023-32046",
"name": "Microsoft Windows MSHTML Platform Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2023-07-11",
"description": "Microsoft Windows MSHTML Platform contains an unspecified vulnerability that allows for privilege escalation.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2021-33742",
"cwes": [
"CWE-787",
"CWE-823"
],
"name": "Microsoft Windows MSHTML Platform Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2021-11-03",
"description": "Microsoft Windows MSHTML Platform contains an unspecified vulnerability that allows for remote code execution.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2024-30040",
"cwes": [
"CWE-20"
],
"name": "Microsoft Windows MSHTML Platform Security Feature Bypass Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2024-05-14",
"description": "Microsoft Windows MSHTML Platform contains an unspecified vulnerability that allows for a security feature bypass.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2024-38112",
"cwes": [
"CWE-451"
],
"name": "Microsoft Windows MSHTML Platform Spoofing Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2024-07-09",
"description": "Microsoft Windows MSHTML Platform contains a spoofing vulnerability that has a high impact to confidentiality, integrity, and availability.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2024-43461",
"cwes": [
"CWE-451"
],
"name": "Microsoft Windows MSHTML Platform Spoofing Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2024-09-16",
"description": "Microsoft Windows MSHTML Platform contains a user interface (UI) misrepresentation of critical information vulnerability that allows an attacker to spoof a web page. This vulnerability was exploited in conjunction with CVE-2024-38112.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2024-43573",
"cwes": [
"CWE-79"
],
"name": "Microsoft Windows MSHTML Platform Spoofing Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2024-10-08",
"description": "Microsoft Windows MSHTML Platform contains an unspecified spoofing vulnerability which can lead to a loss of confidentiality.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2025-24993",
"cwes": [
"CWE-122"
],
"name": "Microsoft Windows NTFS Heap-Based Buffer Overflow Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2025-03-11",
"description": "Microsoft Windows New Technology File System (NTFS) contains a heap-based buffer overflow vulnerability that allows an unauthorized attacker to execute code locally.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2025-24984",
"cwes": [
"CWE-532"
],
"name": "Microsoft Windows NTFS Information Disclosure Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2025-03-11",
"description": "Microsoft Windows New Technology File System (NTFS) contains an insertion of sensitive Information into log file vulnerability that allows an unauthorized attacker to disclose information with a physical attack. An attacker who successfully exploited this vulnerability could potentially read portions of heap memory.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2025-24991",
"cwes": [
"CWE-125"
],
"name": "Microsoft Windows NTFS Out-Of-Bounds Read Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2025-03-11",
"description": "Microsoft Windows New Technology File System (NTFS) contains an out-of-bounds read vulnerability that allows an authorized attacker to disclose information locally.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2021-31956",
"cwes": [
"CWE-191",
"CWE-787"
],
"name": "Microsoft Windows NTFS Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2021-11-03",
"description": "Microsoft Windows New Technology File System (NTFS) contains an unspecified vulnerability that allows attackers to escalate privileges via a specially crafted application.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2025-24054",
"cwes": [
"CWE-73"
],
"name": "Microsoft Windows NTLM Hash Disclosure Spoofing Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2025-04-17",
"description": "Microsoft Windows NTLM contains an external control of file name or path vulnerability that allows an unauthorized attacker to perform spoofing over a network.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2024-43451",
"cwes": [
"CWE-73"
],
"name": "Microsoft Windows NTLMv2 Hash Disclosure Spoofing Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2024-11-12",
"description": "Microsoft Windows contains an NTLMv2 hash spoofing vulnerability that could result in disclosing a user's NTLMv2 hash to an attacker via a file open operation. The attacker could then leverage this hash to impersonate that user.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2026-21525",
"cwes": [
"CWE-476"
],
"name": "Microsoft Windows NULL Pointer Dereference Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2026-02-10",
"description": "Microsoft Windows Remote Access Connection Manager contains a NULL pointer dereference that could allow an unauthorized attacker to deny service locally.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2014-6332",
"cwes": [
"CWE-119"
],
"name": "Microsoft Windows Object Linking & Embedding (OLE) Automation Array Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2022-03-25",
"description": "OleAut32.dll in OLE in Microsoft Windows allows remote attackers to remotely execute code via a crafted web site.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2014-4114",
"cwes": [
"CWE-20"
],
"name": "Microsoft Windows Object Linking & Embedding (OLE) Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2022-03-03",
"description": "A vulnerability exists in Windows Object Linking & Embedding (OLE) that could allow remote code execution if a user opens a file that contains a specially crafted OLE object.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2016-7256",
"cwes": [
"CWE-284"
],
"name": "Microsoft Windows Open Type Font Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2022-05-25",
"description": "A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts. An attacker who successfully exploits this vulnerability could take control of the affected system.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2023-36424",
"cwes": [
"CWE-125"
],
"name": "Microsoft Windows Out-of-Bounds Read Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2026-04-13",
"description": "Microsoft Windows Common Log File System Driver contains an out-of-bounds read vulnerability that could allow a threat actor for privileges escalation",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2013-3918",
"name": "Microsoft Windows Out-of-Bounds Write Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2025-10-06",
"description": "Microsoft Windows contains an out-of-bounds write vulnerability in the InformationCardSigninHelper Class ActiveX control, icardie.dll. An attacker could exploit the vulnerability by constructing a specially crafted webpage. When a user views the webpage, the vulnerability could allow remote code execution. An attacker who successfully exploited this vulnerability could gain the same user rights as the current user. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2024-38107",
"cwes": [
"CWE-416"
],
"name": "Microsoft Windows Power Dependency Coordinator Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2024-08-13",
"description": "Microsoft Windows Power Dependency Coordinator contains an unspecified vulnerability that allows for privilege escalation, enabling a local attacker to obtain SYSTEM privileges.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2022-21999",
"cwes": [
"CWE-1386",
"CWE-40"
],
"name": "Microsoft Windows Print Spooler Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2022-03-25",
"description": "Microsoft Windows Print Spooler contains an unspecified vulnerability which can allow for privilege escalation.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2022-22718",
"name": "Microsoft Windows Print Spooler Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2022-04-19",
"description": "Microsoft Windows Print Spooler contains an unspecified vulnerability which allow for privilege escalation.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2022-41073",
"cwes": [
"CWE-787"
],
"name": "Microsoft Windows Print Spooler Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2022-11-08",
"description": "Microsoft Windows Print Spooler contains an unspecified vulnerability that allows an attacker to gain SYSTEM-level privileges.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2022-38028",
"name": "Microsoft Windows Print Spooler Privilege Escalation Vulnerability ",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2024-04-23",
"description": "Microsoft Windows Print Spooler service contains a privilege escalation vulnerability. An attacker may modify a JavaScript constraints file and execute it with SYSTEM-level permissions.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2021-1675",
"cwes": [
"CWE-285"
],
"name": "Microsoft Windows Print Spooler Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2021-11-03",
"description": "Microsoft Windows Print Spooler contains an unspecified vulnerability that allows for remote code execution.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2021-34527",
"cwes": [
"CWE-269"
],
"name": "Microsoft Windows Print Spooler Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2021-11-03",
"description": "Microsoft Windows Print Spooler contains an unspecified vulnerability due to the Windows Print Spooler service improperly performing privileged file operations. Successful exploitation allows an attacker to perform remote code execution with SYSTEM privileges. The vulnerability is also known under the moniker of PrintNightmare.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2019-1214",
"name": "Microsoft Windows Privilege Common Log File System (CLFS) Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2021-11-03",
"description": "Microsoft Windows Common Log File System (CLFS) driver improperly handles objects in memory which can allow for privilege escalation.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2002-0367",
"name": "Microsoft Windows Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2022-03-03",
"description": "smss.exe debugging subsystem in Microsoft Windows does not properly authenticate programs that connect to other programs, which allows local users to gain administrator or SYSTEM privileges.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2004-0210",
"cwes": [
"CWE-120"
],
"name": "Microsoft Windows Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2022-03-03",
"description": "A privilege elevation vulnerability exists in the POSIX subsystem. This vulnerability could allow a logged on user to take complete control of the system.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2017-0213",
"name": "Microsoft Windows Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2022-03-28",
"description": "Microsoft Windows COM Aggregate Marshaler allows for privilege escalation when an attacker runs a specially crafted application.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2018-8440",
"name": "Microsoft Windows Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2022-03-28",
"description": "An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC).",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2019-0543",
"cwes": [
"CWE-287"
],
"name": "Microsoft Windows Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2022-03-15",
"description": "A privilege escalation vulnerability exists when Windows improperly handles authentication requests. An attacker who successfully exploited this vulnerability could run processes in an elevated context.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2019-0880",
"name": "Microsoft Windows Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2022-05-23",
"description": "A local elevation of privilege vulnerability exists in how splwow64.exe handles certain calls. An attacker who successfully exploited the vulnerability could elevate privileges on an affected system from low-integrity to medium-integrity.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2019-1215",
