181 remote code execution bugs — from Shellshock to React2Shell — with root cause, detection notes and public PoCs.
PHP2Shell
PHP Group PHP core (request lifecycle, session upload progress, fatal-error handling) · CVE-2026-109618 +1Two memory-safety bugs in PHP's request lifecycle let an unauthenticated attacker get code execution with crafted HTTP requests, even against a trivial PHP app. They were reported by researchers from Wiz, Calif, OpenAI and others; details leaked on 20 October, a day before the coordinated release, and watchTowr and Cloudflare reported exploitation attempts on release day. The CNA (PHP) CVSS v4.0 score is 9.2.
pre-authNode2Shell
OpenJS Foundation / Google (Brotli) Node.js (bundled Brotli decoder) · CVE-2026-111497An out-of-bounds write in the Brotli decompressor that Node.js bundles can corrupt decoder state when it handles a malformed stream. Reported to Node.js by OpenAI Codex Security; Imperva's red team named it Node2Shell after getting code execution on the official Node.js 24.22.0 Linux arm64 image. The CNA (Google) scores it CVSS v4.0 9.2; Node.js rates it High.
pre-authPlex2Shell
Plex Plex Media Server · CVE-2026-96652 +3Researcher Zach Main chained four Plex Media Server bugs into unauthenticated RCE as the plex user on servers exposed on port 32400. He reported them in July and Plex patched them on 4 August 2026, but many servers were still unpatched when details were published on 16 October. Exploitation was reported the next day, installing an XMRig miner and a Linux proxy backdoor. Individually the CVEs score 4.3-7.2 (CNA CVSS v3.1; the primary CVE is 4.3), but the researcher rates the full chain 9.8.
pre-authKEVwp2shell
WordPress WordPress Core (REST API batch endpoint, WP_Query) · CVE-2026-63030 +1Adam Kues of Searchlight Cyber chained a REST API batch-routing logic flaw with a SQL injection to get pre-authentication RCE on a stock WordPress install with no plugins. Public PoCs appeared within hours, and multiple threat actors exploited it to upload web-shell plugins. WordPress.org enabled forced auto-updates for affected sites.
pre-authKEVKestra Authentication Bypass to Workflow RCE
Kestra Kestra OSS · CVE-2026-49869Kestra, an open-source orchestration platform, whitelisted its public config endpoint with a suffix match. Any API path ending in 'configs' skipped authentication, letting attackers create and run workflows that execute scripts. CISA added it to KEV in September 2026.
pre-authKEVLiteLLM MCP Test Endpoint Command Execution
BerriAI LiteLLM · CVE-2026-42271LiteLLM, a widely deployed LLM gateway/proxy, let any API-key holder 'preview' an MCP server by supplying the command to launch. The proxy then spawned that command on its own host. CISA added it to KEV in June 2026.
KEVMarimo Unauthenticated Terminal WebSocket RCE
marimo marimo · CVE-2026-39987Marimo, a reactive Python notebook popular in data science, exposed a built-in terminal over a WebSocket that skipped authentication entirely. Connecting to it gave an interactive shell. It was exploited in the wild and added to CISA KEV in April 2026.
pre-authKEVLangflow Public Flow Build Unauthenticated RCE
Langflow Langflow · CVE-2026-33017A second unauthenticated code-execution path in Langflow, distinct from CVE-2025-3248. The endpoint used to build public flows accepted attacker-supplied flow definitions containing Python, which the server then executed. CISA added it to KEV within days of disclosure.
pre-authKEVn8n Form Webhook Unauthenticated File Access (Ni8mare)
n8n n8n · CVE-2026-21858Cyera found that public n8n form workflows could be tricked into reading arbitrary files from the server. By stealing the instance's secrets and database, an unauthenticated attacker could forge an admin session and then use n8n's own features to execute commands.
pre-authLangChain Core Serialization Injection (LangGrinch)
LangChain langchain-core · CVE-2025-68664Reported by Yarden Porat and nicknamed LangGrinch, this flaw let attacker-controlled data masquerade as trusted LangChain objects when serialized and loaded again. It can leak environment secrets and instantiate LangChain classes with attacker parameters. Not strictly RCE by itself, but a critical primitive in agent pipelines that persist or stream LLM output.
pre-authn8n Workflow Expression Injection RCE
n8n n8n · CVE-2025-68613n8n, a popular workflow automation platform, evaluated {{ }} expressions in a JavaScript context that was not isolated from Node.js. Any logged-in user who could edit workflows could run system commands. It was added to CISA KEV in March 2026.
KEVLangflow CORS Token Hijack to RCE
Langflow Langflow · CVE-2025-34291A drive-by chain found by Obsidian Security: simply visiting a malicious web page while logged in to Langflow lets the attacker steal the session and then use Langflow's built-in code execution. It was added to CISA KEV in May 2026.
pre-authKEVReact2Shell
Meta React Server Components (react-server-dom-webpack / parcel / turbopack), Next.js App Router · CVE-2025-55182An unauthenticated attacker can send a single crafted HTTP request to any server that decodes React Server Components 'Flight' payloads (e.g. Next.js Server Actions) and get JavaScript code execution on the server. Default create-next-app projects were exploitable with no developer code involved. It was mass-exploited within days of disclosure.
pre-authKEVRay Dashboard Browser Drive-by RCE
Anyscale Ray · CVE-2025-62593Developers running Ray locally could be compromised just by visiting a malicious website in Firefox or Safari. Ray's only defense against browser requests was a User-Agent check that browsers let scripts override. CISA added it to KEV in August 2026.
pre-authKEVOpen WebUI Direct Connections SSE Code Injection
Open WebUI Open WebUI · CVE-2025-64496Cato CTRL found that a malicious model server connected to Open WebUI could push events that ran JavaScript in the user's browser. The stolen session could then be used with Open WebUI's Functions feature to run Python on the backend.
Metro4Shell
React Native Community @react-native-community/cli-server-api (Metro development server) · CVE-2025-11953JFrog found that the Metro dev server started by the React Native CLI listens on all network interfaces and exposes an unauthenticated /open-url endpoint whose input reaches the 'open' npm package. Anyone who can reach port 8081 can launch executables on the developer's machine, and on Windows run arbitrary shell commands. VulnCheck named it Metro4Shell after seeing in-the-wild exploitation from 21 December 2025.
pre-authKEVWSUS AuthorizationCookie Deserialization RCE
Microsoft Windows Server Update Services (WSUS) · CVE-2025-59287An unauthenticated deserialization bug in WSUS, the server that distributes Windows updates inside enterprises. After public PoCs appeared, Microsoft shipped an emergency out-of-band patch and attacks on WSUS on ports 8530/8531 began within hours.
pre-authKEVRediShell
Redis Redis (Lua scripting engine), also Valkey and managed Redis services · CVE-2025-49844Wiz Research found a use-after-free in Redis's embedded Lua interpreter, first shown at Pwn2Own Berlin 2025. An authenticated user who can run EVAL can escape the Lua sandbox and execute native code on the host. Because many Redis instances run without a password, 'authenticated' often means 'anyone who can connect'.
Cisco ASA/FTD WebVPN Auth Bypass + Buffer Overflow (ArcaneDoor)
Cisco Secure Firewall ASA / FTD VPN web server · CVE-2025-20333 +1Cisco and CISA reported the ArcaneDoor actor (UAT4356) chaining a missing-authorization bug with a buffer overflow in the ASA VPN web server, then tampering with ROMMON on older ASA 5500-X devices for persistence. CISA issued Emergency Directive 25-03.
pre-authKEVFlowise CustomMCP JavaScript Injection RCE
FlowiseAI Flowise · CVE-2025-59528Flowise, a drag-and-drop LLM app builder, evaluated the CustomMCP node's configuration string as JavaScript. Anyone with an API token could run arbitrary Node.js code on the server.
