{ "query": { "exploited": "1", "page": "47" }, "count": 20, "total": 1734, "page": 47, "limit": 20, "updated": { "cves": "2026-10-07T20:48:31.249Z", "kev": "2026-10-07T21:49:33.076Z", "epss": "2026-10-07T18:59:57.359Z", "breaches": "2026-10-07T18:47:59.596Z", "posts": "2026-10-07T21:48:33.240Z" }, "links": { "web": "https://spydr.io/threats?exploited=1&page=47", "next": "https://spydr.io/threats.json?exploited=1&page=48" }, "coverage": { "cves_published_since": "2026-06-09", "days": 120, "also": "every CVE in CISA KEV" }, "unscored_hidden": 0, "warnings": [], "results": [ { "id": "CVE-2021-36948", "url": "https://spydr.io/cve/CVE-2021-36948", "published": "2021-08-12T18:15:10.190Z", "modified": "2026-08-10T20:19:08.120Z", "score": 7.8, "severity": "high", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "score_source": "microsoft.com", "epss": 0.2327, "epss_percentile": 0.97726, "exploited": true, "kev": { "added": "2021-11-03", "due": "2021-11-17", "action": "Apply updates per vendor instructions.", "ransomware": "Unknown" }, "ssvc_exploitation": "active", "vendors": [ "Microsoft" ], "products": [ "Microsoft Windows 10 Version 1809", "Microsoft Windows 10 Version 1909", "Microsoft Windows 10 Version 2004", "Microsoft Windows 10 Version 20H2", "Microsoft Windows 10 Version 21H1", "Microsoft Windows Server 2019", "Microsoft Windows Server 2019 (Server Core installation)", "Microsoft Windows Server version 2004", "Microsoft Windows Server version 20H2" ], "cwes": [], "description": "Windows Update Medic Service Elevation of Privilege Vulnerability" }, { "id": "CVE-2021-36942", "url": "https://spydr.io/cve/CVE-2021-36942", "published": "2021-08-12T18:15:10.000Z", "modified": "2026-08-10T20:19:03.450Z", "score": 7.5, "severity": "high", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "score_source": "microsoft.com", "epss": 0.66023, "epss_percentile": 0.99258, "exploited": true, "kev": { "added": "2021-11-03", "due": "2021-11-17", "action": "Apply updates per vendor instructions.", "ransomware": "Known" }, "ssvc_exploitation": "active", "vendors": [ "Microsoft" ], "products": [ "Microsoft Windows Server 2008 R2 Service Pack 1", "Microsoft Windows Server 2008 R2 Service Pack 1 (Server Core installation)", "Microsoft Windows Server 2008 Service Pack 2", "Microsoft Windows Server 2008 Service Pack 2 (Server Core installation)", "Microsoft Windows Server 2012", "Microsoft Windows Server 2012 (Server Core installation)", "Microsoft Windows Server 2012 R2", "Microsoft Windows Server 2012 R2 (Server Core installation)", "Microsoft Windows Server 2016", "Microsoft Windows Server 2016 (Server Core installation)", "Microsoft Windows Server 2019", "Microsoft Windows Server 2019 (Server Core installation)", "Microsoft Windows Server version 2004", "Microsoft Windows Server version 20H2" ], "cwes": [], "description": "Windows LSA Spoofing Vulnerability" }, { "id": "CVE-2021-34486", "url": "https://spydr.io/cve/CVE-2021-34486", "published": "2021-08-12T18:15:09.190Z", "modified": "2026-08-10T19:59:11.830Z", "score": 7.8, "severity": "high", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "score_source": "microsoft.com", "epss": 0.09253, "epss_percentile": 0.95239, "exploited": true, "kev": { "added": "2022-03-28", "due": "2022-04-18", "action": "Apply updates per vendor instructions.", "ransomware": "Unknown" }, "ssvc_exploitation": "active", "vendors": [ "Microsoft" ], "products": [ "Microsoft Windows 10 Version 1809", "Microsoft Windows 10 Version 1909", "Microsoft Windows 10 Version 2004", "Microsoft Windows 10 Version 20H2", "Microsoft Windows 10 Version 21H1", "Microsoft Windows Server 2019", "Microsoft Windows Server 2019 (Server Core installation)", "Microsoft Windows Server version 2004", "Microsoft Windows Server version 20H2" ], "cwes": [ "CWE-416" ], "description": "Windows