CISA Known Exploited Vulnerabilities Directory

Explore every threat in the CISA Known Exploited Vulnerabilities (KEV) catalog, enhanced with plain-English executive analysis, AWS relevance, and technical remediation guidance.

Showing 1–10 of 17 records

CVE Vendor Product Added Due Status
CVE-2023-21529 — Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability
Microsoft Exchange Server contains a deserialization of untrusted data that allows an authenticated attacker to achieve remote code execution.
 Microsoft Exchange Server Apr 13, 2026 Apr 27, 2026 Ransomware
CVE-2021-31196 — Microsoft Exchange Server Information Disclosure Vulnerability
Microsoft Exchange Server contains an information disclosure vulnerability that allows for remote code execution.
 Microsoft Exchange Server Aug 21, 2024 Sep 11, 2024
CVE-2024-21410 — Microsoft Exchange Server Privilege Escalation Vulnerability
Microsoft Exchange Server contains an unspecified vulnerability that allows for privilege escalation.
 Microsoft Exchange Server Feb 15, 2024 Mar 7, 2024
CVE-2022-41080 — Microsoft Exchange Server Privilege Escalation Vulnerability
Microsoft Exchange Server contains an unspecified vulnerability that allows for privilege escalation. This vulnerability is chainable with CVE-2022-41082, which allows for remote code execution.
 Microsoft Exchange Server Jan 10, 2023 Jan 31, 2023 Ransomware
CVE-2022-41040 — Microsoft Exchange Server Server-Side Request Forgery Vulnerability
Microsoft Exchange Server allows for server-side request forgery. Dubbed "ProxyNotShell," this vulnerability is chainable with CVE-2022-41082 which allows for remote code execution.
 Microsoft Exchange Server Sep 30, 2022 Oct 21, 2022 Ransomware
CVE-2022-41082 — Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft Exchange Server contains an unspecified vulnerability that allows for authenticated remote code execution. Dubbed "ProxyNotShell," this vulnerability is chainable with CVE-2022-41040 which allows for the remote code execution.
 Microsoft Exchange Server Sep 30, 2022 Oct 21, 2022 Ransomware
CVE-2018-8581 — Microsoft Exchange Server Privilege Escalation Vulnerability
A privilege escalation vulnerability exists in Microsoft Exchange Server. An attacker who successfully exploited this vulnerability could attempt to impersonate any other user of the Exchange server.
 Microsoft Exchange Server Mar 3, 2022 Mar 17, 2022 Ransomware
CVE-2021-33766 — Microsoft Exchange Server Information Disclosure
Microsoft Exchange Server contains an information disclosure vulnerability which can allow an unauthenticated attacker to steal email traffic from target.
 Microsoft Exchange Server Jan 18, 2022 Feb 1, 2022
CVE-2020-0688 — Microsoft Exchange Server Validation Key Remote Code Execution Vulnerability
Microsoft Exchange Server Validation Key fails to properly create unique keys at install time, allowing for remote code execution.
 Microsoft Exchange Server Nov 3, 2021 May 3, 2022 Ransomware
CVE-2020-17144 — Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft Exchange Server improperly validates cmdlet arguments which allow an attacker to perform remote code execution.
 Microsoft Exchange Server Nov 3, 2021 May 3, 2022