GoAnywhere MFT License Servlet Deserialization RCE (2025)
Fortra GoAnywhere MFT · CVE-2025-10035Another deserialization bug in the GoAnywhere License Servlet allowed command injection by an attacker with a validly forged license response. Microsoft attributed in-the-wild exploitation to Storm-1175, which deployed Medusa ransomware.
pre-authKEVCitrix NetScaler Memory Overflow RCE
Citrix NetScaler ADC / Gateway · CVE-2025-7775A memory overflow in NetScaler appliances allowed unauthenticated remote code execution or denial of service on specific virtual server configurations. Citrix confirmed in-the-wild exploitation at disclosure and CISA added it to KEV the same day.
pre-authKEVDocker Desktop Container-to-Engine API Escape
Docker Docker Desktop · CVE-2025-9074Felix Boulet found that any container running under Docker Desktop could reach the Docker Engine API on an internal subnet address with no authentication. From there it could start a privileged container that mounts the host's drive.
GitHub Copilot YOLO-Mode Prompt Injection RCE
Microsoft GitHub Copilot / Visual Studio · CVE-2025-53773Johann Rehberger (Embrace The Red) showed that a prompt injection in code, a web page or an issue could make Copilot's agent edit the workspace settings to switch on auto-approval of tools. After that, the agent ran shell commands without asking.
NVIDIA Triton Python Backend RCE Chain
NVIDIA Triton Inference Server · CVE-2025-23319 +2Wiz chained three bugs in Triton's Python backend into unauthenticated remote takeover of the inference server. An info leak revealed the name of a private shared-memory region, which was then abused for out-of-bounds read/write.
pre-authCursor MCP Config Prompt-Injection RCE (CurXecute)
Anysphere Cursor · CVE-2025-54135Aim Labs showed that a prompt injection, for example in a Slack message read via MCP, could make Cursor's agent create a new .cursor/mcp.json file. Cursor immediately started the MCP server defined there, running attacker commands with no user approval.
pre-authToolShell
Microsoft SharePoint Server (on-premises) 2016 / 2019 / Subscription Edition · CVE-2025-53770 +3A pre-auth SharePoint chain first shown at Pwn2Own Berlin 2025 (CVE-2025-49706 + CVE-2025-49704). Attackers found bypasses of the July patches (CVE-2025-53771 / CVE-2025-53770) and mass-exploited them as a zero-day in July 2025. Many victims had their ASP.NET machine keys stolen, so they stayed exposed even after patching.
pre-authKEVNVIDIA Container Toolkit Hook LD_PRELOAD Escape (NVIDIAScape)
NVIDIA NVIDIA Container Toolkit · CVE-2025-23266Wiz showed that a three-line Dockerfile could break out of a GPU container and get root on the host. The flaw lives in an OCI hook the toolkit runs while setting up the container.
mcp-remote OAuth Endpoint OS Command Injection
mcp-remote mcp-remote · CVE-2025-6514mcp-remote, a widely used npm bridge that lets Claude Desktop, Cursor and others talk to remote MCP servers, could be hijacked by a malicious MCP server. JFrog showed the server's OAuth metadata was passed to a shell-invoking 'open' call, executing commands on the client.
pre-authGit Config CR Submodule Path Hook Execution
Git Git · CVE-2025-48384A carriage-return mismatch between how Git writes and reads config values let a malicious repository redirect a submodule checkout into the hooks directory. Recursive clones on Linux and macOS could then run an attacker hook. CISA added it to KEV in August 2025.
KEVFortiWeb Fabric Connector Pre-Auth SQLi to RCE
Fortinet FortiWeb · CVE-2025-25257An unauthenticated SQL injection in the FortiWeb Fabric Connector API could be escalated to remote code execution. watchTowr published a full analysis and exploitation started shortly after, with webshells observed on internet-facing FortiWeb devices.
pre-authKEVCisco ISE Unauthenticated API Command Injection
Cisco Identity Services Engine (ISE / ISE-PIC) · CVE-2025-20281An exposed API in Cisco ISE accepted unauthenticated requests and passed user input to the OS, giving attackers root. It was reported through ZDI and added to KEV after in-the-wild exploitation in July 2025.
pre-authKEVMCP Inspector Unauthenticated Proxy RCE
Anthropic MCP Inspector · CVE-2025-49596The official MCP Inspector developer tool ran a local proxy that would launch any command it was told to, with no authentication. Oligo showed a malicious website could reach it from a developer's browser and execute code.
pre-authRoundcube _from Deserialization RCE
Roundcube Roundcube Webmail · CVE-2025-49113A decade-old bug in Roundcube's settings upload handler lets any logged-in user inject a crafted PHP serialized object into their session and execute code. Exploits circulated days after the patch, and credentials are often easy to obtain via phishing or reuse.
KEVIvanti EPMM Auth Bypass + Expression Language Injection RCE
Ivanti Endpoint Manager Mobile · CVE-2025-4427 +1Two bugs in Ivanti EPMM, an authentication bypass and an expression-language code injection, chained to unauthenticated remote code execution. Exploitation by China-nexus actors began within days of the advisory.
pre-authKEVvLLM Mooncake Pickle Deserialization RCE
vLLM vLLM · CVE-2025-32444vLLM's Mooncake KV-cache transfer integration accepted Python pickles over ZeroMQ sockets bound to all interfaces. Any network attacker could send a pickle and run code on the inference server.
pre-authPyTorch torch.load weights_only Bypass RCE
PyTorch PyTorch · CVE-2025-32434torch.load(weights_only=True) was the officially recommended safe way to load untrusted model files. Researcher Ji'an Zhou showed it could still be made to execute code, so loading a malicious checkpoint compromised the machine.
Erlang/OTP SSH Pre-Auth RCE
Erlang/OTP OTP ssh application · CVE-2025-32433The Erlang/OTP SSH server would process SSH connection-protocol messages, including 'exec' channel requests, before the client had authenticated. Anyone who can reach the port can run arbitrary commands, and a PoC was public within a day.
pre-authKEVLangflow Unauthenticated Code Injection
Langflow Langflow · CVE-2025-3248Langflow, a popular visual builder for LLM agents and RAG pipelines, exposed a code-validation endpoint that required no login. Anyone who could reach the server could make it run arbitrary Python. It was exploited in the wild (including by the Flodrix botnet) and added to CISA KEV.
pre-authKEVBentoML Unauthenticated Pickle Deserialization RCE
BentoML BentoML · CVE-2025-27520BentoML model-serving endpoints would unpickle any request body sent with a special content type. Any unauthenticated client could run code on the model server.
pre-authIvanti Connect Secure X-Forwarded-For Stack Overflow RCE
Ivanti Connect Secure / Policy Secure / ZTA Gateways · CVE-2025-22457A stack overflow initially assessed as a non-exploitable denial-of-service bug was patched silently in February 2025, then exploited by UNC5221 after the actor reverse-engineered the fix. It allows unauthenticated remote code execution on unpatched gateways.
pre-authKEVIngressNightmare
Kubernetes ingress-nginx controller · CVE-2025-1974 +4Wiz found that the ingress-nginx admission webhook, reachable without authentication from the pod network, could be fed a crafted Ingress object that injects NGINX configuration. Because the controller validates configs by running nginx -t with them, injected directives can load a shared library and run code. The controller's service account can read all cluster Secrets, so this often means full cluster takeover.
pre-authCrushFTP S3 Authorization Header Authentication Bypass
CrushFTP CrushFTP · CVE-2025-31161An authentication bypass in CrushFTP's S3-style authorization handling let unauthenticated attackers impersonate any user, including crushadmin. Exploitation began after details leaked amid a disclosure dispute.
pre-authKEVVeeam Backup Deserialization RCE (2025)
Veeam Backup & Replication · CVE-2025-23120Another deserialization bug in Veeam Backup & Replication, reported by Piotr Bazydlo of watchTowr and reachable by any authenticated domain user on domain-joined servers. watchTowr pointed out that Veeam's block-list fix model kept allowing new gadget classes.
