Vulnerabilities CISA has confirmed as actively exploited. Prioritize these for remediation.
Vulnerabilities newly added to CISA KEV in the last 7 days.
| CVE ID | Title | Severity | Added |
|---|---|---|---|
| Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network. | CRITICAL | 2026. 07. 16. | |
| A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests | CRITICAL |
| CVE ID | Title | Severity | References | Ransom | |||||
|---|---|---|---|---|---|---|---|---|---|
| — | — | — | 82.50 | 39.4% | KEV |
| 2026. 07. 16. |
| CVE-2026-39808 | A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.8 may allow attacker to execute unauthorized code or commands via <insert attack vector here> | CRITICAL | 2026. 07. 16. |
| CVE-2026-46817 | Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Payments. Successful attacks of this vulnerability can result in takeover of Oracle Payments. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C | CRITICAL | 2026. 07. 15. |
| CVE-2023-4346 | KNX devices that use KNX Connection Authorization and support Option 1 are, depending on the implementation, vulnerable to being locked and users being unable to reset them to gain access to the device. The BCU key feature on the devices can be used to create a password for the device, but this password can often not be reset without entering the current password. If the device is configured to interface with a network, an attacker with access to that network could interface with the KNX instal | HIGH | 2026. 07. 15. |
| CVE-2026-15410 | Post-authentication improper control of generation of code ('Code Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands. | HIGH | 2026. 07. 14. |
| CVE-2026-15409 | A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A remote unauthenticated attacker could potentially cause the appliance to make requests to unintended location. | CRITICAL | 2026. 07. 14. |
| CVE-2026-56164 | Missing authentication for critical function in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network. | MEDIUM | 2026. 07. 14. |
| CVE-2026-56155 | Insufficient granularity of access control in Active Directory Federation Services (AD FS) allows an authorized attacker to elevate privileges locally. | HIGH | 2026. 07. 14. |
| — |
| 2025. 12. 03. |
| — |
| CVE-2025-48633 | In hasAccountsOnAnyUser of DevicePolicyManagerService.java, there is a possible way to add a Device Owner after provisioning due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | MEDIUM | 5.5v3.1 | 82.50 | 0.2% | KEV KISA | 2025. 12. 08. | 2025. 12. 02. | — |
| CVE-2025-48572 | In multiple locations, there is a possible way to launch activities from the background due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | HIGH | 7.8v3.1 | 100 | 0.2% | KEV KISA | 2025. 12. 08. | 2025. 12. 02. | — |
| CVE-2021-26829 | — | — | — | 82.50 | 48.0% | KEV | — | 2025. 11. 28. | — |
| CVE-2025-61757 | Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Identity Manager. Successful attacks of this vulnerability can result in takeover of Identity Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/ | CRITICAL | 9.8v3.1 | 100 | 88.3% | KEV KISA | 2025. 10. 21. | 2025. 11. 21. | — |
| CVE-2025-13223 | Type Confusion in V8 in Google Chrome prior to 142.0.7444.175 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) | HIGH | 8.8v3.1 | 100 | 4.9% | KEV | 2025. 11. 17. | 2025. 11. 19. | — |
| CVE-2025-58034 | An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4.0 through 7.4.10, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an authenticated attacker to execute unauthorized code on the underlying system via crafted HTTP requests or CLI commands. | HIGH | 7.2v3.1 | 100 | 55.6% | KEV KISA | 2025. 11. 18. | 2025. 11. 18. | — |
| CVE-2025-64446 | A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests. | CRITICAL | 9.8v3.1 | 100 | 89.4% | KEV KISA | 2025. 11. 14. | 2025. 11. 14. | — |
| CVE-2025-62215 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileges locally. | HIGH | 7.0v3.1 | 100 | 6.1% | KEV KISA | 2025. 11. 11. | 2025. 11. 12. | — |
| CVE-2025-12480 | Triofox versions prior to 16.7.10368.56560, are vulnerable to an Improper Access Control flaw that allows access to initial setup pages even after setup is complete. | CRITICAL | 9.1v3.1 | 100 | 90.5% | KEV | 2025. 11. 10. | 2025. 11. 12. | — |
| CVE-2025-9242 | An Out-of-bounds Write vulnerability in WatchGuard Fireware OS may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the Mobile User VPN with IKEv2 and the Branch Office VPN using IKEv2 when configured with a dynamic gateway peer.This vulnerability affects Fireware OS 11.10.2 up to and including 11.12.4_Update1, 12.0 up to and including 12.11.3 and 2025.1. | CRITICAL | 9.3v4.0 | 100 | 86.4% | KEV | 2025. 09. 17. | 2025. 11. 12. | — |
| CVE-2025-21042 | Out-of-bounds write in libimagecodec.quram.so prior to SMR Apr-2025 Release 1 allows remote attackers to execute arbitrary code. | HIGH | 8.8v3.1 | 100 | 11.6% | KEV KISA | 2025. 09. 12. | 2025. 11. 10. | — |
| CVE-2025-11371 | In the default installation and configuration of Gladinet CentreStack and TrioFox, there is an unauthenticated Local File Inclusion Flaw that allows unintended disclosure of system files. Exploitation of this vulnerability has been observed in the wild. This issue impacts Gladinet CentreStack and Triofox: All versions prior to and including 16.7.10368.56560 | HIGH | 7.5v3.1 | 100 | 92.1% | KEV | 2025. 10. 09. | 2025. 11. 04. | — |
| CVE-2025-48703 | CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1205 allows unauthenticated remote code execution via shell metacharacters in the t_total parameter in a filemanager changePerm request. A valid non-root username must be known. | CRITICAL | 9.0v3.1 | 100 | 99.6% | KEV | 2025. 09. 19. | 2025. 11. 04. | — |
| CVE-2025-41244 | VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM. | HIGH | 7.8v3.1 | 100 | 7.9% | KEV KISA | 2025. 09. 29. | 2025. 10. 30. | — |
| CVE-2025-24893 | XWiki Platform allows remote code execution as guest via SolrSearchMacros request | CRITICAL | 9.8v3.1 | 100 | 99.9% | KEV | 2025. 02. 20. | 2025. 10. 30. | — |
| CVE-2025-6205 | A missing authorization vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could allow an attacker to gain privileged access to the application. | CRITICAL | 9.1v3.1 | 100 | 71.1% | KEV | 2025. 08. 04. | 2025. 10. 28. | — |
| CVE-2025-6204 | An Improper Control of Generation of Code (Code Injection) vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could allow an attacker to execute arbitrary code. | HIGH | 8.0v3.1 | 100 | 76.1% | KEV | 2025. 08. 04. | 2025. 10. 28. | — |
| CVE-2025-59287 | Deserialization of untrusted data in Windows Server Update Service allows an unauthorized attacker to execute code over a network. | CRITICAL | 9.8v3.1 | 100 | 100.0% | KEV KISA | 2025. 10. 14. | 2025. 10. 24. | — |
| CVE-2025-54236 | Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality, and integrity impact to high. Exploitation of this issue does not require user interaction. | CRITICAL | 9.1v3.1 | 100 | 96.7% | KEV | 2025. 09. 09. | 2025. 10. 24. | — |