"name": "Microsoft Windows Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2021-11-03",
"description": "Microsoft Windows contains an unspecified vulnerability due to the way ws2ifsl.sys (Winsock) handles objects in memory, allowing for privilege escalation. Successful exploitation allows an attacker to execute code with elevated privileges.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2019-1322",
"name": "Microsoft Windows Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2022-03-15",
"description": "A privilege escalation vulnerability exists when Windows improperly handles authentication requests. An attacker who successfully exploited this vulnerability could run processes in an elevated context.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2021-43226",
"name": "Microsoft Windows Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2025-10-06",
"description": "Microsoft Windows Common Log File System Driver contains a privilege escalation vulnerability that could allow a local, privileged attacker to bypass certain security mechanisms.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2026-32202",
"cwes": [
"CWE-693"
],
"name": "Microsoft Windows Protection Mechanism Failure Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2026-04-28",
"description": "Microsoft Windows Shell contains a protection mechanism failure vulnerability that allows an unauthorized attacker to perform spoofing over a network.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2025-62215",
"cwes": [
"CWE-362"
],
"name": "Microsoft Windows Race Condition Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2025-11-12",
"description": "Microsoft Windows Kernel contains a race condition vulnerability that allows a local attacker with low-level privileges to escalate privileges. Successful exploitation of this vulnerability could enable the attacker to gain SYSTEM-level access.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2010-2568",
"cwes": [
"CWE-20"
],
"name": "Microsoft Windows Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2022-09-15",
"description": "Microsoft Windows incorrectly parses shortcuts in such a way that malicious code may be executed when the operating system displays the icon of a malicious shortcut file. An attacker who successfully exploited this vulnerability could execute code as the logged-on user.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2011-3402",
"name": "Microsoft Windows Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2025-10-06",
"description": "Microsoft Windows Kernel contains an unspecified vulnerability in the TrueType font parsing engine in win32k.sys in the kernel-mode drivers that allows remote attackers to execute arbitrary code via crafted font data in a Word document or web page.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2014-4148",
"cwes": [
"CWE-94"
],
"name": "Microsoft Windows Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2022-05-25",
"description": "A remote code execution vulnerability exists when the Windows kernel-mode driver improperly handles TrueType fonts.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2015-1671",
"cwes": [
"CWE-19"
],
"name": "Microsoft Windows Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2022-05-25",
"description": "A remote code execution vulnerability exists when components of Windows, .NET Framework, Office, Lync, and Silverlight fail to properly handle TrueType fonts.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2022-21971",
"cwes": [
"CWE-824"
],
"name": "Microsoft Windows Runtime Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2022-08-18",
"description": "Microsoft Windows Runtime contains an unspecified vulnerability that allows for remote code execution.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2021-36934",
"cwes": [
"CWE-1220"
],
"name": "Microsoft Windows SAM Local Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2022-02-10",
"description": "If a Volume Shadow Copy (VSS) shadow copy of the system drive is available, users can read the SAM file which would allow any user to escalate privileges to SYSTEM level.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2021-34448",
"cwes": [
"CWE-787"
],
"name": "Microsoft Windows Scripting Engine Memory Corruption Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2021-11-03",
"description": "Microsoft Windows Scripting Engine contains an unspecified vulnerability that allows for memory corruption.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2024-38178",
"cwes": [
"CWE-843"
],
"name": "Microsoft Windows Scripting Engine Memory Corruption Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2024-08-13",
"description": "Microsoft Windows Scripting Engine contains a memory corruption vulnerability that allows unauthenticated attacker to initiate remote code execution via a specially crafted URL.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2025-30397",
"cwes": [
"CWE-843"
],
"name": "Microsoft Windows Scripting Engine Type Confusion Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2025-05-13",
"description": "Microsoft Windows Scripting Engine contains a type confusion vulnerability that allows an unauthorized attacker to execute code over a network via a specially crafted URL.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2022-41128",
"cwes": [
"CWE-787"
],
"name": "Microsoft Windows Scripting Languages Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2022-11-08",
"description": "Microsoft Windows contains an unspecified vulnerability in the JScript9 scripting language which allows for remote code execution.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2017-8543",
"cwes": [
"CWE-281"
],
"name": "Microsoft Windows Search Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2022-05-24",
"description": "Microsoft Windows allows an attacker to take control of the affected system when Windows Search fails to handle objects in memory.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2023-36884",
"cwes": [
"CWE-362"
],
"name": "Microsoft Windows Search Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2023-07-17",
"description": "Microsoft Windows Search contains an unspecified vulnerability that could allow an attacker to evade Mark of the Web (MOTW) defenses via a specially crafted malicious file, leading to remote code execution.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2016-0099",
"cwes": [
"CWE-264"
],
"name": "Microsoft Windows Secondary Logon Service Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2022-03-03",
"description": "A privilege escalation vulnerability exists in Microsoft Windows if the Windows Secondary Logon Service fails to properly manage request handles in memory. An attacker who successfully exploited this vulnerability could run arbitrary code as an administrator.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2017-7269",
"cwes": [
"CWE-119"
],
"name": "Microsoft Windows Server Buffer Overflow Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Internet Information Services (IIS)",
"date_added": "2021-11-03",
"description": "Microsoft Windows Server 2003 R2 contains a buffer overflow vulnerability in Internet Information Services (IIS) 6.0 which allows remote attackers to execute code via a long header beginning with \"If: <http://\" in a PROPFIND request.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2017-0143",
"cwes": [
"CWE-20"
],
"name": "Microsoft Windows Server Message Block (SMBv1) Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2021-11-03",
"description": "Microsoft Windows Server Message Block 1.0 (SMBv1) contains an unspecified vulnerability that allows for remote code execution.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2025-59287",
"cwes": [
"CWE-502"
],
"name": "Microsoft Windows Server Update Service (WSUS) Deserialization of Untrusted Data Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2025-10-24",
"description": "Microsoft Windows Server Update Service (WSUS) contains a deserialization of untrusted data vulnerability that allows for remote code execution.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2017-8464",
"name": "Microsoft Windows Shell (.lnk) Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2022-02-10",
"description": "Windows Shell in multiple versions of Microsoft Windows allows local users or remote attackers to execute arbitrary code via a crafted .LNK file",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2026-21510",
"cwes": [
"CWE-693"
],
"name": "Microsoft Windows Shell Protection Mechanism Failure Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2026-02-10",
"description": "Microsoft Windows Shell contains a protection mechanism failure vulnerability that could allow an unauthorized attacker to bypass a security feature over a network.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2018-8414",
"cwes": [
"CWE-20"
],
"name": "Microsoft Windows Shell Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2022-03-25",
"description": "A remote code execution vulnerability exists when the Windows Shell does not properly validate file paths.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2023-24880",
"cwes": [
"CWE-863"
],
"name": "Microsoft Windows SmartScreen Security Feature Bypass Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2023-03-14",
"description": "Microsoft Windows SmartScreen contains a security feature bypass vulnerability that could allow an attacker to evade Mark of the Web (MOTW) defenses via a specially crafted malicious file.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2023-36025",
"name": "Microsoft Windows SmartScreen Security Feature Bypass Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2023-11-14",
"description": "Microsoft Windows SmartScreen contains a security feature bypass vulnerability that could allow an attacker to bypass Windows Defender SmartScreen checks and their associated prompts.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2024-21351",
"cwes": [
"CWE-94"
],
"name": "Microsoft Windows SmartScreen Security Feature Bypass Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2024-02-13",
"description": "Microsoft Windows SmartScreen contains a security feature bypass vulnerability that allows an attacker to bypass the SmartScreen user experience and inject code to potentially gain code execution, which could lead to some data exposure, lack of system availability, or both.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2024-38213",
"cwes": [
"CWE-693"
],
"name": "Microsoft Windows SmartScreen Security Feature Bypass Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2024-08-13",
"description": "Microsoft Windows SmartScreen contains a security feature bypass vulnerability that allows an attacker to bypass the SmartScreen user experience via a malicious file.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2025-33073",
"cwes": [
"CWE-284"
],
"name": "Microsoft Windows SMB Client Improper Access Control Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2025-10-20",
"description": "Microsoft Windows SMB Client contains an improper access control vulnerability that could allow for privilege escalation. An attacker could execute a specially crafted malicious script to coerce the victim machine to connect back to the attack system using SMB and authenticate.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2019-0703",
"name": "Microsoft Windows SMB Information Disclosure Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2022-05-23",
"description": "An information disclosure vulnerability exists in the way that the Windows SMB Server handles certain requests, which could lead to information disclosure from the server.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2017-0146",
"cwes": [
"CWE-20"
],
"name": "Microsoft Windows SMB Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2022-03-25",
