CISA KEV + NVD
Firewall and VPN gateway flaws attackers are using
138 flaws in firewalls, SSL-VPN and remote-access gateways that CISA lists as exploited in the wild, by vendor, with when each was published, how severe NVD scored it and how many days passed between NVD publication and CISA’s KEV listing. Catalog version 2026.10.20.
In numbers
- 138 exploited flaws across 12 vendors, listed from 3 Nov 2021 to 16 Oct 2026
- 54 used in ransomware campaigns, by CISA’s account
- 74 scored critical by NVD
- 7 days: the median gap between NVD publication and the KEV listing, leaving out the 24 flaws listed on the catalog’s first day; 60 were listed within a week
By vendor
| Vendor | Exploited flaws | Used in ransomware | Median days to KEV | Newest added |
|---|---|---|---|---|
| Fortinet | 24 | 13 | 7 | 16 Oct 2026 |
| Citrix NetScaler | 20 | 4 | 2 | 4 Oct 2026 |
| SonicWall | 16 | 10 | 28 | 2 Sep 2026 |
| Ivanti | 15 | 8 | 0 | 13 Oct 2026 |
| Cisco ASA and Firepower | 14 | 3 | 1 | 11 Aug 2026 |
| Palo Alto Networks | 13 | 6 | 6 | 14 Oct 2026 |
| F5 BIG-IP | 8 | 4 | 5 | 22 Sep 2026 |
| Juniper | 8 | 0 | 88 | 2 Oct 2025 |
| Sophos | 7 | 2 | 386 | 6 Feb 2025 |
| Zyxel firewalls | 6 | 1 | 12 | 3 Dec 2024 |
| WatchGuard | 4 | 1 | 33 | 19 Dec 2025 |
| Check Point | 3 | 2 | 2 | 22 Sep 2026 |
Medians leave out flaws listed on 3 Nov 2021, the catalog’s first day: their gap counts to the launch, not to when exploitation was reported.
NetScaler ADC and NetScaler Gateway were sold as Citrix ADC and Citrix Gateway.
Includes the Pulse Secure entries: Pulse Connect Secure became Ivanti Connect Secure.
BIG-IP is an application delivery controller; its APM module terminates remote-access VPN sessions.
Most Juniper rows are Junos OS, which runs on SRX firewalls and also on EX switches and MX routers; two (CVE-2023-36844, CVE-2023-36847) affect EX switches only. CVE-2015-7755 is ScreenOS, used on older NetScreen and SSG firewalls.
Newest additions
| Vendor | Vulnerability | Product | Published | Added to KEV | CVSS | Advisory |
|---|---|---|---|---|---|---|
| Fortinet | CVE-2025-61624Fortinet Multiple Products Path Traversal Vulnerability | Multiple Products | 14 Apr 2026 | 16 Oct 2026185 days later | 6.5 Medium | Vendor |
| Palo Alto Networks | CVE-2026-0322Palo Alto Networks PAN-OS Code Injection Vulnerability | PAN-OS | 14 Oct 2026 | 14 Oct 2026same day or before NVD | 7.2 High | Vendor |
| Ivanti | CVE-2026-104935Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability | Connect Secure | 13 Oct 2026 | 13 Oct 2026same day or before NVD | 8.6 High | Vendor |
| Citrix NetScaler | CVE-2026-88779Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability | NetScaler | 4 Oct 2026 | 4 Oct 2026same day or before NVD | 7.5 High | Vendor |
| Citrix NetScaler | CVE-2026-88772Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability | NetScaler | 27 Sep 2026 | 27 Sep 2026same day or before NVD | 8.1 High | Vendor |
| Citrix NetScaler | CVE-2026-88771Citrix NetScaler Improper Input Validation Vulnerability | NetScaler | 27 Sep 2026 | 27 Sep 2026same day or before NVD | 9.8 Critical | Vendor |
| F5 BIG-IP | CVE-2026-94127F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability | BIG-IP APM | 22 Sep 2026 | 22 Sep 2026same day or before NVD | 9.8 Critical | Vendor |
| Check Point | CVE-2026-85102Check Point Multiple Products Improper Certificate Validation Vulnerability | Multiple Products | 9 Sep 2026 | 22 Sep 202613 days later | 9.8 Critical | Vendor |
| Citrix NetScaler | CVE-2026-19490Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability | NetScaler | 19 Aug 2026 | 9 Sep 202621 days later | 9.8 Critical | Vendor |
| Fortinet | CVE-2025-25249Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability | Multiple Products | 13 Jan 2026 | 9 Sep 2026239 days later | 9.8 Critical | Vendor |
| SonicWall | CVE-2026-83549SonicWall SMA1000 Appliances OS Command Injection Vulnerability | SMA1000 Appliances | 1 Sep 2026 | 2 Sep 20261 day later | 7.8 High | Vendor |