Tomcat Partial PUT Session Deserialization
Apache Tomcat · CVE-2025-24813Tomcat stored partial PUT uploads in a temp file whose name was derived from the request path. If the default servlet is writable and file-based session persistence is enabled, an attacker can plant a serialized object as a session file and trigger its deserialization with a crafted JSESSIONID cookie.
pre-authKEVWindows OLE Zero-Click RTF RCE
Microsoft Windows OLE (ole32.dll) · CVE-2025-21298A double-free in Windows OLE that can be triggered just by previewing a crafted RTF email in Outlook. No click is needed beyond the message being rendered in the Preview Pane.
pre-authIvanti Connect Secure Stack Overflow RCE (IF-T/TLS)
Ivanti Connect Secure / Policy Secure / ZTA Gateways · CVE-2025-0282A stack-based buffer overflow in Ivanti Connect Secure allowed unauthenticated remote code execution and was exploited as a zero-day by a China-nexus cluster (UNC5337/UNC5221). Mandiant documented SPAWN-family malware deployed after exploitation.
pre-authKEVCraft CMS register_argc_argv Template Path RCE
Pixel & Tonic Craft CMS · CVE-2024-56145When PHP's register_argc_argv is enabled (the default in the official PHP Docker image), Craft read command-line style options from the query string of web requests. An attacker can pass --templatesPath pointing at a remote FTP server and have Craft render a malicious Twig template.
pre-authKEVLDAPNightmare
Microsoft Windows LDAP client (wldap32.dll) · CVE-2024-49112 +1An integer overflow in the Windows LDAP client code that can be triggered when a Windows host processes a malicious LDAP referral response. A remote attacker can make a domain controller or server look up an attacker-controlled domain via CLDAP and then serve a crafted reply.
pre-authPAN-OS Management Interface Auth Bypass + Privilege Escalation
Palo Alto Networks PAN-OS management web interface · CVE-2024-0012 +1An authentication bypass on the PAN-OS management web interface chained with a privilege-escalation command injection gave unauthenticated root access. Palo Alto tracked exploitation as Operation Lunar Peek, and thousands of exposed management interfaces were compromised.
pre-authKEVCleo Harmony/VLTrader/LexiCom Unrestricted File Upload RCE
Cleo Harmony / VLTrader / LexiCom · CVE-2024-50623 +1Huntress observed mass exploitation of Cleo MFT products in December 2024, with attackers bypassing the October patch for CVE-2024-50623. Cl0p later claimed the campaign and leaked data from dozens of victims.
pre-authKEVFortiManager fgfmd Missing Authentication RCE (FortiJump)
Fortinet FortiManager · CVE-2024-47575The FortiGate-to-FortiManager (FGFM) protocol daemon lacked authentication for critical functions, letting an attacker with any valid FortiGate certificate register a rogue device and execute commands on FortiManager. Mandiant tracked UNC5820 exploiting it to exfiltrate managed-device configurations and credentials.
pre-authKEVGrafana SQL Expressions DuckDB Command Injection
Grafana Labs Grafana · CVE-2024-9264Grafana's experimental SQL Expressions feature passed queries straight to DuckDB. Any Viewer could read files and, by loading a DuckDB extension, run shell commands, provided the duckdb binary was installed.
NVIDIA Container Toolkit TOCTOU Container Escape
NVIDIA NVIDIA Container Toolkit · CVE-2024-0132A crafted container image could escape to the host on any machine using NVIDIA's container toolkit for GPU access, including shared cloud AI platforms. Wiz estimated it affected over a third of cloud environments.
CUPS cups-browsed RCE Chain
OpenPrinting CUPS (cups-browsed, libcupsfilters, libppd, cups-filters) · CVE-2024-47176 +2Simone Margaritelli (evilsocket) chained four bugs in the CUPS printing stack. One UDP packet makes a Linux machine add an attacker's printer, and the next time a user prints to it, an attacker-supplied command runs.
pre-authIvanti Cloud Services Appliance Path Traversal + Command Injection
Ivanti Cloud Services Appliance (CSA) 4.6 · CVE-2024-8963 +1A path traversal in the end-of-life Ivanti CSA 4.6 let unauthenticated attackers reach restricted admin functionality, which they chained with an authenticated OS command injection for RCE. Fortinet and Ivanti observed limited zero-day exploitation.
pre-authKEVvCenter DCERPC Heap Overflow (2024)
VMware (Broadcom) vCenter Server · CVE-2024-38812A heap overflow in vCenter's DCERPC implementation demonstrated at China's 2024 Matrix Cup contest by zbl & srs of team TZL. Broadcom's first patch did not fully fix it, and in November 2024 Broadcom confirmed exploitation in the wild.
pre-authKEVVeeam Backup Deserialization RCE (2024)
Veeam Backup & Replication · CVE-2024-40711An unauthenticated .NET deserialization bug in Veeam Backup & Replication reported by Florian Hauser (CODE WHITE). watchTowr published the details and ransomware crews (Akira, Fog, Frag) used it within weeks to create local admin accounts on backup servers.
pre-authKEVSonicWall SonicOS Improper Access Control
SonicWall SonicOS (Gen5/Gen6/Gen7 firewalls) · CVE-2024-40766An improper access control flaw in SonicOS management and SSL-VPN gave unauthorized access to firewall resources. It is not a classic RCE, but Akira and Fog ransomware affiliates used it heavily for initial access via SSL-VPN.
pre-authKEVWindows TCP/IP IPv6 RCE
Microsoft Windows TCP/IP stack (tcpip.sys) · CVE-2024-38063A zero-click kernel bug in the Windows IPv6 stack reported by Kunlun Lab's XiaoWei. Sending specially crafted IPv6 packets to a Windows host could corrupt kernel memory with no user interaction, and the Windows Firewall does not block it because packets are processed before filtering.
pre-authSolarWinds Web Help Desk Java Deserialization
SolarWinds Web Help Desk · CVE-2024-28986A Java deserialization flaw in SolarWinds Web Help Desk was added to CISA KEV two days after the hotfix shipped. SolarWinds first described it as requiring authentication but later confirmed it was exploitable without credentials.
pre-authKEVllama.cpp RPC Server Arbitrary Write
ggml llama.cpp · CVE-2024-42479llama.cpp's distributed-inference RPC server trusted a raw memory pointer sent by clients. Anyone who could reach the port could write to arbitrary memory addresses, a write-what-where primitive leading to code execution.
pre-authApache OFBiz ProgramExport Auth Bypass RCE
Apache OFBiz · CVE-2024-38856Apache OFBiz's override-view handling let unauthenticated users reach screens that should require login, including the Groovy ProgramExport tool. It is a bypass of the earlier CVE-2023-51467 fix and was exploited shortly after disclosure.
pre-authKEVMadLicense
Microsoft Windows Remote Desktop Licensing Service · CVE-2024-38077A pre-authentication heap overflow in the Remote Desktop Licensing (RDL) service, named MadLicense by researchers Lewis Lee, Chunyang Han (Ver) and Zhiniang Peng. An unauthenticated attacker sends crafted RPC messages to the licensing service and gets code execution on the server. The researchers' August 2024 write-up and pseudo-code PoC were later deleted.
pre-authregreSSHion
OpenBSD / OpenSSH OpenSSH server (sshd) on glibc Linux · CVE-2024-6387Qualys found that a fix from 2006 (CVE-2006-5051) was accidentally removed in OpenSSH 8.5p1, bringing back a signal-handler race in sshd. An unauthenticated attacker who wins the race can get root code execution on glibc Linux. Exploitation is slow (hours of attempts on 32-bit, longer on 64-bit with ASLR) but needs no credentials.
pre-authCosmicSting (Adobe Commerce XXE)
Adobe Adobe Commerce / Magento Open Source · CVE-2024-34102A pre-auth XXE in Magento's REST API lets attackers read app/etc/env.php, steal the crypt key and forge admin API tokens. Combined with the glibc iconv bug CVE-2024-2961 it becomes full RCE; Sansec reported thousands of stores hacked, including big brands.
pre-authKEVPHP-CGI Argument Injection (Best-Fit)
PHP Group PHP (CGI mode on Windows) · CVE-2024-4577Orange Tsai found that Windows 'Best-Fit' character conversion turns a soft hyphen (0xAD) in the query string into a regular '-', which revives the 2012 PHP-CGI argument injection. Attackers can pass -d options to php-cgi.exe and run PHP code without authentication. Default XAMPP installs on Windows were exploitable and the bug was mass-exploited by botnets and ransomware.
pre-authKEVOllama Model Pull Path Traversal RCE (Probllama)
Ollama Ollama · CVE-2024-37032Wiz found that Ollama trusted the digest values in model manifests pulled from a registry. A malicious registry could write files anywhere on disk and turn that into code execution. Docker deployments expose the API with no authentication.
pre-authTelerik Report Server Auth Bypass + Deserialization
Progress Telerik Report Server · CVE-2024-4358 +1Sina Kheirkhah chained an initial-setup auth bypass with an insecure deserialization in report processing to get pre-auth RCE on Telerik Report Server. The bypass lets anyone register a new admin, who then uploads a malicious report definition.
pre-authKEVGit Recursive Clone Submodule Hook RCE
Git Git · CVE-2024-32002Cloning a malicious repository with --recursive could execute code during the clone itself on Windows and macOS. Amal Murali published the exploit, which abuses submodules, symlinks and case-insensitive filesystems.
