Exploitation intelligence

Observed Exploitation Signals

Sensor-backed exploitation attempts against internet-facing services, mapped to vulnerabilities and reviewed for confidence. See where attacker activity is concentrating before severity scores alone tell the story.

Browse feed RSS feed JSON API

KEVs Observed: 186; Known exploited vulnerabilities seen in the selected window
Exploitation Events: 278,872; Attempts mapped to tracked vulnerabilities across the sensor network
Attacker IPs: —; Unique source addresses observed in the selected window

Exploitation Attempts

90-day activity, grouped by observation date · 13 Jun–11 Sep 2026 UTC

Exploitation Attempts

90-day activity, grouped by observation date

126

570

276

410

382

212

206

409

371

709

139

172

221

237

349

149

817

551

960

371

11,262

583

441

449

590

699

665

806

582

761

796

1,163

799

600

926

2,826

2,422

2,663

2,680

1,960

1,738

2,180

2,357

2,936

1,745

1,353

2,756

2,779

2,546

2,987

3,011

2,668

3,366

2,685

6,614

2,990

2,396

617

1,137

1,085

1,001

1,307

688

709

1,811

1,745

2,113

3,021

7,731

7,203

4,883

13,415

16,809

4,611

4,928

19,033

19,116

17,186

4,870

6,997

5,884

5,087

3,711

3,665

4,987

3,649

3,388

6,696

6,901

4,030

13 Jun 2 Jul 21 Jul 9 Aug 11 Sep

Click a day to filter stats and tables to that date.

Where Exploitation Activity Concentrated

The highest-volume vulnerabilities in this snapshot, ranked by mapped exploitation attempts—not theoretical severity.

Inspect full KEV record

CVE-2017-9841 #1

PHPUnit

Attempts: 103,353
Attackers: —
Sensors: —

CVE-2026-8451 #2

ADC, Gateway

NetScaler

Attempts: 53,040
Attackers: —
Sensors: —

CVE-2025-55182 #3

react-server-dom-webpack, react-server-dom-turbopack, react-server-dom-parcel

PHP

PHP Group

Attempts: 15,528
Attackers: —
Sensors: —

CVE-2021-41773 #5

Apache HTTP Server

Apache

Attempts: 10,089
Attackers: —
Sensors: —

CVE-2022-47945 #6

ThinkPHP Framework

ThinkPHP

Attempts: 9,829
Attackers: —
Sensors: —

Observed Exploitation Attempts

Search the highest-volume records in the selected window. Each row shows activity breadth and recency alongside raw volume.

How to Read the Signal

Attempts indicate volume. Unique IPs and sensors indicate breadth. First and last seen show persistence. Use the linked CVE record for evidence and remediation context.

