Exploited ⌖ KEV ⚡ RCE KEV 2022-02-10

CVE-2017-0262

Microsoft Office contained a remote code execution vulnerability that was actively exploited in the wild.

AFFECTS 4 Azure Commercial CloudAzure Government (includes Dynamics 365)Microsoft Office 365 GCC HighOffice 365 Multi-Tenant & Supporting Services

▸ DO  Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.

#rce#exploited-in-wild#unpatched

Exploited ⌖ KEV KEV 2022-02-10

CVE-2017-0263

Microsoft Win32k privilege escalation vulnerability allows attackers to escalate privileges via kernel-mode driver memory handling failures.

AFFECTS 4 Azure Commercial CloudAzure Government (includes Dynamics 365)Microsoft Office 365 GCC HighOffice 365 Multi-Tenant & Supporting Services

▸ DO  Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.

#exploited-in-wild#privilege-escalation#unpatched

Exploited ⌖ KEV ⚡ RCE KEV 2022-02-10

CVE-2015-1635

Microsoft HTTP.sys contained a remote code execution vulnerability that was actively exploited in the wild.

AFFECTS 4 Azure Commercial CloudAzure Government (includes Dynamics 365)Microsoft Office 365 GCC HighOffice 365 Multi-Tenant & Supporting Services

▸ DO  Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.

#rce#exploited-in-wild#unpatched

Exploited ⌖ KEV KEV 2022-02-10

CVE-2021-36934

A Windows SAM local privilege escalation vulnerability allowed any user to read the SAM file and escalate to SYSTEM level if a Volume Shadow Copy was available.

AFFECTS 4 Azure Commercial CloudAzure Government (includes Dynamics 365)Microsoft Office 365 GCC HighOffice 365 Multi-Tenant & Supporting Services

▸ DO  Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.

#exploited-in-wild#unpatched#privilege-escalation

Exploited ⌖ KEV ⚡ RCE KEV 2022-02-10

CVE-2017-8464

A crafted .LNK file triggered remote code execution in Windows Shell, a flaw actively exploited in the wild and now on CISA's KEV list.

AFFECTS 4 Azure Commercial CloudAzure Government (includes Dynamics 365)Microsoft Office 365 GCC HighOffice 365 Multi-Tenant & Supporting Services

▸ DO  Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.

#rce#exploited-in-wild#unpatched

Exploited ⌖ KEV KEV 2022-02-04

CVE-2022-21882

Microsoft Win32k privilege escalation vulnerability (CVE-2022-21882) was actively exploited in the wild before patching.

AFFECTS 4 Azure Commercial CloudAzure Government (includes Dynamics 365)Microsoft Office 365 GCC HighOffice 365 Multi-Tenant & Supporting Services

▸ DO  Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.

#exploited-in-wild#unpatched#privilege-escalation

Exploited ⌖ KEV ⚡ RCE KEV 2022-01-28

CVE-2014-1776

A memory corruption flaw in Internet Explorer allowed remote attackers to execute code as the current user.

AFFECTS 4 Azure Commercial CloudAzure Government (includes Dynamics 365)Microsoft Office 365 GCC HighOffice 365 Multi-Tenant & Supporting Services

▸ DO  Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.

#exploited-in-wild#unpatched#rce

Exploited ⌖ KEV KEV 2022-01-18

CVE-2021-33766

An unauthenticated attacker could steal email traffic from Microsoft Exchange Server via CVE-2021-33766, a vulnerability actively exploited in the wild.

AFFECTS 4 Azure Commercial CloudAzure Government (includes Dynamics 365)Microsoft Office 365 GCC HighOffice 365 Multi-Tenant & Supporting Services

▸ DO  Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.

#exploited-in-wild#unpatched#data-breach

Exploited ⌖ KEV KEV 2022-01-18

CVE-2020-14864

Oracle Business Intelligence Enterprise Edition suffered a path traversal vulnerability allowing attackers to read arbitrary system files via the getPreviewImage function.

AFFECTS 10 Aconex for DefenseFederal Managed Cloud ServicesFusion CloudGovernment Cloud - Common ControlsOracle Cloud Infrastructure-Government CloudOracle Enterprise Performance Management (EPM) +4 more

▸ DO  Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.

#exploited-in-wild#unpatched

Exploited ⌖ KEV ⚡ RCE KEV 2022-01-10

CVE-2015-7450

Remote attackers could execute arbitrary commands via serialized-object interfaces in IBM WebSphere Application Server and Server Hypervisor Edition.