CrushFTP VFS Sandbox Escape / Server-Side Template Injection
CrushFTP CrushFTP · CVE-2024-4040A server-side template injection in CrushFTP let unauthenticated users escape the virtual filesystem sandbox, read arbitrary files, bypass authentication and gain admin access. It was exploited as a zero-day in targeted attacks.
pre-authKEVPAN-OS GlobalProtect Command Injection
Palo Alto Networks PAN-OS GlobalProtect · CVE-2024-3400Volexity found a zero-day in PAN-OS GlobalProtect exploited by UTA0218 to deploy a Python backdoor (UPSTYLE). The bug allowed unauthenticated attackers to create files with attacker-chosen names that were later fed to a shell, giving root code execution.
pre-authKEVXZ Utils Backdoor
Tukaani Project XZ Utils (liblzma) · CVE-2024-3094A supply-chain backdoor planted over roughly two years by the maintainer persona 'Jia Tan' and found by Andres Freund after he noticed slow SSH logins. Through systemd's dependency on liblzma, the backdoor hooked OpenSSH's sshd so that the holder of a specific Ed448 key could run commands before authentication.
pre-authTeamCity jsp= Path Auth Bypass
JetBrains TeamCity On-Premises · CVE-2024-27198Rapid7 found that appending a ';.jsp' path parameter to a request that 404s lets it reach any authenticated TeamCity endpoint. Attackers create admin users or tokens and then run commands via plugins or build agents; it was exploited for ransomware within days.
pre-authKEVScreenConnect SetupWizard Auth Bypass (SlashAndGrab)
ConnectWise ScreenConnect · CVE-2024-1709 +1Adding a trailing slash to SetupWizard.aspx let anyone rerun ScreenConnect's initial setup wizard on an already-configured server and create a new administrator. Paired with a path-traversal extension upload, it gave RCE and was mass-exploited by ransomware affiliates within 48 hours.
pre-authKEVMonikerLink
Microsoft Outlook / Office · CVE-2024-21413Check Point's Haifei Li found that adding an exclamation mark and extra text to a file:// link in an email bypassed Outlook's block on remote file links. One click leaks the user's NTLM hash to the attacker and opens the remote document outside Protected View, which can lead to code execution through COM/Office bugs.
pre-authKEVFortiOS SSL-VPN Out-of-Bounds Write RCE
Fortinet FortiOS / FortiProxy SSL-VPN · CVE-2024-21762An out-of-bounds write in the FortiOS SSL-VPN daemon allowed unauthenticated remote code execution via crafted HTTP requests. Fortinet flagged it as potentially exploited in the wild and CISA added it to KEV the next day.
pre-authKEVJenkins CLI @file Arbitrary File Read
Jenkins Jenkins core · CVE-2024-23897Jenkins' built-in CLI used the args4j library, which expands any argument starting with '@' into the contents of that file on the controller. Unauthenticated users can read the first lines of arbitrary files, and with Overall/Read or by stealing keys (secrets/master.key, etc.) escalate to code execution.
pre-authKEVConfluence text-inline.vm Template Injection
Atlassian Confluence Server / Data Center · CVE-2023-22527Velocity template files under /template/aui/ could be requested directly, and one of them evaluated a request parameter as OGNL. Unauthenticated attackers could run commands on out-of-date Confluence 8.x; exploitation began within days of the January 2024 advisory.
pre-authKEVIvanti Connect Secure Auth Bypass + Command Injection
Ivanti Connect Secure / Policy Secure · CVE-2023-46805 +1Volexity discovered a China-nexus actor chaining an authentication bypass and a command injection in Ivanti Connect Secure VPNs. After public analysis, mass exploitation followed and CISA issued an emergency directive ordering federal agencies to disconnect affected devices.
pre-authKEVStruts2 S2-066 File Upload Path Traversal
Apache Struts 2 · CVE-2023-50164Struts file-upload parameter handling is case-sensitive in one place and case-insensitive in another, letting an attacker overwrite the sanitized upload filename with a path-traversal value. On apps exposing a file-upload action this lets a JSP webshell be written into the web root.
pre-authRay Jobs API Unauthenticated RCE (ShadowRay)
Anyscale Ray · CVE-2023-48022Ray's dashboard exposes a Jobs API that runs arbitrary shell commands, and it has no authentication by default. Anyscale disputes the CVE as by-design, but Oligo's 'ShadowRay' research found thousands of exposed clusters actively exploited for cryptomining and credential theft.
pre-authApache ActiveMQ OpenWire ClassInfo RCE
Apache ActiveMQ · CVE-2023-46604ActiveMQ's OpenWire protocol unmarshaller would instantiate any class named in a serialized exception, calling its String constructor. Pointing that at Spring's ClassPathXmlApplicationContext with a remote XML URL runs commands; HelloKitty and other ransomware crews exploited it days after disclosure.
pre-authKEVF5 BIG-IP AJP Request Smuggling Auth Bypass RCE
F5 BIG-IP Configuration utility · CVE-2023-46747Praetorian found that request smuggling between Apache and Tomcat in the BIG-IP Configuration utility allowed unauthenticated attackers to create admin users and run commands. Exploitation started within days of disclosure.
pre-authKEVvCenter DCERPC Out-of-Bounds Write (2023)
VMware vCenter Server · CVE-2023-34048A memory-corruption bug in vCenter's implementation of the DCERPC protocol. Mandiant later found the Chinese espionage group UNC3886 had been exploiting it as a zero-day since late 2021 to deploy backdoors on ESXi hosts.
pre-authKEVCisco IOS XE Web UI Privilege Escalation + Command Injection
Cisco IOS XE Web UI · CVE-2023-20198 +1Talos found attackers creating privilege-15 accounts on IOS XE devices via the Web UI and then implanting a Lua backdoor. Over 40,000 routers and switches were compromised within days.
pre-authKEVShellTorch
PyTorch (Meta / AWS) TorchServe · CVE-2023-43654 +1Oligo Security showed that TorchServe's management API was often exposed without authentication and would download models from any URL. Combined with an unsafe SnakeYAML deserialization in model configuration, this gave remote code execution on AI model-serving infrastructure, including some cloud provider images.
pre-authTeamCity RPC2 Token Auth Bypass
JetBrains TeamCity On-Premises · CVE-2023-42793Any request path ending in /RPC2 bypassed TeamCity's authentication, which let anyone mint an admin access token. Russian SVR (APT29) and North Korean groups exploited it against software supply chains.
pre-authKEVCraft CMS conditions/render RCE
Pixel & Tonic Craft CMS · CVE-2023-41892The unauthenticated conditions/render controller action created objects from attacker-supplied configuration arrays. Attackers can instantiate arbitrary PHP classes with chosen constructor arguments and turn that into file writes and code execution.