Event Tracing Elevation of Privilege Vulnerability" }, { "id": "CVE-2021-34484", "url": "https://spydr.io/cve/CVE-2021-34484", "published": "2021-08-12T18:15:09.117Z", "modified": "2026-08-10T19:59:12.090Z", "score": 7.8, "severity": "high", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "score_source": "microsoft.com", "epss": 0.21827, "epss_percentile": 0.97588, "exploited": true, "kev": { "added": "2022-03-31", "due": "2022-04-21", "action": "Apply updates per vendor instructions.", "ransomware": "Unknown" }, "ssvc_exploitation": "active", "vendors": [ "Microsoft" ], "products": [ "Microsoft Windows 10 Version 1507", "Microsoft Windows 10 Version 1607", "Microsoft Windows 10 Version 1809", "Microsoft Windows 10 Version 1909", "Microsoft Windows 10 Version 2004", "Microsoft Windows 10 Version 20H2", "Microsoft Windows 10 Version 21H1", "Microsoft Windows 7", "Microsoft Windows 7 Service Pack 1", "Microsoft Windows 8.1", "Microsoft Windows Server 2008 R2 Service Pack 1", "Microsoft Windows Server 2008 R2 Service Pack 1 (Server Core installation)", "Microsoft Windows Server 2008 Service Pack 2", "Microsoft Windows Server 2008 Service Pack 2 (Server Core installation)", "Microsoft Windows Server 2012", "Microsoft Windows Server 2012 (Server Core installation)", "Microsoft Windows Server 2012 R2", "Microsoft Windows Server 2012 R2 (Server Core installation)", "Microsoft Windows Server 2016", "Microsoft Windows Server 2016 (Server Core installation)" ], "cwes": [], "description": "Windows User Profile Service Elevation of Privilege Vulnerability" }, { "id": "CVE-2021-20028", "url": "https://spydr.io/cve/CVE-2021-20028", "published": "2021-08-04T19:15:08.247Z", "modified": "2026-06-17T03:33:10.393Z", "score": 9.8, "severity": "critical", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "score_source": "NVD", "epss": 0.30084, "epss_percentile": 0.98177, "exploited": true, "kev": { "added": "2022-03-28", "due": "2022-04-18", "action": "The impacted product is end-of-life and should be disconnected if still in use.", "ransomware": "Known" }, "ssvc_exploitation": "active", "vendors": [ "SonicWall" ], "products": [ "SonicWall SRA/SMA100" ], "cwes": [ "CWE-89" ], "description": "Improper neutralization of a SQL Command leading to SQL Injection vulnerability impacting end-of-life Secure Remote Access (SRA) products, specifically the SRA appliances running all 8.x firmware and 9.0.0.9-26sv or earlier" }, { "id": "CVE-2021-30563", "url": "https://spydr.io/cve/CVE-2021-30563", "published": "2021-08-03T19:15:08.230Z", "modified": "2026-06-17T03:50:28.343Z", "score": 8.8, "severity": "high", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "score_source": "NVD", "epss": 0.09, "epss_percentile": 0.95149, "exploited": true, "kev": { "added": "2021-11-03", "due": "2021-11-17", "action": "Apply updates per vendor instructions.", "ransomware": "Unknown" }, "ssvc_exploitation": "active", "vendors": [ "Google" ], "products": [ "Google Chrome" ], "cwes": [ "CWE-843" ], "description": "Type Confusion in V8 in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page." }, { "id": "CVE-2021-26085", "url": "https://spydr.io/cve/CVE-2021-26085", "published": "2021-08-03T00:15:08.557Z", "modified": "2026-06-17T03:42:49.933Z", "score": 5.3, "severity": "medium", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "score_source": "NVD", "epss": 0.99937, "epss_percentile": 0.99971, "exploited": true, "kev": { "added": "2022-03-28", "due": "2022-04-18", "action": "Apply updates per vendor instructions.", "ransomware": "Known" }, "ssvc_exploitation": "active", "vendors": [ "Atlassian" ], "products": [ "Atlassian Confluence Server", "Atlassian Confluence Data Center" ], "cwes": [ "CWE-425" ], "description": "Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a Pre-Authorization Arbitrary File Read