Vendor

Apache

As of 6 October 2026, 40 Apache vulnerabilities are on CISA's list of exploited vulnerabilities, 8 of them used in ransomware campaigns; 2 were added in 2026. Patch first: CVE-2020-17519.

Patch first

Patch first
#	Vulnerability	Product	Our group	Listed	Deadline	EPSS
1	CVE-2020-17519Improper Access Control	Apache Flink	Patch this weekMetasploit module; EPSS 0.98; verified Exploit-DB entry	2024-05-23	2024-06-13	0.98	2024-05-23 · due 2024-06-13
2	CVE-2013-2251Improper Input Validation	Apache Struts	Patch this weekMetasploit module; EPSS 0.99; verified Exploit-DB entry	2022-03-25	2022-04-15	0.99	2022-03-25 · due 2022-04-15
3	CVE-2017-12617Remote Code Execution	Apache Tomcat	Patch this weekMetasploit module; EPSS 0.99; verified Exploit-DB entry	2022-03-25	2022-04-15	0.99	2022-03-25 · due 2022-04-15
4	CVE-2020-1938Improper Privilege Management	Apache Tomcat	Patch this weekMetasploit module; EPSS 0.99; verified Exploit-DB entry	2022-03-03	2022-03-17	0.99	2022-03-03 · due 2022-03-17
5	CVE-2016-3088Improper Input Validation	Apache ActiveMQ	Patch this weekMetasploit module; EPSS 0.99; verified Exploit-DB entry	2022-02-10	2022-08-10	0.99	2022-02-10 · due 2022-08-10
6	CVE-2017-9791Improper Input Validation	Apache Struts 1	Patch this weekMetasploit module; EPSS 0.99; verified Exploit-DB entry	2022-02-10	2022-08-10	0.99	2022-02-10 · due 2022-08-10
7	CVE-2012-0391Improper Input Validation	Apache Struts 2	Patch this weekMetasploit module; EPSS 0.76; verified Exploit-DB entry	2022-01-21	2022-07-21	0.76	2022-01-21 · due 2022-07-21
8	CVE-2016-4437Code Execution	Apache Shiro	Patch this weekMetasploit module; EPSS 0.93; verified Exploit-DB entry	2021-11-03	2022-05-03	0.93	2021-11-03 · due 2022-05-03
9	CVE-2017-5638Remote Code Execution	Apache Struts	Patch this weekRansomware use; Metasploit module; EPSS 0.99; verified Exploit-DB entry	2021-11-03	2022-05-03	0.99	2021-11-03 · due 2022-05-03
10	CVE-2018-11776Remote Code Execution	Apache Struts	Patch this weekMetasploit module; EPSS 0.99; verified Exploit-DB entry	2021-11-03	2022-05-03	0.99	2021-11-03 · due 2022-05-03
11	CVE-2019-17558VelocityResponseWriter Plug-In Remote Code Execution	Apache Solr	Patch this weekMetasploit module; EPSS 0.99; verified Exploit-DB entry	2021-11-03	2022-05-03	0.99	2021-11-03 · due 2022-05-03
12	CVE-2021-41773Path Traversal	Apache HTTP Server	Patch this weekRansomware use; Metasploit module; EPSS 0.99; verified Exploit-DB entry	2021-11-03	2021-11-17	0.99	2021-11-03 · due 2021-11-17
13	CVE-2021-42013Path Traversal	Apache HTTP Server	Patch this weekRansomware use; Metasploit module; EPSS 0.99; verified Exploit-DB entry	2021-11-03	2021-11-17	0.99	2021-11-03 · due 2021-11-17
14	CVE-2025-24813Path Equivalence	Apache Tomcat	Patch this weekMetasploit module; EPSS 0.99	2025-04-01	2025-04-22	0.99	2025-04-01 · due 2025-04-22
15	CVE-2024-27348Improper Access Control	Apache HugeGraph-Server	Patch this weekMetasploit module; EPSS 0.99	2024-09-18	2024-10-09	0.99	2024-09-18 · due 2024-10-09
16	CVE-2024-38856Incorrect Authorization	Apache OFBiz	Patch this weekMetasploit module; EPSS 0.99	2024-08-27	2024-09-17	0.99	2024-08-27 · due 2024-09-17
17	CVE-2024-32113Path Traversal	Apache OFBiz	Patch this weekMetasploit module; EPSS 0.99	2024-08-07	2024-08-28	0.99	2024-08-07 · due 2024-08-28
18	CVE-2023-27524Insecure Default Initialization of Resource	Apache Superset	Patch this weekMetasploit module; EPSS 0.97	2024-01-08	2024-01-29	0.97	2024-01-08 · due 2024-01-29
19	CVE-2023-46604Deserialization of Untrusted Data	Apache ActiveMQ	Patch this weekRansomware use; Metasploit module; EPSS 0.99	2023-11-02	2023-11-23	0.99	2023-11-02 · due 2023-11-23
20	CVE-2023-33246Command Execution	Apache RocketMQ	Patch this weekMetasploit module; EPSS 0.97	2023-09-06	2023-09-27	0.97	2023-09-06 · due 2023-09-27
21	CVE-2021-45046Deserialization of Untrusted Data	Apache Log4j2	Patch this weekRansomware use; Metasploit module; EPSS 0.99	2023-05-01	2023-05-22	0.99	2023-05-01 · due 2023-05-22
22	CVE-2022-33891Command Injection	Apache Spark	Patch this weekMetasploit module; EPSS 0.93	2023-03-07	2023-03-28	0.93	2023-03-07 · due 2023-03-28
23	CVE-2022-24112Authentication Bypass	Apache APISIX	Patch this weekMetasploit module; EPSS 0.96	2022-08-25	2022-09-15	0.96	2022-08-25 · due 2022-09-15
24	CVE-2022-24706Insecure Default Initialization of Resource	Apache CouchDB	Patch this weekMetasploit module; EPSS 0.93	2022-08-25	2022-09-15	0.93	2022-08-25 · due 2022-09-15
25	CVE-2020-11978Command Injection	Apache Airflow	Patch this weekMetasploit module; EPSS 0.99	2022-01-18	2022-07-18	0.99	2022-01-18 · due 2022-07-18

The next 15, from number 26

Products

Tomcat6 entries
Struts5 entries
HTTP Server4 entries
ActiveMQ3 entries
OFBiz3 entries
Log4j22 entries
Solr2 entries
Struts 12 entries
Airflow1 entry
Airflow's Experimental API1 entry
Apache1 entry
APISIX1 entry
CouchDB1 entry
Flink1 entry
HugeGraph-Server1 entry
Kylin1 entry
RocketMQ1 entry
Shiro1 entry
Spark1 entry
Struts 21 entry
Superset1 entry

Added each year

Entries CISA added each year, removed ones included. Source: CISA KEV.

Show the numbers

Period	entries added
2021	12
2022	13
2023	5
2024	5
2025	3
2026	2

Used in ransomware

Changes CISA made to these entries

2026-08-06
CVE-2026-34486 Apache TomcatEdited: description.
2026-08-06
CVE-2025-24813 Apache TomcatEdited: description.
2026-07-23
CVE-2021-40438 ApacheRansomware use: Unknown to Known.
2025-05-01
CVE-2025-24813 Apache TomcatEdited: notes.
2025-05-01
CVE-2024-45195 Apache OFBizEdited: notes.
2025-05-01
CVE-2024-27348 Apache HugeGraph-ServerEdited: notes.
2025-03-18
CVE-2024-45195 Apache OFBizEdited: notes.

Every change we recorded