AFFECTS 5 IBM Cloud for GovernmentIBM Federal HR CloudIBM Maximo and TRIRIGA on Cloud for U.S. FederalMaaS360 Enterprise Mobility ManagementSmartCloud for Government

▸ DO  Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.

#rce#exploited-in-wild#unpatched

Exploited ⌖ KEV ⚡ RCE KEV 2022-01-10

CVE-2020-6572

A use-after-free vulnerability in Google Chrome's media component allowed remote code execution via a crafted HTML page and was actively exploited in the wild.

AFFECTS 2 Google Services (Google Cloud Platform Products and underlying Infrastructure)Google Workspace

▸ DO  Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.

#exploited-in-wild#unpatched#rce

Exploited ⌖ KEV ⚡ RCE KEV 2022-01-10

CVE-2019-7609

Elastic Kibana's Timelion visualizer contained an arbitrary code execution flaw that was actively exploited in the wild.

AFFECTS 1 Elastic Cloud

▸ DO  Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.

#rce#exploited-in-wild#unpatched#ransomware

Exploited ⌖ KEV ⚡ RCE KEV 2022-01-10

CVE-2021-22017

Attackers exploited a directory-traversal flaw in VMware vCenter's Syslog server to gain persistent remote access.

AFFECTS 2 VMware Government Services (VGS)Workspace ONE

▸ DO  Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.

#exploited-in-wild#unpatched#rce

Exploited ⌖ KEV ⚡ RCE KEV 2022-01-10

CVE-2013-3900

Microsoft's WinVerifyTrust function allowed remote code execution via flawed Authenticode signature verification.

AFFECTS 4 Azure Commercial CloudAzure Government (includes Dynamics 365)Microsoft Office 365 GCC HighOffice 365 Multi-Tenant & Supporting Services

▸ DO  Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.

#rce#exploited-in-wild#unpatched

Exploited ⌖ KEV ⚡ RCE KEV 2021-12-15

CVE-2021-4102

A use-after-free vulnerability in Google Chromium V8 allowed remote attackers to exploit heap corruption via crafted HTML pages, affecting multiple Chromium-based browsers.

AFFECTS 2 Google Services (Google Cloud Platform Products and underlying Infrastructure)Google Workspace

▸ DO  Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.

#exploited-in-wild#unpatched#rce

Exploited ⌖ KEV ⚡ RCE KEV 2021-12-10

CVE-2019-10758

MongoDB mongo-express versions before 0.54.0 suffered a remote code execution flaw via the toBSON method.

AFFECTS 1 MongoDB Atlas for Government

▸ DO  Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.

#rce#exploited-in-wild#unpatched

Exploited ⌖ KEV ⚡ RCE KEV 2021-12-10

CVE-2010-1871

JBoss Seam 2 in Red Hat Linux allows remote code execution when the Java Security Manager is misconfigured, and the flaw is actively exploited in the wild.

AFFECTS 1 Red Hat OpenShift Service on AWS (ROSA)

▸ DO  Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.

#rce#exploited-in-wild#unpatched

Exploited ⌖ KEV ⚡ RCE KEV 2021-11-17

CVE-2021-42292

A local user can bypass Excel security features to execute arbitrary code.

AFFECTS 4 Azure Commercial CloudAzure Government (includes Dynamics 365)Microsoft Office 365 GCC HighOffice 365 Multi-Tenant & Supporting Services

▸ DO  Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.

#rce#exploited-in-wild#unpatched

Exploited ⌖ KEV ⚡ RCE KEV 2021-11-03

CVE-2021-30551

A type confusion vulnerability in Google Chromium V8 allowed remote attackers to exploit heap corruption via crafted HTML pages, affecting multiple Chromium-based browsers.

AFFECTS 2 Google Services (Google Cloud Platform Products and underlying Infrastructure)Google Workspace

▸ DO  Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.

#exploited-in-wild#unpatched#rce

Exploited ⌖ KEV ⚡ RCE KEV 2021-11-03

CVE-2021-28550

Adobe Acrobat and Reader suffered a use-after-free vulnerability allowing unauthenticated remote code execution.

AFFECTS 8 Adobe Acrobat Sign for GovernmentAdobe AnalyticsAdobe CampaignAdobe Connect Managed Services (ACMS-GC)Adobe Creative Cloud for EnterpriseAdobe Document Cloud (PDF Services & Adobe Sign) +2 more

▸ DO  Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.

#rce#exploited-in-wild#unpatched

Exploited ⌖ KEV ◐ 0-DAY KEV 2021-11-03

CVE-2021-28310

A privilege escalation vulnerability in Microsoft Win32k was actively exploited in the wild, allowing attackers to escalate privileges on Windows systems.

