CISA KEV by vendor
Apache vulnerabilities in the CISA KEV catalogue
41 Apache entries in CISA's Known Exploited Vulnerabilities catalogue, 8 of them (20 percent) known to have been used in ransomware campaigns. First added 3 November 2021, latest 8 October 2026.
Data status: a source is stale
Last synced CISA catalogue version 2026.11.04 (released 4 November 2026) 1,768 entries Updated manually
41entries, 2.3% of the catalogue
8known ransomware use
0added in the last 7 days
0federal due dates in the next 14 days
Products
| Product, as CISA names it | Entries |
|---|---|
| Struts | 6 |
| Tomcat | 6 |
| HTTP Server | 4 |
| ActiveMQ | 3 |
| OFBiz | 3 |
| Log4j2 | 2 |
| Struts 1 | 2 |
| Solr | 2 |
| HugeGraph-Server | 1 |
| Flink | 1 |
| Superset | 1 |
| RocketMQ | 1 |
| Spark | 1 |
| CouchDB | 1 |
| APISIX | 1 |
| Kylin | 1 |
| Struts 2 | 1 |
| Airflow's Experimental API | 1 |
| Airflow | 1 |
| Apache | 1 |
| Shiro | 1 |
Latest additions
| CVE | Product | Added | Due | Ransomware | CVSS | EPSS | SSVC | Exposed asset window |
|---|---|---|---|---|---|---|---|---|
| CVE-2016-3081 | Struts | 2026-10-08 | 2026-10-11 passed | Unknown | 8.1 High | 96.5% | Not auto, total | 3 days + triage |
| CVE-2026-34486 | Tomcat | 2026-08-04 | 2026-08-07 | Unknown | 7.5 High | 98.5% | Auto, partial | 3 days |
| CVE-2026-34197 | ActiveMQ | 2026-04-16 | 2026-04-30 | Unknown | 8.8 High | 98.2% | Not auto, total | 3 days + triage |
| CVE-2024-38475 | HTTP Server | 2025-05-01 | 2025-05-22 | Unknown | 9.1 Critical | 99.9% | Auto, total | 3 days + triage |
| CVE-2025-24813 | Tomcat | 2025-04-01 | 2025-04-22 | Unknown | 9.8 Critical | 99.9% | Not auto, total | 3 days + triage |
| CVE-2024-45195 | OFBiz | 2025-02-04 | 2025-02-25 | Unknown | 7.5 High | 99.9% | Auto, total | 3 days + triage |
| CVE-2024-27348 | HugeGraph-Server | 2024-09-18 | 2024-10-09 | Unknown | 9.8 Critical | 99.2% | Auto, total | 3 days + triage |
| CVE-2024-38856 | OFBiz | 2024-08-27 | 2024-09-17 | Unknown | 9.8 Critical | 99.4% | Auto, total | 3 days + triage |
| CVE-2024-32113 | OFBiz | 2024-08-07 | 2024-08-28 | Unknown | 9.8 Critical | 99.9% | Auto, total | 3 days + triage |
| CVE-2020-17519 | Flink | 2024-05-23 | 2024-06-13 | Unknown | 7.5 High | 98.0% | Auto, partial | 3 days |
All 41 entries
| CVE | Product | Added | Due | Ransomware | CVSS | EPSS | SSVC | Exposed asset window |
|---|---|---|---|---|---|---|---|---|
| CVE-2016-3081 | Struts | 2026-10-08 | 2026-10-11 passed | Unknown | 8.1 High | 96.5% | Not auto, total | 3 days + triage |
| CVE-2026-34486 | Tomcat | 2026-08-04 | 2026-08-07 | Unknown | 7.5 High | 98.5% | Auto, partial | 3 days |
| CVE-2026-34197 | ActiveMQ | 2026-04-16 | 2026-04-30 | Unknown | 8.8 High | 98.2% | Not auto, total | 3 days + triage |
| CVE-2024-38475 | HTTP Server | 2025-05-01 | 2025-05-22 | Unknown | 9.1 Critical | 99.9% | Auto, total | 3 days + triage |
| CVE-2025-24813 | Tomcat | 2025-04-01 | 2025-04-22 | Unknown | 9.8 Critical | 99.9% | Not auto, total | 3 days + triage |
| CVE-2024-45195 | OFBiz | 2025-02-04 | 2025-02-25 | Unknown | 7.5 High | 99.9% | Auto, total | 3 days + triage |
| CVE-2024-27348 | HugeGraph-Server | 2024-09-18 | 2024-10-09 | Unknown | 9.8 Critical | 99.2% | Auto, total | 3 days + triage |
| CVE-2024-38856 | OFBiz | 2024-08-27 | 2024-09-17 | Unknown | 9.8 Critical | 99.4% | Auto, total | 3 days + triage |
| CVE-2024-32113 | OFBiz | 2024-08-07 | 2024-08-28 | Unknown | 9.8 Critical | 99.9% | Auto, total | 3 days + triage |
| CVE-2020-17519 | Flink | 2024-05-23 | 2024-06-13 | Unknown | 7.5 High | 98.0% | Auto, partial | 3 days |
| CVE-2023-27524 | Superset | 2024-01-08 | 2024-01-29 | Unknown | 9.8 Critical | 98.1% | Not auto, total | 3 days + triage |
| CVE-2023-46604 | ActiveMQ | 2023-11-02 | 2023-11-23 | Known | 9.8 Critical | 99.9% | Auto, total | 3 days + triage |