pre-authWinRAR File Extension Spoofing RCE
RARLAB WinRAR · CVE-2023-38831Group-IB found traders being targeted with ZIP archives that ran malware when a victim double-clicked what looked like a harmless JPG or PDF inside. The bug was exploited as a zero-day from April 2023 and later by APT28, Sandworm and others.
pre-authKEVJuniper J-Web PHP Environment Variable Manipulation RCE Chain
Juniper Networks Junos OS J-Web (SRX / EX) · CVE-2023-36844 +3Four J-Web bugs rated medium individually combine into unauthenticated RCE on Juniper SRX firewalls and EX switches. watchTowr published a PoC within a week and exploitation followed.
pre-authKEVIvanti EPMM (MobileIron Core) Unauthenticated API Access
Ivanti Endpoint Manager Mobile (MobileIron Core) · CVE-2023-35078An authentication bypass in Ivanti EPMM exposed restricted API endpoints to unauthenticated users, letting them read personal data and make admin changes. It was exploited as a zero-day against Norwegian government ministries, chained with CVE-2023-35081 for code execution.
pre-authKEVMetabase Pre-Auth H2 JDBC RCE
Metabase Metabase · CVE-2023-38646A leftover setup token let unauthenticated users reach Metabase's database-connection validation endpoint. Assetnote chained this with an H2 JDBC connection string to execute code on the server.
pre-authCitrix NetScaler ADC/Gateway Unauthenticated RCE
Citrix NetScaler ADC / Gateway · CVE-2023-3519A memory-safety bug in NetScaler appliances configured as a Gateway or AAA virtual server allowed unauthenticated remote code execution. It was exploited as a zero-day against a US critical-infrastructure organization and later used to implant webshells on thousands of devices.
pre-authKEVLangChain PALChain Code Injection
LangChain LangChain · CVE-2023-36258LangChain's Program-Aided Language chain had the LLM write Python to solve problems and then executed it. Prompt injection let users get arbitrary code run on the host.
pre-authSharePoint Auth Bypass + Code Injection (Pwn2Own 2023)
Microsoft SharePoint Server 2019 · CVE-2023-29357 +1Jang (Nguyen Tien Giang) of STAR Labs chained an authentication bypass with a code-injection bug for unauthenticated RCE on SharePoint at Pwn2Own Vancouver 2023. Forged JWTs signed with the 'none' algorithm let the attacker impersonate any user, including a site admin.
pre-authKEVFortiOS SSL-VPN Pre-Auth Heap Overflow (XORtigate)
Fortinet FortiOS / FortiProxy SSL-VPN · CVE-2023-27997LEXFO researchers found a pre-authentication heap overflow in the FortiGate SSL-VPN web interface reachable on any device with SSL-VPN enabled. Fortinet noted it may have been exploited in limited attacks, and hundreds of thousands of devices were exposed.
pre-authKEVMOVEit Transfer SQL Injection RCE
Progress MOVEit Transfer · CVE-2023-34362The Cl0p ransomware group exploited a zero-day SQL injection in MOVEit Transfer over a holiday weekend to steal data from thousands of organizations. It became one of the largest data-theft campaigns ever recorded.
pre-authKEVBarracuda ESG TAR Attachment Command Injection
Barracuda Networks Email Security Gateway (ESG) appliance · CVE-2023-2868A China-nexus actor (UNC4841) sent emails with crafted TAR attachments that triggered command injection on Barracuda Email Security Gateways, deploying SALTWATER, SEASPY and SEASIDE backdoors. Barracuda took the rare step of telling customers to replace affected hardware.
pre-authKEVZyxel Firewall IKE Unauthenticated Command Injection
Zyxel ATP / USG FLEX / VPN / ZyWALL firewalls · CVE-2023-28771An unauthenticated command injection in how Zyxel firewalls handled IKE packets on UDP 500 allowed remote command execution. It was mass-exploited by Mirai-based botnets and contributed to a wave of attacks on Danish critical infrastructure.
pre-authKEVApache Superset Default SECRET_KEY Session Forgery
Apache Superset · CVE-2023-27524Horizon3 found that roughly two-thirds of internet-facing Superset servers still used the default Flask SECRET_KEY. Knowing it, an attacker can forge an admin session cookie and then reach code execution through Superset features.
pre-authKEVQueueJumper
Microsoft Windows Message Queuing (MSMQ) · CVE-2023-21554A critical bug in the MSMQ service found by Check Point. Sending a crafted packet to TCP port 1801 gives unauthenticated code execution, and Check Point found more than 360,000 hosts exposing that port.
pre-authLangChain LLMMathChain Prompt Injection RCE
LangChain LangChain · CVE-2023-29374One of the first well-known prompt-injection-to-RCE bugs. LangChain's math chain asked the LLM to write Python and then ran it, so a user could simply ask the model to run os.system.
pre-authVeeam Backup Service Credential Leak
Veeam Backup & Replication · CVE-2023-27532The Veeam Backup Service on TCP/9401 exposed a WCF endpoint that returned stored credentials without authentication. Ransomware groups such as FIN7 and Cuba used it to dump cleartext passwords and run commands on backup servers.
pre-authKEVGoAnywhere MFT License Servlet Deserialization RCE
Fortra GoAnywhere MFT · CVE-2023-0669A pre-authentication deserialization flaw in the GoAnywhere MFT admin console was exploited by Cl0p as a zero-day, compromising about 130 organizations. Fortra initially disclosed it only in a private customer advisory.
pre-authKEVOWASSRF
Microsoft Exchange Server 2013 / 2016 / 2019 · CVE-2022-41080 +1CrowdStrike found Play ransomware operators bypassing Microsoft's ProxyNotShell URL Rewrite mitigations. Instead of Autodiscover, they reached the PowerShell backend through an SSRF in Outlook Web Access, then used the same CVE-2022-41082 deserialization bug.
KEVTabShell
Microsoft PowerShell Remoting (Windows PowerShell, PowerShell 7; Exchange remote PowerShell) · CVE-2022-41076A sandbox escape in restricted PowerShell remoting sessions that was used with OWASSRF/ProxyNotShell against Exchange. An authenticated user in a locked-down remoting endpoint could break out of the NoLanguage restrictions and run arbitrary code, as SYSTEM on Exchange.
FortiOS SSL-VPN Heap Overflow RCE
Fortinet FortiOS SSL-VPN (sslvpnd) · CVE-2022-42475A heap overflow in the FortiGate SSL-VPN daemon allowed unauthenticated attackers to run code on the firewall. It was exploited as a zero-day by a China-nexus actor that deployed custom implants (BoldMove) against government targets.
pre-authKEVText4Shell
Apache Commons Text · CVE-2022-42889Apache Commons Text's StringSubstitutor interpolates ${prefix:value} lookups, and its default set included 'script', 'dns' and 'url' lookups. Applications that pass untrusted input to the default interpolator let attackers run code through the JVM script engine. It was named after Log4Shell but is far less exposed, since apps must interpolate attacker input themselves.
pre-authProxyNotShell
Microsoft Exchange Server 2013 / 2016 / 2019 · CVE-2022-41040 +1A ProxyShell-like pair found exploited in the wild by GTSC in September 2022. It reuses the Autodiscover SSRF pattern to reach the PowerShell backend and then triggers a deserialization RCE. Unlike ProxyShell, the attacker needs any valid mailbox credentials, hence 'NotShell'.
KEVZimbra Amavis cpio Path Traversal
Synacor (Zimbra) Zimbra Collaboration Suite · CVE-2022-41352An attacker emails a crafted .cpio/.tar archive to any user on a Zimbra server. When Amavis unpacks it with cpio to scan it, path traversal drops a JSP webshell into Zimbra's public web root, so no authentication or user interaction is needed.
pre-authKEVBitbucket Server Archive Command Injection
Atlassian Bitbucket Server / Data Center · CVE-2022-36804Bitbucket's repository archive REST endpoint passed user-controlled parameters to 'git archive', and NUL bytes let attackers smuggle extra arguments. It needs only repository read access, which means no authentication at all for public repos.
