T1190Initial Access

Exploit Public-Facing Application

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration. Exploited applications are often websites/web servers, but can also include databases (like SQL), standard services (like SMB or SSH), network device administration and management protocols…

attack.mitre.org ↗

CVEs888

In 799

Reports17

Detections

149 Sigma rules tagged T1190

Exploit Public-Facing ApplicationT1190149 general rules

Arcadyan Router Exploitationscriticaltest
Citrix ADS Exploitation CVE-2020-8193 CVE-2020-8195criticaltest
Citrix Netscaler Attack CVE-2019-19781criticaltest
Confluence Exploitation CVE-2019-3398criticaltest
CVE-2010-5278 Exploitation Attemptcriticaltest
CVE-2020-0688 Exchange Exploitation via Web Logcriticaltest
CVE-2020-10148 SolarWinds Orion API Auth Bypasscriticaltest
CVE-2020-5902 F5 BIG-IP Exploitation Attemptcriticaltest

All 149 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

CVEs linked to Exploit Public-Facing Application

Top 150 of 888 by priority. Each link shows its badge.

CVE-2025-55182Meta React Server Components Remote Code Execution Vulnerability
Meta · React Server ComponentsKEVRansomwarePublic exploitCritical · 10.0T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter5 reports
AI mapping from the description · how it is exploited
99.8%Top 0.04%
95.0priority
CVE-2026-0257Palo Alto Networks PAN-OS Authentication Bypass Vulnerability
Palo Alto Networks · PAN-OSKEVRansomwarePublic exploitCritical · 9.1T1190Exploit Public-Facing Application T1133External Remote Services4 reports
AI mapping from the description · how it is exploited
95.0%Top 0.14%
93.3priority
CVE-2026-1731BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection Vulnerability
BeyondTrust · Remote Support (RS) and Privileged Remote Access (PRA)KEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter2 reports
AI mapping from the description · how it is exploited
93.1%Top 0.17%
91.0priority
CVE-2021-44228Apache Log4j2 Remote Code Execution Vulnerability
Apache · Log4j2KEVRansomwarePublic exploitCritical · 10.0T1608.001Upload Malware T1190Exploit Public-Facing Application+3 more · 10 reports
MITRE CTID mapping of the KEV entry · how it is exploited
>99.9%Top 0.01%
90.0priority
CVE-2018-13379Fortinet FortiOS SSL VPN Path Traversal Vulnerability
Fortinet · FortiOSKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application5 reports
MITRE CTID mapping of the KEV entry · how it is exploited
>99.9%Top 0.01%
89.9priority
CVE-2020-5902F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability
F5 · BIG-IPKEVRansomwarePublic exploitCritical · 9.8T1133External Remote Services T1190Exploit Public-Facing Application+5 more · 5 reports
MITRE CTID mapping of the KEV entry · how it is exploited
>99.9%Top 0.01%
89.9priority
CVE-2023-3519Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability
Citrix · NetScaler ADC and NetScaler GatewayKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1574Hijack Execution Flow+2 more · 6 reports
MITRE CTID mapping of the KEV entry · how it is exploited
99.7%Top 0.05%
89.9priority
CVE-2026-63077JetBrains TeamCity Deserialization of Untrusted Data Vulnerability
JetBrains · TeamCityKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter
AI mapping from the description · how it is exploited
93.6%Top 0.16%
89.8priority
CVE-2021-34473Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft · Exchange ServerKEVRansomwarePublic exploitCritical · 9.1T1190Exploit Public-Facing Application T1053.005Scheduled Task+3 more · 9 reports
MITRE CTID mapping of the KEV entry · how it is exploited
>99.9%Top 0.01%
89.4priority
CVE-2026-110447Collabora Online – Built-in CODE Server OS Command Injection Vulnerability
Collabora · Collabora Online – Built-in CODE ServerKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter
AI mapping from the description · how it is exploited
73.3%Top 0.54%
89.4priority
CVE-2021-34523Microsoft Exchange Server Privilege Escalation Vulnerability
Microsoft · Exchange ServerKEVRansomwarePublic exploitCritical · 9.0T1190Exploit Public-Facing Application9 reports
MITRE CTID mapping of the KEV entry · how it is exploited
>99.9%Top 0.01%
89.3priority
CVE-2019-0604Microsoft SharePoint Remote Code Execution Vulnerability
Microsoft · SharePointKEVRansomwarePublic exploitCritical · 9.8T1608.001Upload Malware T1190Exploit Public-Facing Application+3 more · 4 reports
MITRE CTID mapping of the KEV entry · how it is exploited
99.9%Top 0.03%
88.8priority
CVE-2019-2725Oracle WebLogic Server, Injection
Oracle · WebLogic ServerKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter4 reports
MITRE CTID mapping of the CVE · uncategorised
>99.9%Top 0.02%
88.8priority
CVE-2022-42475Fortinet FortiOS Heap-Based Buffer Overflow Vulnerability
Fortinet · FortiOSKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1574Hijack Execution Flow+2 more · 4 reports
MITRE CTID mapping of the KEV entry · how it is exploited
99.5%Top 0.06%
88.8priority
CVE-2025-52691SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerability
SmarterTools · SmarterMailKEVRansomwarePublic exploitCritical · 10.0T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter+1 more · 1 report
AI mapping from the description · how it is exploited
85.7%Top 0.28%
88.8priority
CVE-2026-1281Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability
Ivanti · Endpoint Manager Mobile (EPMM)KEVPublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter1 report
AI mapping from the description · how it is exploited
98.7%Top 0.08%
88.7priority
CVE-2024-21887Ivanti Connect Secure and Policy Secure Command Injection Vulnerability
Ivanti · Connect Secure and Policy SecureKEVRansomwarePublic exploitCritical · 9.1T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter+2 more · 4 reports
MITRE CTID mapping of the KEV entry · how it is exploited
>99.9%Top 0.01%
88.4priority
CVE-2026-18577N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability
