Known Exploited Vulnerabilities: Live

Breadth

Exploited in the wild, not yet on CISA's list.

VulnCheck tracks 544 additional SMB-relevant CVEs being actively exploited beyond CISA's KEV catalog. 52 are flagged as used in ransomware campaigns. The list below covers the same vendors as everything else on this page: Microsoft, Apple, Adobe, Cisco, Fortinet, SonicWall, Ivanti, Palo Alto, Google, and Ubiquiti.

CVE-2020-9771VulnCheck
· Apple Mac OS X
macOS APFS Snapshot Mount Authorization Bypass
VulnCheck recorded exploitation activity as of Aug 13, 2026
CVE-2026-69836VulnCheck
· Microsoft Entra Id
Microsoft Microsoft Entra Id Deserialization of Untrusted Data
VulnCheck recorded exploitation activity as of Aug 11, 2026
CVE-2026-48294VulnCheck
· Adobe Acrobat and Reader
Adobe Acrobat and Reader Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
VulnCheck recorded exploitation activity as of Aug 10, 2026
CVE-2026-48313VulnCheck
· Adobe ColdFusion
Adobe ColdFusion Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
VulnCheck recorded exploitation activity as of Aug 1, 2026
CVE-2025-62631VulnCheck
· Fortinet FortiOS
Fortinet FortiOS Insufficient Session Expiration
VulnCheck recorded exploitation activity as of Jul 23, 2026
CVE-2026-45586VulnCheck
· Microsoft Windows
Microsoft Windows Improper Link Resolution Before File Access ('Link Following')
VulnCheck recorded exploitation activity as of Jul 10, 2026
CVE-2020-17103VulnCheck
· Microsoft Windows
Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
VulnCheck recorded exploitation activity as of Jul 10, 2026
CVE-2021-27076VulnCheck
· Microsoft Business Productivity Servers
Microsoft SharePoint Server Remote Code Execution Vulnerability
VulnCheck recorded exploitation activity as of Jun 24, 2026
CVE-2026-39813VulnCheck
· Fortinet FortiSandbox
Fortinet FortiSandbox Path Traversal: '../filedir'
VulnCheck recorded exploitation activity as of Jun 15, 2026
CVE-2026-41089VulnCheck
· Microsoft Windows
Microsoft Windows Stack-based Buffer Overflow
VulnCheck recorded exploitation activity as of May 29, 2026

Show all 544 SMB-relevant (534 more)

CVE-2024-12802VulnCheckKnown ransomware use
· SonicWall SonicOS
SonicWall SonicOS Authentication Bypass by Primary Weakness
VulnCheck recorded exploitation activity as of May 19, 2026
CVE-2025-40600VulnCheck
· SonicWall SonicOS
SonicWall SonicOS Use of Externally-Controlled Format String
VulnCheck recorded exploitation activity as of May 10, 2026
CVE-2025-32818VulnCheck
· SonicWall SonicOS
SonicWall SonicOS NULL Pointer Dereference
VulnCheck recorded exploitation activity as of May 10, 2026
CVE-2026-25187VulnCheck
· Microsoft Windows
Microsoft Windows Improper Link Resolution Before File Access ('Link Following')
VulnCheck recorded exploitation activity as of Apr 13, 2026
CVE-2026-21262VulnCheck
· Microsoft SQL Server 2016
Microsoft SQL Server 2016 Improper Access Control
VulnCheck recorded exploitation activity as of Apr 13, 2026
CVE-2026-26127VulnCheck
· Microsoft .NET
Microsoft .NET Out-of-bounds Read
VulnCheck recorded exploitation activity as of Apr 13, 2026

VulnCheck also tracks 2,943 exploited CVEs outside the SMB-relevant vendor allowlist — gear we don't typically see in dental, law, or accounting shops. Full exploited-not-on-CISA breadth: 3,487.

Breadth data via VulnCheck KEV.

Last 90 days

Added recently.

New SMB-relevant additions to KEV in the last 90 days — the urgent items most likely to need action this quarter.