KEVApache Spark UI doAs Command Injection
Apache Spark · CVE-2022-33891When Spark UI ACLs were enabled, the user name supplied in the doAs parameter ended up inside a shell command. Unauthenticated attackers could inject commands through a simple URL parameter.
pre-authKEVConfluence URI OGNL Injection (2022)
Atlassian Confluence Server / Data Center · CVE-2022-26134A zero-day discovered by Volexity during incident response over Memorial Day 2022: putting an OGNL expression in the URL path of any Confluence request executes it. Every supported version was vulnerable and exploitation was rampant within a day of public PoCs.
pre-authKEVFollina
Microsoft Windows Support Diagnostic Tool (MSDT) · CVE-2022-30190A zero-day found in a malicious Word document uploaded to VirusTotal and named Follina by Kevin Beaumont. Office fetched a remote HTML template that invoked the ms-msdt: protocol handler, and MSDT then ran attacker-supplied PowerShell, even with macros disabled.
pre-authKEVZyxel Firewall ZTP Unauthenticated Command Injection
Zyxel USG FLEX / ATP / USG20-VPN firewalls · CVE-2022-30525Rapid7 found an unauthenticated command injection in Zyxel firewalls' zero-touch provisioning handler. Zyxel patched silently in April 2022; after disclosure, exploitation and Mirai-variant botnets followed quickly.
pre-authKEVF5 BIG-IP iControl REST Authentication Bypass RCE
F5 BIG-IP iControl REST · CVE-2022-1388An authentication bypass in BIG-IP's iControl REST API allowed unauthenticated attackers to run arbitrary system commands. Public PoCs appeared within days and mass exploitation, including destructive wiping, followed.
pre-authKEVCouchDB Default Erlang Cookie RCE
Apache CouchDB · CVE-2022-24706CouchDB installers shipped a default Erlang distribution cookie ('monster') and exposed the Erlang distribution port. Anyone who could reach it could join the cluster as an Erlang node and run OS commands without credentials.
pre-authKEVVMware Workspace ONE Access Freemarker SSTI
VMware Workspace ONE Access / Identity Manager · CVE-2022-22954A server-side template injection in VMware's identity platform found by Steven Seeley. One unauthenticated GET request with a Freemarker expression runs commands on the server, and exploitation started within 48 hours of the patch.
pre-authKEVSpring4Shell
VMware / Spring Spring Framework (spring-beans / spring-webmvc) · CVE-2022-22965Spring MVC's data binding let request parameters set nested properties on the bound object, including properties reachable through its class and class loader. On JDK 9+ this re-opened an old 2010 bug class and let attackers reconfigure Tomcat's access log to write a JSP web shell. It leaked as a zero-day days before the patch.
pre-authKEVSpring Cloud Function SpEL Injection
VMware / Spring Spring Cloud Function · CVE-2022-22963Spring Cloud Function's routing feature evaluates a Spring Expression Language (SpEL) expression taken directly from an HTTP header. Any app exposing the functionRouter endpoint can be made to execute arbitrary commands with one request.
pre-authKEVSophos Firewall User Portal / Webadmin Auth Bypass RCE
Sophos Sophos Firewall (SFOS) · CVE-2022-1040An authentication bypass in the Sophos Firewall User Portal and Webadmin allowed unauthenticated remote code execution. Volexity documented a Chinese APT (DriftingCloud) exploiting it as a zero-day to hijack DNS and target websites in South Asia.
pre-authKEVRedis Debian Lua Sandbox Escape
Debian / Ubuntu (Redis packaging) Redis · CVE-2022-0543A packaging bug in Debian's Redis: the Lua scripting sandbox left the 'package' library reachable. Any client that can run EVAL could load liblua's io module and run shell commands, and the Muhstik botnet exploited it widely.
pre-authKEVMagento / Adobe Commerce Checkout Template Injection
Adobe Adobe Commerce / Magento Open Source · CVE-2022-24086Adobe issued an out-of-band patch on a Sunday after this flaw was exploited in limited attacks against Magento stores. Improper input validation in the checkout flow allows template-directive injection that leads to code execution, enabling Magecart-style card skimming.
pre-authKEVLog4Shell
Apache Log4j 2 · CVE-2021-44228 +1Log4j 2 evaluated ${...} lookups inside logged messages, including JNDI lookups that fetch and load remote Java objects. Any attacker-controlled string that got logged (a User-Agent, username, chat message) could make the server load attacker code. It is widely considered one of the most severe vulnerabilities ever disclosed because Log4j is embedded almost everywhere in the Java ecosystem.
pre-authKEVSonicWall SMA 100 Unauthenticated Stack Overflow RCE
SonicWall SMA 100 series (200/210/400/410/500v) · CVE-2021-20038A stack-based buffer overflow in the SMA 100 Apache httpd allowed unauthenticated remote code execution as the nobody user. Rapid7 published a detailed analysis and the bug was later exploited in the wild.
pre-authKEVSitecore XP Report.ashx Deserialization
Sitecore Sitecore Experience Platform (XP) · CVE-2021-42237A forgotten reporting handler in older Sitecore XP releases deserialized XML request bodies with NetDataContractSerializer. Unauthenticated POSTs to Report.ashx yield code execution on the IIS server.
pre-authKEVApache HTTP Server 2.4.49/2.4.50 Path Traversal RCE
Apache HTTP Server (httpd) · CVE-2021-41773 +1A path-normalization rewrite in httpd 2.4.49 broke handling of URL-encoded dots, allowing directory traversal outside the document root. Where CGI (mod_cgi) is enabled this becomes remote command execution, and the 2.4.50 fix was bypassed within days using double encoding.
pre-authKEVvCenter Analytics Service File Upload
VMware vCenter Server · CVE-2021-22005An unauthenticated arbitrary file write in vCenter's Analytics (CEIP telemetry) service. Within days of the advisory, attackers were writing JSP webshells or cron jobs through it.
pre-authKEVOMIGOD
Microsoft Open Management Infrastructure (OMI) on Azure Linux VMs · CVE-2021-38647 +3Wiz found that OMI, an agent Azure quietly installed on many Linux VMs, ran as root and treated requests with no Authorization header as coming from root. Where OMI's ports were exposed, a single unauthenticated request ran commands as root, and it was exploited by Mirai-style botnets within days.
pre-authKEVConfluence Webwork OGNL Injection (2021)
Atlassian Confluence Server / Data Center · CVE-2021-26084Several Confluence Velocity templates passed a user-supplied queryString parameter into a Webwork OGNL evaluation. On most instances the vulnerable endpoints are reachable without logging in, and exploitation began within a week of disclosure (it was used against US Cyber Command-tracked targets).
pre-authKEVProxyShell
Microsoft Exchange Server 2013 / 2016 / 2019 · CVE-2021-34473 +2Orange Tsai's second Exchange chain, shown at Pwn2Own 2021 and Black Hat USA 2021. A URL path confusion in the Autodiscover front end gives pre-auth access to back-end endpoints, an EoP lets the attacker act as any user in the Exchange PowerShell backend, and a mailbox-export trick writes a web shell. Mass exploitation began within days of the talk.
pre-authKEVKaseya VSA Credential Leak / Auth Bypass (REvil Supply Chain)
Kaseya VSA (on-premises) · CVE-2021-30116REvil exploited Kaseya VSA servers on 2 July 2021, pushing ransomware through VSA's agent update mechanism to about 60 MSPs and up to 1,500 downstream businesses. DIVD had reported the bugs to Kaseya weeks earlier.
pre-authKEVPrintNightmare
Microsoft Windows Print Spooler · CVE-2021-34527 +1A bug in the Windows Print Spooler that let any authenticated domain user make a remote machine load an arbitrary DLL as SYSTEM. A PoC leaked after researchers mistook it for the already-patched CVE-2021-1675, and domain controllers (which run the spooler by default) became an easy target.