N-able · N-centralKEVPublic exploitHigh · 8.1T1190Exploit Public-Facing Application T1078Valid Accounts7 reports
AI mapping from the description · how it is exploited
14.6%Top 3.3%
88.0priority
CVE-2020-0796Microsoft SMBv3 Remote Code Execution Vulnerability
Microsoft · SMBv3KEVRansomwarePublic exploitCritical · 10.0T1190Exploit Public-Facing Application3 reports
AI mapping from the description · how it is exploited
99.8%Top 0.04%
87.7priority
CVE-2023-46805Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerability
Ivanti · Connect Secure and Policy SecureKEVRansomwarePublic exploitHigh · 8.2T1190Exploit Public-Facing Application T1078Valid Accounts+2 more · 4 reports
MITRE CTID mapping of the KEV entry · how it is exploited
>99.9%Top 0.02%
87.7priority
CVE-2024-3400Palo Alto Networks PAN-OS Command Injection Vulnerability
Palo Alto Networks · PAN-OSKEVRansomwarePublic exploitCritical · 10.0T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter3 reports
AI mapping from the description · how it is exploited
>99.9%Top 0.01%
87.7priority
CVE-2026-15409SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability
SonicWall · SMA1000 AppliancesKEVRansomwarePublic exploitCritical · 10.0T1190Exploit Public-Facing Application T1090Proxy1 report
AI mapping from the description · how it is exploited
6.8%Top 6%
87.7priority
CVE-2022-47966Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability
Zoho · ManageEngineKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1136.001Local Account+1 more · 3 reports
MITRE CTID mapping of the KEV entry · how it is exploited
99.8%Top 0.04%
87.6priority
CVE-2020-0688Microsoft Exchange Server Validation Key Remote Code Execution Vulnerability
Microsoft · Exchange ServerKEVRansomwarePublic exploitHigh · 8.8T1190Exploit Public-Facing Application T1505.003Web Shell+2 more · 3 reports
MITRE CTID mapping of the KEV entry · how it is exploited
>99.9%Top 0.03%
86.9priority
CVE-2026-59310Broadcom VMware vCenter Path Traversal Vulnerability
Broadcom · VMware vCenterKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter
AI mapping from the description · how it is exploited
2.6%Top 15%
86.9priority
CVE-2023-20198Cisco IOS XE Web UI Privilege Escalation Vulnerability
Cisco · IOS XE Web UIKEVPublic exploitCritical · 10.0T1190Exploit Public-Facing Application T1136Create Account2 reports
MITRE CTID mapping of the KEV entry · how it is exploited
99.6%Top 0.05%
86.1priority
CVE-2010-0840Oracle JRE Unspecified Vulnerability
Oracle · Java Runtime Environment (JRE)KEVPublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter2 reports
AI mapping from the description · how it is exploited
96.3%Top 0.12%
86.0priority
CVE-2012-0507Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability
Oracle · Java SEKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1211Exploitation for Stealth+1 more · 2 reports
AI mapping from the description · how it is exploited
98.2%Top 0.09%
86.0priority
CVE-2016-3088Apache ActiveMQ Improper Input Validation Vulnerability
Apache · ActiveMQKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter2 reports
MITRE CTID mapping of the CVE · uncategorised
98.5%Top 0.08%
86.0priority
CVE-2018-10561Dasan GPON Routers Authentication Bypass Vulnerability
Dasan · Gigabit Passive Optical Network (GPON) RoutersKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1078Valid Accounts2 reports
AI mapping from the description · how it is exploited
92.8%Top 0.17%
86.0priority
CVE-2022-22965Spring Framework JDK 9+ Remote Code Execution Vulnerability
VMware · Spring FrameworkKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter2 reports
MITRE CTID mapping of the KEV entry · how it is exploited
99.6%Top 0.05%
86.0priority
CVE-2022-26134Atlassian Confluence Server and Data Center Remote Code Execution Vulnerability
Atlassian · Confluence Server/Data CenterKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application2 reports
MITRE CTID mapping of the KEV entry · how it is exploited
>99.9%Top 0.01%
86.0priority
CVE-2022-30525Zyxel Multiple Firewalls OS Command Injection Vulnerability
Zyxel · Multiple FirewallsKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter2 reports
AI mapping from the description · how it is exploited
99.9%Top 0.03%
86.0priority
CVE-2023-34362Progress MOVEit Transfer SQL Injection Vulnerability
Progress · MOVEit TransferKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter+5 more · 2 reports
MITRE CTID mapping of the KEV entry · how it is exploited
99.9%Top 0.03%
86.0priority
CVE-2025-53770Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
Microsoft · SharePointKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter2 reports
MITRE CTID mapping of the KEV entry · how it is exploited
>99.9%Top 0.01%
86.0priority
CVE-2025-0282Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability
Ivanti · Connect Secure, Policy Secure, and ZTA GatewaysKEVRansomwarePublic exploitCritical · 9.0T1595Active Scanning T1190Exploit Public-Facing Application+4 more · 2 reports
MITRE CTID mapping of the KEV entry · how it is exploited
>99.9%Top 0.02%
85.4priority
CVE-2024-20353Cisco ASA and FTD Denial of Service Vulnerability
Cisco · Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)KEVPublic exploitHigh · 8.6T1608.001Upload Malware T1190Exploit Public-Facing Application+2 more · 2 reports
MITRE CTID mapping of the KEV entry · how it is exploited
69.8%Top 0.63%
85.0priority
CVE-2025-26399SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability
SolarWinds · Web Help DeskKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter
AI mapping from the description · how it is exploited
90.1%Top 0.2%
84.8priority
CVE-2025-61757Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability
Oracle · Fusion MiddlewareKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1078Valid Accounts
AI mapping from the description · how it is exploited
88.6%Top 0.23%
