CISA KEV — Live Table
Sortable, filterable snapshot of CISA's Known Exploited Vulnerabilities catalog — the CVEs U.S. federal agencies must patch on a deadline.
The CISA Known Exploited Vulnerabilities (KEV) catalog is the closest thing the industry has to a public "patch this now" list. Under Binding Operational Directive 22-01, U.S. federal civilian agencies must remediate every CVE on the list by the published due date, and the same list has become the de facto priority queue for private-sector security and change teams too. This tool renders a compact, sortable snapshot of the catalog so a change manager can scan it in seconds: click any column header to sort, type in the filter box to narrow by vendor / product / CVE, or flip the ransomware-use toggle to show only the entries CISA has flagged as tied to active ransomware campaigns. The underlying data comes from CISA's public JSON feed; the snapshot bundled with this page refreshes nightly. For the authoritative, up-to-the-minute list, use the CISA link at the bottom. Nothing you type here is sent to a server — filtering and sorting all happens in the browser.
| CVE | Vendor | Product | Date added | Due date | Notes |
|---|---|---|---|---|---|
| CVE-2026-88779 | Citrix | NetScaler | 2026-10-04 | 2026-10-07 | Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway) contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for a denial of service. |
| CVE-2026-102489 | Zammad GmbH | Zammad | 2026-10-02 | 2026-10-05 | Zammad GmbH Zammad contains a session fixation vulnerability that can lead to remote code execution as the zammad user. This vulnerability can be chained with CVE-2026-102490. |
| CVE-2026-102490 | Zammad GmbH | Zammad | 2026-10-02 | 2026-10-05 | Zammad GmbH Zammad contains an improper privilege management vulnerability that can allow the local zammad user to escalate privileges to root. This vulnerability can be chained with CVE-2026-102489. |
| CVE-2026-104286 | Fortinet | FortiMail | 2026-10-01 | 2026-10-04 | Fortinet FortiMail contains a path traversal and an improper neutralization of NULL byte or NULL character vulnerability that may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests. |
| CVE-2026-76504 | Cisco | Catalyst SD-WAN Manager | 2026-09-30 | 2026-10-03 | Cisco Catalyst SD-WAN Manager contains a hex encoding vulnerability that could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user due to improper handling of URI encoding in an HTTP request. |
| CVE-2026-86950 | Apple | Multiple Products | 2026-09-29 | 2026-10-02 | Apple iOS, macOS, and iPadOS contain an out-of-bounds write vulnerability in CoreGraphics that may lead to arbitrary code execution. |
| CVE-2026-88771 | Citrix | NetScaler | 2026-09-27 | 2026-09-30 | Citrix NetScaler ADC and NetScaler Gateway contain an improper input validation vulnerability that could allow an unauthenticated attacker to execute arbitrary commands. |
| CVE-2026-88772 | Citrix | NetScaler | 2026-09-27 | 2026-09-30 | Citrix NetScaler ADC and NetScaler Gateway contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for remote code execution or denial of service |
| CVE-2026-87902 | WordPress | Core | 2026-09-25 | 2026-09-28 | WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local `.php` file outside the active theme directories, leading to remote code execution. |
| CVE-2026-65660 | Microsoft | SharePoint | 2026-09-25 | 2026-09-28 | Microsoft SharePoint contains a code injection vulnerability which could allow an authorized attacker to execute code over a network. |
| CVE-2026-67279 | MikroTik | RouterOS | 2026-09-25 | 2026-09-28 | Mikrotik RouterOS contains an improper enforcement of behavioral workflow vulnerability that could allow an unauthenticated client to open a session channel and send an exec request. This vulnerability can be chained to achieve unauthenticated exploitation of CVE-2026-86060. |
| CVE-2026-71362 | Adobe | Commerce and Magento | 2026-09-24 | 2026-09-27 | Adobe Commerce and Magento contains an incorrect authorization vulnerability that could allow an attacker to leverage this vulnerability to gain elevated access to sensitive resources without any user interaction. |
| CVE-2026-5430 | WSO2 | Multiple Products | 2026-09-24 | 2026-09-27 | WSO2 API Control Plane, API Manager, Traffic Manager & Universal Gateway contain a path traversal vulnerability that could allow for unrestricted file upload and lead to remote code execution. |
| CVE-2026-85102 | Check Point | Multiple Products | 2026-09-22 | 2026-09-25 | Check Point Security Gateway and Check Point Spark Firewall using Site to Site VPN or Remote Access VPN contain an improper certificate validation vulnerability which could allow an unauthenticated remote attacker to execute arbitrary code on the Gateway. |
| CVE-2026-93616 | Check Point | Multiple Products | 2026-09-22 | 2026-09-25 | Check Point Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent contain a path traversal vulnerability that allows an unauthenticated attacker to upload and execute arbitrary scripts. |
| CVE-2026-94127 | F5 | BIG-IP APM | 2026-09-22 | 2026-09-25 | F5 BIG-IP APM contains a heap-based buffer overflow vulnerability when access policy and an OAuth profile are configured on a virtual server. This vulnerability could allow an unauthenticated attacker to perform remote code execution. |
| CVE-2026-93952 | Arista | VeloCloud Orchestrator | 2026-09-22 | 2026-09-25 | Arista VeloCloud Orchestrator (VCO) on-prem contains an improper input validation vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. |
| CVE-2026-7273 | Zyxel | GS1900 Series Switches | 2026-09-21 | 2026-09-24 | Zyxel GS1900 series switches contain a stack-based buffer overflow vulnerability in the CGI program which could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request. |
| CVE-2026-53266 | Linux | Kernel | 2026-09-18 | 2026-09-21 | Linux Kernel contains an out-of-bounds write vulnerability in the ebtables SNAT target which allows an ARP sender hardware address rewrite to write directly into a nonlinear socket-buffer fragment backed by a splice-imported file page. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. |
| CVE-2025-39964 | Linux | Kernel | 2026-09-18 | 2026-09-21 | Linux Kernel contains a race condition vulnerability which allows concurrent writes to the same AF_ALG socket causing data to be unpredictably interleaved and creating inconsistencies in the socket's internal state. |
Source: CISA Known Exploited Vulnerabilities Catalog. Snapshot generated 2026-10-05T08:08:38Z.
About this tool
The KEV catalog is most useful when it shortens a practical question: which entries require an owner to determine whether the organization is exposed? This view makes the public catalog easier to sort and filter during triage. Search by vendor, product, or catalog field, then move relevant entries into the workflow that connects findings to assets, owners, and due dates.
A catalog entry signals known exploitation, not automatic impact. Start with the affected product and vulnerability details, validate installed versions and exposure paths, and check the required action against local policy. The date belongs to the catalog record, not a disclosure or exploitation-start date. When a deadline applies, track the organization's response and any accepted exception outside this table.
How to read the output
- Filter first, then carefully validate each candidate against owned assets.
- Use the required action as a starting point for remediation planning.
- Separate catalog status from internal evidence of exposure or exploitation.
- Assign exceptions and completion evidence in the vulnerability management system.
What this does not tell you
- KEV catalog dates describe CISA catalog activity and do not establish the vulnerability's disclosure or exploitation start date.
- The catalog cannot identify which assets, versions, internet exposures, or compensating controls exist in a specific environment.
- CISA entries are a high-priority input, but organizations still need their own threat, business, and change context.
Data sources
Free to use, no account required, and nothing you enter is transmitted to this site — the tool runs entirely in your browser.