Explore every threat in the CISA Known Exploited Vulnerabilities (KEV) catalog, enhanced with plain-English executive analysis, AWS relevance, and technical remediation guidance.
| CVE | Vendor | Product | Added | Due | Status |
|---|---|---|---|---|---|
|
CVE-2021-26858 — Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain.
|
Microsoft | Exchange Server | Nov 3, 2021 | May 3, 2022 | Ransomware |
|
CVE-2021-27059 — Microsoft Office Remote Code Execution Vulnerability
Microsoft Office contains an unspecified vulnerability that allows for remote code execution.
|
Microsoft | Office | Nov 3, 2021 | Nov 17, 2021 | |
|
CVE-2021-27065 — Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain.
|
Microsoft | Exchange Server | Nov 3, 2021 | May 3, 2022 | Ransomware |
|
CVE-2021-27085 — Microsoft Internet Explorer Remote Code Execution Vulnerability
Microsoft Internet Explorer contains an unspecified vulnerability that allows for remote code execution.
|
Microsoft | Internet Explorer | Nov 3, 2021 | Nov 17, 2021 | |
|
CVE-2021-27101 — Accellion FTA SQL Injection Vulnerability
Accellion FTA contains a SQL injection vulnerability exploited via a crafted host header in a request to document_root.html.
|
Accellion | FTA | Nov 3, 2021 | Nov 17, 2021 | Ransomware |
|
CVE-2021-27102 — Accellion FTA OS Command Injection Vulnerability
Accellion FTA contains an OS command injection vulnerability exploited via a local web service call.
|
Accellion | FTA | Nov 3, 2021 | Nov 17, 2021 | Ransomware |
|
CVE-2021-27103 — Accellion FTA Server-Side Request Forgery (SSRF) Vulnerability
Accellion FTA contains a server-side request forgery (SSRF) vulnerability exploited via a crafted POST request to wmProgressstat.html.
|
Accellion | FTA | Nov 3, 2021 | Nov 17, 2021 | Ransomware |
|
CVE-2021-27104 — Accellion FTA OS Command Injection Vulnerability
Accellion FTA contains an OS command injection vulnerability exploited via a crafted POST request to various admin endpoints.
|
Accellion | FTA | Nov 3, 2021 | Nov 17, 2021 | Ransomware |
|
CVE-2021-27561 — Yealink Device Management Server-Side Request Forgery (SSRF) Vulnerability
Yealink Device Management contains a server-side request forgery (SSRF) vulnerability that allows for unauthenticated remote code execution.
|
Yealink | Device Management | Nov 3, 2021 | Nov 17, 2021 | |
|
CVE-2021-27562 — Arm Trusted Firmware Out-of-Bounds Write Vulnerability
Arm Trusted Firmware contains an out-of-bounds write vulnerability allowing the non-secure (NS) world to trigger a system halt, overwrite secure data, or print out secure data when calling secure functions under the non-secure processing environment (NSPE) handler mode. This vulnerability affects Yealink Device Management servers.
|
Arm | Trusted Firmware | Nov 3, 2021 | Nov 17, 2021 |
Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain.
Exchange Server · Nov 3, 2021
Microsoft Office contains an unspecified vulnerability that allows for remote code execution.
Office · Nov 3, 2021
Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain.
Exchange Server · Nov 3, 2021
Microsoft Internet Explorer contains an unspecified vulnerability that allows for remote code execution.
Internet Explorer · Nov 3, 2021
Accellion FTA contains a SQL injection vulnerability exploited via a crafted host header in a request to document_root.html.
FTA · Nov 3, 2021
Accellion FTA contains an OS command injection vulnerability exploited via a local web service call.
FTA · Nov 3, 2021
Accellion FTA contains a server-side request forgery (SSRF) vulnerability exploited via a crafted POST request to wmProgressstat.html.
FTA · Nov 3, 2021
Accellion FTA contains an OS command injection vulnerability exploited via a crafted POST request to various admin endpoints.
FTA · Nov 3, 2021
Yealink Device Management contains a server-side request forgery (SSRF) vulnerability that allows for unauthenticated remote code execution.
Device Management · Nov 3, 2021
Arm Trusted Firmware contains an out-of-bounds write vulnerability allowing the non-secure (NS) world to trigger a system halt, overwrite secure data, or print out secure data when calling secure functions under the non-secure processing environment (NSPE) handler mode. This vulnerability affects Yealink Device Management servers.
Trusted Firmware · Nov 3, 2021