84.8priority
CVE-2026-1340Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability
Ivanti · Endpoint Manager Mobile (EPMM)KEVPublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter
AI mapping from the description · how it is exploited
98.6%Top 0.08%
84.8priority
CVE-2026-20131Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management…
Cisco · Secure Firewall Management Center (FMC)KEVRansomwarePublic exploitCritical · 10.0T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter
AI mapping from the description · how it is exploited
44.4%Top 1.2%
84.8priority
CVE-2026-21643Fortinet FortiClient EMS SQL Injection Vulnerability
Fortinet · FortiClient EMSKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter
AI mapping from the description · how it is exploited
97.7%Top 0.1%
84.8priority
CVE-2026-23760SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel Vulnerability
SmarterTools · SmarterMailKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1078Valid Accounts+1 more
AI mapping from the description · how it is exploited
96.4%Top 0.12%
84.8priority
CVE-2026-24061GNU InetUtils Argument Injection Vulnerability
GNU · InetUtilsKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1078Valid Accounts
AI mapping from the description · how it is exploited
99.0%Top 0.07%
84.8priority
CVE-2026-24423SmarterTools SmarterMail Missing Authentication for Critical Function Vulnerability
SmarterTools · SmarterMailKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter
AI mapping from the description · how it is exploited
88.2%Top 0.23%
84.8priority
CVE-2026-35273Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability
Oracle · PeopleSoft Enterprise PeopleToolsKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1078Valid Accounts
AI mapping from the description · how it is exploited
96.7%Top 0.12%
84.8priority
CVE-2026-35616Fortinet FortiClient EMS Improper Access Control Vulnerability
Fortinet · FortiClient EMSKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter
AI mapping from the description · how it is exploited
94.0%Top 0.15%
84.8priority
CVE-2026-41940WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability
WebPros · cPanel & WHM and WP2 (WordPress Squared)KEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1078Valid Accounts
AI mapping from the description · how it is exploited
98.5%Top 0.08%
84.8priority
CVE-2025-59718Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability
Fortinet · Multiple ProductsKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1078Valid Accounts
AI mapping from the description · how it is exploited
68.3%Top 0.67%
84.7priority
CVE-2026-0300Palo Alto Networks PAN-OS Out-of-bounds Write Vulnerability
Palo Alto Networks · PAN-OSKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter
AI mapping from the description · how it is exploited
41.7%Top 1.3%
84.6priority
CVE-2017-10271Oracle Corporation WebLogic Server Remote Code Execution Vulnerability
Oracle · WebLogic ServerKEVRansomwarePublic exploitHigh · 7.5T1190Exploit Public-Facing Application T1499.004Application or System Exploitation2 reports
MITRE CTID mapping of the CVE · uncategorised
>99.9%Top 0.01%
84.4priority
CVE-2026-48172LiteSpeed cPanel Plugin Privilege Escalation Vulnerability
LiteSpeed · cPanel PluginKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1068Exploitation for Privilege Escalation
AI mapping from the description · how it is exploited
17.9%Top 2.8%
84.3priority
CVE-2026-42271BerriAI LiteLLM Command Injection Vulnerability
BerriAI · LiteLLMKEVPublic exploitHigh · 8.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter
AI mapping from the description · how it is exploited
91.4%Top 0.19%
84.1priority
CVE-2026-45659Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability
Microsoft · SharePoint ServerKEVRansomwarePublic exploitHigh · 8.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter
AI mapping from the description · how it is exploited
80.2%Top 0.38%
84.1priority
CVE-2026-46817Oracle E-Business Suite Improper Privilege Management Vulnerability
Oracle · E-Business SuiteKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1068Exploitation for Privilege Escalation
AI mapping from the description · how it is exploited
12.3%Top 3.8%
84.1priority
CVE-2024-1709ConnectWise ScreenConnect Authentication Bypass Vulnerability
ConnectWise · ScreenConnectKEVRansomwarePublic exploitCritical · 10.0T1190Exploit Public-Facing Application T1078Valid Accounts1 report
AI mapping from the description · how it is exploited
>99.9%Top 0.02%
83.9priority
CVE-2026-20182Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability
Cisco · Catalyst SD-WANKEVPublic exploitCritical · 10.0T1190Exploit Public-Facing Application4 reports
AI mapping from the description · how it is exploited
91.8%Top 0.18%
83.9priority
CVE-2026-20079Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability
Cisco · Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall ManagementKEVPublic exploitCritical · 10.0T1190Exploit Public-Facing Application1 report
AI mapping from the description · how it is exploited
88.7%Top 0.23%
83.8priority
CVE-2018-10562Dasan GPON Routers Command Injection Vulnerability
Dasan · Gigabit Passive Optical Network (GPON) RoutersKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter1 report
AI mapping from the description · how it is exploited
99.9%Top 0.03%
83.7priority
CVE-2018-7600Drupal Core Remote Code Execution Vulnerability
Drupal · Drupal CoreKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter+2 more · 1 report
MITRE CTID mapping of the KEV entry · how it is exploited
>99.9%Top 0.01%
83.7priority
CVE-2019-18935Progress Telerik UI for ASP.NET AJAX Deserialization of Untrusted Data Vulnerability
Progress · Telerik UI for ASP.NET AJAXKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1505.003Web Shell+2 more · 1 report
MITRE CTID mapping of the KEV entry · how it is exploited
99.7%Top 0.05%