"description": "The SMBv1 server in Microsoft Windows allows remote attackers to perform remote code execution.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2017-0147",
"cwes": [
"CWE-200"
],
"name": "Microsoft Windows SMBv1 Information Disclosure Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "SMBv1 server",
"date_added": "2022-05-24",
"description": "The SMBv1 server in Microsoft Windows allows remote attackers to obtain sensitive information from process memory via a crafted packet.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2020-1464",
"cwes": [
"CWE-347"
],
"name": "Microsoft Windows Spoofing Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2021-11-03",
"description": "Microsoft Windows contains a spoofing vulnerability when Windows incorrectly validates file signatures, allowing an attacker to bypass security features and load improperly signed files.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2025-21391",
"cwes": [
"CWE-59"
],
"name": "Microsoft Windows Storage Link Following Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2025-02-11",
"description": "Microsoft Windows Storage contains a link following vulnerability that could allow for privilege escalation. This vulnerability could allow an attacker to delete data including data that results in the service being unavailable.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2022-30190",
"cwes": [
"CWE-610"
],
"name": "Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2022-06-14",
"description": "A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run code with the privileges of the calling application.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2022-34713",
"name": "Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2022-08-09",
"description": "A remote code execution vulnerability exists when Microsoft Windows MSDT is called using the URL protocol from a calling application.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2024-49039",
"cwes": [
"CWE-287"
],
"name": "Microsoft Windows Task Scheduler Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2024-11-12",
"description": "Microsoft Windows Task Scheduler contains a privilege escalation vulnerability that can allow an attacker-provided, local application to escalate privileges outside of its AppContainer, and access privileged RPC functions.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2017-0101",
"cwes": [
"CWE-119"
],
"name": "Microsoft Windows Transaction Manager Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2022-03-15",
"description": "A privilege escalation vulnerability exists when the Windows Transaction Manager improperly handles objects in memory.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2015-0016",
"cwes": [
"CWE-22"
],
"name": "Microsoft Windows TS WebProxy Directory Traversal Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2022-05-25",
"description": "Directory traversal vulnerability in the TS WebProxy (TSWbPrxy) component in Microsoft Windows allows remote attackers to escalate privileges.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2026-21519",
"cwes": [
"CWE-843"
],
"name": "Microsoft Windows Type Confusion Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2026-02-10",
"description": "Microsoft Desktop Windows Manager contains a type confusion vulnerability that could allow an authorized attacker to elevate privileges locally.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2019-1405",
"name": "Microsoft Windows Universal Plug and Play (UPnP) Service Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2022-03-15",
"description": "A privilege escalation vulnerability exists when the Windows UPnP service improperly allows COM object creation.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2025-24990",
"cwes": [
"CWE-822"
],
"name": "Microsoft Windows Untrusted Pointer Dereference Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2025-10-14",
"description": "Microsoft Windows Agere Modem Driver contains an untrusted pointer dereference vulnerability that allows for privilege escalation. An attacker who successfully exploited this vulnerability could gain administrator privileges.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2021-36948",
"name": "Microsoft Windows Update Medic Service Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2021-11-03",
"description": "Microsoft Windows Update Medic Service contains an unspecified vulnerability that allows for privilege escalation.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2025-62221",
"cwes": [
"CWE-416"
],
"name": "Microsoft Windows Use After Free Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2025-12-09",
"description": "Microsoft Windows Cloud Files Mini Filter Driver contains a use after free vulnerability that can allow an authorized attacker to elevate privileges locally.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2021-34484",
"cwes": [
"CWE-269"
],
"name": "Microsoft Windows User Profile Service Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2022-03-31",
"description": "Microsoft Windows User Profile Service contains an unspecified vulnerability that allows for privilege escalation.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2022-21919",
"cwes": [
"CWE-1386"
],
"name": "Microsoft Windows User Profile Service Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2022-04-25",
"description": "Microsoft Windows User Profile Service contains an unspecified vulnerability that allows for privilege escalation.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2022-26904",
"cwes": [
"CWE-362"
],
"name": "Microsoft Windows User Profile Service Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2022-04-25",
"description": "Microsoft Windows User Profile Service contains an unspecified vulnerability that allows for privilege escalation.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2018-8174",
"cwes": [
"CWE-787"
],
"name": "Microsoft Windows VBScript Engine Out-of-Bounds Write Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2022-02-15",
"description": "A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka \"Windows VBScript Engine Remote Code Execution\"",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2018-8639",
"cwes": [
"CWE-404"
],
"name": "Microsoft Windows Win32k Improper Resource Shutdown or Release Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2025-03-03",
"description": "Microsoft Windows Win32k contains an improper resource shutdown or release vulnerability that allows for local, authenticated privilege escalation. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2021-40449",
"cwes": [
"CWE-416"
],
"name": "Microsoft Windows Win32k Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2021-11-17",
"description": "Unspecified vulnerability allows for an authenticated user to escalate privileges.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2025-24983",
"cwes": [
"CWE-416"
],
"name": "Microsoft Windows Win32k Use-After-Free Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Windows",
"date_added": "2025-03-11",
"description": "Microsoft Windows Win32 Kernel Subsystem contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2013-3900",
"cwes": [
"CWE-20"
],
"name": "Microsoft WinVerifyTrust function Remote Code Execution",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "WinVerifyTrust function",
"date_added": "2022-01-10",
"description": "A remote code execution vulnerability exists in the way that the WinVerifyTrust function handles Windows Authenticode signature verification for PE files.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2023-36761",
"cwes": [
"CWE-668"
],
"name": "Microsoft Word Information Disclosure Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Word",
"date_added": "2023-09-12",
"description": "Microsoft Word contains an unspecified vulnerability that allows for information disclosure.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2006-2492",
"cwes": [
"CWE-120"
],
"name": "Microsoft Word Malformed Object Pointer Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Word",
"date_added": "2022-06-08",
"description": "Microsoft Word and Microsoft Works Suites contain a malformed object pointer which allows attackers to execute code.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2014-1761",
"cwes": [
"CWE-119"
],
"name": "Microsoft Word Memory Corruption Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Word",
"date_added": "2022-02-15",
"description": "Microsoft Word contains a memory corruption vulnerability which when exploited could allow for remote code execution.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2012-2539",
"cwes": [
"CWE-399"
],
"name": "Microsoft Word Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "Word",
"date_added": "2022-03-28",
"description": "Microsoft Word allows attackers to execute remote code or cause a denial-of-service (DoS) via crafted RTF data.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2023-36563",
"cwes": [
"CWE-20"
],
"name": "Microsoft WordPad Information Disclosure Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "WordPad",
"date_added": "2023-10-10",
"description": "Microsoft WordPad contains an unspecified vulnerability that allows for information disclosure.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2017-0022",
"cwes": [
"CWE-200"
],
"name": "Microsoft XML Core Services Information Disclosure Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "XML Core Services",
"date_added": "2022-05-24",
"description": "Microsoft XML Core Services (MSXML) improperly handles objects in memory, allowing attackers to test for files on disk via a crafted web site.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "microsoft",
"evidence_id": 10791,
"data": {
"cve": "CVE-2012-1889",
"cwes": [
"CWE-119"
],
"name": "Microsoft XML Core Services Memory Corruption Vulnerability",
"source": "cisa_kev",
"vendor": "Microsoft",
"product": "XML Core Services",
"date_added": "2022-06-08",
"description": "Microsoft XML Core Services contains a memory corruption vulnerability which could allow for remote code execution.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "minio",
"evidence_id": 10791,
"data": {
"cve": "CVE-2023-28432",
"cwes": [
"CWE-200"
],
"name": "MinIO Information Disclosure Vulnerability",
"source": "cisa_kev",
"vendor": "MinIO",
"product": "MinIO",
"date_added": "2023-04-21",
"description": "MinIO contains a vulnerability in a cluster deployment where MinIO returns all environment variables, which allows for information disclosure.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "minio",
"evidence_id": 10791,
"data": {
"cve": "CVE-2023-28434",
"cwes": [
"CWE-269"
],
"name": "MinIO Security Feature Bypass Vulnerability",
"source": "cisa_kev",
"vendor": "MinIO",
"product": "MinIO",
"date_added": "2023-09-19",
"description": "MinIO contains a security feature bypass vulnerability that allows an attacker to use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing `PostPolicyBucket` to conduct privilege escalation. To carry out this attack, the attacker requires credentials with `arn:aws:s3:::*` permission, as well as enabled Console API access.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "mongodb",
"evidence_id": 10791,
"data": {
"cve": "CVE-2025-14847",
"cwes": [
"CWE-130"
],
"name": "MongoDB and MongoDB Server Improper Handling of Length Parameter Inconsistency Vulnerability",
"source": "cisa_kev",
"vendor": "MongoDB",
"product": "MongoDB and MongoDB Server",
"date_added": "2025-12-29",
"description": "MongoDB Server contains an improper handling of length parameter inconsistency vulnerability in Zlib compressed protocol headers. This vulnerability may allow a read of uninitialized heap memory by an unauthenticated client.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "mongodb",
"evidence_id": 10791,
"data": {
"cve": "CVE-2019-10758",
"name": "MongoDB mongo-express Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "MongoDB",
"product": "mongo-express",