| CVE-2023-33246 | RocketMQ | 2023-09-06 | 2023-09-27 | Unknown | 9.8 Critical | 96.5% | Auto, total | 3 days + triage |
| CVE-2016-8735 | Tomcat | 2023-05-12 | 2023-06-02 | Unknown | 9.8 Critical | 90.3% | Auto, total | 3 days + triage |
| CVE-2021-45046 | Log4j2 | 2023-05-01 | 2023-05-22 | Known | 9.0 Critical | 99.9% | Not auto, total | 3 days + triage |
| CVE-2022-33891 | Spark | 2023-03-07 | 2023-03-28 | Unknown | 8.8 High | 93.2% | Not auto, total | 3 days + triage |
| CVE-2022-24706 | CouchDB | 2022-08-25 | 2022-09-15 | Unknown | 9.8 Critical | 92.5% | Auto, total | 3 days + triage |
| CVE-2022-24112 | APISIX | 2022-08-25 | 2022-09-15 | Unknown | 9.8 Critical | 96.0% | Auto, total | 3 days + triage |
| CVE-2020-1956 | Kylin | 2022-03-25 | 2022-04-15 | Unknown | 8.8 High | 97.3% | Not auto, total | 3 days + triage |
| CVE-2017-12617 | Tomcat | 2022-03-25 | 2022-04-15 | Unknown | 8.1 High | 99.9% | Not auto, total | 3 days + triage |
| CVE-2017-12615 | Tomcat | 2022-03-25 | 2022-04-15 | Known | 8.1 High | 99.7% | Not auto, total | 3 days + triage |
| CVE-2013-2251 | Struts | 2022-03-25 | 2022-04-15 | Unknown | 9.8 Critical | 99.9% | Auto, total | 3 days + triage |
| CVE-2020-1938 | Tomcat | 2022-03-03 | 2022-03-17 | Unknown | 9.8 Critical | 99.2% | Auto, total | 3 days + triage |
| CVE-2017-9791 | Struts 1 | 2022-02-10 | 2022-08-10 | Unknown | 9.8 Critical | 98.9% | Auto, total | 3 days + triage |
| CVE-2016-3088 | ActiveMQ | 2022-02-10 | 2022-08-10 | Unknown | 9.8 Critical | 98.5% | Auto, total | 3 days + triage |
| CVE-2012-0391 | Struts 2 | 2022-01-21 | 2022-07-21 | Unknown | 9.8 Critical | 75.5% | Auto, total | 3 days + triage |
| CVE-2006-1547 | Struts 1 | 2022-01-21 | 2022-07-21 | Unknown | 7.5 High | 54.6% | Auto, partial | 3 days |
| CVE-2020-13927 | Airflow's Experimental API | 2022-01-18 | 2022-07-18 | Unknown | 9.8 Critical | 99.7% | Auto, total | 3 days + triage |
| CVE-2020-11978 | Airflow | 2022-01-18 | 2022-07-18 | Unknown | 8.8 High | 99.1% | Not auto, total | 3 days + triage |
| CVE-2021-44228 | Log4j2 | 2021-12-10 | 2021-12-24 | Known | 10.0 Critical | 99.9% | Auto, total | 3 days + triage |
| CVE-2019-0193 | Solr | 2021-12-10 | 2022-06-10 | Unknown | 7.2 High | 83.5% | Not auto, total | 3 days + triage |
| CVE-2021-40438 | Apache | 2021-12-01 | 2021-12-15 | Known | 9.0 Critical | 99.9% | Auto, total | 3 days + triage |
| CVE-2021-42013 | HTTP Server | 2021-11-03 | 2021-11-17 | Known | 9.8 Critical | 99.9% | Auto, total | 3 days + triage |
| CVE-2021-41773 | HTTP Server | 2021-11-03 | 2021-11-17 | Known | 9.8 Critical | 99.9% | Auto, total | 3 days + triage |
| CVE-2020-17530 | Struts | 2021-11-03 | 2022-05-03 | Unknown | 9.8 Critical | 96.2% | Auto, total | 3 days + triage |
| CVE-2019-17558 | Solr | 2021-11-03 | 2022-05-03 | Unknown | 7.5 High | 98.5% | Not auto, total | 3 days + triage |
| CVE-2019-0211 | HTTP Server | 2021-11-03 | 2022-05-03 | Unknown | 7.8 High | 65.0% | Not auto, total | 3 days + triage |
| CVE-2018-11776 | Struts | 2021-11-03 | 2022-05-03 | Unknown | 8.1 High | 99.9% | Not auto, total | 3 days + triage |
| CVE-2017-9805 | Struts | 2021-11-03 | 2022-05-03 | Unknown | 8.1 High | 99.3% | Not auto, total | 3 days + triage |
| CVE-2017-5638 | Struts | 2021-11-03 | 2022-05-03 | Known | 9.8 Critical | 99.9% | Auto, total | 3 days + triage |
| CVE-2016-4437 | Shiro | 2021-11-03 | 2022-05-03 | Unknown | 9.8 Critical | 93.0% | Auto, total | 3 days + triage |
Due dates bind US federal civilian executive branch agencies only (BOD 26-04). Filter Apache in the tracker by date, score or status.
Source: CISA Known Exploited Vulnerabilities Catalog; NVD, FIRST EPSS and CISA SSVC for the scores. This product uses data from the NVD API but is not endorsed or certified by the NVD. CISA does not endorse Sysprobs.