83.7priority
CVE-2021-21972VMware vCenter Server Remote Code Execution Vulnerability
VMware · vCenter ServerKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter1 report
MITRE CTID mapping of the KEV entry · how it is exploited
99.9%Top 0.04%
83.7priority
CVE-2021-30116Kaseya Virtual System/Server Administrator (VSA) Information Disclosure Vulnerability
Kaseya · Virtual System/Server Administrator (VSA)KEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1552Unsecured Credentials1 report
AI mapping from the description · how it is exploited
85.7%Top 0.27%
83.7priority
CVE-2021-3129Laravel Ignition File Upload Vulnerability
Laravel · IgnitionKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter1 report
MITRE CTID mapping of the KEV entry · how it is exploited
99.9%Top 0.03%
83.7priority
CVE-2021-40539Zoho ManageEngine ADSelfService Plus Authentication Bypass Vulnerability
Zoho · ManageEngineKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1047Windows Management Instrumentation+11 more · 1 report
MITRE CTID mapping of the KEV entry · how it is exploited
99.0%Top 0.07%
83.7priority
CVE-2022-47986IBM Aspera Faspex Code Execution Vulnerability
IBM · Aspera FaspexKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter1 report
AI mapping from the description · how it is exploited
>99.9%Top 0.02%
83.7priority
CVE-2023-27997Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow Vulnerability
Fortinet · FortiOS and FortiProxy SSL-VPNKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1574Hijack Execution Flow+1 more · 1 report
MITRE CTID mapping of the KEV entry · how it is exploited
85.7%Top 0.28%
83.7priority
CVE-2023-46747F5 BIG-IP Configuration Utility Authentication Bypass Vulnerability
F5 · BIG-IP Configuration UtilityKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter1 report
AI mapping from the description · how it is exploited
96.7%Top 0.11%
83.7priority
CVE-2023-48788Fortinet FortiClient EMS SQL Injection Vulnerability
Fortinet · FortiClient EMSKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter+1 more · 1 report
MITRE CTID mapping of the KEV entry · how it is exploited
98.4%Top 0.08%
83.7priority
CVE-2024-55956Cleo Multiple Products Unauthenticated File Upload Vulnerability
Cleo · Multiple ProductsKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter1 report
AI mapping from the description · how it is exploited
94.0%Top 0.16%
83.7priority
CVE-2025-10035Fortra GoAnywhere MFT Deserialization of Untrusted Data Vulnerability
Fortra · GoAnywhere MFTKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter1 report
AI mapping from the description · how it is exploited
99.8%Top 0.04%
83.7priority
CVE-2025-22457Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability
Ivanti · Connect Secure, Policy Secure, and ZTA GatewaysKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter1 report
MITRE CTID mapping of the KEV entry · how it is exploited
>99.9%Top 0.02%
83.7priority
CVE-2026-81578PaperCut NG/MF Missing Authentication for Critical Function Vulnerability
PaperCut · NG/MFKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1098Account Manipulation1 report
AI mapping from the description · how it is exploited
84.7%Top 0.29%
83.7priority
CVE-2021-22893Ivanti Pulse Connect Secure Use-After-Free Vulnerability
Ivanti · Pulse Connect SecureKEVRansomwarePublic exploitCritical · 10.0T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter+1 more · 1 report
MITRE CTID mapping of the KEV entry · how it is exploited
47.2%Top 1.2%
83.6priority
CVE-2022-31199Netwrix Auditor Insecure Object Deserialization Vulnerability
Netwrix · AuditorKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter1 report
AI mapping from the description · how it is exploited
36.0%Top 1.5%
83.4priority
CVE-2026-82078PaperCut NG/MF Unsafe Reflection Vulnerability
PaperCut · NG/MFKEVPublic exploitCritical · 9.1T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter1 report
AI mapping from the description · how it is exploited
63.0%Top 0.8%
83.1priority
CVE-2017-0143Microsoft Windows Server Message Block (SMBv1) Remote Code Execution Vulnerability
Microsoft · WindowsKEVRansomwarePublic exploitHigh · 8.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter1 report
AI mapping from the description · how it is exploited
93.3%Top 0.16%
83.0priority
CVE-2022-41040Microsoft Exchange Server Server-Side Request Forgery Vulnerability
Microsoft · Exchange ServerKEVRansomwarePublic exploitHigh · 8.8T1190Exploit Public-Facing Application T1068Exploitation for Privilege Escalation1 report
AI mapping from the description · how it is exploited
>99.9%Top 0.02%
83.0priority
CVE-2025-49704Microsoft SharePoint Code Injection Vulnerability
Microsoft · SharePointKEVRansomwarePublic exploitHigh · 8.8T1190Exploit Public-Facing Application T1059.003Windows Command Shell1 report
MITRE CTID mapping of the KEV entry · how it is exploited
>99.9%Top 0.01%
83.0priority
CVE-2018-11776Apache Struts Remote Code Execution Vulnerability
Apache · StrutsKEVPublic exploitHigh · 8.1T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter+1 more · 1 report
MITRE CTID mapping of the KEV entry · how it is exploited
>99.9%Top 0.01%
82.5priority
CVE-2026-48710Kludex Starlette HTTP Request/Response Smuggling Vulnerability
Kludex · StarletteKEVPublic exploitMedium · 6.5T1190Exploit Public-Facing Application
AI mapping from the description · how it is exploited
70.3%Top 0.62%
82.4priority
CVE-2025-5777Citrix NetScaler ADC and Gateway Out-of-Bounds Read Vulnerability
Citrix · NetScaler ADC and GatewayKEVRansomwarePublic exploitHigh · 7.5T1190Exploit Public-Facing Application T1555Credentials from Password Stores1 report
MITRE CTID mapping of the KEV entry · how it is exploited
>99.9%Top 0.02%
82.1priority
CVE-2026-18556N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability
N-able · N-centralKEVPublic exploitHigh · 7.4T1190Exploit Public-Facing Application T1078Valid Accounts5 reports