| SonicWall | CVE-2026-83548SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability | SMA1000 Appliances | 1 Sep 2026 | 2 Sep 20261 day later | 10.0 Critical | Vendor |
| Citrix NetScaler | CVE-2026-8452Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability | NetScaler ADC and NetScaler Gateway | 30 Jun 2026 | 26 Aug 202657 days later | 9.8 Critical | Vendor |
| Cisco ASA and Firepower | CVE-2026-20349Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability | Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) | 11 Aug 2026 | 11 Aug 2026same day or before NVD | 8.6 High | Vendor |
| Fortinet | CVE-2025-68686Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability | FortiOS | 10 Feb 2026 | 27 Jul 2026167 days later | 5.9 Medium | Vendor |
Other vendors
| Vendor | Vulnerability | Product | Published | Added to KEV | CVSS | Advisory |
|---|---|---|---|---|---|---|
| WatchGuard | CVE-2025-14733WatchGuard Firebox Out of Bounds Write Vulnerability | Firebox | 19 Dec 2025 | 19 Dec 2025same day or before NVDUsed in ransomware | 9.8 Critical | Vendor |
| WatchGuard | CVE-2025-9242WatchGuard Firebox Out-of-Bounds Write Vulnerability | Firebox | 17 Sep 2025 | 12 Nov 202556 days later | 9.8 Critical | Vendor |
| WatchGuard | CVE-2022-23176WatchGuard Firebox and XTM Privilege Escalation Vulnerability | Firebox and XTM | 24 Feb 2022 | 11 Apr 202246 days later | 8.8 High | — |
| WatchGuard | CVE-2022-26318WatchGuard Firebox and XTM Appliances Arbitrary Code Execution | Firebox and XTM Appliances | 4 Mar 2022 | 25 Mar 202221 days later | 9.8 Critical | — |
| Check Point | CVE-2026-85102Check Point Multiple Products Improper Certificate Validation Vulnerability | Multiple Products | 9 Sep 2026 | 22 Sep 202613 days later | 9.8 Critical | Vendor |
| Check Point | CVE-2026-50751Check Point Security Gateway Improper Authentication Vulnerability | Security Gateway | 8 Jun 2026 | 8 Jun 2026same day or before NVDUsed in ransomware | 9.3 Critical | Vendor |
| Check Point | CVE-2024-24919Check Point Quantum Security Gateways Information Disclosure Vulnerability | Quantum Security Gateways | 28 May 2024 | 30 May 20242 days laterUsed in ransomware | 8.6 High | Vendor |
What to do
- Match the product and version on your appliance against the vendor advisory linked in the row (where none is shown, use the references on the NVD page), and install the fixed release it names.
- CISA’s required action is to apply the vendor’s updates or mitigations, or stop using the product where none exist; recent entries add CISA’s own hunt or forensic-triage steps, and end-of-life products are to be disconnected. US federal civilian agencies must act by a deadline; everyone else faces the same risk.
- Keep the management interface and the VPN portal off the public internet where you can, and restrict them to known addresses where you cannot.
- A patch does not remove an attacker who got in first. For any flaw on this list, look for the vendor’s or CISA’s guidance on signs of compromise, not just the fix.
How this list is kept
- A row appears when CISA adds the flaw to its Known Exploited Vulnerabilities catalog: attackers are using it, not just able to. The catalog is re-read every week.
- Scope is the perimeter appliance: firewalls, SSL-VPN and remote-access gateways, and the delivery controllers that terminate remote access. Email gateways, sandboxes, management consoles and endpoint tools from the same vendors are left out.
- Publication date and CVSS score are NVD’s. “Days later” counts from NVD publication to the KEV listing; “same day or before NVD” means CISA listed the flaw no later than NVD published it. The catalog began on 3 Nov 2021, so older flaws listed that day count to the catalog’s start, not to when exploitation was first reported; the medians leave them out.
- “Used in ransomware” is CISA’s own field, set when a ransomware campaign is known to have used the flaw. How the data pages are built.
The data on this page as JSON: kev.json (CC BY 4.0) · All open data · Changes and Atom feed