KEV21Nails
Exim Exim MTA · CVE-2020-28017 +9Qualys disclosed 21 bugs in Exim at once: 10 remotely exploitable and 11 local. Chained together, several give unauthenticated root code execution on a default Exim install.
pre-authGitLab ExifTool DjVu RCE
GitLab GitLab CE/EE · CVE-2021-22205GitLab passed uploaded images to ExifTool to strip metadata, and ExifTool's DjVu parser evaluated part of the file as Perl. An unauthenticated upload endpoint meant any internet-facing GitLab could be compromised with a crafted 'image'; botnets abused it months later after its severity was raised to 10.0.
pre-authKEVProxyLogon
Microsoft Exchange Server 2013 / 2016 / 2019 · CVE-2021-26855 +3A pre-auth server-side request forgery in Exchange's front-end proxy let attackers authenticate to the back end as the Exchange server itself, then chain a post-auth arbitrary file write to drop a web shell. Found by Orange Tsai (DEVCORE), it was exploited as a zero-day by HAFNIUM and then by many groups, compromising tens of thousands of servers.
pre-authKEVvCenter vROps Plugin Unauthenticated Upload
VMware vCenter Server · CVE-2021-21972The vRealize Operations plugin in the vCenter web client, enabled by default, exposed an unauthenticated file-upload endpoint. Attackers uploaded a crafted tar archive with path-traversal entries to drop a webshell or SSH key and take over vCenter.
pre-authKEVESXi OpenSLP Heap Overflow (ESXiArgs)
VMware ESXi (OpenSLP) · CVE-2021-21974A heap overflow in the OpenSLP service bundled with ESXi. Two years after the patch, the February 2023 ESXiArgs ransomware campaign hit thousands of unpatched internet-facing ESXi hosts, and this bug was widely reported as the entry point.
pre-authLaravel Ignition Debug Mode RCE
Facade / Spatie Ignition (Laravel debug page) · CVE-2021-3129Ignition, Laravel's default error page, exposes 'solutions' that can be executed over HTTP, one of which reads and writes a file path supplied by the user. Ambionics turned this into RCE by abusing PHP filters to plant a PHAR in the Laravel log, then triggering deserialization; it is still widely exploited on debug-enabled sites.
pre-authKEVAccellion FTA SQL Injection + Command Injection Chain
Accellion (Kiteworks) File Transfer Appliance (FTA) · CVE-2021-27101 +3UNC2546 chained SQL injection and command injection bugs in Accellion's legacy File Transfer Appliance to deploy the DEWMODE webshell and steal data, followed by Cl0p-branded extortion. Victims included universities, governments and law firms.
pre-authKEVWebLogic Console Path Traversal RCE
Oracle WebLogic Server · CVE-2020-14882 +1A double-URL-encoded '../' in a static-resource path lets unauthenticated users reach the WebLogic admin console, and a console handle parameter instantiates arbitrary classes. Exploitation began within a week of the October 2020 CPU, and Oracle issued an emergency alert for a patch bypass.
pre-authKEVWordPress File Manager elFinder Upload RCE
WebDesi9 (wp-file-manager) File Manager plugin for WordPress · CVE-2020-25213The File Manager plugin (700k+ active installs) shipped an elFinder connector file that could be called directly with no authentication. Attackers uploaded PHP webshells to the plugin's files directory; Wordfence saw attacks on 1.7M sites within days.
pre-authKEVApache Airflow Example DAG Command Injection
Apache Airflow · CVE-2020-11978One of the example DAGs shipped with Airflow passed trigger configuration straight into a Bash command. Combined with Airflow's unauthenticated experimental API (CVE-2020-13927) on many deployments, attackers could run commands on workers.
KEVSIGRed
Microsoft Windows DNS Server · CVE-2020-1350A 17-year-old wormable bug in the Windows DNS Server found by Check Point. A malicious DNS response with an oversized SIG record overflows a heap buffer in dns.exe, which runs as SYSTEM and usually lives on domain controllers.
pre-authKEVF5 BIG-IP TMUI RCE
F5 BIG-IP TMUI (Configuration utility) · CVE-2020-5902Positive Technologies found that the BIG-IP Traffic Management User Interface could be reached without authentication through a path normalization flaw, exposing JSP pages that read files and run tmsh commands. Exploitation began within days of disclosure.
pre-authKEVSaltStack Salt Master Authentication Bypass
SaltStack Salt · CVE-2020-11651 +1F-Secure found that the Salt master's request server exposed internal methods without authentication. Attackers could steal the root key and push commands to every managed minion; mass exploitation hit LineageOS, Ghost, DigiCert and others within days.
pre-authKEVLiferay Portal JSONWS Deserialization
Liferay Liferay Portal · CVE-2020-7961Liferay's JSON web services API allowed callers to specify arbitrary Java types for object parameters, which were then instantiated by the Jodd/Flexjson deserializer. Unauthenticated requests to /api/jsonws/invoke could thus trigger Java gadget chains and execute code.
pre-authKEVSMBGhost
Microsoft Windows SMBv3.1.1 (srv2.sys) · CVE-2020-0796An integer overflow in the SMBv3.1.1 compression feature, accidentally revealed before a patch was ready. Pre-authentication packets with a compression header could corrupt kernel memory on both SMB servers and clients, making it wormable.
pre-authKEVGhostcat
Apache Tomcat (AJP connector) · CVE-2020-1938Chaitin Tech found that Tomcat's AJP connector, enabled by default on port 8009, trusted request attributes sent by the proxy. An attacker talking AJP directly could read any file in a web app (like WEB-INF/web.xml) or make Tomcat treat an uploaded file as a JSP, giving code execution.
pre-authKEVExchange Static Validation Key RCE
Microsoft Exchange Server (ECP) · CVE-2020-0688Every Exchange install shipped with the same hard-coded ASP.NET machineKey for the Exchange Control Panel. Any authenticated mailbox user could forge a signed ViewState and get code execution as SYSTEM on the server.
KEVOpenSMTPD MAIL FROM RCE
OpenBSD OpenSMTPD · CVE-2020-7247A Qualys-found bug in OpenBSD's mail server. Shell metacharacters in the SMTP MAIL FROM address end up executed by the shell as root when the message is handed to the local delivery agent.
pre-authKEVApache Solr VelocityResponseWriter RCE
Apache Solr · CVE-2019-17558Solr's Velocity response writer can be switched on via the Config API, after which a Velocity template supplied in a query parameter runs Java methods. Solr has no authentication by default, so exposed instances can be taken over with two requests.
pre-authKEVCitrix ADC Path Traversal RCE (Shitrix)
Citrix ADC / Gateway / SD-WAN WANOP · CVE-2019-19781A directory traversal in the Citrix ADC/Gateway VPN portal let unauthenticated attackers write and then render a template file, executing commands on the appliance. Public exploits appeared in January 2020 before patches shipped, leading to mass exploitation by ransomware operators and state actors.
pre-authKEVTelerik UI RadAsyncUpload Deserialization
Progress Telerik UI for ASP.NET AJAX · CVE-2019-18935The RadAsyncUpload handler in Telerik's ASP.NET AJAX controls deserializes a JSON type descriptor with JavaScriptSerializer. Combined with weak/hardcoded encryption keys, unauthenticated attackers upload a mixed-mode DLL and load it; multiple APTs used it against US federal agencies (CISA AA23-074A).
pre-authKEVvBulletin 5 widget_php Pre-Auth RCE
vBulletin (MH Sub I) vBulletin 5 · CVE-2019-16759An anonymous researcher dropped a 0-day exploit on Full Disclosure: one POST to any vBulletin 5 forum with routestring=ajax/render/widget_php runs PHP code. Its patch was itself bypassed in August 2020 (CVE-2020-17496).
pre-authKEVReturn of the WIZard
Exim Exim MTA · CVE-2019-10149A command injection in the Exim mail server found by Qualys, named after Sendmail's 1980s WIZ backdoor. A crafted recipient address makes Exim expand and run attacker-supplied commands as root, and Sandworm (GRU) was later seen exploiting it at scale.
pre-authKEVBlueKeep
Microsoft Windows Remote Desktop Services · CVE-2019-0708A wormable pre-authentication bug in Windows Remote Desktop Services found by the UK NCSC. A single crafted RDP connection could run code as SYSTEM before any login. Microsoft took the unusual step of patching out-of-support Windows XP and 2003.
pre-authKEVWebLogic wls9_async XMLDecoder Deserialization
Oracle WebLogic Server · CVE-2019-2725A 0-day in WebLogic's async SOAP components (wls9_async_response, wls-wsat) allowed unauthenticated deserialization via XMLDecoder. It was used to deploy Sodinokibi/REvil ransomware and cryptominers before and after Oracle's emergency alert.
pre-authKEVPulse Secure Connect Arbitrary File Read + Command Injection Chain
Pulse Secure (Ivanti) Pulse Connect Secure · CVE-2019-11510 +1Orange Tsai and Meh Chang showed that an unauthenticated arbitrary file read in Pulse Connect Secure could leak session data and cleartext credentials, which combined with an admin command injection gave full RCE. It was among the most widely exploited VPN bugs of 2019-2021, used by ransomware groups and APTs.
pre-authKEVKibana Timelion Prototype Pollution RCE
Elastic Kibana · CVE-2019-7609Michal Bentkowski (Securitum) found that Kibana's Timelion expression language allowed JavaScript prototype pollution. Polluting environment variables for child processes turned it into command execution on the Kibana server.