AI mapping from the description · how it is exploited
7.9%Top 5.3%
82.1priority
CVE-2020-8260Ivanti Pulse Connect Secure Code Execution Vulnerability
Ivanti · Pulse Connect SecureKEVPublic exploitHigh · 7.2T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter1 report
AI mapping from the description · how it is exploited
96.5%Top 0.12%
81.9priority
CVE-2021-44832Apache Log4j2 vulnerable to RCE via JDBC Appender when attacker controls configuration
Apache Software Foundation · Apache Log4j2Public exploitMedium · 6.6T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter1 report
AI mapping from the description · how it is exploited
97.9%Top 0.09%
81.5priority
CVE-2025-49706Microsoft SharePoint Improper Authentication Vulnerability
Microsoft · SharePointKEVRansomwarePublic exploitMedium · 6.5T1190Exploit Public-Facing Application T1059.003Windows Command Shell+1 more · 1 report
MITRE CTID mapping of the KEV entry · how it is exploited
99.1%Top 0.07%
81.4priority
CVE-2025-53771Microsoft SharePoint Server Spoofing Vulnerability
Microsoft · Microsoft SharePoint Enterprise Server 2016Public exploitMedium · 6.5T1190Exploit Public-Facing Application T1078Valid Accounts1 report
AI mapping from the description · how it is exploited
99.9%Top 0.03%
81.4priority
CVE-2021-45105Apache Log4j2 does not always protect from infinite recursion in lookup evaluation
Apache Software Foundation · Apache Log4j2Public exploitMedium · 5.9T1190Exploit Public-Facing Application T1499.004Application or System Exploitation1 report
AI mapping from the description · how it is exploited
>99.9%Top 0.01%
81.0priority
CVE-2015-3306ProFTPD Improper Access Control Vulnerability
ProFTPD · ProFTPDKEVPublic exploitCritical · 10.0T1190Exploit Public-Facing Application T1005Data from Local System
AI mapping from the description · how it is exploited
99.5%Top 0.06%
80.0priority
CVE-2021-22205GitLab Community and Enterprise Editions Remote Code Execution Vulnerability
GitLab · Community and Enterprise EditionsKEVRansomwarePublic exploitCritical · 10.0T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter+2 more
MITRE CTID mapping of the KEV entry · how it is exploited
99.7%Top 0.05%
80.0priority
CVE-2021-35211SolarWinds Serv-U Remote Code Execution Vulnerability
SolarWinds · Serv-UKEVRansomwarePublic exploitCritical · 10.0T1190Exploit Public-Facing Application T1068Exploitation for Privilege Escalation
AI mapping from the description · how it is exploited
91.2%Top 0.19%
80.0priority
CVE-2024-4040CrushFTP VFS Sandbox Escape Vulnerability
CrushFTP · CrushFTPKEVPublic exploitCritical · 10.0T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter+1 more
AI mapping from the description · how it is exploited
99.5%Top 0.05%
80.0priority
CVE-2026-72898Metabase SQL Injection Vulnerability
Metabase · MetabaseKEVPublic exploitCritical · 10.0T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter
AI mapping from the description · how it is exploited
98.6%Top 0.08%
80.0priority
CVE-2026-85706GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability
GitLab · Community Edition and Enterprise EditionKEVPublic exploitCritical · 10.0T1190Exploit Public-Facing Application T1005Data from Local System
AI mapping from the description · how it is exploited
97.4%Top 0.1%
80.0priority
CVE-2010-2861Adobe ColdFusion Directory Traversal Vulnerability
Adobe · ColdFusionKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1119Automated Collection+1 more
MITRE CTID mapping of the KEV entry · how it is exploited
99.7%Top 0.05%
79.9priority
CVE-2015-1427Elasticsearch Groovy Scripting Engine Remote Code Execution Vulnerability
Elastic · ElasticsearchKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter
AI mapping from the description · how it is exploited
99.9%Top 0.03%
79.9priority
CVE-2017-5638Apache Struts Remote Code Execution Vulnerability
Apache · StrutsKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter+1 more
MITRE CTID mapping of the KEV entry · how it is exploited
>99.9%Top 0.01%
79.9priority
CVE-2019-11043PHP FastCGI Process Manager (FPM) Buffer Overflow Vulnerability
PHP · FastCGI Process Manager (FPM)KEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter
AI mapping from the description · how it is exploited
99.8%Top 0.04%
79.9priority
CVE-2019-15107Webmin Command Injection Vulnerability
Webmin · WebminKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter
MITRE CTID mapping of the CVE · uncategorised
99.7%Top 0.05%
79.9priority
CVE-2019-16920D-Link Multiple Routers Command Injection Vulnerability
D-Link · Multiple RoutersKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter
AI mapping from the description · how it is exploited
>99.9%Top 0.01%
79.9priority
CVE-2021-20038SonicWall SMA 100 Appliances Stack-Based Buffer Overflow Vulnerability
SonicWall · SMA 100 AppliancesKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter
AI mapping from the description · how it is exploited
99.9%Top 0.03%
79.9priority
CVE-2021-21985VMware vCenter Server Improper Input Validation Vulnerability
VMware · vCenter ServerKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter
AI mapping from the description · how it is exploited
>99.9%Top 0.01%
79.9priority
CVE-2021-22005VMware vCenter Server File Upload Vulnerability
VMware · vCenter ServerKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter
MITRE CTID mapping of the KEV entry · how it is exploited
>99.9%Top 0.01%
79.9priority
CVE-2021-22986F5 BIG-IP and BIG-IQ Centralized Management iControl REST Remote Code Execution Vulnerability
F5 · BIG-IP and BIG-IQ Centralized ManagementKEVRansomwarePublic exploitCritical · 9.8T1133External Remote Services T1190Exploit Public-Facing Application+3 more
MITRE CTID mapping of the KEV entry · how it is exploited
99.9%Top 0.03%
79.9priority
CVE-2021-31166Microsoft HTTP Protocol Stack Remote Code Execution Vulnerability
Microsoft · HTTP Protocol StackKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter
MITRE CTID mapping of the KEV entry · how it is exploited
99.9%Top 0.04%
79.9priority
CVE-2021-35464ForgeRock Access Management (AM) Core Server Remote Code Execution Vulnerability
ForgeRock · Access Management (AM)KEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter
MITRE CTID mapping of the KEV entry · how it is exploited
>99.9%Top 0.01%
79.9priority
CVE-2021-38647Microsoft Open Management Infrastructure (OMI) Remote Code Execution Vulnerability
Microsoft · Open Management Infrastructure (OMI)KEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter
AI mapping from the description · how it is exploited
99.9%Top 0.03%
79.9priority
CVE-2022-1040Sophos Firewall Authentication Bypass Vulnerability
Sophos · FirewallKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1078Valid Accounts+4 more
MITRE CTID mapping of the KEV entry · how it is exploited
99.8%Top 0.04%
79.9priority
CVE-2022-29464WSO2 Multiple Products Unrestrictive Upload of File Vulnerability
WSO2 · Multiple ProductsKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1202Indirect Command Execution+1 more
MITRE CTID mapping of the KEV entry · how it is exploited
>99.9%Top 0.01%
79.9priority
CVE-2022-40684Fortinet Multiple Products Authentication Bypass Vulnerability
Fortinet · Multiple ProductsKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1098.004SSH Authorized Keys
MITRE CTID mapping of the KEV entry · how it is exploited
>99.9%Top 0.02%
79.9priority
CVE-2023-22518Atlassian Confluence Data Center and Server Improper Authorization Vulnerability
Atlassian · Confluence Data Center and ServerKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1033System Owner/User Discovery+1 more
MITRE CTID mapping of the KEV entry · how it is exploited
>99.9%Top 0.01%
79.9priority
CVE-2023-27350PaperCut MF/NG Improper Access Control Vulnerability
PaperCut · MF/NGKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter+1 more
MITRE CTID mapping of the KEV entry · how it is exploited
>99.9%Top 0.01%
79.9priority
CVE-2023-29300Adobe ColdFusion Deserialization of Untrusted Data Vulnerability
Adobe · ColdFusionKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1105Ingress Tool Transfer
MITRE CTID mapping of the KEV entry · how it is exploited
>99.9%Top 0.01%
79.9priority
CVE-2023-29357Microsoft SharePoint Server Privilege Escalation Vulnerability
Microsoft · SharePoint ServerKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1068Exploitation for Privilege Escalation
AI mapping from the description · how it is exploited
>99.9%Top 0.02%
79.9priority
CVE-2023-35078Ivanti Endpoint Manager Mobile Authentication Bypass Vulnerability
Ivanti · Endpoint Manager Mobile (EPMM)KEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1136Create Account+1 more
MITRE CTID mapping of the KEV entry · how it is exploited
>99.9%Top 0.01%
79.9priority
CVE-2023-35082Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass Vulnerability
Ivanti · Endpoint Manager Mobile (EPMM) and MobileIron CoreKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1078Valid Accounts
AI mapping from the description · how it is exploited
>99.9%Top 0.01%
79.9priority
CVE-2023-38035Ivanti Sentry Authentication Bypass Vulnerability
Ivanti · SentryKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter+6 more
MITRE CTID mapping of the KEV entry · how it is exploited
>99.9%Top 0.03%
79.9priority
CVE-2023-41265Qlik Sense HTTP Tunneling Vulnerability
Qlik · SenseKEVRansomwarePublic exploitCritical · 9.9T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter
AI mapping from the description · how it is exploited
88.2%Top 0.23%
79.9priority
CVE-2023-42793JetBrains TeamCity Authentication Bypass Vulnerability
JetBrains · TeamCityKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1059.003Windows Command Shell
MITRE CTID mapping of the KEV entry · how it is exploited
>99.9%Top 0.02%
79.9priority
CVE-2023-46604Apache ActiveMQ Deserialization of Untrusted Data Vulnerability
Apache · ActiveMQKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1059.004Unix Shell+1 more
MITRE CTID mapping of the KEV entry · how it is exploited
>99.9%Top 0.01%
79.9priority
CVE-2024-0012Palo Alto Networks PAN-OS Management Interface Authentication Bypass Vulnerability
Palo Alto Networks · PAN-OSKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1078Valid Accounts
AI mapping from the description · how it is exploited
99.8%Top 0.04%
79.9priority
CVE-2024-23897Jenkins Command Line Interface (CLI) Path Traversal Vulnerability
Jenkins · Jenkins Command Line Interface (CLI)KEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1005Data from Local System
AI mapping from the description · how it is exploited
>99.9%Top 0.01%
79.9priority
CVE-2024-27198JetBrains TeamCity Authentication Bypass Vulnerability
JetBrains · TeamCityKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter
MITRE CTID mapping of the KEV entry · how it is exploited
99.9%Top 0.03%
79.9priority
CVE-2024-4577PHP-CGI OS Command Injection Vulnerability
PHP Group · PHPKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter+10 more
MITRE CTID mapping of the KEV entry · how it is exploited
>99.9%Top 0.02%
79.9priority
CVE-2025-59287Microsoft Windows Server Update Service (WSUS) Deserialization of Untrusted Data Vulnerability
Microsoft · WindowsKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter
AI mapping from the description · how it is exploited
>99.9%Top 0.02%
79.9priority
CVE-2025-61882Oracle E-Business Suite Unspecified Vulnerability
Oracle · E-Business SuiteKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1078Valid Accounts
AI mapping from the description · how it is exploited
99.7%Top 0.05%
79.9priority
CVE-2026-105134Ahsay AhsayCBS Command Injection Vulnerability
Ahsay · AhsayCBSKEVPublic exploitCritical · 10.0T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter
AI mapping from the description · how it is exploited
