CISA Known Exploited Vulnerabilities
KEV additions — March 2022
94 CVEs entered the KEV catalog in March 2022.
Added March 31, 20227
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2018-10561 | Dasan GPON Routers Authentication Bypass Vulnerability | 9.8 | 93.3 % | April 21, 2022 |
| CVE-2018-10562ransomware | Dasan GPON Routers Command Injection Vulnerability | 9.8 | 94.0 % | April 21, 2022 |
| CVE-2021-21551 | Dell dbutil Driver Insufficient Access Control Vulnerability | 7.8 | 59.9 % | April 21, 2022 |
| CVE-2021-28799ransomware | QNAP NAS Improper Authorization Vulnerability | 9.8 | 91.1 % | April 21, 2022 |
| CVE-2021-34484 | Microsoft Windows User Profile Service Privilege Escalation Vulnerability | 7.8 | 2.4 % | April 21, 2022 |
| CVE-2022-1040 | Sophos Firewall Authentication Bypass Vulnerability | 9.8 | 94.4 % | April 21, 2022 |
| CVE-2022-26871 | Trend Micro Apex Central Arbitrary File Upload Vulnerability | 9.8 | 13.6 % | April 21, 2022 |
Added March 28, 202210
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2018-8405ransomware | Microsoft DirectX Graphics Kernel Privilege Escalation Vulnerability | 7.8 | 50.0 % | April 18, 2022 |
| CVE-2018-8406ransomware | Microsoft DirectX Graphics Kernel Privilege Escalation Vulnerability | 7.8 | 50.0 % | April 18, 2022 |
| CVE-2018-8440ransomware | Microsoft Windows Privilege Escalation Vulnerability | 7.8 | 74.5 % | April 18, 2022 |
| CVE-2019-7483 | SonicWall SMA100 Directory Traversal Vulnerability | 7.5 | 34.6 % | April 18, 2022 |
| CVE-2021-20028ransomware | SonicWall Secure Remote Access (SRA) SQL Injection Vulnerability | 9.8 | 85.7 % | April 18, 2022 |
| CVE-2021-26085ransomware | Atlassian Confluence Server Pre-Authorization Arbitrary File Read Vulnerability | 5.3 | 94.0 % | April 18, 2022 |
| CVE-2021-34486 | Microsoft Windows Event Tracing Privilege Escalation Vulnerability | 7.8 | 34.7 % | April 18, 2022 |
| CVE-2021-38646ransomware | Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability | 7.8 | 42.7 % | April 18, 2022 |
| CVE-2022-0543 | Debian-specific Redis Server Lua Sandbox Escape Vulnerability | 10 | 94.4 % | April 18, 2022 |
| CVE-2022-1096 | Google Chromium V8 Type Confusion Vulnerability | 8.8 | 47.6 % | April 18, 2022 |
Added March 25, 202232
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2016-11021 | D-Link DCS-930L Devices OS Command Injection Vulnerability | 7.2 | 91.3 % | April 15, 2022 |
| CVE-2017-12617 | Apache Tomcat Remote Code Execution Vulnerability | 8.1 | 100.0 % | April 15, 2022 |
| CVE-2018-11138ransomware | Quest KACE System Management Appliance Remote Command Execution Vulnerability | 9.8 | 92.0 % | April 15, 2022 |
| CVE-2018-1273ransomware | VMware Tanzu Spring Data Commons Property Binder Vulnerability | 9.8 | 94.3 % | April 15, 2022 |
| CVE-2018-14839 | LG N1A1 NAS Remote Command Execution Vulnerability | 9.8 | 90.3 % | April 15, 2022 |
| CVE-2018-6961 | VMware SD-WAN Edge by VeloCloud Command Injection Vulnerability | 8.1 | 93.6 % | April 15, 2022 |
| CVE-2018-8373 | Microsoft Scripting Engine Memory Corruption Vulnerability | 7.5 | 82.4 % | April 15, 2022 |
| CVE-2018-8414 | Microsoft Windows Shell Remote Code Execution Vulnerability | 8.8 | 87.9 % | April 15, 2022 |
| CVE-2019-0903 | Microsoft GDI Remote Code Execution Vulnerability | 8.8 | 34.4 % | April 15, 2022 |
| CVE-2019-1003030 | Jenkins Matrix Project Plugin Remote Code Execution Vulnerability | 9.9 | 93.1 % | April 15, 2022 |
| CVE-2019-10068 | Kentico Xperience Deserialization of Untrusted Data Vulnerability | 9.8 | 93.9 % | April 15, 2022 |
| CVE-2019-11043ransomware | PHP FastCGI Process Manager (FPM) Buffer Overflow Vulnerability | 9.8 | 94.1 % | April 15, 2022 |
| CVE-2019-12989 | Citrix SD-WAN and NetScaler SQL Injection Vulnerability | 9.8 | 91.1 % | April 15, 2022 |