vulnerability in the /s/ endpoint. The affected versions are before version 7.4.10, and from version 7.5.0 before 7.12.3." }, { "id": "CVE-2021-36742", "url": "https://spydr.io/cve/CVE-2021-36742", "published": "2021-07-29T20:15:07.650Z", "modified": "2026-06-17T03:59:05.680Z", "score": 7.8, "severity": "high", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "score_source": "NVD", "epss": 0.01482, "epss_percentile": 0.73167, "exploited": true, "kev": { "added": "2021-11-03", "due": "2021-11-17", "action": "Apply updates per vendor instructions.", "ransomware": "Unknown" }, "ssvc_exploitation": "active", "vendors": [ "Trend Micro" ], "products": [ "Trend Micro Apex One", "Trend Micro OfficeScan", "Trend Micro Worry-Free Business Security" ], "cwes": [ "CWE-20" ], "description": "A improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG and Worry-Free Business Security 10.0 SP1 allows a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability." }, { "id": "CVE-2021-36741", "url": "https://spydr.io/cve/CVE-2021-36741", "published": "2021-07-29T20:15:07.620Z", "modified": "2026-06-17T03:59:05.507Z", "score": 8.8, "severity": "high", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "score_source": "NVD", "epss": 0.04951, "epss_percentile": 0.9194, "exploited": true, "kev": { "added": "2021-11-03", "due": "2021-11-17", "action": "Apply updates per vendor instructions.", "ransomware": "Unknown" }, "ssvc_exploitation": "active", "vendors": [ "Trend Micro" ], "products": [ "Trend Micro Apex One", "Trend Micro OfficeScan", "Trend Micro Worry-Free Business Security" ], "cwes": [ "CWE-434" ], "description": "An improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG, and Worry-Free Business Security 10.0 SP1 allows a remote attached to upload arbitrary files on affected installations. Please note: an attacker must first obtain the ability to logon to the product�s management console in order to exploit this vulnerability." }, { "id": "CVE-2021-35464", "url": "https://spydr.io/cve/CVE-2021-35464", "published": "2021-07-22T18:15:23.247Z", "modified": "2026-06-17T03:57:31.503Z", "score": 9.8, "severity": "critical", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "score_source": "NVD", "epss": 0.99999, "epss_percentile": 0.99994, "exploited": true, "kev": { "added": "2021-11-03", "due": "2021-11-17", "action": "Apply updates per vendor instructions.", "ransomware": "Known" }, "ssvc_exploitation": "active", "vendors": [ "forgerock" ], "products": [ "forgerock access management", "forgerock openam" ], "cwes": [ "CWE-502" ], "description": "ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pages. The exploitation does not require authentication, and remote code execution can be triggered by sending a single crafted /ccversion/* request to the server. The vulnerability exists due to the usage of Sun ONE Application Framework (JATO) found in versions of Java 8 or earlier" }, { "id": "CVE-2021-36934", "url": "https://spydr.io/cve/CVE-2021-36934", "published": "2021-07-22T07:15:11.013Z", "modified": "2026-08-10T20:19:00.610Z", "score": 7.8, "severity": "high", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "score_source": "microsoft.com", "epss": 0.67252, "epss_percentile": 0.99289, "exploited": true, "kev": { "added": "2022-02-10", "due": "2022-02-24", "action": "Apply updates per vendor instructions.", "ransomware": "Unknown" }, "ssvc_exploitation": "active", "vendors": [ "Microsoft" ], "products": [ "Microsoft Windows 10 Version 1809", "Microsoft Windows 10 Version 1909", "Microsoft Windows 10 Version 2004", "Microsoft Windows 10 Version 20H2", "Microsoft Windows 10 Version 21H1" ], "cwes": [], "description": "An elevation of privilege vulnerability exists because of overly permissive Access Control Lists (ACLs) on multiple system files, including the Security Accounts Manager (SAM) database. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. An attacker must have the ability to execute code on a victim system to exploit this vulnerability. After installing this security update, you must manually delete all shadow copies of system files, including the SAM database, to fully mitigate this vulnerabilty. Simply installing this security update will not fully mitigate this vulnerability. See KB5005357- Delete Volume Shadow Copies." }, { "id": "CVE-2021-34448", "url": "https://spydr.io/cve/CVE-2021-34448", "published": "2021-07-16T21:15:09.580Z", "modified": "2026-08-10T19:58:48.893Z", "score": 6.8, "severity": "medium", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N", "score_source": "microsoft.com", "epss": 0.40062, "epss_percentile": 0.986, "exploited": true, "kev": { "added": "2021-11-03", "due": "2021-11-17", "action": "Apply updates per vendor instructions.", "ransomware": "Unknown" }, "ssvc_exploitation": "active", "vendors": [ "Microsoft" ], "products": [ "Microsoft Windows 10 Version 1507", "Microsoft Windows 10 Version 1607", "Microsoft Windows 10 Version 1809", "Microsoft Windows 10 Version 1909", "Microsoft Windows 10 Version 2004", "Microsoft Windows 10 Version 20H2", "Microsoft Windows 10 Version 21H1", "Microsoft Windows 7", "Microsoft Windows 7 Service Pack 1", "Microsoft Windows 8.1", "Microsoft Windows Server 2008 R2 Service Pack 1", "Microsoft Windows Server 2012", "Microsoft Windows Server 2012 R2", "Microsoft Windows Server 2016", "Microsoft Windows Server 2019" ], "cwes": [ "CWE-787" ], "description": "Scripting Engine Memory Corruption Vulnerability" }, { "id": "CVE-2021-35211", "url": "https://spydr.io/cve/CVE-2021-35211", "published": "2021-07-14T21:15:08.090Z", "modified": "2026-06-17T03:57:18.450Z", "score": 10, "severity": "critical", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "score_source": "NVD", "epss": 0.9116, "epss_percentile": 0.99808, "exploited": true, "kev": { "added": "2021-11-03", "due": "2021-11-17", "action": "Apply updates per vendor instructions.", "ransomware": "Known" }, "ssvc_exploitation": "active", "vendors": [ "SolarWinds" ], "products": [ "SolarWinds Serv-U Managed File Transfer Server and Serv-U Secured FTP" ], "cwes": [ "CWE-787" ], "description": "Microsoft discovered a remote code execution (RCE) vulnerability in the SolarWinds Serv-U product utilizing a Remote Memory Escape Vulnerability. If exploited, a threat actor may be able to gain privileged access to the machine hosting Serv-U Only. SolarWinds Serv-U Managed File Transfer and Serv-U Secure FTP for Windows before 15.2.3 HF2 are affected by this vulnerability." }, { "id": "CVE-2021-34523", "url": "https://spydr.io/cve/CVE-2021-34523", "published": "2021-07-14T18:15:12.347Z", "modified": "2026-08-10T19:59:11.883Z", "score": 9, "severity": "critical", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N", "score_source": "microsoft.com", "epss": 0.9999, "epss_percentile": 0.99985, "exploited": true, "kev": { "added": "2021-11-03", "due": "2021-11-17", "action": "Apply updates per vendor instructions.", "ransomware": "Known" }, "ssvc_exploitation": "active", "vendors": [ "Microsoft" ], "products": [ "Microsoft Exchange Server 2013 Cumulative Update 23", "Microsoft Exchange Server 2016 Cumulative Update 19", "Microsoft Exchange Server 2016 Cumulative Update 20", "Microsoft Exchange Server 2019 Cumulative Update 8", "Microsoft Exchange Server 2019 Cumulative Update 9" ], "cwes": [], "description": "Microsoft Exchange Server Elevation of Privilege Vulnerability" }, { "id": "CVE-2021-34473", "url": "https://spydr.io/cve/CVE-2021-34473", "published": "2021-07-14T18:15:11.163Z", "modified": "2026-08-10T19:58:52.800Z", "score": 9.1, "severity": "critical", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "score_source": "microsoft.com", "epss": 