"date_added": "2021-12-10",
"description": "mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "n8n",
"evidence_id": 10791,
"data": {
"cve": "CVE-2025-68613",
"cwes": [
"CWE-913"
],
"name": "n8n Improper Control of Dynamically-Managed Code Resources Vulnerability",
"source": "cisa_kev",
"vendor": "n8n",
"product": "n8n",
"date_added": "2026-03-11",
"description": "n8n contains an improper control of dynamically managed code resources vulnerability in its workflow expression evaluation system that allows for remote code execution.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "oracle",
"evidence_id": 10791,
"data": {
"cve": "CVE-2022-21445",
"cwes": [
"CWE-502"
],
"name": "Oracle ADF Faces Deserialization of Untrusted Data Vulnerability",
"source": "cisa_kev",
"vendor": "Oracle",
"product": "ADF Faces",
"date_added": "2024-09-18",
"description": "Oracle ADF Faces library, included with Oracle JDeveloper Distribution, contains a deserialization of untrusted data vulnerability leading to unauthenticated remote code execution.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "oracle",
"evidence_id": 10791,
"data": {
"cve": "CVE-2024-20953",
"cwes": [
"CWE-502"
],
"name": "Oracle Agile Product Lifecycle Management (PLM) Deserialization Vulnerability",
"source": "cisa_kev",
"vendor": "Oracle",
"product": "Agile Product Lifecycle Management (PLM)",
"date_added": "2025-02-24",
"description": "Oracle Agile Product Lifecycle Management (PLM) contains a deserialization vulnerability that allows a low-privileged attacker with network access via HTTP to compromise the system.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "oracle",
"evidence_id": 10791,
"data": {
"cve": "CVE-2024-21287",
"cwes": [
"CWE-863"
],
"name": "Oracle Agile Product Lifecycle Management (PLM) Incorrect Authorization Vulnerability",
"source": "cisa_kev",
"vendor": "Oracle",
"product": "Agile Product Lifecycle Management (PLM)",
"date_added": "2024-11-21",
"description": "Oracle Agile Product Lifecycle Management (PLM) contains an incorrect authorization vulnerability in the Process Extension component of the Software Development Kit. Successful exploitation of this vulnerability may result in unauthenticated file disclosure.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "oracle",
"evidence_id": 10791,
"data": {
"cve": "CVE-2019-2616",
"name": "Oracle BI Publisher Unauthorized Access Vulnerability",
"source": "cisa_kev",
"vendor": "Oracle",
"product": "BI Publisher (Formerly XML Publisher)",
"date_added": "2022-03-25",
"description": "Oracle BI Publisher, formerly XML Publisher, contains an unspecified vulnerability that allows for various unauthorized actions. Open-source reporting attributes this vulnerability to allowing for authentication bypass.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "oracle",
"evidence_id": 10791,
"data": {
"cve": "CVE-2020-14864",
"cwes": [
"CWE-22"
],
"name": "Oracle Business Intelligence Enterprise Edition Path Transversal",
"source": "cisa_kev",
"vendor": "Oracle",
"product": "Intelligence Enterprise Edition",
"date_added": "2022-01-18",
"description": "Path traversal vulnerability, where an attacker can target the preview FilePath parameter of the getPreviewImage function to get access to arbitrary system file.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "oracle",
"evidence_id": 10791,
"data": {
"cve": "CVE-2017-10271",
"name": "Oracle Corporation WebLogic Server Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Oracle",
"product": "WebLogic Server",
"date_added": "2022-02-10",
"description": "Oracle Corporation WebLogic Server contains a vulnerability that allows for remote code execution.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "oracle",
"evidence_id": 10791,
"data": {
"cve": "CVE-2026-46817",
"cwes": [
"CWE-269",
"CWE-287",
"CWE-306"
],
"name": "Oracle E-Business Suite Improper Privilege Management Vulnerability",
"source": "cisa_kev",
"vendor": "Oracle",
"product": "E-Business Suite",
"date_added": "2026-07-15",
"description": "Oracle E-Business Suite contains an improper privilege management vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Payments. Successful attacks of this vulnerability can result in takeover of Oracle Payments.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "oracle",
"evidence_id": 10791,
"data": {
"cve": "CVE-2025-61884",
"cwes": [
"CWE-918"
],
"name": "Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability",
"source": "cisa_kev",
"vendor": "Oracle",
"product": "E-Business Suite",
"date_added": "2025-10-20",
"description": "Oracle E-Business Suite contains a server-side request forgery (SSRF) vulnerability in the Runtime component of Oracle Configurator. This vulnerability is remotely exploitable without authentication.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "oracle",
"evidence_id": 10791,
"data": {
"cve": "CVE-2022-21587",
"cwes": [
"CWE-306"
],
"name": "Oracle E-Business Suite Unspecified Vulnerability",
"source": "cisa_kev",
"vendor": "Oracle",
"product": "E-Business Suite",
"date_added": "2023-02-02",
"description": "Oracle E-Business Suite contains an unspecified vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "oracle",
"evidence_id": 10791,
"data": {
"cve": "CVE-2025-61882",
"name": "Oracle E-Business Suite Unspecified Vulnerability",
"source": "cisa_kev",
"vendor": "Oracle",
"product": "E-Business Suite",
"date_added": "2025-10-06",
"description": "Oracle E-Business Suite contains an unspecified vulnerability in the BI Publisher Integration component. The vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Concurrent Processing. Successful attacks can result in takeover of Oracle Concurrent Processing.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "oracle",
"evidence_id": 10791,
"data": {
"cve": "CVE-2025-61757",
"cwes": [
"CWE-306"
],
"name": "Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability",
"source": "cisa_kev",
"vendor": "Oracle",
"product": "Fusion Middleware",
"date_added": "2025-11-21",
"description": "Oracle Fusion Middleware contains a missing authentication for critical function vulnerability, allowing unauthenticated remote attackers to take over Identity Manager.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "oracle",
"evidence_id": 10791,
"data": {
"cve": "CVE-2012-0518",
"cwes": [
"CWE-601"
],
"name": "Oracle Fusion Middleware Unspecified Vulnerability",
"source": "cisa_kev",
"vendor": "Oracle",
"product": "Fusion Middleware",
"date_added": "2022-03-28",
"description": "Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware allows remote attackers to affect integrity via Unknown vectors",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "oracle",
"evidence_id": 10791,
"data": {
"cve": "CVE-2012-1710",
"name": "Oracle Fusion Middleware Unspecified Vulnerability",
"source": "cisa_kev",
"vendor": "Oracle",
"product": "Fusion Middleware",
"date_added": "2022-05-25",
"description": "Unspecified vulnerability in the Oracle WebCenter Forms Recognition component in Oracle Fusion Middleware allows remote attackers to affect confidentiality, integrity, and availability via Unknown vectors related to Designer.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "oracle",
"evidence_id": 10791,
"data": {
"cve": "CVE-2012-3152",
"name": "Oracle Fusion Middleware Unspecified Vulnerability",
"source": "cisa_kev",
"vendor": "Oracle",
"product": "Fusion Middleware",
"date_added": "2021-11-03",
"description": "Oracle Fusion Middleware Reports Developer contains an unspecified vulnerability that allows remote attackers to affect confidentiality and integrity of affected systems.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "oracle",
"evidence_id": 10791,
"data": {
"cve": "CVE-2020-2551",
"name": "Oracle Fusion Middleware Unspecified Vulnerability",
"source": "cisa_kev",
"vendor": "Oracle",
"product": "Fusion Middleware",
"date_added": "2023-11-16",
"description": "Oracle Fusion Middleware contains an unspecified vulnerability in the WLS Core Components that allows an unauthenticated attacker with network access via IIOP to compromise the WebLogic Server.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "oracle",
"evidence_id": 10791,
"data": {
"cve": "CVE-2021-35587",
"cwes": [
"CWE-502",
"CWE-790"
],
"name": "Oracle Fusion Middleware Unspecified Vulnerability",
"source": "cisa_kev",
"vendor": "Oracle",
"product": "Fusion Middleware",
"date_added": "2022-11-28",
"description": "Oracle Fusion Middleware Access Manager allows an unauthenticated attacker with network access via HTTP to takeover the Access Manager product.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "oracle",
"evidence_id": 10791,
"data": {
"cve": "CVE-2026-21962",
"cwes": [
"CWE-284"
],
"name": "Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability",
"source": "cisa_kev",
"vendor": "Oracle",
"product": "HTTP Server and Oracle Weblogic Server Proxy Plug-in",
"date_added": "2026-08-24",
"description": "Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in contain an improper access control vulnerability that can result in unauthorized creation, deletion or modification access to critical data as well as unauthorized access to critical data or complete access to all Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in accessible data.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "oracle",
"evidence_id": 10791,
"data": {
"cve": "CVE-2015-2590",
"name": "Oracle Java SE and Java SE Embedded Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Oracle",
"product": "Java SE",
"date_added": "2022-03-03",
"description": "An unspecified vulnerability exists within Oracle Java Runtime Environment that allows an attacker to perform remote code execution.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "oracle",
"evidence_id": 10791,
"data": {
"cve": "CVE-2016-3427",
"name": "Oracle Java SE and JRockit Unspecified Vulnerability",
"source": "cisa_kev",
"vendor": "Oracle",
"product": "Java SE and JRockit",
"date_added": "2023-05-12",
"description": "Oracle Java SE and JRockit contains an unspecified vulnerability that allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Java Management Extensions (JMX). This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "oracle",
"evidence_id": 10791,
"data": {
"cve": "CVE-2015-4902",
"name": "Oracle Java SE Integrity Check Vulnerability",
"source": "cisa_kev",
"vendor": "Oracle",
"product": "Java SE",
"date_added": "2022-03-03",
"description": "Unspecified vulnerability in Oracle Java SE allows remote attackers to affect integrity via Unknown vectors related to deployment.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "oracle",
"evidence_id": 10791,
"data": {
"cve": "CVE-2011-3544",
"name": "Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Oracle",
"product": "Java SE JDK and JRE",
"date_added": "2022-03-03",
"description": "An access control vulnerability exists in the Applet Rhino Script Engine component of Oracle's Java Runtime Environment allows an attacker to remotely execute arbitrary code.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "oracle",
"evidence_id": 10791,
"data": {
"cve": "CVE-2012-0507",
"name": "Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Oracle",
"product": "Java SE",
"date_added": "2022-03-03",
"description": "An incorrect type vulnerability exists in the Concurrency component of Oracle's Java Runtime Environment allows an attacker to remotely execute arbitrary code.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "oracle",
"evidence_id": 10791,
"data": {
"cve": "CVE-2012-1723",
"name": "Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Oracle",
"product": "Java SE",
"date_added": "2022-03-03",
"description": "Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE allows remote attackers to affect confidentiality, integrity, and availability via Unknown vectors related to Hotspot.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "oracle",
"evidence_id": 10791,
"data": {
"cve": "CVE-2012-4681",
