CISA Known Exploited Vulnerabilities Directory

Explore every threat in the CISA Known Exploited Vulnerabilities (KEV) catalog, enhanced with plain-English executive analysis, AWS relevance, and technical remediation guidance.

CVE	Vendor	Product	Added	Due	Status
CVE-2022-24521 — Microsoft Windows CLFS Driver Privilege Escalation Vulnerability Microsoft Windows Common Log File System (CLFS) Driver contains an unspecified vulnerability that allows for privilege escalation.	Microsoft	Windows	Apr 13, 2022	May 4, 2022	Ransomware
CVE-2021-42278 — Microsoft Active Directory Domain Services Privilege Escalation Vulnerability Microsoft Active Directory Domain Services contains an unspecified vulnerability that allows for privilege escalation.	Microsoft	Active Directory	Apr 11, 2022	May 2, 2022	Ransomware
CVE-2021-42287 — Microsoft Active Directory Domain Services Privilege Escalation Vulnerability Microsoft Active Directory Domain Services contains an unspecified vulnerability that allows for privilege escalation.	Microsoft	Active Directory	Apr 11, 2022	May 2, 2022	Ransomware
CVE-2017-0148 — Microsoft SMBv1 Server Remote Code Execution Vulnerability The SMBv1 server in Microsoft allows remote attackers to execute arbitrary code via crafted packets.	Microsoft	SMBv1 server	Apr 6, 2022	Apr 27, 2022	Ransomware
CVE-2021-31166 — Microsoft HTTP Protocol Stack Remote Code Execution Vulnerability Microsoft HTTP Protocol Stack contains a vulnerability in http.sys that allows for remote code execution.	Microsoft	HTTP Protocol Stack	Apr 6, 2022	Apr 27, 2022
CVE-2021-34484 — Microsoft Windows User Profile Service Privilege Escalation Vulnerability Microsoft Windows User Profile Service contains an unspecified vulnerability that allows for privilege escalation.	Microsoft	Windows	Mar 31, 2022	Apr 21, 2022
CVE-2010-4398 — Microsoft Windows Kernel Stack-Based Buffer Overflow Vulnerability Stack-based buffer overflow in the RtlQueryRegistryValues function in win32k.sys in Microsoft Windows allows local users to gain privileges, and bypass the User Account Control (UAC) feature.	Microsoft	Windows	Mar 28, 2022	Apr 21, 2022
CVE-2011-2005 — Microsoft Ancillary Function Driver (afd.sys) Improper Input Validation Vulnerability afd.sys in the Ancillary Function Driver in Microsoft Windows does not properly validate user-mode input passed to kernel mode, which allows local users to gain privileges via a crafted application.	Microsoft	Ancillary Function Driver (afd.sys)	Mar 28, 2022	Apr 18, 2022
CVE-2012-2539 — Microsoft Word Remote Code Execution Vulnerability Microsoft Word allows attackers to execute remote code or cause a denial-of-service (DoS) via crafted RTF data.	Microsoft	Word	Mar 28, 2022	Apr 18, 2022
CVE-2013-2551 — Microsoft Internet Explorer Use-After-Free Vulnerability Use-after-free vulnerability in Microsoft Internet Explorer allows remote attackers to execute remote code via a crafted web site that triggers access to a deleted object.	Microsoft	Internet Explorer	Mar 28, 2022	Apr 18, 2022	Ransomware

Ransomware Microsoft

CVE-2022-24521 — Microsoft Windows CLFS Driver Privilege Escalation Vulnerability

Microsoft Windows Common Log File System (CLFS) Driver contains an unspecified vulnerability that allows for privilege escalation.

Windows · Apr 13, 2022

Ransomware Microsoft

CVE-2021-42278 — Microsoft Active Directory Domain Services Privilege Escalation Vulnerability

Microsoft Active Directory Domain Services contains an unspecified vulnerability that allows for privilege escalation.

Active Directory · Apr 11, 2022

Ransomware Microsoft

CVE-2021-42287 — Microsoft Active Directory Domain Services Privilege Escalation Vulnerability

Microsoft Active Directory Domain Services contains an unspecified vulnerability that allows for privilege escalation.

Active Directory · Apr 11, 2022

Ransomware Microsoft

CVE-2017-0148 — Microsoft SMBv1 Server Remote Code Execution Vulnerability

The SMBv1 server in Microsoft allows remote attackers to execute arbitrary code via crafted packets.

SMBv1 server · Apr 6, 2022

Microsoft

CVE-2021-31166 — Microsoft HTTP Protocol Stack Remote Code Execution Vulnerability

Microsoft HTTP Protocol Stack contains a vulnerability in http.sys that allows for remote code execution.

HTTP Protocol Stack · Apr 6, 2022

Microsoft

CVE-2021-34484 — Microsoft Windows User Profile Service Privilege Escalation Vulnerability

Microsoft Windows User Profile Service contains an unspecified vulnerability that allows for privilege escalation.

Windows · Mar 31, 2022

Microsoft

CVE-2010-4398 — Microsoft Windows Kernel Stack-Based Buffer Overflow Vulnerability

Stack-based buffer overflow in the RtlQueryRegistryValues function in win32k.sys in Microsoft Windows allows local users to gain privileges, and bypass the User Account Control (UAC) feature.

Windows · Mar 28, 2022

Microsoft

CVE-2011-2005 — Microsoft Ancillary Function Driver (afd.sys) Improper Input Validation Vulnerability

afd.sys in the Ancillary Function Driver in Microsoft Windows does not properly validate user-mode input passed to kernel mode, which allows local users to gain privileges via a crafted application.

Ancillary Function Driver (afd.sys) · Mar 28, 2022

Microsoft

CVE-2012-2539 — Microsoft Word Remote Code Execution Vulnerability

Microsoft Word allows attackers to execute remote code or cause a denial-of-service (DoS) via crafted RTF data.

Word · Mar 28, 2022

Ransomware Microsoft

CVE-2013-2551 — Microsoft Internet Explorer Use-After-Free Vulnerability

Use-after-free vulnerability in Microsoft Internet Explorer allows remote attackers to execute remote code via a crafted web site that triggers access to a deleted object.

Internet Explorer · Mar 28, 2022