0.99999, "epss_percentile": 0.99996, "exploited": true, "kev": { "added": "2021-11-03", "due": "2021-11-17", "action": "Apply updates per vendor instructions.", "ransomware": "Known" }, "ssvc_exploitation": "active", "vendors": [ "Microsoft" ], "products": [ "Microsoft Exchange Server 2013 Cumulative Update 23", "Microsoft Exchange Server 2016 Cumulative Update 19", "Microsoft Exchange Server 2016 Cumulative Update 20", "Microsoft Exchange Server 2019 Cumulative Update 8", "Microsoft Exchange Server 2019 Cumulative Update 9" ], "cwes": [ "CWE-918" ], "description": "Microsoft Exchange Server Remote Code Execution Vulnerability" }, { "id": "CVE-2021-33771", "url": "https://spydr.io/cve/CVE-2021-33771", "published": "2021-07-14T18:15:10.483Z", "modified": "2026-08-10T19:58:46.650Z", "score": 7.8, "severity": "high", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "score_source": "microsoft.com", "epss": 0.10172, "epss_percentile": 0.95552, "exploited": true, "kev": { "added": "2021-11-03", "due": "2021-11-17", "action": "Apply updates per vendor instructions.", "ransomware": "Unknown" }, "ssvc_exploitation": "active", "vendors": [ "Microsoft" ], "products": [ "Microsoft Windows 10 Version 1507", "Microsoft Windows 10 Version 1607", "Microsoft Windows 10 Version 1809", "Microsoft Windows 10 Version 1909", "Microsoft Windows 10 Version 2004", "Microsoft Windows 10 Version 20H2", "Microsoft Windows 10 Version 21H1", "Microsoft Windows 8.1", "Microsoft Windows Server 2012 R2", "Microsoft Windows Server 2012 R2 (Server Core installation)", "Microsoft Windows Server 2016", "Microsoft Windows Server 2016 (Server Core installation)", "Microsoft Windows Server 2019", "Microsoft Windows Server 2019 (Server Core installation)", "Microsoft Windows Server version 2004", "Microsoft Windows Server version 20H2" ], "cwes": [], "description": "Windows Kernel Elevation of Privilege Vulnerability" }, { "id": "CVE-2021-33766", "url": "https://spydr.io/cve/CVE-2021-33766", "published": "2021-07-14T18:15:10.380Z", "modified": "2026-08-10T19:58:44.540Z", "score": 7.3, "severity": "high", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "score_source": "microsoft.com", "epss": 0.98176, "epss_percentile": 0.99914, "exploited": true, "kev": { "added": "2022-01-18", "due": "2022-02-01", "action": "Apply updates per vendor instructions.", "ransomware": "Unknown" }, "ssvc_exploitation": "active", "vendors": [ "Microsoft" ], "products": [ "Microsoft Exchange Server 2013 Cumulative Update 23", "Microsoft Exchange Server 2016 Cumulative Update 19", "Microsoft Exchange Server 2016 Cumulative Update 20", "Microsoft Exchange Server 2019 Cumulative Update 8", "Microsoft Exchange Server 2019 Cumulative Update 9" ], "cwes": [], "description": "Microsoft Exchange Server Information Disclosure Vulnerability" }, { "id": "CVE-2021-31979", "url": "https://spydr.io/cve/CVE-2021-31979", "published": "2021-07-14T18:15:09.597Z", "modified": "2026-08-10T19:58:41.753Z", "score": 7.8, "severity": "high", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "score_source": "microsoft.com", "epss": 0.0454, "epss_percentile": 0.91303, "exploited": true, "kev": { "added": "2021-11-03", "due": "2021-11-17", "action": "Apply updates per vendor instructions.", "ransomware": "Unknown" }, "ssvc_exploitation": "active", "vendors": [ "Microsoft" ], "products": [ "Microsoft Windows 10 Version 1507", "Microsoft Windows 10 Version 1607", "Microsoft Windows 10 Version 1809", "Microsoft Windows 10 Version 1909", "Microsoft Windows 10 Version 2004", "Microsoft Windows 10 Version 20H2", "Microsoft Windows 10 Version 21H1", "Microsoft Windows 7", "Microsoft Windows 7 Service Pack 1", "Microsoft Windows 8.1", "Microsoft Windows Server 2008 R2 Service Pack 1", "Microsoft Windows Server 2008 R2 Service Pack 1 (Server