Being used in attacks, by company

94 companies have three or more flaws on CISA’s list of vulnerabilities known to be used in attacks. Each page lists every one, newest first, with what to do.

• CompanyFlawsMost recent
• Microsoft39013 Oct 2026
• Cisco10114 Oct 2026
• Apple9529 Sep 2026
• Adobe8224 Sep 2026
• Google7516 Sep 2026
• Oracle4624 Aug 2026
• Apache418 Oct 2026
• Ivanti3613 Oct 2026
• Fortinet3216 Oct 2026
• Linux3118 Sep 2026
• Citrix274 Oct 2026
• D-Link2624 Apr 2026
• VMware264 Mar 2025
• SonicWall192 Sep 2026
• Synacor1921 Aug 2026
• Android172 Jun 2026
• Palo Alto Networks1614 Oct 2026
• Samsung1524 Apr 2026
• Atlassian1415 Oct 2026
• SAP1415 May 2025
• Zyxel1321 Sep 2026
• Mozilla136 Oct 2025
• Trend Micro1221 May 2026
• Qualcomm123 Mar 2026
• SolarWinds115 Jun 2026
• Roundcube1120 Feb 2026
• QNAP1121 Dec 2023
• Red Hat926 Aug 2026
• Progress97 Aug 2026
• Arm912 Jun 2024
• Zoho97 Mar 2023
• F5822 Sep 2026
• IBM84 Aug 2026
• Juniper82 Oct 2025
• NETGEAR88 Sep 2022
• Mitel712 Feb 2025
• Sophos76 Feb 2025
• WordPress625 Sep 2026
• Jenkins62 Oct 2025
• TP-Link63 Sep 2025
• Plex520 Oct 2026
• MikroTik525 Sep 2026
• Check Point522 Sep 2026
• GitLab511 Sep 2026
• N-able58 Sep 2026
• PaperCut531 Aug 2026
• Broadcom518 Aug 2026
• Langflow521 Jul 2026
• Drupal522 May 2026
• GNU526 Jan 2026
• RARLAB59 Dec 2025
• DrayTek515 May 2025
• Exim525 Mar 2022
• BeyondTrust416 Oct 2026
• ConnectWise411 Sep 2026
• JFrog411 Sep 2026
• Sangoma42 Sep 2026
• JetBrains45 Aug 2026
• SimpleHelp429 Jun 2026
• Ubiquiti423 Jun 2026
• Kentico420 Apr 2026
• Craft CMS420 Mar 2026
• WatchGuard419 Dec 2025
• Gladinet415 Dec 2025
• Fortra429 Sep 2025
• Sitecore44 Sep 2025
• Veeam417 Oct 2024
• GIGABYTE424 Oct 2022
• Nagios418 Jan 2022
• Accellion43 Nov 2021
• Arista322 Sep 2026
• BerriAI32 Sep 2026
• TrueConf320 Aug 2026
• Laravel320 Mar 2026
• SmarterTools35 Feb 2026
• ASUS317 Dec 2025
• OSGeo311 Dec 2025
• Dassault Systèmes328 Oct 2025
• Meta Platforms32 Sep 2025
• CrushFTP322 Jul 2025
• SysAid322 Jul 2025
• Rails37 Jul 2025
• PHP37 Jul 2025
• TeleMessage31 Jul 2025
• Qlik313 Jan 2025
• ImageMagick39 Sep 2024
• Realtek318 Sep 2023
• Veritas37 Apr 2023
• VMware Tanzu325 Aug 2022
• Kaseya324 May 2022
• Elastic325 Mar 2022
• Tenda33 Nov 2021
• SaltStack33 Nov 2021
• DotNetNuke (DNN)33 Nov 2021

From CISA’s Known Exploited Vulnerabilities catalog, updated 21 Oct 2026: 1,754 flaws from 290 companies. The rest are in the lookup.