AFFECTS 4 Azure Commercial CloudAzure Government (includes Dynamics 365)Microsoft Office 365 GCC HighOffice 365 Multi-Tenant & Supporting Services

▸ DO  Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.

#exploited-in-wild#unpatched#privilege-escalation

Exploited ⌖ KEV ⚡ RCE KEV 2021-11-03

CVE-2021-27085

Microsoft Internet Explorer had a remote code execution vulnerability that was actively exploited in the wild.

AFFECTS 4 Azure Commercial CloudAzure Government (includes Dynamics 365)Microsoft Office 365 GCC HighOffice 365 Multi-Tenant & Supporting Services

▸ DO  Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.

#rce#exploited-in-wild#unpatched

Exploited ⌖ KEV ⚡ RCE KEV 2021-11-03

CVE-2021-27059

Microsoft Office contained an unpatched remote code execution vulnerability that was actively exploited in the wild.

AFFECTS 4 Azure Commercial CloudAzure Government (includes Dynamics 365)Microsoft Office 365 GCC HighOffice 365 Multi-Tenant & Supporting Services

▸ DO  Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.

#rce#exploited-in-wild#unpatched

Exploited ⌖ KEV ⚡ RCE KEV 2021-11-03

CVE-2021-22900

An authenticated admin on Ivanti Pulse Connect Secure could upload malicious archives to write arbitrary files via an unrestricted file upload flaw.

AFFECTS 2 Ivanti Neurons for ITSM (Formerly Service Manager)Ivanti Neurons for MDM (Formerly MobileIron)

▸ DO  Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.

#rce#exploited-in-wild#unpatched

Exploited ⌖ KEV ⚡ RCE KEV 2021-11-03

CVE-2021-22899

Ivanti Pulse Connect Secure suffered a command injection vulnerability allowing remote authenticated users to execute arbitrary code via Windows File Resource Profiles.

AFFECTS 2 Ivanti Neurons for ITSM (Formerly Service Manager)Ivanti Neurons for MDM (Formerly MobileIron)

▸ DO  Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.

#rce#exploited-in-wild#unpatched

Exploited ⌖ KEV ⚡ RCE KEV 2021-11-03

CVE-2021-22894

Ivanti Pulse Connect Secure suffered a buffer overflow allowing remote authenticated users to execute root code via malicious meeting rooms.

AFFECTS 2 Ivanti Neurons for ITSM (Formerly Service Manager)Ivanti Neurons for MDM (Formerly MobileIron)

▸ DO  Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.

#rce#exploited-in-wild#unpatched

Exploited ⌖ KEV ⚡ RCE KEV 2021-11-03

CVE-2021-21224

A type confusion vulnerability in Google Chromium V8 allowed remote code execution inside a browser sandbox via a crafted HTML page.

AFFECTS 2 Google Services (Google Cloud Platform Products and underlying Infrastructure)Google Workspace

▸ DO  Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.

#exploited-in-wild#unpatched#rce

Exploited ⌖ KEV ⚡ RCE KEV 2021-11-03

CVE-2021-21220

A remote attacker could exploit heap corruption via a crafted HTML page in Google Chromium V8 to execute arbitrary code.

AFFECTS 2 Google Services (Google Cloud Platform Products and underlying Infrastructure)Google Workspace

▸ DO  Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.

#exploited-in-wild#unpatched#rce

Exploited ⌖ KEV ⚡ RCE KEV 2021-11-03

CVE-2021-21206

A use-after-free vulnerability in Google Chromium Blink allowed remote attackers to exploit heap corruption via crafted HTML pages, affecting multiple Chromium-based browsers.

AFFECTS 2 Google Services (Google Cloud Platform Products and underlying Infrastructure)Google Workspace

▸ DO  Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.

#exploited-in-wild#unpatched#rce

Exploited ⌖ KEV ⚡ RCE KEV 2021-11-03

CVE-2021-21193

A use-after-free vulnerability in Google Chromium Blink allowed remote attackers to exploit heap corruption via crafted HTML pages, affecting multiple Chromium-based browsers.

AFFECTS 2 Google Services (Google Cloud Platform Products and underlying Infrastructure)Google Workspace

▸ DO  Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.

#exploited-in-wild#unpatched#rce

Exploited ⌖ KEV ⚡ RCE KEV 2021-11-03

CVE-2021-21166

A race condition in Google Chromium allows remote attackers to exploit heap corruption via a crafted HTML page, affecting multiple Chromium-based browsers.