Core installation)", "Microsoft Windows Server 2008 Service Pack 2", "Microsoft Windows Server 2008 Service Pack 2 (Server Core installation)", "Microsoft Windows Server 2012", "Microsoft Windows Server 2012 (Server Core installation)", "Microsoft Windows Server 2012 R2", "Microsoft Windows Server 2012 R2 (Server Core installation)", "Microsoft Windows Server 2016", "Microsoft Windows Server 2016 (Server Core installation)" ], "cwes": [ "CWE-119" ], "description": "Windows Kernel Elevation of Privilege Vulnerability" }, { "id": "CVE-2021-31196", "url": "https://spydr.io/cve/CVE-2021-31196", "published": "2021-07-14T18:15:09.463Z", "modified": "2026-08-10T19:58:38.973Z", "score": 7.2, "severity": "high", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "score_source": "microsoft.com", "epss": 0.54056, "epss_percentile": 0.98982, "exploited": true, "kev": { "added": "2024-08-21", "due": "2024-09-11", "action": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "ransomware": "Unknown" }, "ssvc_exploitation": "active", "vendors": [ "Microsoft" ], "products": [ "Microsoft Exchange Server 2013 Cumulative Update 23", "Microsoft Exchange Server 2016 Cumulative Update 20", "Microsoft Exchange Server 2016 Cumulative Update 21", "Microsoft Exchange Server 2019 Cumulative Update 10", "Microsoft Exchange Server 2019 Cumulative Update 9" ], "cwes": [], "description": "Microsoft Exchange Server Remote Code Execution Vulnerability" }, { "id": "CVE-2021-30116", "url": "https://spydr.io/cve/CVE-2021-30116", "published": "2021-07-09T14:15:07.770Z", "modified": "2026-08-14T05:16:54.497Z", "score": 9.8, "severity": "critical", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "score_source": "NVD", "epss": 0.85735, "epss_percentile": 0.99722, "exploited": true, "kev": { "added": "2021-11-03", "due": "2021-11-17", "action": "Apply updates per vendor instructions.", "ransomware": "Known" }, "ssvc_exploitation": "active", "vendors": [ "kaseya" ], "products": [ "kaseya vsa agent", "kaseya vsa server" ], "cwes": [ "CWE-522" ], "description": "Kaseya VSA before 9.5.7 allows credential disclosure, as exploited in the wild in July 2021. By default Kaseya VSA on premise offers a download page where the clients for the installation can be downloaded. The default URL for this page is https://x.x.x.x/dl.asp When an attacker download a client for Windows and installs it, the file KaseyaD.ini is generated (C:\\Program Files (x86)\\Kaseya\\XXXXXXXXXX\\KaseyaD.ini) which contains an Agent_Guid and AgentPassword This Agent_Guid and AgentPassword can be used to log in on dl.asp (https://x.x.x.x/dl.asp?un=840997037507813&pw=113cc622839a4077a84837485ced6b93e440bf66d44057713cb2f95e503a06d9) This request authenticates the client and returns a sessionId cookie that can be used in subsequent attacks to bypass authentication. Security issues discovered --- * Unauthenticated download page leaks credentials * Credentials of agent software can be used to obtain a sessionId (cookie) that can be used for services not intended for use by agents * dl.asp accepts credentials via a GET request * Access to KaseyaD.ini gives an attacker access to sufficient information to penetrate the Kaseya installation and its clients. Impact --- Via the page /dl.asp enough information can be obtained to give an attacker a sessionId that can be used to execute further (semi-authenticated) attacks against the system." } ], "attribution": [ { "source": "NVD", "url": "https://nvd.nist.gov", "notice": "This product uses data from the NVD API but is not endorsed or certified by the NVD." }, { "source": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "notice": "Known exploited vulnerabilities from the CISA KEV catalog." }, { "source": "FIRST EPSS", "url": "https://www.first.org/epss", "notice": "Exploit prediction scores from FIRST EPSS." } ] }