81.8%Top 0.36%
79.9priority
CVE-2026-109618PHP Memory Corruption Vulnerability
PHP Group · PHPKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter
AI mapping from the description · how it is exploited
>99.9%Top 0.01%
79.9priority
CVE-2026-76460Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability
Cisco · Identity Services EngineKEVPublic exploitCritical · 10.0T1190Exploit Public-Facing Application T1078Valid Accounts
AI mapping from the description · how it is exploited
75.6%Top 0.48%
79.9priority
CVE-2013-4810HP Multiple Products Remote Code Execution Vulnerability
Hewlett Packard (HP) · ProCurve Manager (PCM), PCM+, Identity Driven Manager (IDM), and Application Lifecycle ManagementKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter
AI mapping from the description · how it is exploited
79.5%Top 0.4%
79.8priority
CVE-2017-11357Telerik UI for ASP.NET AJAX Insecure Direct Object Reference Vulnerability
Telerik · User Interface (UI) for ASP.NET AJAXKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter
AI mapping from the description · how it is exploited
77.7%Top 0.44%
79.8priority
CVE-2017-12149Red Hat JBoss Application Server Remote Code Execution Vulnerability
Red Hat · JBoss Application ServerKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter
AI mapping from the description · how it is exploited
90.7%Top 0.2%
79.8priority
CVE-2017-18362Kaseya VSA SQL Injection Vulnerability
Kaseya · Virtual System/Server Administrator (VSA)KEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter+1 more
MITRE CTID mapping of the CVE · uncategorised
86.8%Top 0.26%
79.8priority
CVE-2018-1000861Jenkins Stapler Web Framework Deserialization of Untrusted Data Vulnerability
Jenkins · Jenkins Stapler Web FrameworkKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter
MITRE CTID mapping of the CVE · uncategorised
98.3%Top 0.08%
79.8priority
CVE-2018-11138Quest KACE System Management Appliance Remote Command Execution Vulnerability
Quest · KACE System Management ApplianceKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter
AI mapping from the description · how it is exploited
91.7%Top 0.19%
79.8priority
CVE-2018-1273VMware Tanzu Spring Data Commons Property Binder Vulnerability
VMware Tanzu · Spring Data CommonsKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter
AI mapping from the description · how it is exploited
97.0%Top 0.11%
79.8priority
CVE-2018-6530D-Link Multiple Routers OS Command Injection Vulnerability
D-Link · Multiple RoutersKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter
AI mapping from the description · how it is exploited
96.7%Top 0.12%
79.8priority
CVE-2018-6789Exim Buffer Overflow Vulnerability
Exim · EximKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter
MITRE CTID mapping of the KEV entry · how it is exploited
82.1%Top 0.35%
79.8priority
CVE-2018-7602Drupal Core Remote Code Execution Vulnerability
Drupal · CoreKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter
MITRE CTID mapping of the CVE · uncategorised
99.2%Top 0.07%
79.8priority
CVE-2019-16057D-Link DNS-320 Remote Code Execution Vulnerability
D-Link · DNS-320 Storage DeviceKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter
AI mapping from the description · how it is exploited
86.5%Top 0.26%
79.8priority
CVE-2019-5544VMware ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow Vulnerability
VMware · VMware ESXi and Horizon DaaSKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1499.004Application or System Exploitation
AI mapping from the description · how it is exploited
98.1%Top 0.09%
79.8priority
CVE-2019-7192QNAP Photo Station Improper Access Control Vulnerability
QNAP · Photo StationKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1078Valid Accounts
AI mapping from the description · how it is exploited
88.1%Top 0.23%
79.8priority
CVE-2019-7194QNAP Photo Station Path Traversal Vulnerability
QNAP · Photo StationKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1005Data from Local System
AI mapping from the description · how it is exploited
82.7%Top 0.33%
79.8priority
CVE-2019-7195QNAP Photo Station Path Traversal Vulnerability
QNAP · Photo StationKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1005Data from Local System
AI mapping from the description · how it is exploited
89.3%Top 0.22%
79.8priority
CVE-2021-20021SonicWall Email Security Improper Privilege Management Vulnerability
SonicWall · SonicWall Email SecurityKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1136Create Account
AI mapping from the description · how it is exploited
88.8%Top 0.22%
79.8priority
CVE-2021-23758Ajax.NET Professional Deserialization of Untrusted Data Vulnerability
Ajax.NET Professional · Ajax.NET ProfessionalKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter
AI mapping from the description · how it is exploited
82.6%Top 0.33%
79.8priority
CVE-2021-28799QNAP NAS Improper Authorization Vulnerability
QNAP · Network Attached Storage (NAS)KEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1078Valid Accounts
AI mapping from the description · how it is exploited
78.3%Top 0.42%
79.8priority
CVE-2021-44529Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) Code Injection Vulnerability
Ivanti · Endpoint Manager Cloud Service Appliance (EPM CSA)KEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1195.002Compromise Software Supply Chain
MITRE CTID mapping of the KEV entry · how it is exploited
99.1%Top 0.07%
79.8priority
CVE-2022-21587Oracle E-Business Suite Unspecified Vulnerability
Oracle · E-Business SuiteKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1078Valid Accounts
AI mapping from the description · how it is exploited
98.3%Top 0.08%
79.8priority
CVE-2022-26352dotCMS Unrestricted Upload of File Vulnerability
dotCMS · dotCMSKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1105Ingress Tool Transfer
AI mapping from the description · how it is exploited
91.2%Top 0.19%
79.8priority

