KEV Intelligence is becoming Previdian.

Exploitation intelligence

Observed Exploitation Signals

Sensor-backed exploitation attempts against internet-facing services, mapped to vulnerabilities and reviewed for confidence. See where attacker activity is concentrating before severity scores alone tell the story.

KEVs Observed
50
Known exploited vulnerabilities seen in the selected window
Exploitation Events
14,192
Attempts mapped to tracked vulnerabilities across the sensor network
Attacker IPs
301
Unique source addresses observed in the selected window

Exploitation Attempts

24-hour activity, grouped by observation date · 24 Aug–25 Aug 2026 UTC

Exploitation Attempts

24-hour activity, grouped by observation date

11,319
2,873
24 Aug 25 Aug

Click a day to filter stats and tables to that date.

Where Exploitation Activity Concentrated

The highest-volume vulnerabilities in this snapshot, ranked by mapped exploitation attempts—not theoretical severity.

Inspect full KEV record

ADC, Gateway

NetScaler

Attempts
6,623
Attackers
1
Sensors
1

PHPUnit

PHPUnit

Attempts
4,745
Attackers
125
Sensors
29

PHP

PHP Group

Attempts
818
Attackers
128
Sensors
28

react-server-dom-webpack, react-server-dom-turbopack, react-server-dom-parcel

Meta

Attempts
734
Attackers
7
Sensors
6

AcyMailing SMTP Newsletter

AcyMailing Newsletter Team

Attempts
250
Attackers
4
Sensors
4

Apache HTTP Server

Apache Software Foundation

Attempts
241
Attackers
178
Sensors
29

Observed Exploitation Attempts

Search the highest-volume records in the selected window. Each row shows activity breadth and recency alongside raw volume.

How to Read the Signal

Attempts indicate volume. Unique IPs and sensors indicate breadth. First and last seen show persistence. Use the linked CVE record for evidence and remediation context.

CVE-2026-8451

ADC, Gateway

NetScaler

Attempts
6,623
Attacker IPs
1
Sensors
1
CVE-2017-9841

PHPUnit

PHPUnit

Attempts
4,745
Attacker IPs
125
Sensors
29
CVE-2024-4577

PHP

PHP Group

Attempts
818
Attacker IPs
128
Sensors
28
CVE-2025-55182

react-server-dom-webpack, react-server-dom-turbopack, react-server-dom-parcel

Meta

Attempts
734
Attacker IPs
7
Sensors
6
CVE-2026-57739

AcyMailing SMTP Newsletter

AcyMailing Newsletter Team

Attempts
250
Attacker IPs
4
Sensors
4
CVE-2021-41773

Apache HTTP Server

Apache Software Foundation

Attempts
241
Attacker IPs
178
Sensors
29
CVE-2026-63030

WordPress

WordPress

Attempts
224
Attacker IPs
10
Sensors
4
CVE-2018-20062

NoneCms

NoneCms

Attempts
147
Attacker IPs
51
Sensors
28
CVE-2022-47945

ThinkPHP Framework

ThinkPHP

Attempts
132
Attacker IPs
48
Sensors
26
CVE-2026-73570

Collaboration

Zimbra

Attempts
39
Attacker IPs
2
Sensors
1
CVE-2024-20767

ColdFusion

Adobe

Attempts
38
Attacker IPs
16
Sensors
15
CVE-2026-35273

PeopleSoft Enterprise PeopleTools

Oracle Corporation

Attempts
21
Attacker IPs
4
Sensors
1
CVE-2024-12847

DGN1000

NETGEAR

Attempts
19
Attacker IPs
13
Sensors
7
CVE-2013-2251

Struts

Apache

Attempts
18
Attacker IPs
1
Sensors
1
CVE-2026-9198

Langflow OSS

IBM

Attempts
17
Attacker IPs
15
Sensors
4
CVE-2018-10562

GPON home routers

Dasan

Attempts
13
Attacker IPs
9
Sensors
6
CVE-2022-41040

Microsoft Exchange Server 2013 Cumulative Update 23, Microsoft Exchange Server 2016 Cumulative Update 22, Microsoft Exchange Server 2019 Cumulative Update 11, Microsoft Exchange Server 2019 Cumulative Update 12, Microsoft Exchange Server 2016 Cumulative Update 23

