Known Exploited Vulnerabilities Catalog - CISA For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild Organizations should use the KEV catalog as an input to their vulnerability management prioritization framework How to use the KEV
2023 Top Routinely Exploited Vulnerabilities - CISA Technical Details Key Findings In 2023, malicious cyber actors exploited more zero-day vulnerabilities to compromise enterprise networks compared to 2022, allowing them to conduct cyber operations against higher-priority targets In 2023, the majority of the most frequently exploited vulnerabilities were initially exploited as a zero-day, which is an increase from 2022, when less than half of
CISA Adds One Known Exploited Vulnerability, CVE-2025-53770 “ToolShell . . . CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation See CISA’s Alert Microsoft Releases Guidance on Exploitation of SharePoint Vulnerability (CVE-2025-53770) for more information and to apply the recommended mitigations
Critical Vulnerabilities in Microsoft Windows Operating Systems An attacker could remotely exploit these vulnerabilities to decrypt, modify, or inject data on user connections: CryptoAPI spoofing vulnerability – CVE-2020-0601: This vulnerability affects all machines running 32- or 64-bit Windows 10 operating systems, including Windows Server versions 2016 and 2019
2023 Top Routinely Exploited Vulnerabilities - CISA Top Routinely Exploited Vulnerabilities Listed in Table 1 are the top 15 vulnerabilities the authoring agencies observed malicious cyber actors routinely exploiting in 2023 with details also discussed below
UPDATE: Microsoft Releases Guidance on Exploitation of . . . - CISA For more information see MAR-251132 c1 v1 Exploitation of SharePoint Vulnerabilities and CISA Releases Malware Analysis Report Associated with Microsoft SharePoint Vulnerabilities Update (07 31 2025): CISA has updated this alert to provide clarification on antivirus and endpoint detection and response (EDR) solutions, and details regarding mitigations related to the IIS server Update (07