CVE-2026-33824 · Microsoft Internet Key Exchange (IKE) Service ExtensionsDouble Free VulnerabilityPatch this weekAdded to KEV Aug 18, 2026
Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability
Affects anyone running on-premises Microsoft Exchange Server. If you have Exchange in your office (as opposed to Microsoft 365 hosted email), it's the mail server holding all internal email — full compromise reads every conversation it stores.
Microsoft Internet Key Exchange (IKE) Service Extensions contains a double free vulnerability that could enable remote code execution.
View the full entry
CVE-2026-55040 · Microsoft SharePointWeak Authentication VulnerabilityPatch this weekAdded to KEV Aug 18, 2026
Microsoft SharePoint Weak Authentication Vulnerability
Affects anyone running Microsoft SharePoint. Microsoft products in a small practice typically sit close to credentials, email, or document workflows — treat the patch as in-scope.
Microsoft SharePoint contains a weak authentication vulnerability which allows an unauthorized attacker to bypass a security feature over a network.
View the full entry
CVE-2026-65400 · Apple macOSImproper Authentication VulnerabilityPatch this weekAdded to KEV Aug 18, 2026
Apple macOS Improper Authentication Vulnerability
Affects anyone running Macs, iPhones, or iPads in the office. For a small practice, Apple endpoints are typically how staff handle email, browse client portals, and store local case files — exploitation gives an attacker access to that data on the device.
Apple macOS contains an improper authentication vulnerability that could allow an attacker on the network to authenticate to Screen Sharing without valid credentials.
View the full entry
CVE-2026-20349 · Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD)Heap Inspection VulnerabilityPatch this weekAdded to KEV Aug 11, 2026
Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability
Affects anyone with Cisco networking or security appliances on their network — typically a firewall, switch, or remote-access VPN. That device controls traffic to and from every workstation; exploitation can mean an attacker pivots inside the network without touching any user device.
Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) contain a heap inspection vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.
View the full entry
CVE-2026-68820 · Microsoft Windows Ancillary Function Driver for WinSockUse-After-Free VulnerabilityPlan to patchAdded to KEV Aug 11, 2026
Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability
Affects anyone running Windows workstations or servers. In a small CPA, legal, or dental practice, Windows is typically the platform your accounting, document management, or practice management software runs on — exploitation gives an attacker access to whatever client files and credentials live on those machines.
Microsoft Windows Ancillary Function Driver for WinSock contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.
- KB5120238
- KB5120242
- KB5120229
- KB5120249
- +9 more
View the full entry
CVE-2026-20316 · Cisco Secure Firewall Management Center (FMC)Secure Firewall Management Center Use of Hard-coded Password VulnerabilityPlan to patchAdded to KEV Jul 29, 2026
Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability
Affects anyone with Cisco networking or security appliances on their network — typically a firewall, switch, or remote-access VPN. That device controls traffic to and from every workstation; exploitation can mean an attacker pivots inside the network without touching any user device.
Cisco Secure Firewall Management Center (FMC) formerly known as Firepower Management Center contains a use of hard-coded password vulnerability that could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems.
View the full entry
CVE-2025-68686 · Fortinet FortiOSExposure of Sensitive Information to an Unauthorized Actor VulnerabilityPlan to patchAdded to KEV Jul 27, 2026
Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability
Affects anyone whose internet connection goes through a Fortinet appliance — typically a FortiGate firewall or FortiClient VPN. The firewall sits between every device in the office and the internet; exploitation can mean an attacker gets inside the network perimeter without touching a workstation.
Fortinet FortiOS contains an exposure of sensitive information to an unauthorized actor vulnerability. This may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests. An attacker would need first to have compromised the product via another vulnerability, at filesystem level.
View the full entry
CVE-2026-50522 · Microsoft SharePointDeserialization of Untrusted Data VulnerabilityPatch this weekAdded to KEV Jul 22, 2026
Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
Affects anyone running Microsoft SharePoint. Microsoft products in a small practice typically sit close to credentials, email, or document workflows — treat the patch as in-scope.
Microsoft SharePoint contains a deserialization of untrusted data vulnerability which could allow an unauthorized attacker to execute code over a network.
View the full entry
CVE-2026-58644 · Microsoft SharePointDeserialization of Untrusted Data VulnerabilityPatch this weekAdded to KEV Jul 16, 2026
Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
Affects anyone running Microsoft SharePoint. Microsoft products in a small practice typically sit close to credentials, email, or document workflows — treat the patch as in-scope.
Microsoft SharePoint contains a deserialization of untrusted data vulnerability that allows an unauthorized attacker to execute code over a network.
View the full entry