| CVE-2019-12991 | Citrix SD-WAN and NetScaler Command Injection Vulnerability | 8.8 | 81.0 % | April 15, 2022 |
| CVE-2019-15107 | Webmin Command Injection Vulnerability | 9.8 | 94.5 % | April 15, 2022 |
| CVE-2019-16920 | D-Link Multiple Routers Command Injection Vulnerability | 9.8 | 94.4 % | April 15, 2022 |
| CVE-2019-2616 | Oracle BI Publisher Unauthorized Access Vulnerability | 7.2 | 94.2 % | April 15, 2022 |
| CVE-2019-6340 | Drupal Core Remote Code Execution Vulnerability | 8.1 | 94.4 % | April 15, 2022 |
| CVE-2020-1631 | Juniper Junos OS Path Traversal Vulnerability | 9.8 | 5.4 % | April 15, 2022 |
| CVE-2020-1956 | Apache Kylin OS Command Injection Vulnerability | 8.8 | 93.7 % | April 15, 2022 |
| CVE-2020-2021ransomware | Palo Alto Networks PAN-OS Authentication Bypass Vulnerability | 10 | 21.1 % | April 15, 2022 |
| CVE-2020-2506 | QNAP Helpdesk Improper Access Control Vulnerability | 9.8 | 18.0 % | April 15, 2022 |
| CVE-2020-25223 | Sophos SG UTM Remote Code Execution Vulnerability | 9.8 | 94.4 % | April 15, 2022 |
| CVE-2020-5410 | VMware Tanzu Spring Cloud Config Directory Traversal Vulnerability | 7.5 | 94.3 % | April 15, 2022 |
| CVE-2020-7247 | OpenSMTPD Remote Code Execution Vulnerability | 9.8 | 94.1 % | April 15, 2022 |
| CVE-2020-9054 | Zyxel Multiple NAS Devices OS Command Injection Vulnerability | 9.8 | 94.3 % | April 15, 2022 |
| CVE-2020-9377 | D-Link DIR-610 Devices Remote Command Execution | 8.8 | 76.6 % | April 15, 2022 |
| CVE-2021-22941ransomware | Citrix ShareFile Improper Access Control Vulnerability | 9.8 | 87.8 % | April 15, 2022 |
| CVE-2021-42237ransomware | Sitecore XP Remote Command Execution Vulnerability | 9.8 | 94.4 % | April 15, 2022 |
| CVE-2022-21999ransomware | Microsoft Windows Print Spooler Privilege Escalation Vulnerability | 7.8 | 71.4 % | April 15, 2022 |
| CVE-2022-26143 | MiCollab, MiVoice Business Express Access Control Vulnerability | 9.8 | 89.2 % | April 15, 2022 |
| CVE-2022-26318 | WatchGuard Firebox and XTM Appliances Arbitrary Code Execution | 9.8 | 92.2 % | April 15, 2022 |
Added March 15, 202212
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2018-8120ransomware | Microsoft Win32k Privilege Escalation Vulnerability | 7 | 94.1 % | April 5, 2022 |
| CVE-2019-0543ransomware | Microsoft Windows Privilege Escalation Vulnerability | 7.8 | 16.6 % | April 5, 2022 |
| CVE-2019-0841ransomware | Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation Vulnerability | 7.8 | 82.7 % | April 5, 2022 |
| CVE-2019-1064ransomware | Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation Vulnerability | 7.8 | 11.3 % | April 5, 2022 |
| CVE-2019-1069ransomware | Microsoft Task Scheduler Privilege Escalation Vulnerability | 7.8 | 30.5 % | April 5, 2022 |
| CVE-2019-1129ransomware | Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation Vulnerability | 7.8 | 3.1 % | April 5, 2022 |
| CVE-2019-1132 | Microsoft Win32k Privilege Escalation Vulnerability | 7.8 | 35.6 % | April 5, 2022 |
| CVE-2019-1253ransomware | Microsoft Windows AppX Deployment Server Privilege Escalation Vulnerability | 7.8 | 30.2 % | April 5, 2022 |
| CVE-2019-1315ransomware | Microsoft Windows Error Reporting Manager Privilege Escalation Vulnerability | 7.8 | 7.5 % | April 5, 2022 |
| CVE-2019-1322ransomware | Microsoft Windows Privilege Escalation Vulnerability | 7.8 | 36.5 % | April 5, 2022 |
| CVE-2019-1405ransomware | Microsoft Windows Universal Plug and Play (UPnP) Service Privilege Escalation Vulnerability | 7.8 | 57.1 % | April 5, 2022 |
| CVE-2020-5135 | SonicWall SonicOS Buffer Overflow Vulnerability | 9.8 | 25.0 % | April 5, 2022 |
Added March 7, 20225
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2019-11581 | Atlassian Jira Server and Data Center Server-Side Template Injection Vulnerability | 9.8 | 94.4 % | September 7, 2022 |