Microsoft

Attempts
12
Attacker IPs
12
Sensors
1
CVE-2026-4020

Gravity SMTP

RocketGenius

Attempts
9
Attacker IPs
6
Sensors
7
CVE-2023-1389

TP-Link Archer AX21 (AX1800)

TP-Link

Attempts
9
Attacker IPs
2
Sensors
6
CVE-2019-12725

Zeroshell

Zeroshell

Attempts
7
Attacker IPs
1
Sensors
3
CVE-2026-0770

Langflow

Langflow

Attempts
6
Attacker IPs
5
Sensors
2
CVE-2018-13379

Fortinet FortiOS, FortiProxy

Fortinet

Attempts
5
Attacker IPs
5
Sensors
2
CVE-2026-8037

LoadMaster, ECS Connections Manager, Object Scale Connection Manager, MOVEit WAF

Progress Software

Attempts
5
Attacker IPs
4
Sensors
2
CVE-2017-10271

WebLogic Server

Oracle Corporation

Attempts
4
Attacker IPs
1
Sensors
1
CVE-2020-3452

Cisco Adaptive Security Appliance (ASA) Software

Cisco

Attempts
4
Attacker IPs
4
Sensors
1
CVE-2024-8181

Flowise

FlowiseAI

Attempts
4
Attacker IPs
2
Sensors
1
CVE-2026-55040

Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, Microsoft SharePoint Server Subscription Edition

Microsoft

Attempts
4
Attacker IPs
3
Sensors
1
CVE-2021-41277

metabase

metabase

Attempts
3
Attacker IPs
3
Sensors
1
CVE-2026-46442

Flowise

FlowiseAI

Attempts
3
Attacker IPs
1
Sensors
1
CVE-2023-26801

BL-AC1900_2.0, BL-WR9000, BL-X26, BL-LTE300

LB-LINK

Attempts
2
Attacker IPs
1
Sensors
1
CVE-2026-8452

ADC, Gateway

NetScaler

Attempts
2
Attacker IPs
1
Sensors
1
CVE-2023-20198

Cisco IOS XE Software

Cisco

Attempts
2
Attacker IPs
1
Sensors
1
CVE-2023-4966

NetScaler ADC, NetScaler Gateway

Citrix

Attempts
2
Attacker IPs
2
Sensors
1
CVE-2017-9805

Apache Struts

Apache Software Foundation

Attempts
2
Attacker IPs
1
Sensors
1
CVE-2016-3081

Struts

Apache

Attempts
1
Attacker IPs
1
Sensors
1
CVE-2017-9822

DotNetNuke CMS Fixed in 9.1.1

DotNetNuke

Attempts
1
Attacker IPs
1
Sensors
1
CVE-2025-8943

Flowise

Flowise

Attempts
1
Attacker IPs
1
Sensors
1
CVE-2026-5027

langflow

langflow-ai

Attempts
1
Attacker IPs
1
Sensors
1
CVE-2024-3721

DVR-4104, DVR-4216

TBK

Attempts
1
Attacker IPs
1
Sensors
1
CVE-2026-6875

ServiceNow AI Platform

ServiceNow

Attempts
1
Attacker IPs
1
Sensors
1
CVE-2026-55450

langflow

langflow-ai

Attempts
1
Attacker IPs
1
Sensors
1
CVE-2025-20282

Cisco Identity Services Engine Software

Cisco

Attempts
1
Attacker IPs
1
Sensors
1
CVE-2026-16232

Quantum Security Management, Multi-Domain Security Management

checkpoint

Attempts
1
Attacker IPs
1
Sensors
1

Showing 50 of 50 highest-volume records · 24 Aug–25 Aug 2026 UTC

Early warning alerts

Get alerts on high-impact exploitation

Receive curator-selected alerts when exploitation activity warrants attention. Each alert includes the evidence and context needed to decide what requires attention now.

Occasional high-impact alerts. Unsubscribe anytime. See our Privacy Policy.