CISA Known Exploited Vulnerabilities Directory

Explore every threat in the CISA Known Exploited Vulnerabilities (KEV) catalog, enhanced with plain-English executive analysis, AWS relevance, and technical remediation guidance.

CVE	Vendor	Product	Added	Due	Status
CVE-2018-8174 — Microsoft Windows VBScript Engine Out-of-Bounds Write Vulnerability A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows VBScript Engine Remote Code Execution"	Microsoft	Windows	Feb 15, 2022	Aug 15, 2022	Ransomware
CVE-2019-0752 — Microsoft Internet Explorer Type Confusion Vulnerability A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer	Microsoft	Internet Explorer	Feb 15, 2022	Aug 15, 2022	Ransomware
CVE-2015-1635 — Microsoft HTTP.sys Remote Code Execution Vulnerability Microsoft HTTP protocol stack (HTTP.sys) contains a vulnerability that allows for remote code execution.	Microsoft	HTTP.sys	Feb 10, 2022	Aug 10, 2022
CVE-2017-0144 — Microsoft SMBv1 Remote Code Execution Vulnerability The SMBv1 server in multiple Microsoft Windows versions allows remote attackers to execute arbitrary code via crafted packets.	Microsoft	SMBv1	Feb 10, 2022	Aug 10, 2022	Ransomware
CVE-2017-0145 — Microsoft SMBv1 Remote Code Execution Vulnerability The SMBv1 server in multiple Microsoft Windows versions allows remote attackers to execute arbitrary code via crafted packets.	Microsoft	SMBv1	Feb 10, 2022	Aug 10, 2022	Ransomware
CVE-2017-0262 — Microsoft Office Remote Code Execution Vulnerability A remote code execution vulnerability exists in Microsoft Office.	Microsoft	Office	Feb 10, 2022	Aug 10, 2022
CVE-2017-0263 — Microsoft Win32k Privilege Escalation Vulnerability Microsoft Win32k contains a privilege escalation vulnerability due to the Windows kernel-mode driver failing to properly handle objects in memory.	Microsoft	Win32k	Feb 10, 2022	Aug 10, 2022
CVE-2017-8464 — Microsoft Windows Shell (.lnk) Remote Code Execution Vulnerability Windows Shell in multiple versions of Microsoft Windows allows local users or remote attackers to execute arbitrary code via a crafted .LNK file	Microsoft	Windows	Feb 10, 2022	Aug 10, 2022
CVE-2020-0796 — Microsoft SMBv3 Remote Code Execution Vulnerability A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests. An attacker who successfully exploited the vulnerability could gain the ability to execute code on the target server or client.	Microsoft	SMBv3	Feb 10, 2022	Aug 10, 2022	Ransomware
CVE-2021-36934 — Microsoft Windows SAM Local Privilege Escalation Vulnerability If a Volume Shadow Copy (VSS) shadow copy of the system drive is available, users can read the SAM file which would allow any user to escalate privileges to SYSTEM level.	Microsoft	Windows	Feb 10, 2022	Feb 24, 2022

Ransomware Microsoft

CVE-2018-8174 — Microsoft Windows VBScript Engine Out-of-Bounds Write Vulnerability

A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows VBScript Engine Remote Code Execution"

Windows · Feb 15, 2022

Ransomware Microsoft

CVE-2019-0752 — Microsoft Internet Explorer Type Confusion Vulnerability

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer

Internet Explorer · Feb 15, 2022

Microsoft

CVE-2015-1635 — Microsoft HTTP.sys Remote Code Execution Vulnerability

Microsoft HTTP protocol stack (HTTP.sys) contains a vulnerability that allows for remote code execution.

HTTP.sys · Feb 10, 2022

Ransomware Microsoft

CVE-2017-0144 — Microsoft SMBv1 Remote Code Execution Vulnerability

The SMBv1 server in multiple Microsoft Windows versions allows remote attackers to execute arbitrary code via crafted packets.

SMBv1 · Feb 10, 2022

Ransomware Microsoft

CVE-2017-0145 — Microsoft SMBv1 Remote Code Execution Vulnerability

The SMBv1 server in multiple Microsoft Windows versions allows remote attackers to execute arbitrary code via crafted packets.

SMBv1 · Feb 10, 2022

Microsoft

CVE-2017-0262 — Microsoft Office Remote Code Execution Vulnerability

A remote code execution vulnerability exists in Microsoft Office.

Office · Feb 10, 2022

Microsoft

CVE-2017-0263 — Microsoft Win32k Privilege Escalation Vulnerability

Microsoft Win32k contains a privilege escalation vulnerability due to the Windows kernel-mode driver failing to properly handle objects in memory.

Win32k · Feb 10, 2022

Microsoft

CVE-2017-8464 — Microsoft Windows Shell (.lnk) Remote Code Execution Vulnerability

Windows Shell in multiple versions of Microsoft Windows allows local users or remote attackers to execute arbitrary code via a crafted .LNK file

Windows · Feb 10, 2022

Ransomware Microsoft

CVE-2020-0796 — Microsoft SMBv3 Remote Code Execution Vulnerability

A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests. An attacker who successfully exploited the vulnerability could gain the ability to execute code on the target server or client.

SMBv3 · Feb 10, 2022

Microsoft

CVE-2021-36934 — Microsoft Windows SAM Local Privilege Escalation Vulnerability

If a Volume Shadow Copy (VSS) shadow copy of the system drive is available, users can read the SAM file which would allow any user to escalate privileges to SYSTEM level.

Windows · Feb 10, 2022