"name": "Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Oracle",
"product": "Java SE",
"date_added": "2022-03-03",
"description": "The Java Runtime Environment (JRE) component in Oracle Java SE allow for remote code execution.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "oracle",
"evidence_id": 10791,
"data": {
"cve": "CVE-2012-5076",
"name": "Oracle Java SE Sandbox Bypass Vulnerability",
"source": "cisa_kev",
"vendor": "Oracle",
"product": "Java SE",
"date_added": "2022-03-28",
"description": "The default Java security properties configuration did not restrict access to the com.sun.org.glassfish.external and com.sun.org.glassfish.gmbal packages. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "oracle",
"evidence_id": 10791,
"data": {
"cve": "CVE-2013-2465",
"name": "Oracle Java SE Unspecified Vulnerability",
"source": "cisa_kev",
"vendor": "Oracle",
"product": "Java SE",
"date_added": "2022-03-28",
"description": "Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE allows remote attackers to affect confidentiality, integrity, and availability via Unknown vectors related to 2D",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "oracle",
"evidence_id": 10791,
"data": {
"cve": "CVE-2013-0422",
"cwes": [
"CWE-264"
],
"name": "Oracle JRE Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Oracle",
"product": "Java Runtime Environment (JRE)",
"date_added": "2022-05-25",
"description": "A vulnerability in the way Java restricts the permissions of Java applets could allow an attacker to execute commands on a vulnerable system.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "oracle",
"evidence_id": 10791,
"data": {
"cve": "CVE-2013-0431",
"name": "Oracle JRE Sandbox Bypass Vulnerability",
"source": "cisa_kev",
"vendor": "Oracle",
"product": "Java Runtime Environment (JRE)",
"date_added": "2022-05-25",
"description": "Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle allows remote attackers to bypass the Java security sandbox.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "oracle",
"evidence_id": 10791,
"data": {
"cve": "CVE-2010-0840",
"name": "Oracle JRE Unspecified Vulnerability",
"source": "cisa_kev",
"vendor": "Oracle",
"product": "Java Runtime Environment (JRE)",
"date_added": "2022-05-25",
"description": "Unspecified vulnerability in the Java Runtime Environment (JRE) in Java SE component allows remote attackers to affect confidentiality, integrity, and availability via Unknown vectors.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "oracle",
"evidence_id": 10791,
"data": {
"cve": "CVE-2013-2423",
"name": "Oracle JRE Unspecified Vulnerability",
"source": "cisa_kev",
"vendor": "Oracle",
"product": "Java Runtime Environment (JRE)",
"date_added": "2022-05-25",
"description": "Unspecified vulnerability in hotspot for Java Runtime Environment (JRE) allows remote attackers to affect integrity.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "oracle",
"evidence_id": 10791,
"data": {
"cve": "CVE-2020-2555",
"cwes": [
"CWE-502"
],
"name": "Oracle Multiple Products Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Oracle",
"product": "Multiple Products",
"date_added": "2021-11-03",
"description": "Multiple Oracle products contain a remote code execution vulnerability that allows an unauthenticated attacker with network access via T3 or HTTP to takeover the affected system. Impacted Oracle products: Oracle Coherence in Fusion Middleware, Oracle Utilities Framework, Oracle Retail Assortment Planning, Oracle Commerce, Oracle Communications Diameter Signaling Router (DSR).",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "oracle",
"evidence_id": 10791,
"data": {
"cve": "CVE-2026-35273",
"cwes": [
"CWE-306"
],
"name": "Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability",
"source": "cisa_kev",
"vendor": "Oracle",
"product": " PeopleSoft Enterprise PeopleTools",
"date_added": "2026-06-12",
"description": "Oracle PeopleSoft Enterprise PeopleTools contains a missing authentication for critical function vulnerability which could allow an unauthenticated attacker to obtain takeover of PeopleSoft Enterprise PeopleTools.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "oracle",
"evidence_id": 10791,
"data": {
"cve": "CVE-2020-14871",
"cwes": [
"CWE-787"
],
"name": "Oracle Solaris and Zettabyte File System (ZFS) Unspecified Vulnerability",
"source": "cisa_kev",
"vendor": "Oracle",
"product": "Solaris and Zettabyte File System (ZFS)",
"date_added": "2021-11-03",
"description": "Oracle Solaris and Oracle ZFS Storage Appliance Kit contain an unspecified vulnerability causing high impacts to confidentiality, integrity, and availability of affected systems.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "oracle",
"evidence_id": 10791,
"data": {
"cve": "CVE-2019-3010",
"name": "Oracle Solaris Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Oracle",
"product": "Solaris",
"date_added": "2022-05-25",
"description": "Oracle Solaris component: XScreenSaver contains an unspecified vulnerability that allows for privilege escalation.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "oracle",
"evidence_id": 10791,
"data": {
"cve": "CVE-2008-3431",
"cwes": [
"CWE-264"
],
"name": "Oracle VirtualBox Insufficient Input Validation Vulnerability",
"source": "cisa_kev",
"vendor": "Oracle",
"product": "VirtualBox",
"date_added": "2022-03-03",
"description": "An input validation vulnerability exists in the VBoxDrv.sys driver of Sun xVM VirtualBox which allows attackers to locally execute arbitrary code.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "oracle",
"evidence_id": 10791,
"data": {
"cve": "CVE-2015-4852",
"cwes": [
"CWE-502"
],
"name": "Oracle WebLogic Server Deserialization of Untrusted Data Vulnerability",
"source": "cisa_kev",
"vendor": "Oracle",
"product": "WebLogic Server",
"date_added": "2021-11-03",
"description": "Oracle WebLogic Server contains a deserialization of untrusted data vulnerability within Apache Commons, which can allow for for remote code execution.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "oracle",
"evidence_id": 10791,
"data": {
"cve": "CVE-2017-3506",
"cwes": [
"CWE-78"
],
"name": "Oracle WebLogic Server OS Command Injection Vulnerability",
"source": "cisa_kev",
"vendor": "Oracle",
"product": "WebLogic Server",
"date_added": "2024-06-03",
"description": "Oracle WebLogic Server, a product within the Fusion Middleware suite, contains an OS command injection vulnerability that allows an attacker to execute arbitrary code via a specially crafted HTTP request that includes a malicious XML document.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "oracle",
"evidence_id": 10791,
"data": {
"cve": "CVE-2020-14644",
"name": "Oracle WebLogic Server Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Oracle",
"product": "WebLogic Server",
"date_added": "2024-09-18",
"description": "Oracle WebLogic Server, a product within the Fusion Middleware suite, contains a deserialization vulnerability. Unauthenticated attackers with network access via T3 or IIOP can exploit this vulnerability to achieve remote code execution.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "oracle",
"evidence_id": 10791,
"data": {
"cve": "CVE-2020-14750",
"name": "Oracle WebLogic Server Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Oracle",
"product": "WebLogic Server",
"date_added": "2021-11-03",
"description": "Oracle WebLogic Server contains an unspecified vulnerability allowing an unauthenticated attacker to perform remote code execution. This vulnerability is related to CVE-2020-14882.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "oracle",
"evidence_id": 10791,
"data": {
"cve": "CVE-2020-14882",
"name": "Oracle WebLogic Server Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Oracle",
"product": "WebLogic Server",
"date_added": "2021-11-03",
"description": "Oracle WebLogic Server contains an unspecified vulnerability, which is assessed to allow for remote code execution, based on this vulnerability being related to CVE-2020-14750.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "oracle",
"evidence_id": 10791,
"data": {
"cve": "CVE-2018-2628",
"cwes": [
"CWE-502"
],
"name": "Oracle WebLogic Server Unspecified Vulnerability",
"source": "cisa_kev",
"vendor": "Oracle",
"product": "WebLogic Server",
"date_added": "2022-09-08",
"description": "Oracle WebLogic Server contains an unspecified vulnerability which can allow an unauthenticated attacker with T3 network access to compromise the server.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "oracle",
"evidence_id": 10791,
"data": {
"cve": "CVE-2020-14883",
"name": "Oracle WebLogic Server Unspecified Vulnerability",
"source": "cisa_kev",
"vendor": "Oracle",
"product": "WebLogic Server",
"date_added": "2021-11-03",
"description": "Oracle WebLogic Server contains an unspecified vulnerability in the Console component with high impacts to confidentilaity, integrity, and availability.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "oracle",
"evidence_id": 10791,
"data": {
"cve": "CVE-2020-2883",
"name": "Oracle WebLogic Server Unspecified Vulnerability",
"source": "cisa_kev",
"vendor": "Oracle",
"product": "WebLogic Server",
"date_added": "2025-01-07",
"description": "Oracle WebLogic Server, a product within the Fusion Middleware suite, contains an unspecified vulnerability exploitable by an unauthenticated attacker with network access via IIOP or T3.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "oracle",
"evidence_id": 10791,
"data": {
"cve": "CVE-2023-21839",
"name": "Oracle WebLogic Server Unspecified Vulnerability",
"source": "cisa_kev",
"vendor": "Oracle",
"product": "WebLogic Server",
"date_added": "2023-05-01",
"description": "Oracle WebLogic Server contains an unspecified vulnerability that allows an unauthenticated attacker with network access via T3, IIOP, to compromise Oracle WebLogic Server.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "oracle",
"evidence_id": 10791,
"data": {
"cve": "CVE-2024-21182",
"name": "Oracle WebLogic Server Unspecified Vulnerability",
"source": "cisa_kev",
"vendor": "Oracle",
"product": "WebLogic Server",
"date_added": "2026-06-01",
"description": "Oracle WebLogic contains an unspecified vulnerability that could allow an unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "oracle",
"evidence_id": 10791,
"data": {
"cve": "CVE-2019-2725",
"cwes": [
"CWE-74"
],
"name": "Oracle WebLogic Server, Injection",
"source": "cisa_kev",
"vendor": "Oracle",
"product": "WebLogic Server",
"date_added": "2022-01-10",
"description": "Injection vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services).",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "plex-tv",
"evidence_id": 10791,
"data": {
"cve": "CVE-2020-5741",
"cwes": [
"CWE-502"
],
"name": "Plex Media Server Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Plex",
"product": "Media Server",
"date_added": "2023-03-10",
"description": "Plex Media Server contains a remote code execution vulnerability that allows an attacker with access to the server administrator's Plex account to upload a malicious file via the Camera Upload feature and have the media server execute it.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "qlik",
"evidence_id": 10791,
"data": {
"cve": "CVE-2023-41265",
"cwes": [
"CWE-444"
],
"name": "Qlik Sense HTTP Tunneling Vulnerability",
"source": "cisa_kev",
"vendor": "Qlik",
"product": "Sense",
"date_added": "2023-12-07",
"description": "Qlik Sense contains an HTTP tunneling vulnerability that allows an attacker to escalate privileges and execute HTTP requests on the backend server hosting the software.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "qlik",
"evidence_id": 10791,
"data": {
"cve": "CVE-2023-48365",
"cwes": [
"CWE-444"
],
"name": "Qlik Sense HTTP Tunneling Vulnerability",
"source": "cisa_kev",
"vendor": "Qlik",
"product": "Sense",
"date_added": "2025-01-13",
"description": "Qlik Sense contains an HTTP tunneling vulnerability that allows an attacker to escalate privileges and execute HTTP requests on the backend server hosting the software.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "qlik",