| CVE-2020-8218 | Pulse Connect Secure Code Injection Vulnerability | 7.2 | 91.1 % | September 7, 2022 |
| CVE-2021-21973 | VMware vCenter Server and Cloud Foundation Server Side Request Forgery (SSRF) Vulnerability | 5.3 | 90.3 % | March 21, 2022 |
| CVE-2022-26485 | Mozilla Firefox Use-After-Free Vulnerability | 8.8 | 7.1 % | March 21, 2022 |
| CVE-2022-26486 | Mozilla Firefox Use-After-Free Vulnerability | 9.6 | 5.0 % | March 21, 2022 |
Added March 3, 202228
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2017-12319 | Cisco IOS XE Software Ethernet Virtual Private Network Border Gateway Protocol Denial-of-Service Vulnerability | 5.9 | 0.9 % | March 24, 2022 |
| CVE-2018-0151 | Cisco IOS Software and Cisco IOS XE Software Quality of Service Remote Code Execution Vulnerability | 9.8 | 7.4 % | March 17, 2022 |
| CVE-2018-0154 | Cisco IOS Software Integrated Services Module for VPN Denial-of-Service Vulnerability | 7.5 | 9.0 % | March 17, 2022 |
| CVE-2018-0155 | Cisco Catalyst Bidirectional Forwarding Detection Denial-of-Service Vulnerability | 8.6 | 11.2 % | March 17, 2022 |
| CVE-2018-0156 | Cisco IOS Software and Cisco IOS XE Software Smart Install Denial-of-Service Vulnerability | 7.5 | 12.1 % | March 17, 2022 |
| CVE-2018-0158 | Cisco IOS and XE Software Internet Key Exchange Memory Leak Vulnerability | 8.6 | 11.3 % | March 17, 2022 |
| CVE-2018-0159 | Cisco IOS and XE Software Internet Key Exchange Version 1 Denial-of-Service Vulnerability | 7.5 | 5.3 % | March 17, 2022 |
| CVE-2018-0161 | Cisco IOS Software Resource Management Errors Vulnerability | 6.3 | 0.7 % | March 17, 2022 |
| CVE-2018-0167 | Cisco IOS, XR, and XE Software Buffer Overflow Vulnerability | 8.8 | 1.1 % | March 17, 2022 |
| CVE-2018-0172 | Cisco IOS and IOS XE Software Improper Input Validation Vulnerability | 8.6 | 5.9 % | March 17, 2022 |
| CVE-2018-0173 | Cisco IOS and IOS XE Software Improper Input Validation Vulnerability | 8.6 | 4.1 % | March 17, 2022 |
| CVE-2018-0174 | Cisco IOS Software and Cisco IOS XE Software Improper Input Validation Vulnerability | 8.6 | 4.1 % | March 17, 2022 |
| CVE-2018-0175 | Cisco IOS, XR, and XE Software Buffer Overflow Vulnerability | 8 | 2.2 % | March 17, 2022 |
| CVE-2018-0179 | Cisco IOS Software Denial-of-Service Vulnerability | 5.9 | 1.5 % | March 17, 2022 |
| CVE-2018-0180 | Cisco IOS Software Denial-of-Service Vulnerability | 5.9 | 1.3 % | March 17, 2022 |
| CVE-2018-8298 | ChakraCore Scripting Engine Type Confusion Vulnerability | 7.5 | 90.1 % | March 17, 2022 |
| CVE-2018-8581ransomware | Microsoft Exchange Server Privilege Escalation Vulnerability | 7.4 | 91.5 % | March 17, 2022 |
| CVE-2019-1297 | Microsoft Excel Remote Code Execution Vulnerability | 8.8 | 30.8 % | March 17, 2022 |
| CVE-2019-1652 | Cisco Small Business Routers Improper Input Validation Vulnerability | 7.2 | 93.0 % | March 17, 2022 |
| CVE-2019-16928 | Exim Out-of-bounds Write Vulnerability | 9.8 | 89.8 % | March 17, 2022 |
| CVE-2020-11899 | Treck TCP/IP stack Out-of-Bounds Read Vulnerability | 5.4 | 33.3 % | March 17, 2022 |
| CVE-2020-1938 | Apache Tomcat Improper Privilege Management Vulnerability | 9.8 | 94.5 % | March 17, 2022 |
| CVE-2021-41379ransomware | Microsoft Windows Installer Privilege Escalation Vulnerability | 5.5 | 1.2 % | March 17, 2022 |
| CVE-2022-20699 | Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability | 9.8 | 89.9 % | March 17, 2022 |
| CVE-2022-20700 | Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability | 9.8 | 21.8 % | March 17, 2022 |
| CVE-2022-20701 | Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability | 7.8 | 6.1 % | March 17, 2022 |
| CVE-2022-20703 | Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability | 8 | 2.0 % | March 17, 2022 |
| CVE-2022-20708 | Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability | 8 | 13.0 % | March 17, 2022 |