Exploitation intelligence

Observed Exploitation Signals

Sensor-backed exploitation attempts against internet-facing services, mapped to vulnerabilities and reviewed for confidence. See where attacker activity is concentrating before severity scores alone tell the story.

Browse feed RSS feed JSON API

KEVs Observed: 157; Known exploited vulnerabilities seen in the selected window
Exploitation Events: 135,324; Attempts mapped to tracked vulnerabilities across the sensor network
Attacker IPs: —; Unique source addresses observed in the selected window

Exploitation Attempts

90-day activity, grouped by observation date · 27 May–25 Aug 2026 UTC

Exploitation Attempts

90-day activity, grouped by observation date

365

134

536

232

370

341

176

168

366

312

682

130

171

183

287

741

526

939

361

10,886

581

439

437

443

584

693

661

805

572

759

779

1,163

796

598

917

2,790

2,414

2,651

2,667

1,915

1,725

2,171

2,354

2,928

1,727

1,341

2,636

2,765

2,536

2,983

2,825

2,545

3,221

2,605

6,529

2,953

2,372

584

1,082

1,037

980

1,286

672

621

1,605

1,642

1,388

2,365

6,912

7,186

4,852

13,082

2,873

27 May 15 Jun 4 Jul 23 Jul 25 Aug

Click a day to filter stats and tables to that date.

Where Exploitation Activity Concentrated

The highest-volume vulnerabilities in this snapshot, ranked by mapped exploitation attempts—not theoretical severity.

Inspect full KEV record

CVE-2017-9841 #1

PHPUnit

Attempts: 53,747
Attackers: —
Sensors: —

CVE-2025-55182 #2

react-server-dom-webpack, react-server-dom-turbopack, react-server-dom-parcel

PHP

PHP Group

Attempts: 8,514
Attackers: —
Sensors: —

CVE-2026-10520 #4

Sentry

ivanti

Attempts: 8,271
Attackers: —
Sensors: —

CVE-2021-41773 #5

Apache HTTP Server

Apache Software Foundation

Attempts: 7,430
Attackers: —
Sensors: —

CVE-2022-47945 #6

ThinkPHP Framework

ThinkPHP

Attempts: 7,139
Attackers: —
Sensors: —

Observed Exploitation Attempts

Search the highest-volume records in the selected window. Each row shows activity breadth and recency alongside raw volume.

How to Read the Signal

Attempts indicate volume. Unique IPs and sensors indicate breadth. First and last seen show persistence. Use the linked CVE record for evidence and remediation context.