"evidence_id": 10791,
"data": {
"cve": "CVE-2023-41266",
"cwes": [
"CWE-20"
],
"name": "Qlik Sense Path Traversal Vulnerability",
"source": "cisa_kev",
"vendor": "Qlik",
"product": "Sense",
"date_added": "2023-12-07",
"description": "Qlik Sense contains a path traversal vulnerability that allows a remote, unauthenticated attacker to create an anonymous session by sending maliciously crafted HTTP requests. This anonymous session could allow the attacker to send further requests to unauthorized endpoints.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "red-hat",
"evidence_id": 10791,
"data": {
"cve": "CVE-2015-5287",
"name": "Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "Red Hat",
"product": "Automatic Bug Reporting Tool",
"date_added": "2026-08-26",
"description": "Red Hat Automatic Bug Reporting Tool (ABRT) contains a privilege escalation vulnerability that could allow local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "red-hat",
"evidence_id": 10791,
"data": {
"cve": "CVE-2017-12149",
"cwes": [
"CWE-502"
],
"name": "Red Hat JBoss Application Server Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Red Hat",
"product": "JBoss Application Server",
"date_added": "2021-12-10",
"description": "The JBoss Application Server, shipped with Red Hat Enterprise Application Platform 5.2, allows an attacker to execute arbitrary code via crafted serialized data.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "red-hat",
"evidence_id": 10791,
"data": {
"cve": "CVE-2010-0738",
"cwes": [
"CWE-264"
],
"name": "Red Hat JBoss Authentication Bypass Vulnerability",
"source": "cisa_kev",
"vendor": "Red Hat",
"product": "JBoss",
"date_added": "2022-05-25",
"description": "The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform performs access control only for the GET and POST methods, which allows remote attackers to send requests to this application's GET handler by using a different method.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "red-hat",
"evidence_id": 10791,
"data": {
"cve": "CVE-2010-1428",
"cwes": [
"CWE-264"
],
"name": "Red Hat JBoss Information Disclosure Vulnerability",
"source": "cisa_kev",
"vendor": "Red Hat",
"product": "JBoss",
"date_added": "2022-05-25",
"description": "Unauthenticated access to the JBoss Application Server Web Console (/web-console) is blocked by default. However, it was found that this block was incomplete, and only blocked GET and POST HTTP verbs. A remote attacker could use this flaw to gain access to sensitive information.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "red-hat",
"evidence_id": 10791,
"data": {
"cve": "CVE-2018-14667",
"cwes": [
"CWE-94"
],
"name": "Red Hat JBoss RichFaces Framework Expression Language Injection Vulnerability",
"source": "cisa_kev",
"vendor": "Red Hat",
"product": "JBoss RichFaces Framework",
"date_added": "2023-09-28",
"description": "Red Hat JBoss RichFaces Framework contains an expression language injection vulnerability via the UserResource resource. A remote, unauthenticated attacker could exploit this vulnerability to execute malicious code using a chain of Java serialized objects via org.ajax4jsf.resource.UserResource$UriData.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "red-hat",
"evidence_id": 10791,
"data": {
"cve": "CVE-2015-3246",
"name": "Red Hat Libuser Race Condition Vulnerability",
"source": "cisa_kev",
"vendor": "Red Hat",
"product": "Libuser",
"date_added": "2026-08-26",
"description": "Red Hat libuser contains a race condition vulnerability that allows authenticated local users to corrupt the /etc/passwd file to cause a denial of service or privilege escalation.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "red-hat",
"evidence_id": 10791,
"data": {
"cve": "CVE-2010-1871",
"cwes": [
"CWE-20"
],
"name": "Red Hat Linux JBoss Seam 2 Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Red Hat",
"product": "JBoss Seam 2",
"date_added": "2021-12-10",
"description": "JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, allows attackers to perform remote code execution. This vulnerability can only be exploited when the Java Security Manager is not properly configured.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "red-hat",
"evidence_id": 10791,
"data": {
"cve": "CVE-2021-3560",
"cwes": [
"CWE-863"
],
"name": "Red Hat Polkit Incorrect Authorization Vulnerability",
"source": "cisa_kev",
"vendor": "Red Hat",
"product": "Polkit",
"date_added": "2023-05-12",
"description": "Red Hat Polkit contains an incorrect authorization vulnerability through the bypassing of credential checks for D-Bus requests, allowing for privilege escalation.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "red-hat",
"evidence_id": 10791,
"data": {
"cve": "CVE-2021-4034",
"cwes": [
"CWE-787"
],
"name": "Red Hat Polkit Out-of-Bounds Read and Write Vulnerability",
"source": "cisa_kev",
"vendor": "Red Hat",
"product": "Polkit",
"date_added": "2022-06-27",
"description": "The Red Hat polkit pkexec utility contains an out-of-bounds read and write vulnerability that allows for privilege escalation with administrative rights.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "redis",
"evidence_id": 10791,
"data": {
"cve": "CVE-2022-0543",
"cwes": [
"CWE-862"
],
"name": "Debian-specific Redis Server Lua Sandbox Escape Vulnerability",
"source": "cisa_kev",
"vendor": "Redis",
"product": "Debian-specific Redis Servers",
"date_added": "2022-03-28",
"description": "Redis is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "sciencelogic",
"evidence_id": 10791,
"data": {
"cve": "CVE-2024-9537",
"name": "ScienceLogic SL1 Unspecified Vulnerability",
"source": "cisa_kev",
"vendor": "ScienceLogic",
"product": "SL1",
"date_added": "2024-10-21",
"description": "ScienceLogic SL1 (formerly EM7) is affected by an unspecified vulnerability involving an unspecified third-party component.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "servicenow",
"evidence_id": 10791,
"data": {
"cve": "CVE-2024-4879",
"cwes": [
"CWE-1287"
],
"name": "ServiceNow Improper Input Validation Vulnerability",
"source": "cisa_kev",
"vendor": "ServiceNow",
"product": "Utah, Vancouver, and Washington DC Now Platform",
"date_added": "2024-07-29",
"description": "ServiceNow Utah, Vancouver, and Washington DC Now Platform releases contain a jelly template injection vulnerability in UI macros. An unauthenticated user could exploit this vulnerability to execute code remotely.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "servicenow",
"evidence_id": 10791,
"data": {
"cve": "CVE-2024-5217",
"cwes": [
"CWE-184"
],
"name": "ServiceNow Incomplete List of Disallowed Inputs Vulnerability",
"source": "cisa_kev",
"vendor": "ServiceNow",
"product": "Utah, Vancouver, and Washington DC Now Platform",
"date_added": "2024-07-29",
"description": "ServiceNow Washington DC, Vancouver, and earlier Now Platform releases contain an incomplete list of disallowed inputs vulnerability in the GlideExpression script. An unauthenticated user could exploit this vulnerability to execute code remotely.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "sitecore",
"evidence_id": 10791,
"data": {
"cve": "CVE-2019-9874",
"cwes": [
"CWE-502"
],
"name": "Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability",
"source": "cisa_kev",
"vendor": "Sitecore",
"product": "CMS and Experience Platform (XP)",
"date_added": "2025-03-26",
"description": "Sitecore CMS and Experience Platform (XP) contain a deserialization vulnerability in the Sitecore.Security.AntiCSRF module that allows an unauthenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "sitecore",
"evidence_id": 10791,
"data": {
"cve": "CVE-2019-9875",
"cwes": [
"CWE-502"
],
"name": "Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability",
"source": "cisa_kev",
"vendor": "Sitecore",
"product": "CMS and Experience Platform (XP)",
"date_added": "2025-03-26",
"description": "Sitecore CMS and Experience Platform (XP) contain a deserialization vulnerability in the Sitecore.Security.AntiCSRF module that allows an authenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "sitecore",
"evidence_id": 10791,
"data": {
"cve": "CVE-2025-53690",
"cwes": [
"CWE-502"
],
"name": "Sitecore Multiple Products Deserialization of Untrusted Data Vulnerability",
"source": "cisa_kev",
"vendor": "Sitecore",
"product": "Multiple Products",
"date_added": "2025-09-04",
"description": "Sitecore Experience Manager (XM), Experience Platform (XP), Experience Commerce (XC), and Managed Cloud contain a deserialization of untrusted data vulnerability involving the use of default machine keys. This flaw allows attackers to exploit exposed ASP.NET machine keys to achieve remote code execution.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "sitecore",
"evidence_id": 10791,
"data": {
"cve": "CVE-2021-42237",
"cwes": [
"CWE-502"
],
"name": "Sitecore XP Remote Command Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Sitecore",
"product": "XP",
"date_added": "2022-03-25",
"description": "Sitcore XP contains an insecure deserialization vulnerability which can allow for remote code execution.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "solarwinds",
"evidence_id": 10791,
"data": {
"cve": "CVE-2020-10148",
"cwes": [
"CWE-288"
],
"name": "SolarWinds Orion Authentication Bypass Vulnerability",
"source": "cisa_kev",
"vendor": "SolarWinds",
"product": "Orion",
"date_added": "2021-11-03",
"description": "SolarWinds Orion API contains an authentication bypass vulnerability that could allow a remote attacker to execute API commands.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "solarwinds",
"evidence_id": 10791,
"data": {
"cve": "CVE-2021-35247",
"cwes": [
"CWE-20"
],
"name": "SolarWinds Serv-U Improper Input Validation Vulnerability",
"source": "cisa_kev",
"vendor": "SolarWinds",
"product": "Serv-U",
"date_added": "2022-01-21",
"description": "SolarWinds Serv-U versions 15.2.5 and earlier contain an improper input validation vulnerability that allows attackers to build and send queries without sanitization.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "solarwinds",
"evidence_id": 10791,
"data": {
"cve": "CVE-2024-28995",
"cwes": [
"CWE-22"
],
"name": "SolarWinds Serv-U Path Traversal Vulnerability ",
"source": "cisa_kev",
"vendor": "SolarWinds",
"product": "Serv-U",
"date_added": "2024-07-17",
"description": "SolarWinds Serv-U contains a path traversal vulnerability that allows an attacker access to read sensitive files on the host machine.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "solarwinds",
"evidence_id": 10791,
"data": {
"cve": "CVE-2021-35211",
"cwes": [
"CWE-787"
],
"name": "SolarWinds Serv-U Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "SolarWinds",
"product": "Serv-U",
"date_added": "2021-11-03",
"description": "SolarWinds Serv-U contains an unspecified memory escape vulnerability which can allow for remote code execution.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "solarwinds",
"evidence_id": 10791,
"data": {
"cve": "CVE-2026-28318",
"cwes": [
"CWE-400"
],
"name": "SolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability",
"source": "cisa_kev",
"vendor": "SolarWinds",
"product": "Serv-U",
"date_added": "2026-06-05",
"description": "SolarWinds Serv-U contains an uncontrolled resource consumption vulnerability that allows specially crafted POST requests using the Content-Encoding: deflate header to crash the Serv-U service without authentication.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "solarwinds",
"evidence_id": 10791,
"data": {
"cve": "CVE-2016-3643",
"cwes": [
"CWE-264"
],
"name": "SolarWinds Virtualization Manager Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "SolarWinds",
"product": "Virtualization Manager",
"date_added": "2021-11-03",
"description": "SolarWinds Virtualization Manager allows for privilege escalation through leveraging a misconfiguration of sudo.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "solarwinds",