Fortinet FortiSandbox: 2 CVEsPatch this weekadded Jul 16, 2026
- CVE-2026-25089
  Fortinet FortiSandbox OS Command Injection Vulnerability
  Affects anyone whose internet connection goes through a Fortinet appliance — typically a FortiGate firewall or FortiClient VPN. The firewall sits between every device in the office and the internet; exploitation can mean an attacker gets inside the network perimeter without touching a workstation.
  Fortinet FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS contain an OS command injection vulnerability that allows an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests.
- CVE-2026-39808
  Fortinet FortiSandbox OS Command Injection Vulnerability
  Affects anyone whose internet connection goes through a Fortinet appliance — typically a FortiGate firewall or FortiClient VPN. The firewall sits between every device in the office and the internet; exploitation can mean an attacker gets inside the network perimeter without touching a workstation.
  Fortinet FortiSandbox contains an OS command injection vulnerability that could allow an unauthenticated attacker to execute unauthorized code or commands via crafted HTTP requests.
CVE-2026-56155 · Microsoft Active Directory Federation ServicesInsufficient Granularity of Access Control VulnerabilityPlan to patchAdded to KEV Jul 14, 2026
Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability
Affects anyone running Microsoft Active Directory Federation Services. Microsoft products in a small practice typically sit close to credentials, email, or document workflows — treat the patch as in-scope.
Microsoft Active Directory Federation Services contains an insufficient granularity of access control vulnerability that allows an authorized attacker to elevate privileges locally.
- KB5099538
- KB5099540
- KB5099536
- KB5099535
- +2 more
View the full entry
CVE-2026-56164 · Microsoft SharePoint ServerMissing Authentication for Critical Function VulnerabilityMonitorAdded to KEV Jul 14, 2026
Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability
Affects anyone running Microsoft SharePoint Server. Microsoft products in a small practice typically sit close to credentials, email, or document workflows — treat the patch as in-scope.
Microsoft SharePoint contains a missing authentication for critical function vulnerability that allows an unauthorized attacker to elevate privileges over a network.
View the full entry
SonicWall SMA1000 Appliances: 2 CVEsPatch nowadded Jul 14, 2026
- CVE-2026-15409Known ransomware use
  SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability
  Affects anyone whose network is fronted by a SonicWall firewall or SSL VPN. The device sits at the edge between your office and the internet and authenticates remote workers — exploitation typically means an attacker reaches inside without needing a user credential.
  SonicWall SMA1000 Appliances contain a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to potentially cause the appliance to make requests to unintended location.
- CVE-2026-15410Known ransomware use
  SonicWall SMA1000 Appliances Code Injection Vulnerability
  Affects anyone whose network is fronted by a SonicWall firewall or SSL VPN. The device sits at the edge between your office and the internet and authenticates remote workers — exploitation typically means an attacker reaches inside without needing a user credential.
  SonicWall SMA1000 Appliances contain a code injection vulnerability which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands.
CVE-2008-4128 · Cisco iOSCross-Site Request Forgery VulnerabilityPlan to patchAdded to KEV Jul 13, 2026
Cisco iOS Cross-Site Request Forgery Vulnerability
Affects anyone with Cisco networking or security appliances on their network — typically a firewall, switch, or remote-access VPN. That device controls traffic to and from every workstation; exploitation can mean an attacker pivots inside the network without touching any user device.
Cisco IOS 12.4 contains multiple cross-site forgery vulnerabilities that allows remote attackers to execute arbitrary commands via (1) a certain "show privilege" command to the /level/15/exec/- URI, and (2) a certain "alias exec" command to the /level/15/exec/-/configure/http URI.
View the full entry
CVE-2026-48282 · Adobe ColdFusionPath Traversal VulnerabilityPatch this weekAdded to KEV Jul 7, 2026
Adobe ColdFusion Path Traversal Vulnerability
Affects anyone running Adobe ColdFusion. If it's part of your document workflow, exploitation can lead to code execution when a user opens an attacker-controlled file.
Adobe ColdFusion contains a path traversal vulnerability that could lead to arbitrary code execution in the context of the current user.
View the full entry
CVE-2026-45659 · Microsoft SharePoint ServerDeserialization of Untrusted Data VulnerabilityKnown ransomware usePatch nowAdded to KEV Jul 1, 2026
Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability
Affects anyone running Microsoft SharePoint Server. Microsoft products in a small practice typically sit close to credentials, email, or document workflows — treat the patch as in-scope.
Microsoft SharePoint Server contains a deserialization of untrusted data vulnerability which allows an authorized attacker to execute code over a network.
View the full entry
CVE-2026-20230 · Cisco Unified Communications ManagerServer-Side Request Forgery (SSRF) VulnerabilityPatch this weekAdded to KEV Jun 25, 2026
Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability
Affects anyone with Cisco networking or security appliances on their network — typically a firewall, switch, or remote-access VPN. That device controls traffic to and from every workstation; exploitation can mean an attacker pivots inside the network without touching any user device.
Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) contain a server-side request forgery (SSRF) Vulnerability that could allow an unauthenticated, remote attacker to write files to the underlying operating system that could be used later to elevate to root.
View the full entry
Ubiquiti UniFi OS: 3 CVEsPatch this weekadded Jun 23, 2026
- CVE-2026-34910
  Ubiquiti UniFi OS Improper Input Validation Vulnerability
  Affects anyone running Ubiquiti UniFi networking gear (access points, switches, security gateways, NVRs). The gear carries internal network traffic and often hosts video surveillance — exploitation can expose network traffic or grant management access to the network itself.
  Ubiquiti UniFi OS contains an improper input validation vulnerability which could allow a malicious actor with access to the network to conduct command injection.
- CVE-2026-34909
  Ubiquiti UniFi OS Path Traversal Vulnerability
  Affects anyone running Ubiquiti UniFi networking gear (access points, switches, security gateways, NVRs). The gear carries internal network traffic and often hosts video surveillance — exploitation can expose network traffic or grant management access to the network itself.
  Ubiquiti UniFi OS contains a path traversal vulnerability which could allow a malicious actor with access to the network to access files on the underlying system that could be manipulated to access an underlying account.
- CVE-2026-34908
  Ubiquiti UniFi OS Improper Access Control Vulnerability
  Affects anyone running Ubiquiti UniFi networking gear (access points, switches, security gateways, NVRs). The gear carries internal network traffic and often hosts video surveillance — exploitation can expose network traffic or grant management access to the network itself.
  Ubiquiti UniFi OS contains an improper access control vulnerability which could allow a malicious actor with access to the network to make unauthorized changes to the system.
CVE-2026-20262 · Cisco Catalyst SD-WAN ManagerDirectory or Path Traversal VulnerabilityPlan to patchAdded to KEV Jun 15, 2026
Cisco Catalyst SD-WAN Manager Directory or Path Traversal Vulnerability
Affects anyone with Cisco networking or security appliances on their network — typically a firewall, switch, or remote-access VPN. That device controls traffic to and from every workstation; exploitation can mean an attacker pivots inside the network without touching any user device.
Cisco Catalyst SD-WAN Manager contains a directory or path traversal vulnerability that could allow an authenticated, remote attacker to create a file or overwrite any file on the filesystem of an affected system.
View the full entry
CVE-2026-10520 · Ivanti SentryOS Command Injection VulnerabilityPatch this weekAdded to KEV Jun 11, 2026
Ivanti Sentry OS Command Injection Vulnerability
Affects anyone using Ivanti VPN (Connect Secure or Pulse) or Ivanti endpoint management. The VPN is what remote workers use to reach internal systems; the endpoint management tool typically has admin reach into every laptop — exploitation in either is high-impact.
Ivanti Sentry (formerly known as MobileIron Sentry) contains an OS command injection vulnerability which could allow a remote unauthenticated user to achieve root-level remote code execution. This vulnerability can be successfully exploited in cases where the Sentry appliance is in an unmanaged state with its endpoints externally reachable. The use of mTLS with EPMM or restricted HTTPS access through Neurons for MDM makes interfaces inaccessible to external actors.
View the full entry
CVE-2026-11645 · Google Chromium V8Out-of-Bounds Read and Write VulnerabilityPlan to patchAdded to KEV Jun 9, 2026
Google Chromium V8 Out-of-Bounds Read and Write Vulnerability
Affects anyone using Chrome or Chromium as their browser. The browser is where staff log into cloud apps, banking, and client portals — exploitation can mean session theft or credential exposure for every site you're signed into.
Google Chromium V8 out-of-bounds read and write vulnerability that could allow a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
View the full entry
CVE-2026-20245 · Cisco Catalyst SD-WAN ManagerImproper Encoding or Escaping of Output VulnerabilityPatch this weekAdded to KEV Jun 9, 2026
Cisco Catalyst SD-WAN Manager Improper Encoding or Escaping of Output Vulnerability
Affects anyone with Cisco networking or security appliances on their network — typically a firewall, switch, or remote-access VPN. That device controls traffic to and from every workstation; exploitation can mean an attacker pivots inside the network without touching any user device.
Cisco Catalyst SD-WAN Manager formerly SD-WAN vManage contains an improper encoding or escaping of output vulnerability. This vulnerability could allow an authenticated, local attacker to execute arbitrary commands as root by supplying a crafted file to the affected system.
View the full entry
CVE-2026-0257 · Palo Alto Networks PAN-OSAuthentication Bypass VulnerabilityKnown ransomware usePatch nowAdded to KEV May 29, 2026
Palo Alto Networks PAN-OS Authentication Bypass Vulnerability
Affects anyone behind a Palo Alto firewall or using GlobalProtect VPN. The firewall is the network edge; the VPN is how remote workers reach inside the perimeter — exploitation puts an attacker on the internal network without touching a workstation.
Palo Alto Networks PAN-OS contains an authentication bypass vulnerability that allows attackers to bypass security restrictions and establish an unauthorized VPN connection.
View the full entry

