CVE-20XX-?
agent?

Being exploited right now.

CVEs that CISA lists as exploited in real attacks, newest additions first.

43 CVEs · updated 2026-11-12 23:55 UTC

Reset all
  1. CVE-2026-65400

    An authentication issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, macOS Tahoe 26.6.1, macOS Tahoe 26.7. An attacker on the network may be able to authenticate to Screen Sharing without valid credentials.

    Drop everything exploited Auth & access OS & kernel Apple macOS

    9.8 CRITICAL 18% exploit odds Fix listed
  2. CVE-2025-33073

    Improper access control in Windows SMB allows an authorized attacker to elevate privileges over a network.

    exploited Auth & access OS & kernel Microsoft Windows 10 1507

    8.8 HIGH 83% exploit odds Fix listed
  3. CVE-2014-1812

    The Group Policy implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 does not properly handle distribution of passwords, which allows remote authenticated users to obtain sensitive credential information and consequently gain privileges by leveraging access to the SYSVOL share, as exploited in the wild in May 2014, aka "Group Policy Preferences Password Elevation of Privilege Vulnerability."

    exploited Auth & access OS & kernel Microsoft Windows 7

    8.8 HIGH 65% exploit odds Fix listed
  4. CVE-2021-42287

    Active Directory Domain Services Elevation of Privilege Vulnerability

    exploited Auth & access OS & kernel Microsoft Windows Server 2004

    7.5 HIGH 77% exploit odds Fix listed
  5. CVE-2021-42278

    Active Directory Domain Services Elevation of Privilege Vulnerability

    exploited Auth & access OS & kernel Microsoft Windows Server 2004

    7.5 HIGH 73% exploit odds Fix listed
  6. CVE-2016-0151

    The Client-Server Run-time Subsystem (CSRSS) in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 mismanages process tokens, which allows local users to gain privileges via a crafted application, aka "Windows CSRSS Security Feature Bypass Vulnerability."

    exploited Auth & access OS & kernel Microsoft Windows 10 1507

    7.8 HIGH 63% exploit odds Fix listed
  7. CVE-2019-11634

    Citrix Workspace App before 1904 for Windows has Incorrect Access Control.

    exploited Auth & access OS & kernel Citrix Receiver

    9.8 CRITICAL 8% exploit odds Fix listed
  8. CVE-2023-36874

    Windows Error Reporting Service Elevation of Privilege Vulnerability

    exploited Auth & access OS & kernel Microsoft Windows 10 1507

    7.8 HIGH 44% exploit odds Fix listed
  9. CVE-2024-49039

    Windows Task Scheduler Elevation of Privilege Vulnerability

    exploited Auth & access OS & kernel Microsoft Windows 10 1507

    8.8 HIGH 14% exploit odds Fix listed
  10. CVE-2019-1405

    An elevation of privilege vulnerability exists when the Windows Universal Plug and Play (UPnP) service improperly allows COM object creation, aka 'Windows UPnP Service Elevation of Privilege Vulnerability'.

    exploited Auth & access OS & kernel Microsoft Windows 10 1507

    7.8 HIGH 30% exploit odds Fix listed
  11. CVE-2021-36948

    Windows Update Medic Service Elevation of Privilege Vulnerability

    exploited Auth & access OS & kernel Microsoft Windows 10 1809

    7.8 HIGH 23% exploit odds Fix listed
  12. CVE-2021-34484

    Windows User Profile Service Elevation of Privilege Vulnerability

    exploited Auth & access OS & kernel Microsoft Windows 10 1507

    7.8 HIGH 22% exploit odds Fix listed
  13. CVE-2019-1215

    An elevation of privilege vulnerability exists in the way that ws2ifsl.sys (Winsock) handles objects in memory, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1253, CVE-2019-1278, CVE-2019-1303.

    exploited Auth & access OS & kernel Microsoft Windows 10 1507

    7.8 HIGH 19% exploit odds Fix listed
  14. CVE-2019-1322

    An elevation of privilege vulnerability exists when Windows improperly handles authentication requests, aka 'Microsoft Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1320, CVE-2019-1340.

