CISA Known Exploited Vulnerabilities
What attackers are exploiting right now
MeasuredCISA (the US cyber agency) has evidence attackers are actually using each entry, and sets a deadline to fix it.
Not establishedWhether you run it. Fix-by dates bind US federal agencies only.
What this can and cannot tell you
- CISA has evidence each entry was actively exploited, and lists the action to take.
- Whether it is known to be used in ransomware campaigns, and whether BOD 26-04 requires forensic triage.
- EPSS (FIRST): a model's probability that the CVE is exploited in the next 30 days.
- Whether you run an affected version. The catalog names products, not your inventory.
- Fix-by dates bind US federal civilian agencies (BOD 22-01). For everyone else they are a priority signal, not a deadline.
- Ransomware "Unknown" means not known, which is not the same as never. EPSS is a forecast, not observed exploitation.
Loading the catalog…
ransomwareforensic triageamber edge: due within 14 daysdashed red edge: past due