Exploitation intelligence

Observed Exploitation Signals

Sensor-backed exploitation attempts against internet-facing services, mapped to vulnerabilities and reviewed for confidence. See where attacker activity is concentrating before severity scores alone tell the story.

Browse KEV feedStart 14-day Pro trial

Also available as an RSS feed or JSON API.

KEVs Observed
246
Known exploited vulnerabilities seen in the selected window
Exploitation Events
499,919
Attempts mapped to tracked vulnerabilities across the sensor network
Attacker IPs
—
Unique source addresses observed in the selected window

Exploitation Attempts

90-day activity, grouped by observation date · 11 Jul–09 Oct 2026 UTC

Exploitation Attempts

90-day activity, grouped by observation date

806
583
767
798
1,164
801
605
930
2,852
2,423
2,668
2,682
1,976
1,747
2,185
2,359
2,937
1,745
1,364
2,773
2,781
2,546
2,987
3,014
2,671
3,369
2,719
6,618
3,024
2,397
621
1,140
1,098
1,005
1,318
692
710
1,816
1,763
2,113
3,044
7,732
7,213
4,889
13,419
16,814
4,614
4,937
19,041
19,120
17,233
4,887
7,041
5,959
5,125
3,742
3,671
4,990
3,649
3,390
6,712
6,909
6,076
5,068
4,228
4,960
5,698
4,254
8,656
6,811
7,061
7,449
6,549
7,259
7,207
11,209
9,768
10,901
8,967
16,988
11,389
12,991
10,254
10,405
9,634
9,064
12,793
9,554
11,341
9,250
1,437
11 Jul 30 Jul 18 Aug 6 Sep 9 Oct

Click a day to filter stats and tables to that date.

Where Exploitation Activity Concentrated

The highest-volume vulnerabilities in this snapshot, ranked by mapped exploitation attempts—not theoretical severity.

Inspect full KEV record
CVE-2017-9841 #1

PHPUnit

PHPUnit

Attempts
231,545
Attackers
—
Sensors
—
CVE-2026-8451 #2

ADC, Gateway

NetScaler

Attempts
53,053
Attackers
—
Sensors
—
CVE-2025-55182 #3

react-server-dom-webpack, react-server-dom-turbopack, react-server-dom-parcel

Meta

Attempts
49,069
Attackers
—
Sensors
—
CVE-2024-4577 #4

PHP

PHP Group

Attempts
35,226
Attackers
—
Sensors
—
CVE-2018-20062 #5

NoneCms

NoneCms

Attempts
13,549
Attackers
—
Sensors
—
CVE-2022-47945 #6

ThinkPHP Framework

ThinkPHP

Attempts
13,265
Attackers
—
Sensors
—

Observed Exploitation Attempts

Search the highest-volume records in the selected window. Each row shows activity breadth and recency alongside raw volume.

How to Read the Signal

Attempts indicate volume. Unique attacker IPs indicate breadth. Last seen shows how recently the activity was observed. Use the linked CVE record for evidence and remediation context.

CVE-2017-9841

PHPUnit

PHPUnit

Attempts
231,545
Change
↑ 231,538 attempts
Attackers
—
Last Seen
09 Oct · 04:09
CVE-2026-8451

ADC, Gateway

NetScaler

Attempts
53,053
Change
↑ 53,001 attempts
Attackers
—
Last Seen
08 Oct · 10:45
CVE-2025-55182

react-server-dom-webpack, react-server-dom-turbopack, react-server-dom-parcel

Meta

Attempts
49,069
Change
↑ 48,461 attempts
Attackers
—
Last Seen
09 Oct · 03:54
CVE-2024-4577

PHP

PHP Group

Attempts
35,226
Change
New
Attackers
—
Last Seen
09 Oct · 04:08
CVE-2018-20062

NoneCms

NoneCms

Attempts
13,549
Change
↑ 13,051 attempts
Attackers
—
Last Seen
09 Oct · 04:09
CVE-2022-47945