"evidence_id": 10791,
"data": {
"cve": "CVE-2024-28986",
"cwes": [
"CWE-502"
],
"name": "SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability",
"source": "cisa_kev",
"vendor": "SolarWinds",
"product": "Web Help Desk",
"date_added": "2024-08-15",
"description": "SolarWinds Web Help Desk contains a deserialization of untrusted data vulnerability that could allow for remote code execution.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "solarwinds",
"evidence_id": 10791,
"data": {
"cve": "CVE-2025-26399",
"cwes": [
"CWE-502"
],
"name": "SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability",
"source": "cisa_kev",
"vendor": "SolarWinds",
"product": "Web Help Desk",
"date_added": "2026-03-09",
"description": "SolarWinds Web Help Desk contain a deserialization of untrusted data vulnerability in AjaxProxy that could allow an attacker to run commands on the host machine.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "solarwinds",
"evidence_id": 10791,
"data": {
"cve": "CVE-2025-40551",
"cwes": [
"CWE-502"
],
"name": "SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability",
"source": "cisa_kev",
"vendor": "SolarWinds",
"product": "Web Help Desk",
"date_added": "2026-02-03",
"description": "SolarWinds Web Help Desk contains a deserialization of untrusted data vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This could be exploited without authentication.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "solarwinds",
"evidence_id": 10791,
"data": {
"cve": "CVE-2024-28987",
"cwes": [
"CWE-798"
],
"name": "SolarWinds Web Help Desk Hardcoded Credential Vulnerability",
"source": "cisa_kev",
"vendor": "SolarWinds",
"product": "Web Help Desk",
"date_added": "2024-10-15",
"description": "SolarWinds Web Help Desk contains a hardcoded credential vulnerability that could allow a remote, unauthenticated user to access internal functionality and modify data.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "solarwinds",
"evidence_id": 10791,
"data": {
"cve": "CVE-2025-40536",
"cwes": [
"CWE-693"
],
"name": "SolarWinds Web Help Desk Security Control Bypass Vulnerability",
"source": "cisa_kev",
"vendor": "SolarWinds",
"product": "Web Help Desk",
"date_added": "2026-02-12",
"description": "SolarWinds Web Help Desk contains a security control bypass vulnerability that could allow an unauthenticated attacker to gain access to certain restricted functionality.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "sonatype",
"evidence_id": 10791,
"data": {
"cve": "CVE-2019-7238",
"name": "Sonatype Nexus Repository Manager Incorrect Access Control Vulnerability",
"source": "cisa_kev",
"vendor": "Sonatype",
"product": "Nexus Repository Manager",
"date_added": "2021-12-10",
"description": "Sonatype Nexus Repository Manager before 3.15.0 has an incorrect access control vulnerability. Exploitation allows for remote code execution.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "sonatype",
"evidence_id": 10791,
"data": {
"cve": "CVE-2020-10199",
"cwes": [
"CWE-917"
],
"name": "Sonatype Nexus Repository Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Sonatype",
"product": "Nexus Repository",
"date_added": "2021-11-03",
"description": "Sonatype Nexus Repository contains an unspecified vulnerability that allows for remote code execution.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "sophos",
"evidence_id": 10791,
"data": {
"cve": "CVE-2020-29574",
"cwes": [
"CWE-89"
],
"name": "CyberoamOS (CROS) SQL Injection Vulnerability",
"source": "cisa_kev",
"vendor": "Sophos",
"product": "CyberoamOS",
"date_added": "2025-02-06",
"description": "CyberoamOS (CROS) contains a SQL injection vulnerability in the WebAdmin that allows an unauthenticated attacker to execute arbitrary SQL statements remotely.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "sophos",
"evidence_id": 10791,
"data": {
"cve": "CVE-2022-1040",
"cwes": [
"CWE-158"
],
"name": "Sophos Firewall Authentication Bypass Vulnerability",
"source": "cisa_kev",
"vendor": "Sophos",
"product": "Firewall",
"date_added": "2022-03-31",
"description": "An authentication bypass vulnerability in User Portal and Webadmin of Sophos Firewall allows for remote code execution.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "sophos",
"evidence_id": 10791,
"data": {
"cve": "CVE-2022-3236",
"cwes": [
"CWE-94"
],
"name": "Sophos Firewall Code Injection Vulnerability",
"source": "cisa_kev",
"vendor": "Sophos",
"product": "Firewall",
"date_added": "2022-09-23",
"description": "A code injection vulnerability in the User Portal and Webadmin of Sophos Firewall allows for remote code execution.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "sophos",
"evidence_id": 10791,
"data": {
"cve": "CVE-2020-12271",
"cwes": [
"CWE-89"
],
"name": "Sophos SFOS SQL Injection Vulnerability",
"source": "cisa_kev",
"vendor": "Sophos",
"product": "SFOS",
"date_added": "2021-11-03",
"description": "Sophos Firewall operating system (SFOS) firmware contains a SQL injection vulnerability when configured with either the administration (HTTPS) service or the User Portal is exposed on the WAN zone. Successful exploitation may cause remote code execution to exfiltrate usernames and hashed passwords for the local device admin(s), portal admins, and user accounts used for remote access (but not external Active Directory or LDAP passwords).",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "sophos",
"evidence_id": 10791,
"data": {
"cve": "CVE-2020-25223",
"cwes": [
"CWE-78"
],
"name": "Sophos SG UTM Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Sophos",
"product": "SG UTM",
"date_added": "2022-03-25",
"description": "A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "sophos",
"evidence_id": 10791,
"data": {
"cve": "CVE-2023-1671",
"cwes": [
"CWE-77"
],
"name": "Sophos Web Appliance Command Injection Vulnerability",
"source": "cisa_kev",
"vendor": "Sophos",
"product": "Web Appliance",
"date_added": "2023-11-16",
"description": "Sophos Web Appliance contains a command injection vulnerability in the warn-proceed handler that allows for remote code execution.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "sophos",
"evidence_id": 10791,
"data": {
"cve": "CVE-2020-15069",
"cwes": [
"CWE-120"
],
"name": "Sophos XG Firewall Buffer Overflow Vulnerability",
"source": "cisa_kev",
"vendor": "Sophos",
"product": "XG Firewall",
"date_added": "2025-02-06",
"description": "Sophos XG Firewall contains a buffer overflow vulnerability that allows for remote code execution via the \"HTTP/S bookmark\" feature.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "splunk",
"evidence_id": 10791,
"data": {
"cve": "CVE-2026-20253",
"cwes": [
"CWE-306"
],
"name": "Splunk Enterprise Missing Authentication for Critical Function Vulnerability",
"source": "cisa_kev",
"vendor": "Splunk",
"product": "Enterprise",
"date_added": "2026-06-18",
"description": "Splunk Enterprise contains a missing authentication for critical function vulnerability which could allow an unauthenticated user to create or truncate arbitrary files through a PostgreSQL sidecar service endpoint.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "teamviewer",
"evidence_id": 10791,
"data": {
"cve": "CVE-2019-18988",
"cwes": [
"CWE-521"
],
"name": "TeamViewer Desktop Bypass Remote Login Vulnerability",
"source": "cisa_kev",
"vendor": "TeamViewer",
"product": "Desktop",
"date_added": "2021-11-03",
"description": "TeamViewer Desktop allows for bypass of remote-login access control because the same AES key is used for different customers' installations. If an attacker were to know this key, they could decrypt protected information stored in registry or configuration files or decryption of the Unattended Access password to the system (which allows for remote login to the system).",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "trend-micro-us",
"evidence_id": 10791,
"data": {
"cve": "CVE-2022-26871",
"cwes": [
"CWE-184"
],
"name": "Trend Micro Apex Central Arbitrary File Upload Vulnerability",
"source": "cisa_kev",
"vendor": "Trend Micro",
"product": "Apex Central",
"date_added": "2022-03-31",
"description": "An arbitrary file upload vulnerability in Trend Micro Apex Central could allow for remote code execution.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "trend-micro-us",
"evidence_id": 10791,
"data": {
"cve": "CVE-2026-34926",
"cwes": [
"CWE-23"
],
"name": "Trend Micro Apex One (On-Premise) Directory Traversal Vulnerability",
"source": "cisa_kev",
"vendor": "Trend Micro",
"product": "Apex One",
"date_added": "2026-05-21",
"description": "Trend Micro Apex One (on-premise) contains a directory traversal vulnerability that could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agents on affected installations.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "trend-micro-us",
"evidence_id": 10791,
"data": {
"cve": "CVE-2022-40139",
"cwes": [
"CWE-353",
"CWE-641"
],
"name": "Trend Micro Apex One and Apex One as a Service Improper Validation Vulnerability",
"source": "cisa_kev",
"vendor": "Trend Micro",
"product": "Apex One and Apex One as a Service",
"date_added": "2022-09-15",
"description": "Trend Micro Apex One and Apex One as a Service contain an improper validation of rollback mechanism components that could lead to remote code execution.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "trend-micro-us",
"evidence_id": 10791,
"data": {
"cve": "CVE-2020-8599",
"name": "Trend Micro Apex One and OfficeScan Authentication Bypass Vulnerability",
"source": "cisa_kev",
"vendor": "Trend Micro",
"product": "Apex One and OfficeScan",
"date_added": "2021-11-03",
"description": "Trend Micro Apex One and OfficeScan server contain a vulnerable EXE file that could allow a remote attacker to write data to a path on affected installations and bypass root login.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "trend-micro-us",
"evidence_id": 10791,
"data": {
"cve": "CVE-2020-8467",
"name": "Trend Micro Apex One and OfficeScan Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Trend Micro",
"product": "Apex One and OfficeScan",
"date_added": "2021-11-03",
"description": "Trend Micro Apex One and OfficeScan contain an unspecified vulnerability within a migration tool component that allows for remote code execution.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "trend-micro-us",
"evidence_id": 10791,
"data": {
"cve": "CVE-2023-41179",
"name": "Trend Micro Apex One and Worry-Free Business Security Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Trend Micro",
"product": "Apex One and Worry-Free Business Security",
"date_added": "2023-09-21",
"description": "Trend Micro Apex One and Worry-Free Business Security contain an unspecified vulnerability in the third-party anti-virus uninstaller that could allow an attacker to manipulate the module to conduct remote code execution. An attacker must first obtain administrative console access on the target system in order to exploit this vulnerability.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "trend-micro-us",
"evidence_id": 10791,
"data": {
"cve": "CVE-2025-54948",
"cwes": [
"CWE-78"
],
"name": "Trend Micro Apex One OS Command Injection Vulnerability",
"source": "cisa_kev",
"vendor": "Trend Micro",
"product": "Apex One",
"date_added": "2025-08-18",
"description": "Trend Micro Apex One Management Console (on-premise) contains an OS command injection vulnerability that could allow a pre-authenticated remote attacker to upload malicious code and execute commands on affected installations.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "trend-micro-us",
"evidence_id": 10791,
"data": {
"cve": "CVE-2020-8468",
"cwes": [
"CWE-74"
],
"name": "Trend Micro Multiple Products Content Validation Escape Vulnerability",
"source": "cisa_kev",
"vendor": "Trend Micro",
"product": "Apex One, OfficeScan and Worry-Free Business Security Agents",
"date_added": "2021-11-03",