CVE / Product	Attempts	Attacker IPs	First Seen	Last Seen
CVE-2017-9841 PHPUnit · PHPUnit	53,747	—	18 Jul · 16:46	25 Aug · 02:52
CVE-2025-55182 react-server-dom-webpack, react-server-dom-turbopack, react-server-dom-parcel · Meta	12,907	—	09 Jun · 14:41	24 Aug · 20:26
CVE-2024-4577 PHP · PHP Group	8,514	—	21 Jul · 18:44	25 Aug · 02:51
CVE-2026-10520 Sentry · ivanti	8,271	—	10 Jun · 09:03	24 Aug · 19:18
CVE-2021-41773 Apache HTTP Server · Apache Software Foundation	7,430	—	29 Jun · 11:05	25 Aug · 02:51
CVE-2022-47945 ThinkPHP Framework · ThinkPHP	7,139	—	08 Jun · 22:26	25 Aug · 02:52
CVE-2026-8451 ADC, Gateway · NetScaler	6,677	—	05 Jul · 20:47	25 Aug · 03:02
CVE-2018-20062 NoneCms · NoneCms	4,425	—	05 Jul · 09:37	25 Aug · 02:52
CVE-2026-63030 WordPress · WordPress	3,868	—	19 Jul · 16:02	24 Aug · 20:08
CVE-2026-0770 Langflow · Langflow	2,082	—	27 Jun · 10:18	25 Aug · 02:19
CVE-2026-8037 LoadMaster, ECS Connections Manager, Object Scale Connection Manager, MOVEit WAF · Progress Software	1,670	—	30 Jun · 07:54	25 Aug · 01:28
CVE-2026-20230 Cisco Unified Communications Manager · Cisco	1,321	—	25 Jun · 02:30	30 Jul · 09:54
CVE-2026-20253 Splunk Enterprise · Splunk	1,260	—	12 Jun · 21:36	13 Aug · 14:33
CVE-2026-35273 PeopleSoft Enterprise PeopleTools · Oracle Corporation	1,091	—	14 Jun · 13:47	24 Aug · 18:47
CVE-2026-46817 Oracle Payments · Oracle Corporation	1,014	—	01 Jul · 01:33	22 Aug · 14:38
CVE-2026-9198 Langflow OSS · IBM	942	—	06 Jul · 14:26	25 Aug · 02:19
CVE-2026-57739 AcyMailing SMTP Newsletter · AcyMailing Newsletter Team	878	—	22 Aug · 02:52	24 Aug · 20:24
CVE-2022-41040 Microsoft Exchange Server 2013 Cumulative Update 23, Microsoft Exchange Server 2016 Cumulative Update 22, Microsoft Exchange Server 2019 Cumulative Update 11, Microsoft Exchange Server 2019 Cumulative Update 12, Microsoft Exchange Server 2016 Cumulative Update 23 · Microsoft	601	—	01 Jul · 03:59	24 Aug · 12:12
CVE-2026-39808 FortiSandbox, FortiSandbox PaaS · Fortinet	574	—	12 Jun · 13:59	23 Aug · 17:25
CVE-2026-4020 Gravity SMTP · RocketGenius	563	—	12 Jun · 00:35	24 Aug · 20:23
CVE-2024-12847 DGN1000 · NETGEAR	538	—	09 Jun · 10:18	25 Aug · 02:18
CVE-2026-15409 SMA1000 · SonicWall	479	—	17 Jul · 15:14	17 Aug · 10:09
CVE-2014-2383 dompdf · dompdf	471	—	27 Jun · 09:30	21 Aug · 13:27
CVE-2026-55040 Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, Microsoft SharePoint Server Subscription Edition · Microsoft	405	—	19 Jul · 02:09	25 Aug · 02:36
CVE-2026-52813 gogs · gogs	399	—	26 Jun · 16:33	22 Aug · 06:13
CVE-2018-10562 GPON home routers · Dasan	389	—	09 Jun · 01:20	25 Aug · 02:18
CVE-2017-18368 P660HN-T1A v1 TCLinux Fw · ZyXEL	377	—	09 Jun · 16:18	23 Aug · 08:57
CVE-2020-14882 WebLogic Server · Oracle Corporation	363	—	10 Jun · 21:20	20 Aug · 19:11
CVE-2024-37014 Langflow · langflow-ai	303	—	13 Jul · 04:36	21 Aug · 23:29
CVE-2025-61882 Oracle Concurrent Processing · Oracle Corporation	276	—	01 Jul · 01:33	01 Jul · 03:19
CVE-2026-48282 ColdFusion 2025, ColdFusion 2023 · Adobe	258	—	02 Jul · 16:52	20 Aug · 11:38
CVE-2020-5902 BIG-IP · F5	247	—	12 Jun · 00:32	20 Aug · 11:36
CVE-2018-13379 Fortinet FortiOS, FortiProxy · Fortinet	246	—	29 Jun · 18:59	24 Aug · 12:12
CVE-2022-46169 cacti · Cacti	237	—	10 Jul · 03:21	25 Aug · 02:18
CVE-2023-1389 TP-Link Archer AX21 (AX1800) · TP-Link	234	—	11 Jun · 06:25	25 Aug · 02:18
CVE-2020-3452 Cisco Adaptive Security Appliance (ASA) Software · Cisco	202	—	29 Jun · 18:59	24 Aug · 12:12
CVE-2024-20767 ColdFusion · Adobe	196	—	12 Jun · 00:33	24 Aug · 17:00
CVE-2026-16723 Fastjson · Alibaba	192	—	27 Jul · 01:37	27 Jul · 02:05
CVE-2017-10271 WebLogic Server · Oracle Corporation	188	—	12 Jun · 00:32	25 Aug · 02:18
CVE-2023-26801 BL-AC1900_2.0, BL-WR9000, BL-X26, BL-LTE300 · LB-LINK	173	—	25 Jun · 17:17	25 Aug · 00:33
CVE-2017-9822 DotNetNuke CMS Fixed in 9.1.1 · DotNetNuke	164	—	12 Jun · 00:32	25 Aug · 02:02
CVE-2025-71334 Flowise · Flowise	160	—	03 Jul · 09:04	22 Aug · 00:29
CVE-2025-1302 jsonpath-plus · JSONPath-Plus	136	—	12 Jun · 00:34	22 Aug · 05:40
CVE-2013-2251 Struts · Apache	119	—	11 Jul · 16:18	24 Aug · 22:15
CVE-2020-17518 Apache Flink · Apache Software Foundation	116	—	12 Jun · 00:32	20 Aug · 11:40
CVE-2023-20198 Cisco IOS XE Software · Cisco	116	—	12 Jun · 00:33	24 Aug · 12:11
CVE-2025-34037 E4200, E3200, E3000, E2500 v1/v2, E2100L v1, E2000, E1550, E1500 v1, E1200 v1, E1000 v1, E900 v1 · Linksys	116	—	07 Jul · 16:17	07 Aug · 09:50
CVE-2021-41277 metabase · metabase	109	—	30 Jun · 18:33	24 Aug · 12:11
CVE-2020-14883 WebLogic Server · Oracle Corporation	99	—	12 Jun · 00:32	20 Aug · 11:36
CVE-2024-8181 Flowise · FlowiseAI	98	—	12 Jun · 00:34	24 Aug · 15:44

CVE-2017-9841

PHPUnit

Attempts: 53,747
Attacker IPs: —

CVE-2025-55182

react-server-dom-webpack, react-server-dom-turbopack, react-server-dom-parcel

Get alerts on high-impact exploitation

Receive curator-selected alerts when exploitation activity warrants attention. Each alert includes the evidence and context needed to decide what requires attention now.