Earlier

Older entries still worth a check.

The most recent SMB-relevant entries that predate the 90-day window above. Use the search bar to reach anything older.

CVE-2009-3459 · Adobe Acrobat and ReaderHeap-Based Buffer Overflow VulnerabilityPlan to patchAdded to KEV May 20, 2026
Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability
Affects anyone opening, editing, or signing PDFs in Adobe Acrobat or Reader. For a CPA or legal practice, PDFs are typically client tax returns, engagement letters, signed agreements, and discovery documents — opening a malicious PDF runs attacker code in the user's session, which can pivot to file shares or email.
Adobe Acrobat and Reader contain a heap-based buffer overflow vulnerability which could allow remote attackers to execute arbitrary code via a crafted PDF file that triggers memory corruption.
View the full entry
Microsoft Internet Explorer: 2 CVEsPlan to patchadded May 20, 2026
- CVE-2010-0806
  Microsoft Internet Explorer Use-After-Free Vulnerability
  Affects anyone running Microsoft Internet Explorer. Microsoft products in a small practice typically sit close to credentials, email, or document workflows — treat the patch as in-scope.
  Microsoft Internet Explorer contains an use-after-free vulnerability that could allow remote attackers to execute arbitrary code via vectors involving access to an invalid pointer after the deletion of an object. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.

3 new fixes landed this week.

What to patch first.

Your insurer will ask if this is patched.

One Windows Update run clears all of these.

Get the weekly digest in your inbox.

You don't have to triage 827 vulnerabilities yourself.

What's being actively exploited.

Exploited in the wild, not yet on CISA's list.

Added recently.

Older entries still worth a check.