Known exploited vulnerabilities
Vulnerabilities CISA has confirmed are being exploited, newest additions first — with the remediation deadline federal agencies must meet.
| Score | CVE | Affected | EPSS | Added to KEV |
|---|---|---|---|---|
| 7.6 high | CVE-2021-27059 KEV | Microsoft Office 2010 Service Pack 2 Microsoft Office Remote Code Execution Vulnerability | 6.1% | 3 Nov 2021 |
| 8.8 high | CVE-2021-26411 KEV | Microsoft Internet Explorer 11 Internet Explorer Memory Corruption Vulnerability | 81% | 3 Nov 2021 |
| 8.8 high | CVE-2021-21166 KEV | Google Chrome Data race in audio in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | 24% | 3 Nov 2021 |
| 7.8 high | CVE-2021-27065 KEV | Microsoft Exchange Server 2013 Cumulative Update 21 Microsoft Exchange Server Remote Code Execution Vulnerability | >99% | 3 Nov 2021 |
| 7.8 high | CVE-2021-26858 KEV | Microsoft Exchange Server 2013 Cumulative Update 21 Microsoft Exchange Server Remote Code Execution Vulnerability | 94% | 3 Nov 2021 |
| 7.8 high | CVE-2021-26857 KEV | Microsoft Exchange Server 2010 Service Pack 3 Microsoft Exchange Server Remote Code Execution Vulnerability | 96% | 3 Nov 2021 |
| 9.1 critical | CVE-2021-26855 KEV | Microsoft Exchange Server 2013 Cumulative Update 21 Microsoft Exchange Server Remote Code Execution Vulnerability | >99% | 3 Nov 2021 |
| 7.8 high | CVE-2021-1732 KEV | Microsoft Windows 10 Version 1803 Windows Win32k Elevation of Privilege Vulnerability | 78% | 3 Nov 2021 |
| 9.8 critical | CVE-2021-21972 KEV | VMware vCenter Server The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server. This affects VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2). | >99% | 3 Nov 2021 |
| 9.8 critical | CVE-2021-27104 KEV | accellion fta Accellion FTA 9_12_370 and earlier is affected by OS command execution via a crafted POST request to various admin endpoints. The fixed version is FTA_9_12_380 and later. | 57% | 3 Nov 2021 |
| 9.8 critical | CVE-2021-27103 KEV | accellion fta Accellion FTA 9_12_411 and earlier is affected by SSRF via a crafted POST request to wmProgressstat.html. The fixed version is FTA_9_12_416 and later. | 11% | 3 Nov 2021 |
| 7.8 high | CVE-2021-27102 KEV | accellion fta Accellion FTA 9_12_411 and earlier is affected by OS command execution via a local web service call. The fixed version is FTA_9_12_416 and later. | 3.7% | 3 Nov 2021 |
| 9.8 critical | CVE-2021-27101 KEV | accellion fta Accellion FTA 9_12_370 and earlier is affected by SQL injection via a crafted Host header in a request to document_root.html. The fixed version is FTA_9_12_380 and later. | 6.0% | 3 Nov 2021 |
| 8.8 high | CVE-2021-21017 KEV | Adobe Acrobat Reader Acrobat Reader DC versions versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are affected by a heap-based buffer overflow vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | 86% | 3 Nov 2021 |
| 7.8 high | CVE-2021-23874 KEV | McAfee,LLC McAfee Total Protection (MTP) Arbitrary Process Execution vulnerability in McAfee Total Protection (MTP) prior to 16.0.30 allows a local user to gain elevated privileges and execute arbitrary code bypassing MTP self-defense. | 1.0% | 3 Nov 2021 |
| 8.8 high | CVE-2021-21148 KEV | Google Chrome Heap buffer overflow in V8 in Google Chrome prior to 88.0.4324.150 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | 20% | 3 Nov 2021 |
| 9.8 critical | CVE-2021-22502 KEV | Operation Bridge Reporter. Remote Code execution vulnerability in Micro Focus Operation Bridge Reporter (OBR) product, affecting version 10.40. The vulnerability could be exploited to allow Remote Code Execution on the OBR server. | 97% | 3 Nov 2021 |
| 9.8 critical | CVE-2021-20016 KEV | SonicWall SMA100 A SQL-Injection vulnerability in the SonicWall SSLVPN SMA100 product allows a remote unauthenticated attacker to perform SQL query to access username password and other session related information. This vulnerability impacts SMA100 build version 10.x. | 40% | 3 Nov 2021 |
| 9.8 critical | CVE-2020-25506 KEV | dlink dns-320 firmware D-Link DNS-320 FW v2.06B01 Revision Ax is affected by command injection in the system_mgr.cgi component, which can lead to remote arbitrary code execution. | >99% | 3 Nov 2021 |
| 9.8 critical | CVE-2020-29557 KEV | dlink dir-825 r1 firmware An issue was discovered on D-Link DIR-825 R1 devices through 3.0.1 before 2020-11-20. A buffer overflow in the web interface allows attackers to achieve pre-authentication remote code execution. | 54% | 3 Nov 2021 |