    exploited Auth & access OS & kernel Microsoft Windows 10 1803

    7.8 HIGH 19% exploit odds Fix listed
  15. CVE-2022-22718

    Windows Print Spooler Elevation of Privilege Vulnerability

    exploited Auth & access OS & kernel Microsoft Windows 10 1507

    7.8 HIGH 18% exploit odds Fix listed
  16. CVE-2022-26925

    Windows LSA Spoofing Vulnerability

    exploited Auth & access OS & kernel Microsoft Windows 10 1507

    8.1 HIGH 10% exploit odds Fix listed
  17. CVE-2022-38028

    Windows Print Spooler Elevation of Privilege Vulnerability

    exploited Auth & access OS & kernel Microsoft Windows 10 1507

    7.8 HIGH 15% exploit odds Fix listed
  18. CVE-2023-41992

    The issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.7, iOS 16.7 and iPadOS 16.7, macOS Ventura 13.6. A local attacker may be able to elevate their privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.

    exploited Auth & access OS & kernel Apple Ipados

    7.8 HIGH 12% exploit odds Fix listed
  19. CVE-2021-30657

    A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.3, Security Update 2021-002 Catalina. A malicious application may bypass Gatekeeper checks. Apple is aware of a report that this issue may have been actively exploited..

    exploited Auth & access OS & kernel Apple Mac Os X

    5.5 MEDIUM 69% exploit odds Fix listed
  20. CVE-2015-1130

    The XPC implementation in Admin Framework in Apple OS X before 10.10.3 allows local users to bypass authentication and obtain admin privileges via unspecified vectors.

    exploited Auth & access OS & kernel Apple Mac Os X

    7.8 HIGH 10% exploit odds Fix listed
  21. CVE-2019-1388

    An elevation of privilege vulnerability exists in the Windows Certificate Dialog when it does not properly enforce user privileges, aka 'Windows Certificate Dialog Elevation of Privilege Vulnerability'.

    exploited Auth & access OS & kernel Microsoft Windows 10 1507

    7.8 HIGH 9% exploit odds Fix listed
  22. CVE-2021-30713

    A permissions issue was addressed with improved validation. This issue is fixed in macOS Big Sur 11.4. A malicious application may be able to bypass Privacy preferences. Apple is aware of a report that this issue may have been actively exploited..

    exploited Auth & access OS & kernel Apple Mac Os X

    7.8 HIGH 7% exploit odds Fix listed
  23. CVE-2026-33825

    Insufficient granularity of access control in Microsoft Defender allows an authorized attacker to elevate privileges locally.

    exploited Auth & access OS & kernel Microsoft Defender Antimalware Platform

    7.8 HIGH 7% exploit odds Fix listed
  24. CVE-2024-38014

    Windows Installer Elevation of Privilege Vulnerability

    exploited Auth & access OS & kernel Microsoft Windows 10 1507

    7.8 HIGH 6% exploit odds Fix listed
  25. CVE-2022-0492

    A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly.

    exploited Auth & access OS & kernel Netapp h300s Firmware

    7.8 HIGH 6% exploit odds Fix listed
  26. CVE-2002-0367

    smss.exe debugging subsystem in Windows NT and Windows 2000 does not properly authenticate programs that connect to other programs, which allows local users to gain administrator or SYSTEM privileges by duplicating a handle to a privileged process, as demonstrated by DebPloit.

    exploited Auth & access OS & kernel Microsoft Windows 2000

    7.8 HIGH 5% exploit odds Fix listed
  27. CVE-2019-0543

    An elevation of privilege vulnerability exists when Windows improperly handles authentication requests, aka "Microsoft Windows Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.

    exploited Auth & access OS & kernel Microsoft Windows 10 1507

    7.8 HIGH 5% exploit odds Fix listed
  28. CVE-2026-21533

    Improper privilege management in Windows Remote Desktop allows an authorized attacker to elevate privileges locally.

    exploited Auth & access OS & kernel Microsoft Windows 10 1607

    7.8 HIGH 4% exploit odds Fix listed
  29. CVE-2024-26169

    Windows Error Reporting Service Elevation of Privilege Vulnerability

    exploited Auth & access OS & kernel Microsoft Windows 10 1507

    7.8 HIGH 4% exploit odds Fix listed
  30. CVE-2019-1385

    An elevation of privilege vulnerability exists when the Windows AppX Deployment Extensions improperly performs privilege management, resulting in access to system files.To exploit this vulnerability, an authenticated attacker would need to run a specially crafted application to elevate privileges.The security update addresses the vulnerability by correcting how AppX Deployment Extensions manages privileges., aka 'Windows AppX Deployment Extensions Elevation of Privilege Vulnerability'.

