CISA Known Exploited Vulnerabilities
KEV additions — July 2024
13 CVEs entered the KEV catalog in July 2024.
Added July 30, 20241
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2024-37085ransomware | VMware ESXi Authentication Bypass Vulnerability | 7.2 | 72.5 % | August 20, 2024 |
Added July 29, 20243
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2023-45249 | Acronis Cyber Infrastructure (ACI) Insecure Default Password Vulnerability | 9.8 | 93.2 % | August 19, 2024 |
| CVE-2024-4879 | ServiceNow Improper Input Validation Vulnerability | 9.8 | 94.3 % | August 19, 2024 |
| CVE-2024-5217 | ServiceNow Incomplete List of Disallowed Inputs Vulnerability | 9.8 | 94.1 % | August 19, 2024 |
Added July 23, 20241
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2024-39891 | Twilio Authy Information Disclosure Vulnerability | 5.3 | 29.6 % | August 13, 2024 |
Added July 17, 20243
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2022-22948 | VMware vCenter Server Incorrect Default File Permissions Vulnerability | 6.5 | 13.9 % | August 7, 2024 |
| CVE-2024-28995 | SolarWinds Serv-U Path Traversal Vulnerability | 7.5 | 94.4 % | August 7, 2024 |
| CVE-2024-34102 | Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE) Vulnerability | 9.8 | 94.1 % | August 7, 2024 |
Added July 15, 20241
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2024-36401 | OSGeo GeoServer GeoTools Eval Injection Vulnerability | 9.8 | 94.4 % | August 5, 2024 |
Added July 9, 20243
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2024-23692 | Rejetto HTTP File Server 2.3m Unauthenticated RCE | 9.8 | 94.3 % | July 30, 2024 |
| CVE-2024-38080 | Microsoft Windows Hyper-V Privilege Escalation Vulnerability | 7.8 | 14.0 % | July 30, 2024 |
| CVE-2024-38112 | Microsoft Windows MSHTML Platform Spoofing Vulnerability | 7.5 | 92.7 % | July 30, 2024 |
Added July 2, 20241
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2024-20399 | Cisco NX-OS Command Injection Vulnerability | 6.7 | 0.6 % | July 23, 2024 |