Actively-exploited / critical CVEs correlated to FedRAMP-authorized products, read by dex — the gist, which products are hit, and what to do. Sorted with those under active attack (CISA KEV) first. Click a CVE for full detail.
An authenticated attacker with network access can execute arbitrary root code on Palo Alto Networks PAN-OS firewalls via a code injection flaw.
▸ DO Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
An unauthenticated remote attacker can write arbitrary files on the underlying OS via a relative path traversal flaw in Cisco Secure Email Gateway.
▸ DO Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
A command injection flaw in Windows Shell lets attackers bypass network security features remotely.
▸ DO Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
Ivanti Connect Secure allows remote unauthenticated attackers to bypass authentication and execute arbitrary commands via a spoofing vulnerability.
▸ DO Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
Citrix NetScaler ADC and Gateway suffer a memory buffer vulnerability causing denial of service, part of a pattern of critical flaws exploited in the wild.
▸ DO Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
An unauthenticated remote attacker could escalate to admin privileges via improper URI encoding in Cisco Catalyst SD-WAN Manager.
▸ DO Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
An unauthenticated attacker can execute arbitrary commands on Citrix NetScaler ADC and Gateway due to improper input validation.
▸ DO Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
Citrix NetScaler ADC and Gateway suffer a memory buffer flaw enabling remote code execution or denial of service.
▸ DO Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
An authenticated attacker can execute arbitrary code on Microsoft SharePoint via unsafe deserialization, and the flaw is actively exploited in the wild.
▸ DO Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
An incorrect authorization flaw in Adobe Commerce and Magento allowed attackers to gain elevated access to sensitive resources without user interaction.
▸ DO Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
A logic error in Google Pixel cellular modems allows privilege escalation by bypassing authorization checks.
▸ DO Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
An unauthenticated remote attacker can bypass Cisco ISE's web management interface via incorrect privileged API use.
▸ DO Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
Cisco Secure Email Gateway suffered an unpatched SQL injection flaw allowing remote attackers to execute arbitrary root commands.
▸ DO Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
An unauthenticated remote attacker can bypass Citrix NetScaler authentication via an alternate path, enabling full system compromise.
▸ DO Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
An out-of-bounds write flaw in Google Chromium V8 lets remote attackers execute arbitrary code inside the browser sandbox via a crafted HTML page.
▸ DO Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
An unauthenticated remote attacker could bypass authentication and execute scripts to gain root access on Cisco FMC/SCC devices.
▸ DO Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
A local privilege escalation vulnerability in the Windows Update Stack allows attackers to escalate to SYSTEM.
▸ DO Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
An unpatched template engine flaw in Adobe Commerce and Magento allows remote code execution, enabling attackers to take control of e-commerce sites.
▸ DO Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
A heap-based buffer overflow in Windows allows local privilege escalation, now actively exploited in the wild.
▸ DO Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
A type confusion vulnerability in Google Chromium V8 allows remote attackers to execute arbitrary code inside the browser sandbox via a crafted HTML page.
▸ DO Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
An unpatched remote code execution flaw in Microsoft SQL Server allowed attackers to execute arbitrary code as the database engine service account.
▸ DO Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
A privilege escalation flaw in Red Hat's Automatic Bug Reporting Tool allowed local users to escalate privileges via a symlink attack on a predictable file.
▸ DO Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
An unauthenticated attacker can execute arbitrary code as root on Citrix NetScaler ADC and Gateway appliances via CVE-2026-8452.
▸ DO Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
A race condition in Red Hat's libuser allowed authenticated local users to corrupt /etc/passwd, causing denial of service or privilege escalation.
▸ DO Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
Oracle HTTP Server and Weblogic Server Proxy Plug-in suffer from an improper access control flaw allowing unauthorized data manipulation and full data access.
▸ DO Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
A deserialization of untrusted data vulnerability in Microsoft Entra ID allowed remote code execution over a network.
▸ DO Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
A double free vulnerability in Microsoft's Internet Key Exchange (IKE) Service Extensions allows remote code execution and is actively exploited in the wild.
▸ DO Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
Microsoft SharePoint's weak authentication flaw lets attackers bypass security controls over a network.
▸ DO Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
Unauthenticated attackers exploited a path traversal flaw in VMware vCenter to execute arbitrary code and establish persistent backdoors.
▸ DO Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
A use-after-free vulnerability in the Windows Ancillary Function Driver for WinSock allows local privilege escalation and is actively exploited in the wild.
▸ DO Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
Cisco ASA/FTD devices have an unpatched heap inspection vulnerability allowing remote denial of service.
▸ DO Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
IBM Langflow Code Injection Vulnerability allows RCE.
▸ DO Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
Cisco FMC shipped with a hardcoded password allowing unauthenticated remote login to sensitive data.
▸ DO Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
Microsoft SharePoint RCE due to untrusted data deserialization
▸ DO Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
Microsoft SharePoint RCE due to untrusted data deserialization
▸ DO Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
Oracle E-Business Suite exposed to unauthenticated attacks via HTTP, potentially allowing takeover of Oracle Payments.
▸ DO Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
Authorized attackers can elevate privileges in Microsoft AD FS due to insufficient access control granularity.
▸ DO Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
Unpatched RCE in SharePoint Server
▸ DO Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
Cisco IOS 12.4 devices are actively exploited in the wild via a cross-site request forgery vulnerability enabling remote command execution.
▸ DO Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
Adobe ColdFusion allows arbitrary code execution via path traversal, enabling attackers to run commands as the current user.
▸ DO Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.