"description": "Trend Micro Apex One, OfficeScan, and Worry-Free Business Security agents contain a content validation escape vulnerability that could allow an attacker to manipulate certain agent client components.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "trend-micro-us",
"evidence_id": 10791,
"data": {
"cve": "CVE-2020-24557",
"name": "Trend Micro Multiple Products Improper Access Control Vulnerability",
"source": "cisa_kev",
"vendor": "Trend Micro",
"product": "Apex One, OfficeScan, and Worry-Free Business Security",
"date_added": "2021-11-03",
"description": "Trend Micro Apex One, OfficeScan, and Worry-Free Business Security on Microsoft Windows contain an improper access control vulnerability that may allow an attacker to manipulate a particular product folder to disable the security temporarily, abuse a specific Windows function, and attain privilege escalation.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "trend-micro-us",
"evidence_id": 10791,
"data": {
"cve": "CVE-2021-36741",
"cwes": [
"CWE-22"
],
"name": "Trend Micro Multiple Products Improper Input Validation Vulnerability",
"source": "cisa_kev",
"vendor": "Trend Micro",
"product": "Apex One, Apex One as a Service, and Worry-Free Business Security",
"date_added": "2021-11-03",
"description": "Trend Micro Apex One, Apex One as a Service, and Worry-Free Business Security contain an improper input validation vulnerability that allows a remote attacker to upload files.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "trend-micro-us",
"evidence_id": 10791,
"data": {
"cve": "CVE-2021-36742",
"cwes": [
"CWE-20"
],
"name": "Trend Micro Multiple Products Improper Input Validation Vulnerability",
"source": "cisa_kev",
"vendor": "Trend Micro",
"product": "Apex One, Apex One as a Service, and Worry-Free Business Security",
"date_added": "2021-11-03",
"description": "Trend Micro Apex One, Apex One as a Service, and Worry-Free Business Security contain an improper input validation vulnerability that allows for privilege escalation.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "trend-micro-us",
"evidence_id": 10791,
"data": {
"cve": "CVE-2019-18187",
"cwes": [
"CWE-22"
],
"name": "Trend Micro OfficeScan Directory Traversal Vulnerability",
"source": "cisa_kev",
"vendor": "Trend Micro",
"product": "OfficeScan",
"date_added": "2021-11-03",
"description": "Trend Micro OfficeScan contains a directory traversal vulnerability by extracting files from a zip file to a specific folder on the OfficeScan server, leading to remote code execution.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "twilio",
"evidence_id": 10791,
"data": {
"cve": "CVE-2024-39891",
"cwes": [
"CWE-203"
],
"name": "Twilio Authy Information Disclosure Vulnerability",
"source": "cisa_kev",
"vendor": "Twilio",
"product": "Authy",
"date_added": "2024-07-23",
"description": "Twilio Authy contains an information disclosure vulnerability in its API that allows an unauthenticated endpoint to accept a request containing a phone number and respond with information about whether the phone number was registered with Authy.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "ubiquiti",
"evidence_id": 10791,
"data": {
"cve": "CVE-2010-5330",
"cwes": [
"CWE-77"
],
"name": "Ubiquiti AirOS Command Injection Vulnerability",
"source": "cisa_kev",
"vendor": "Ubiquiti",
"product": "AirOS",
"date_added": "2022-04-15",
"description": "Certain Ubiquiti devices contain a command injection vulnerability via a GET request to stainfo.cgi.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "ubiquiti",
"evidence_id": 10791,
"data": {
"cve": "CVE-2026-34908",
"cwes": [
"CWE-284"
],
"name": "Ubiquiti UniFi OS Improper Access Control Vulnerability",
"source": "cisa_kev",
"vendor": "Ubiquiti",
"product": "UniFi OS",
"date_added": "2026-06-23",
"description": "Ubiquiti UniFi OS contains an improper access control vulnerability which could allow a malicious actor with access to the network to make unauthorized changes to the system.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "ubiquiti",
"evidence_id": 10791,
"data": {
"cve": "CVE-2026-34910",
"cwes": [
"CWE-20"
],
"name": "Ubiquiti UniFi OS Improper Input Validation Vulnerability",
"source": "cisa_kev",
"vendor": "Ubiquiti",
"product": "UniFi OS",
"date_added": "2026-06-23",
"description": "Ubiquiti UniFi OS contains an improper input validation vulnerability which could allow a malicious actor with access to the network to conduct command injection.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "ubiquiti",
"evidence_id": 10791,
"data": {
"cve": "CVE-2026-34909",
"cwes": [
"CWE-22"
],
"name": "Ubiquiti UniFi OS Path Traversal Vulnerability",
"source": "cisa_kev",
"vendor": "Ubiquiti",
"product": "UniFi OS",
"date_added": "2026-06-23",
"description": "Ubiquiti UniFi OS contains a path traversal vulnerability which could allow a malicious actor with access to the network to access files on the underlying system that could be manipulated to access an underlying account.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "watchguard-technologies",
"evidence_id": 10791,
"data": {
"cve": "CVE-2022-26318",
"cwes": [
"CWE-122"
],
"name": "WatchGuard Firebox and XTM Appliances Arbitrary Code Execution",
"source": "cisa_kev",
"vendor": "WatchGuard",
"product": "Firebox and XTM Appliances",
"date_added": "2022-03-25",
"description": "On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary code.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "watchguard-technologies",
"evidence_id": 10791,
"data": {
"cve": "CVE-2022-23176",
"name": "WatchGuard Firebox and XTM Privilege Escalation Vulnerability",
"source": "cisa_kev",
"vendor": "WatchGuard",
"product": "Firebox and XTM",
"date_added": "2022-04-11",
"description": "WatchGuard Firebox and XTM appliances allow a remote attacker with unprivileged credentials to access the system with a privileged management session via exposed management access.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "watchguard-technologies",
"evidence_id": 10791,
"data": {
"cve": "CVE-2025-14733",
"cwes": [
"CWE-787"
],
"name": "WatchGuard Firebox Out of Bounds Write Vulnerability",
"source": "cisa_kev",
"vendor": "WatchGuard",
"product": "Firebox",
"date_added": "2025-12-19",
"description": "WatchGuard Fireware OS iked process contains an out of bounds write vulnerability in the OS iked process. This vulnerability may allow a remote unauthenticated attacker to execute arbitrary code and affects both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when configured with a dynamic gateway peer.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "watchguard-technologies",
"evidence_id": 10791,
"data": {
"cve": "CVE-2025-9242",
"cwes": [
"CWE-787"
],
"name": "WatchGuard Firebox Out-of-Bounds Write Vulnerability",
"source": "cisa_kev",
"vendor": "WatchGuard",
"product": "Firebox",
"date_added": "2025-11-12",
"description": "WatchGuard Firebox contains an out-of-bounds write vulnerability in the OS iked process that may allow a remote unauthenticated attacker to execute arbitrary code.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "wso2",
"evidence_id": 10791,
"data": {
"cve": "CVE-2026-5430",
"cwes": [
"CWE-347"
],
"name": "WSO2 Multiple Products Path Traversal Vulnerability ",
"source": "cisa_kev",
"vendor": "WSO2",
"product": "Multiple Products",
"date_added": "2026-09-24",
"description": "WSO2 API Control Plane, API Manager, Traffic Manager & Universal Gateway contain a path traversal vulnerability that could allow for unrestricted file upload and lead to remote code execution.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "wso2",
"evidence_id": 10791,
"data": {
"cve": "CVE-2022-29464",
"cwes": [
"CWE-22"
],
"name": "WSO2 Multiple Products Unrestrictive Upload of File Vulnerability",
"source": "cisa_kev",
"vendor": "WSO2",
"product": "Multiple Products",
"date_added": "2022-04-25",
"description": "Multiple WSO2 products allow for unrestricted file upload, resulting in remote code execution.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "zoho",
"evidence_id": 10791,
"data": {
"cve": "CVE-2021-44515",
"name": "Zoho Desktop Central Authentication Bypass Vulnerability",
"source": "cisa_kev",
"vendor": "Zoho",
"product": "Desktop Central",
"date_added": "2021-12-10",
"description": "Zoho Desktop Central contains an authentication bypass vulnerability that could allow an attacker to execute arbitrary code in the Desktop Central MSP server.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "zoho",
"evidence_id": 10791,
"data": {
"cve": "CVE-2021-40539",
"cwes": [
"CWE-55"
],
"name": "Zoho ManageEngine ADSelfService Plus Authentication Bypass Vulnerability",
"source": "cisa_kev",
"vendor": "Zoho",
"product": "ManageEngine",
"date_added": "2021-11-03",
"description": "Zoho ManageEngine ADSelfService Plus contains an authentication bypass vulnerability affecting the REST API URLs which allow for remote code execution.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "zoho",
"evidence_id": 10791,
"data": {
"cve": "CVE-2022-28810",
"cwes": [
"CWE-259",
"CWE-78"
],
"name": "Zoho ManageEngine ADSelfService Plus Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Zoho",
"product": "ManageEngine",
"date_added": "2023-03-07",
"description": "Zoho ManageEngine ADSelfService Plus contains an unspecified vulnerability allowing for remote code execution when performing a password change or reset.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "zoho",
"evidence_id": 10791,
"data": {
"cve": "CVE-2020-10189",
"cwes": [
"CWE-502"
],
"name": "Zoho ManageEngine Desktop Central File Upload Vulnerability",
"source": "cisa_kev",
"vendor": "Zoho",
"product": "ManageEngine",
"date_added": "2021-11-03",
"description": "Zoho ManageEngine Desktop Central contains a file upload vulnerability that allows for unauthenticated remote code execution.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "zoho",
"evidence_id": 10791,
"data": {
"cve": "CVE-2022-35405",
"cwes": [
"CWE-502"
],
"name": "Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Zoho",
"product": "ManageEngine",
"date_added": "2022-09-22",
"description": "Zoho ManageEngine PAM360, Password Manager Pro, and Access Manager Plus contain an unspecified vulnerability that allows for remote code execution.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "zoho",
"evidence_id": 10791,
"data": {
"cve": "CVE-2022-47966",
"name": "Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Zoho",
"product": "ManageEngine",
"date_added": "2023-01-23",
"description": "Multiple Zoho ManageEngine products contain an unauthenticated remote code execution vulnerability due to the usage of an outdated third-party dependency, Apache Santuario.",
"known_ransomware_use": true
}
},
{
"kind": "vulnerability",
"vendor": "zoho",
"evidence_id": 10791,
"data": {
"cve": "CVE-2021-37415",
"cwes": [
"CWE-306"
],
"name": "Zoho ManageEngine ServiceDesk Authentication Bypass Vulnerability",
"source": "cisa_kev",
"vendor": "Zoho",
"product": "ManageEngine ServiceDesk Plus (SDP)",
"date_added": "2021-12-01",
"description": "Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authentication",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "zoho",
"evidence_id": 10791,
"data": {
"cve": "CVE-2019-8394",
"cwes": [
"CWE-434"
],
"name": "Zoho ManageEngine ServiceDesk Plus (SDP) File Upload Vulnerability",
"source": "cisa_kev",
"vendor": "Zoho",
"product": "ManageEngine",
"date_added": "2021-11-03",
"description": "Zoho ManageEngine ServiceDesk Plus (SDP) contains an unspecified vulnerability that allows remote users to upload files via login page customization.",
"known_ransomware_use": false
}
},
{
"kind": "vulnerability",
"vendor": "zoho",
"evidence_id": 10791,
"data": {
"cve": "CVE-2021-44077",
"cwes": [
"CWE-306"
],
"name": "Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability",
"source": "cisa_kev",
"vendor": "Zoho",
"product": "ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus",
"date_added": "2021-12-01",
"description": "Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution",
"known_ransomware_use": false
}
}
]
}