CVE / Product	Attempts	Attacker IPs	First Seen	Last Seen
CVE-2017-9841 PHPUnit · PHPUnit	103,353	—	07 Jul · 23:05	11 Sep · 16:59
CVE-2026-8451 ADC, Gateway · NetScaler	53,040	—	05 Jul · 20:47	06 Sep · 18:04
CVE-2025-55182 react-server-dom-webpack, react-server-dom-turbopack, react-server-dom-parcel · Meta	31,183	—	09 Jun · 14:41	11 Sep · 14:40
CVE-2024-4577 PHP · PHP Group	15,528	—	21 Jul · 18:44	11 Sep · 16:59
CVE-2021-41773 Apache HTTP Server · Apache	10,089	—	10 Jun · 14:57	11 Sep · 17:04
CVE-2022-47945 ThinkPHP Framework · ThinkPHP	9,829	—	08 Jun · 22:26	11 Sep · 16:59
CVE-2026-10520 Sentry · Ivanti	8,363	—	10 Jun · 09:03	10 Sep · 13:07
CVE-2018-20062 NoneCms · NoneCms	7,580	—	28 Jun · 17:29	11 Sep · 16:59
CVE-2026-63030 WordPress · WordPress	6,329	—	19 Jul · 16:02	11 Sep · 16:29
CVE-2026-8037 LoadMaster, ECS Connections Manager, Object Scale Connection Manager, MOVEit WAF · Progress Software	3,641	—	30 Jun · 07:54	10 Sep · 20:04
CVE-2026-0770 Langflow · Langflow	2,527	—	27 Jun · 10:18	03 Sep · 08:39
CVE-2026-55040 Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, Microsoft SharePoint Server Subscription Edition · Microsoft	1,408	—	19 Jul · 02:09	11 Sep · 10:43
CVE-2026-20230 Cisco Unified Communications Manager · Cisco	1,356	—	25 Jun · 02:30	30 Jul · 09:54
CVE-2026-20253 Splunk Enterprise · Splunk	1,290	—	12 Jun · 21:36	11 Sep · 12:27
CVE-2021-44228 Apache Log4j2 · Apache	1,262	—	03 Jul · 04:32	11 Sep · 02:18
CVE-2026-9198 Langflow OSS · IBM	1,248	—	06 Jul · 14:26	11 Sep · 16:20
CVE-2026-0768 Langflow · Langflow	1,157	—	14 Jul · 15:39	11 Sep · 14:55
CVE-2026-35273 PeopleSoft Enterprise PeopleTools · Oracle	1,094	—	14 Jun · 13:47	09 Sep · 08:16
CVE-2026-46817 Oracle Payments · Oracle	1,042	—	01 Jul · 01:33	22 Aug · 14:38
CVE-2026-57739 AcyMailing SMTP Newsletter · AcyMailing Newsletter Team	920	—	22 Aug · 02:52	25 Aug · 08:55
CVE-2026-75650 Adobe Commerce, Adobe Commerce B2B, Magento Open Source · Adobe	915	—	07 Sep · 21:46	11 Sep · 12:07
CVE-2022-41040 Microsoft Exchange Server 2013 Cumulative Update 23, Microsoft Exchange Server 2016 Cumulative Update 22, Microsoft Exchange Server 2019 Cumulative Update 11, Microsoft Exchange Server 2019 Cumulative Update 12, Microsoft Exchange Server 2016 Cumulative Update 23 · Microsoft	880	—	01 Jul · 03:59	10 Sep · 19:15
CVE-2026-4020 Gravity SMTP · RocketGenius	724	—	12 Jun · 00:35	10 Sep · 12:45
CVE-2024-12847 DGN1000 · NETGEAR	709	—	09 Jun · 10:18	11 Sep · 09:45
CVE-2026-52813 gogs · Gogs	632	—	26 Jun · 16:33	10 Sep · 07:08
CVE-2024-37014 Langflow · Langflow-ai	628	—	13 Jul · 04:36	11 Sep · 16:30
CVE-2026-39808 FortiSandbox, FortiSandbox PaaS · Fortinet	605	—	12 Jun · 13:59	07 Sep · 17:18
CVE-2018-10562 GPON home routers · Dasan	541	—	09 Jun · 01:20	11 Sep · 13:39
CVE-2026-15409 SMA1000 · SonicWall	509	—	17 Jul · 15:14	11 Sep · 16:08
CVE-2014-2383 dompdf · Dompdf	482	—	27 Jun · 09:30	03 Sep · 04:21
CVE-2020-14882 WebLogic Server · Oracle	406	—	10 Jun · 21:20	11 Sep · 10:04
CVE-2017-10271 WebLogic Server · Oracle	400	—	12 Jun · 00:32	10 Sep · 20:02
CVE-2017-18368 P660HN-T1A v1 TCLinux Fw · ZyXEL	379	—	09 Jun · 16:18	10 Sep · 05:46
CVE-2023-1389 TP-Link Archer AX21 (AX1800) · TP-Link	368	—	11 Jun · 06:25	11 Sep · 16:28
CVE-2018-13379 Fortinet FortiOS, FortiProxy · Fortinet	347	—	29 Jun · 18:59	11 Sep · 16:33
CVE-2025-61882 Oracle Concurrent Processing · Oracle	276	—	01 Jul · 01:33	01 Jul · 03:19
CVE-2020-3452 Cisco Adaptive Security Appliance (ASA) Software · Cisco	271	—	29 Jun · 18:59	11 Sep · 16:03
CVE-2026-48282 ColdFusion 2025, ColdFusion 2023 · Adobe	264	—	02 Jul · 16:52	09 Sep · 08:17
CVE-2022-46169 cacti · Cacti	259	—	10 Jul · 03:21	11 Sep · 09:45
CVE-2020-5902 BIG-IP · F5	257	—	12 Jun · 00:32	11 Sep · 10:04
CVE-2023-26801 BL-AC1900_2.0, BL-WR9000, BL-X26, BL-LTE300 · LB-LINK	242	—	25 Jun · 17:17	10 Sep · 03:02
CVE-2024-20767 ColdFusion · Adobe	225	—	12 Jun · 00:33	10 Sep · 06:35
CVE-2013-2251 Struts · Apache	206	—	11 Jul · 16:18	10 Sep · 11:39
CVE-2026-16723 Fastjson · Alibaba	192	—	27 Jul · 01:37	27 Jul · 02:05
CVE-2025-8943 Flowise · Flowise	184	—	25 Jun · 23:45	11 Sep · 08:44
CVE-2017-9822 DotNetNuke CMS Fixed in 9.1.1 · DotNetNuke	177	—	12 Jun · 00:32	09 Sep · 07:47
CVE-2025-71334 Flowise · Flowise	160	—	03 Jul · 09:04	22 Aug · 00:29
CVE-2025-1302 jsonpath-plus · JSONPath-Plus	136	—	12 Jun · 00:34	09 Sep · 08:12
CVE-2024-10914 DNS-320, DNS-320LW, DNS-325, DNS-340L · D-Link	125	—	12 Jun · 00:33	11 Sep · 09:45
CVE-2023-20198 Cisco IOS XE Software · Cisco	125	—	12 Jun · 00:33	09 Sep · 08:04

CVE-2017-9841