AFFECTS 2 Google Services (Google Cloud Platform Products and underlying Infrastructure)Google Workspace

▸ DO  Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.

#exploited-in-wild#unpatched#rce

Exploited ⌖ KEV ⚡ RCE KEV 2021-11-03

CVE-2021-21148

A heap buffer overflow in Google Chromium V8 allowed remote attackers to exploit heap corruption via crafted HTML pages, affecting multiple Chromium-based browsers.

AFFECTS 2 Google Services (Google Cloud Platform Products and underlying Infrastructure)Google Workspace

▸ DO  Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.

#exploited-in-wild#unpatched#rce

Exploited ⌖ KEV ⚡ RCE KEV 2021-11-03

CVE-2021-21017

Adobe Acrobat and Reader suffered a heap-based buffer overflow allowing unauthenticated remote code execution, a known critical flaw repeatedly exploited in the wild.

AFFECTS 8 Adobe Acrobat Sign for GovernmentAdobe AnalyticsAdobe CampaignAdobe Connect Managed Services (ACMS-GC)Adobe Creative Cloud for EnterpriseAdobe Document Cloud (PDF Services & Adobe Sign) +2 more

▸ DO  Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.

#rce#exploited-in-wild#unpatched#ransomware

Exploited ⌖ KEV ⚡ RCE KEV 2021-11-03

CVE-2021-1647

Microsoft Defender contained an unpatched remote code execution vulnerability that was actively exploited in the wild.

AFFECTS 4 Azure Commercial CloudAzure Government (includes Dynamics 365)Microsoft Office 365 GCC HighOffice 365 Multi-Tenant & Supporting Services

▸ DO  Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.

#rce#exploited-in-wild#unpatched

Exploited ⌖ KEV ⚡ RCE KEV 2021-11-03

CVE-2021-1498

Cisco HyperFlex HX installer VM had insufficient input validation allowing command execution as tomcat8 user.

AFFECTS 9 AppDynamics GovAPMCisco Cloudlock for GovernmentCisco Meraki for GovernmentCisco SD-WAN for GovernmentCisco Umbrella for GovernmentCisco Unified Communications Manager Cloud for Government (Cisco UCM Cloud for Government) +3 more

▸ DO  Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.

#rce#exploited-in-wild#unpatched

Exploited ⌖ KEV ⚡ RCE KEV 2021-11-03

CVE-2021-1497

Cisco HyperFlex HX installer VM suffered a command injection flaw allowing root-level code execution.

AFFECTS 9 AppDynamics GovAPMCisco Cloudlock for GovernmentCisco Meraki for GovernmentCisco SD-WAN for GovernmentCisco Umbrella for GovernmentCisco Unified Communications Manager Cloud for Government (Cisco UCM Cloud for Government) +3 more

▸ DO  Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.

#rce#exploited-in-wild#unpatched

Exploited ⌖ KEV ⚡ RCE KEV 2021-11-03

CVE-2020-8599

Trend Micro Apex One and OfficeScan servers suffered an authentication bypass allowing remote attackers to write data and bypass root login.

AFFECTS 2 Trend Micro Cloud One for GovernmentTrend Micro Vision One for Government

▸ DO  Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.

#exploited-in-wild#unpatched#rce#supply-chain

Exploited ⌖ KEV KEV 2021-11-03

CVE-2020-8468

Trend Micro Apex One, OfficeScan, and Worry-Free Business Security agents had a content validation escape vulnerability allowing attackers to manipulate agent client components.

AFFECTS 2 Trend Micro Cloud One for GovernmentTrend Micro Vision One for Government

▸ DO  Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.

#exploited-in-wild#unpatched

Exploited ⌖ KEV ⚡ RCE KEV 2021-11-03

CVE-2020-8467

Trend Micro Apex One and OfficeScan suffered a remote code execution vulnerability in a migration tool component that was actively exploited in the wild.

AFFECTS 2 Trend Micro Cloud One for GovernmentTrend Micro Vision One for Government

▸ DO  Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.

#rce#exploited-in-wild#unpatched

Exploited ⌖ KEV ⚡ RCE KEV 2021-11-03

CVE-2020-8260

An authenticated attacker could execute arbitrary code via uncontrolled gzip extraction in Ivanti Pulse Connect Secure.

AFFECTS 2 Ivanti Neurons for ITSM (Formerly Service Manager)Ivanti Neurons for MDM (Formerly MobileIron)

▸ DO  Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.

#rce#exploited-in-wild#unpatched