ThinkPHP Framework

ThinkPHP

Attempts
13,265
Change
↑ 10,579 attempts
Attackers
—
Last Seen
09 Oct · 04:09
CVE-2026-39364

vite, vite-plus

Vitejs

Attempts
13,074
Change
↑ 12,895 attempts
Attackers
—
Last Seen
08 Oct · 21:58
CVE-2021-41773

Apache HTTP Server

Apache

Attempts
12,780
Change
↑ 10,530 attempts
Attackers
—
Last Seen
09 Oct · 04:08
CVE-2021-36260

IP Camera

Hikvision

Attempts
11,727
Change
↑ 11,723 attempts
Attackers
—
Last Seen
08 Oct · 20:10
CVE-2026-63030

WordPress

WordPress

Attempts
9,967
Change
New
Attackers
—
Last Seen
09 Oct · 04:03
CVE-2026-75650

Adobe Commerce, Adobe Commerce B2B, Magento Open Source

Adobe

Attempts
5,614
Change
New
Attackers
—
Last Seen
08 Oct · 20:57
CVE-2026-87902

WordPress

WordPress

Attempts
5,038
Change
New
Attackers
—
Last Seen
08 Oct · 22:47
CVE-2026-8037

LoadMaster, ECS Connections Manager, Object Scale Connection Manager, MOVEit WAF

Progress Software

Attempts
3,658
Change
↑ 2,787 attempts
Attackers
—
Last Seen
07 Oct · 13:04
CVE-2026-0768

Langflow

Langflow

Attempts
2,920
Change
New
Attackers
—
Last Seen
09 Oct · 03:38
CVE-2026-0770

Langflow

Langflow

Attempts
2,501
Change
↑ 2,474 attempts
Attackers
—
Last Seen
30 Sep · 01:56
CVE-2023-2825

GitLab

GitLab

Attempts
2,022
Change
New
Attackers
—
Last Seen
08 Oct · 19:06
CVE-2026-9198

Langflow OSS

IBM

Attempts
1,886
Change
↑ 1,873 attempts
Attackers
—
Last Seen
09 Oct · 04:09
CVE-2021-44228

Apache Log4j2

Apache

Attempts
1,828
Change
↑ 1,822 attempts
Attackers
—
Last Seen
08 Oct · 14:30
CVE-2026-10520

Sentry

Ivanti

Attempts
1,805
Change
↓ 5,298 attempts
Attackers
—
Last Seen
08 Oct · 10:22
CVE-2026-55040

Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, Microsoft SharePoint Server Subscription Edition

Microsoft

Attempts
1,483
Change
New
Attackers
—
Last Seen
03 Oct · 23:02
CVE-2022-41040

Microsoft Exchange Server 2013 Cumulative Update 23, Microsoft Exchange Server 2016 Cumulative Update 22, Microsoft Exchange Server 2019 Cumulative Update 11, Microsoft Exchange Server 2019 Cumulative Update 12, Microsoft Exchange Server 2016 Cumulative Update 23

Microsoft

Attempts
1,466
Change
↑ 1,320 attempts
Attackers
—
Last Seen
07 Oct · 14:26
CVE-2024-37014

Langflow

Langflow-ai

Attempts
990
Change
New
Attackers
—
Last Seen
07 Oct · 09:11
CVE-2026-52813

gogs

Gogs

Attempts
983
Change
↑ 827 attempts
Attackers
—
Last Seen
09 Oct · 03:03
CVE-2026-104286

FortiMail

Fortinet

Attempts
957
Change
New
Attackers
—
Last Seen
08 Oct · 07:53
CVE-2026-57739

AcyMailing SMTP Newsletter

AcyMailing Newsletter Team

Attempts
925
Change
New
Attackers
—
Last Seen
07 Oct · 17:00

Showing 25 of 25 highest-volume records · 11 Jul–09 Oct 2026 UTC · Change versus the previous 90 days