Passages that support these links

First 40, from the highest-priority CVEs

CVE-2019-19781

In December 2019, we began to see less sophisticated threat actors share information from open source reports about CVE-2019-19781 and new forum threads started where actors sought to buy an exploit for the vulnerability.

Prioritizing “critical” vulnerabilities: A threat intelligence perspective Intel 471, 12 Aug 2020 Original ↗

CVE-2019-19781

An actor shared several code variants for CVE-2019-19781.

Prioritizing “critical” vulnerabilities: A threat intelligence perspective Intel 471, 12 Aug 2020 Original ↗

CVE-2019-19781

CISA has observed the actors leveraging CVE-2019-19781 to compromise Citrix Application Delivery Controllers.

AA20-258A: Chinese Ministry of State Security-Affiliated Cyber Threat Actor Activity us-cert.cisa.gov Original ↗

CVE-2021-34473

distributing phishing emails with malicious attachments [T1566.001] and by exploiting the following vulnerabilities against Microsoft Exchange servers [T1190]: CVE-2021-31207 - Microsoft Exchange Server Security Feature Bypass Vulnerability CVE-2021-34473 - Microsoft Exchange Server Remote Code Execution

#StopRansomware: Hive Ransomware cisa.gov Original ↗

CVE-2021-34473

BlackByte ransomware threat actors exploit ProxyShell vulnerabilities (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) found in Microsoft Exchange Server to gain initial access to the target network.

TTPs used by BlackByte Ransomware Targeting Critical Infrastructure picussecurity.com Original ↗

CVE-2021-34473

Tactic;Technique;Description TA0001 Initial Access;T1190 Exploit Public-Facing Application;In a number of attacks, the threat actors used ProxyShell vulnerablilities (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207).

Blackcat blog.group-ib.com Original ↗

CVE-2021-26855

In early March 2021, APT actors exploited CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065 to install 17 China Chopper webshells on the Exchange Server.

Impacket and Exfiltration Tool Used to Steal Sensitive Information from Defense Industrial Base Organization cisa.gov Original ↗

CVE-2021-34523

the following vulnerabilities against Microsoft Exchange servers [T1190]: CVE-2021-31207 - Microsoft Exchange Server Security Feature Bypass Vulnerability CVE-2021-34473 - Microsoft Exchange Server Remote Code Execution Vulnerability CVE-2021-34523 - Microsoft Exchange Server Privilege Escalation

#StopRansomware: Hive Ransomware cisa.gov Original ↗

CVE-2021-34523

BlackByte ransomware threat actors exploit ProxyShell vulnerabilities (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) found in Microsoft Exchange Server to gain initial access to the target network.

TTPs used by BlackByte Ransomware Targeting Critical Infrastructure picussecurity.com Original ↗

CVE-2021-34523

Tactic;Technique;Description TA0001 Initial Access;T1190 Exploit Public-Facing Application;In a number of attacks, the threat actors used ProxyShell vulnerablilities (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207).

Blackcat blog.group-ib.com Original ↗

CVE-2019-2725

Exploit Public-Facing Application (ATT&CK T1190) : Attackers exploit vulnerabilities in enterprise applications to distribute it, such as the deserialization vulnerability CVE-2019-2725 in Oracle WebLogic Server having a CVSS score of 9.8/10.

A brief history and further technical analysis of Sodinokibi Ransomware picussecurity.com Original ↗

CVE-2019-2725

One of the most ubiquitous ransomware variants on the market, deployments of REvil first were observed on April 17, 2019, where attackers leveraged a vulnerability in Oracle WebLogic servers tracked as CVE-2019-2725.

Ransomware-as-a-service: The pandemic within a pandemic Intel 471, 16 Nov 2020 Original ↗

CVE-2019-0604

Attackers linked to LookingFrog exploited Microsoft SharePoint servers in 2019 to gain code execution, probably by leveraging CVE-2019-0604.

A lookback under the TA410 umbrella: Its cyberespionage TTPs and activity welivesecurity.com Original ↗

CVE-2021-34527

Internet-facing applications and systems vulnerabilities can be exploited, such as PrintNightmare (CVE-2021-1675) and (CVE-2021-34527), to gain initial access.

Vice Society: Profiling a Persistent Threat to the Education Sector unit42.paloaltonetworks.com Original ↗

CVE-2021-31207

Hive actors have also gained initial access to victim networks by distributing phishing emails with malicious attachments [T1566.001] and by exploiting the following vulnerabilities against Microsoft Exchange servers [T1190]: CVE-2021-31207 - Microsoft Exchange Server Security Feature Bypass Vulnerability

#StopRansomware: Hive Ransomware cisa.gov Original ↗

CVE-2021-31207

BlackByte ransomware threat actors exploit ProxyShell vulnerabilities (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) found in Microsoft Exchange Server to gain initial access to the target network.

TTPs used by BlackByte Ransomware Targeting Critical Infrastructure picussecurity.com Original ↗

CVE-2021-31207

Tactic;Technique;Description TA0001 Initial Access;T1190 Exploit Public-Facing Application;In a number of attacks, the threat actors used ProxyShell vulnerablilities (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207).

Blackcat blog.group-ib.com Original ↗

CVE-2021-27065

In early March 2021, APT actors exploited CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065 to install 17 China Chopper webshells on the Exchange Server.

Impacket and Exfiltration Tool Used to Steal Sensitive Information from Defense Industrial Base Organization cisa.gov Original ↗

CVE-2020-0688

T1190 Exploit Public-Facing Application Gelsemium exploits the vulnerability CVE-2020- 0688 .

Eset gelsemium web-assets.esetstatic.com Original ↗

CVE-2021-26857

In early March 2021, APT actors exploited CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065 to install 17 China Chopper webshells on the Exchange Server.

Impacket and Exfiltration Tool Used to Steal Sensitive Information from Defense Industrial Base Organization cisa.gov Original ↗

CVE-2021-1675

Internet-facing applications and systems vulnerabilities can be exploited, such as PrintNightmare (CVE-2021-1675) and (CVE-2021-34527), to gain initial access.

Vice Society: Profiling a Persistent Threat to the Education Sector unit42.paloaltonetworks.com Original ↗