KEVRails Development-Mode secret_key_base RCE
Ruby on Rails Rails (railties) · CVE-2019-5420In development mode Rails derived secret_key_base from the application's class name, so the key used to sign cookies and Active Storage URLs was guessable. Knowing it lets an attacker sign a Marshal-serialized object and get it deserialized, giving code execution on any dev-mode Rails app exposed to the network.
pre-authrunc Container Breakout
Open Containers Initiative runc (Docker, containerd, Kubernetes, LXC) · CVE-2019-5736A container escape found by Adam Iwaniuk and Borys Popławski. A malicious image or a root process in a container can overwrite the host's runc binary, so code runs as root on the host the next time someone runs docker exec or starts a container.
Jenkins Stapler + Script Security Pre-Auth RCE (Orange Tsai)
Jenkins Jenkins core / Script Security plugin · CVE-2018-1000861 +3Orange Tsai chained a Stapler URL-routing flaw that reaches methods via unauthenticated paths with a Groovy sandbox bypass in the Script Security plugin's checkScript endpoint. A single GET request compiling a Groovy class with a malicious constructor or @Grab annotation yields code execution.
pre-authKEVThinkPHP 5 invokefunction RCE
ThinkPHP (top-think) ThinkPHP 5.x · CVE-2018-20062 +1ThinkPHP 5 did not validate controller names taken from the 's' routing parameter, so a request can call any class method, including \think\app::invokefunction with call_user_func_array. It became one of the most-scanned web exploits on the internet, used by Mirai variants and miners.
pre-authKEVStruts2 S2-057 Namespace OGNL
Apache Struts 2 · CVE-2018-11776When an action has no namespace set (or uses a wildcard namespace) and alwaysSelectFullNamespace is true, the namespace portion of the URL is evaluated as OGNL. Requesting a URL such as /${expr}/action.action runs arbitrary code.
pre-authKEVCisco Smart Install Stack Overflow RCE
Cisco IOS / IOS XE Smart Install · CVE-2018-0171A stack overflow in the Smart Install client allowed unauthenticated attackers on TCP 4786 to reload devices or run code. It has been exploited for years, including by Russian state actors (Static Tundra) against critical infrastructure.
pre-authKEVDrupalgeddon2
Drupal Drupal core · CVE-2018-7600Drupal's Form API accepted attacker-supplied render-array properties (keys starting with '#') in request data, letting unauthenticated users invoke arbitrary PHP callbacks. Public exploits appeared two weeks after the patch and it was mass-exploited for cryptominers and botnets.
pre-authKEVPAN-OS Management Interface Pre-Auth RCE Chain
Palo Alto Networks PAN-OS management web interface · CVE-2017-15944Philip Pettersson chained three bugs in the PAN-OS management interface into unauthenticated root code execution. A Metasploit module followed and CISA later added it to KEV based on exploitation.
pre-authKEVJBoss /invoker/readonly Deserialization
Red Hat JBoss Application Server 5.x / EAP 5 · CVE-2017-12149JBoss's HTTP Invoker ReadOnlyAccessFilter deserialized POST bodies sent to /invoker/readonly without authentication. Any legacy JBoss 5 box with Commons Collections on the classpath falls to a ysoserial payload, and it remains a staple of ransomware and cryptomining campaigns.
pre-authKEVPHPUnit eval-stdin.php RCE
Sebastian Bergmann PHPUnit · CVE-2017-9841PHPUnit shipped a helper script that evals whatever PHP code is POSTed to it. Sites that deploy their composer /vendor directory into the web root expose it directly, and it remains one of the most heavily scanned URLs on the internet years later.
pre-authKEVSambaCry
Samba Samba smbd · CVE-2017-7494A Samba bug, disclosed weeks after WannaCry, that lets a client with write access to a share upload a shared library and get the Samba server to load it. Many NAS devices and embedded Linux systems were affected.
KEVEternalBlue (MS17-010)
Microsoft Windows SMBv1 · CVE-2017-0144 +4A memory-corruption bug in the Windows SMBv1 server, developed into the NSA exploit EternalBlue and leaked by the Shadow Brokers in April 2017. It was then used by the WannaCry and NotPetya worms to spread across networks, giving unauthenticated remote code execution as SYSTEM.
pre-authKEVStruts2 S2-045 (Equifax)
Apache Struts 2 · CVE-2017-5638A single malformed Content-Type header sent to any Struts 2 action using the default Jakarta multipart parser executes OGNL on the server. It was mass-exploited within 48 hours of disclosure and was the entry point for the 2017 Equifax breach of ~147 million records.
pre-authKEVImageTragick
ImageMagick ImageMagick · CVE-2016-3714 +4ImageMagick delegated some formats to external programs by building shell command lines, and it trusted file contents over extensions. An uploaded 'image' (actually MVG/SVG) could inject shell commands, so any site resizing user uploads with ImageMagick could be taken over.
pre-authKEVJoomla Session User-Agent Object Injection
Joomla! Joomla! CMS · CVE-2015-8562Joomla stored the User-Agent and X-Forwarded-For headers in the session unsanitized, and a MySQL utf8 truncation quirk let attackers break the session serialization format. Sending a single crafted User-Agent results in PHP object injection and code execution; it was exploited as a 0-day two days before the patch.
pre-authHTTP.sys Range Header RCE (MS15-034)
Microsoft Windows HTTP.sys / IIS · CVE-2015-1635An integer overflow in the kernel-mode HTTP driver used by IIS. A single HTTP request with a huge Range header could crash the server or leak kernel memory, and Microsoft rated it as remote code execution.
pre-authKEVElasticsearch Groovy Sandbox Escape
Elastic Elasticsearch · CVE-2015-1427 +1Early Elasticsearch shipped without authentication and let search requests include scripts. First MVEL (CVE-2014-3120) and then the Groovy sandbox (CVE-2015-1427) allowed arbitrary Java execution through a single HTTP request to port 9200, and both were mass-exploited for DDoS bots and cryptominers.
pre-authKEVGHOST
GNU glibc · CVE-2015-0235A heap overflow in glibc's gethostbyname*() functions found by Qualys, named GHOST because it is triggered through GetHOSTbyname. Qualys showed remote code execution against the Exim mail server just by sending a crafted HELO hostname.
pre-authDrupalgeddon (SQLi to RCE)
Drupal Drupal core · CVE-2014-3704A pre-auth SQL injection in Drupal 7's database abstraction layer let anyone run arbitrary SQL through array keys in the login form. Drupal warned that any site not patched within 7 hours of release should be assumed compromised.
pre-authShellshock
GNU Bash · CVE-2014-6271 +5Bash parsed function definitions exported through environment variables and kept executing any commands that followed the definition. Since CGI scripts, DHCP clients, OpenSSH ForceCommand and others copy attacker data into environment variables, a single HTTP header could run commands on the server. Several follow-up CVEs came from incomplete fixes.
pre-authKEV