    exploited Auth & access OS & kernel Microsoft Windows 10 1709

    7.8 HIGH 4% exploit odds Fix listed
  31. CVE-2025-59230

    Improper access control in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally.

    exploited Auth & access OS & kernel Microsoft Windows 10 1507

    7.8 HIGH 3% exploit odds Fix listed
  32. CVE-2020-24557

    A vulnerability in Trend Micro Apex One and Worry-Free Business Security 10.0 SP1 on Microsoft Windows may allow an attacker to manipulate a particular product folder to disable the security temporarily, abuse a specific Windows function and attain privilege escalation. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. Please note that version 1909 (OS Build 18363.719) of Microsoft Windows 10 mitigates hard links, but previous versions are affected.

    exploited Auth & access OS & kernel Trendmicro Apex One

    7.8 HIGH 3% exploit odds Fix listed
  33. CVE-2022-41033

    Windows COM+ Event System Service Elevation of Privilege Vulnerability

    exploited Auth & access OS & kernel Microsoft Windows 10 1507

    7.8 HIGH 2% exploit odds Fix listed
  34. CVE-2024-37085

    VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was previously configured to use AD for user management https://blogs.vmware.com/vsphere/2012/09/joining-vsphere-hosts-to-active-directory.html by re-creating the configured AD group ('ESXi Admins' by default) after it was deleted from AD.

    exploited Auth & access OS & kernel VMware Cloud Foundation

    6.8 MEDIUM 27% exploit odds Fix listed
  35. CVE-2026-56155

    Insufficient granularity of access control in Active Directory Federation Services (AD FS) allows an authorized attacker to elevate privileges locally.

    exploited Auth & access OS & kernel Microsoft Windows 10 1607

    7.8 HIGH 0.3% exploit odds Fix listed
  36. CVE-2022-26904

    Windows User Profile Service Elevation of Privilege Vulnerability

    exploited Auth & access OS & kernel Microsoft Windows 10 1507

    7.0 HIGH 17% exploit odds Fix listed
  37. CVE-2023-24880

    Windows SmartScreen Security Feature Bypass Vulnerability

    exploited Auth & access OS & kernel Microsoft Windows 10 1607

    4.4 MEDIUM 78% exploit odds Fix listed
  38. CVE-2022-21919

    Windows User Profile Service Elevation of Privilege Vulnerability

    exploited Auth & access OS & kernel Microsoft Windows 10 1507

    7.0 HIGH 3% exploit odds Fix listed
  39. CVE-2022-48618

    The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.1, watchOS 9.2, iOS 16.2 and iPadOS 16.2, tvOS 16.2. An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication. Apple is aware of a report that this issue may have been exploited against versions of iOS released before iOS 15.7.1.

    exploited Auth & access OS & kernel Apple Ipados

    7.0 HIGH 0.5% exploit odds Fix listed
  40. CVE-2022-41091

    Windows Mark of the Web Security Feature Bypass Vulnerability

    exploited Auth & access OS & kernel Microsoft Windows 10 1507

    5.4 MEDIUM 2% exploit odds Fix listed
  41. CVE-2024-8068

    Privilege escalation to NetworkService Account access in Citrix Session Recording when an attacker is an authenticated user in the same Windows Active Directory domain as the session recording server domain

    exploited Auth & access OS & kernel Citrix Session Recording

    5.1 MEDIUM 3% exploit odds Fix listed
  42. CVE-2021-25337

    Improper access control in clipboard service in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows untrusted applications to read or write certain local files.

    exploited Auth & access OS & kernel Samsung Android

    4.4 MEDIUM 3% exploit odds Fix listed
  43. CVE-2023-20867

    A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine.

    exploited Auth & access OS & kernel VMware Tools

    3.9 LOW 14% exploit odds Fix listed

These CVEs appear in CISA's Known Exploited Vulnerabilities (KEV) catalog, which means attackers are using them in real attacks. Each entry shows severity, exploit odds, fix status and a timeline.