Exploitation intelligence

Observed Exploitation Signals

Sensor-backed exploitation attempts against internet-facing services, mapped to CVEs and reviewed for confidence. See where attacker activity is concentrating before severity scores alone tell the story.

Browse feed RSS feed JSON API

KEVs Observed: 150; Known exploited vulnerabilities seen in the selected window
Exploitation Events: 91,473; Attempts mapped to tracked CVEs across the sensor network
Attacker IPs: —; Unique source addresses observed in the selected window

Exploitation Attempts

90-day activity, grouped by observation date · 21 May–19 Aug 2026 UTC

Exploitation Attempts

90-day activity, grouped by observation date

365

134

536

232

370

341

176

168

366

312

682

130

171

183

287

741

526

939

361

10,886

581

439

437

443

584

693

661

805

572

759

763

1,163

796

598

917

2,789

2,414

2,623

2,513

1,805

1,628

2,069

2,191

2,697

1,622

1,261

2,492

2,548

2,369

2,733

2,635

2,349

2,957

2,383

6,040

2,714

2,101

405

829

702

740

966

436

354

1,352

1,387

881

21 May 9 Jun 28 Jun 17 Jul 19 Aug

Click a day to filter stats and tables to that date.

Where Exploitation Activity Concentrated

The highest-volume CVEs in this snapshot, ranked by mapped exploitation attempts—not theoretical severity.

Inspect full KEV record

CVE-2017-9841 #1

PHPUnit

Attempts: 40,360
Attackers: —
Sensors: —

CVE-2026-10520 #2

Sentry

ivanti

Attempts: 8,162
Attackers: —
Sensors: —

CVE-2021-41773 #3

Apache HTTP Server

Apache Software Foundation

Attempts: 6,730
Attackers: —
Sensors: —

CVE-2022-47945 #4

ThinkPHP Framework

ThinkPHP

Attempts: 6,589
Attackers: —
Sensors: —

CVE-2018-20062 #5

NoneCms

Attempts: 3,834
Attackers: —
Sensors: —

CVE-2026-63030 #6

WordPress

Attempts: 2,908
Attackers: —
Sensors: —

Observed Exploitation Attempts

Search the highest-volume records in the selected window. Each row shows activity breadth and recency alongside raw volume.

How to Read the Signal

Attempts indicate volume. Unique IPs and sensors indicate breadth. First and last seen show persistence. Use the linked CVE record for evidence and remediation context.

CVE / Product	Attempts	Attacker IPs	First Seen	Last Seen
CVE-2017-9841 PHPUnit · PHPUnit	40,360	—	18 Jul · 16:46	19 Aug · 11:38
CVE-2026-10520 Sentry · ivanti	8,162	—	10 Jun · 09:03	19 Aug · 10:40
CVE-2021-41773 Apache HTTP Server · Apache Software Foundation	6,730	—	29 Jun · 11:05	19 Aug · 12:19
CVE-2022-47945 ThinkPHP Framework · ThinkPHP	6,589	—	08 Jun · 22:26	19 Aug · 10:40
CVE-2018-20062 NoneCms · NoneCms	3,834	—	05 Jul · 09:37	19 Aug · 10:40
CVE-2026-63030 WordPress · WordPress	2,908	—	19 Jul · 16:02	19 Aug · 03:46
CVE-2025-55182 react-server-dom-webpack, react-server-dom-turbopack, react-server-dom-parcel · Meta	2,297	—	09 Jun · 14:41	18 Aug · 16:54
CVE-2026-0770 Langflow · Langflow	2,038	—	27 Jun · 10:18	18 Aug · 16:54
CVE-2026-8037 LoadMaster, ECS Connections Manager, Object Scale Connection Manager, MOVEit WAF · Progress Software	1,638	—	30 Jun · 07:54	16 Aug · 10:43
CVE-2026-20230 Cisco Unified Communications Manager · Cisco	1,321	—	25 Jun · 02:30	30 Jul · 09:54
CVE-2026-20253 Splunk Enterprise · Splunk	1,260	—	12 Jun · 21:36	13 Aug · 14:33
CVE-2026-35273 PeopleSoft Enterprise PeopleTools · Oracle Corporation	1,066	—	14 Jun · 13:47	17 Aug · 04:40
CVE-2026-46817 Oracle Payments · Oracle Corporation	1,008	—	01 Jul · 01:33	09 Aug · 02:26
CVE-2026-9198 Langflow OSS · IBM	879	—	06 Jul · 14:26	19 Aug · 11:38
CVE-2026-39808 FortiSandbox, FortiSandbox PaaS · Fortinet	568	—	12 Jun · 13:59	15 Aug · 18:57
CVE-2022-41040 Microsoft Exchange Server 2013 Cumulative Update 23, Microsoft Exchange Server 2016 Cumulative Update 22, Microsoft Exchange Server 2019 Cumulative Update 11, Microsoft Exchange Server 2019 Cumulative Update 12, Microsoft Exchange Server 2016 Cumulative Update 23 · Microsoft	556	—	01 Jul · 03:59	17 Aug · 16:43
CVE-2026-4020 Gravity SMTP · RocketGenius	497	—	12 Jun · 00:35	18 Aug · 21:10
CVE-2024-12847 DGN1000 · NETGEAR	496	—	09 Jun · 10:18	18 Aug · 22:09
CVE-2026-15409 SMA1000 · SonicWall	479	—	17 Jul · 15:14	17 Aug · 10:09
CVE-2014-2383 dompdf · dompdf	460	—	27 Jun · 09:30	12 Aug · 12:02
CVE-2026-52813 gogs · gogs	395	—	26 Jun · 16:33	17 Aug · 12:12
CVE-2026-55040 Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, Microsoft SharePoint Server Subscription Edition · Microsoft	393	—	19 Jul · 02:09	18 Aug · 06:21
CVE-2017-18368 P660HN-T1A v1 TCLinux Fw · ZyXEL	374	—	09 Jun · 16:18	16 Aug · 05:37
CVE-2020-14882 WebLogic Server · Oracle Corporation	361	—	10 Jun · 21:20	18 Aug · 10:09
CVE-2018-10562 GPON home routers · Dasan	352	—	09 Jun · 01:20	19 Aug · 06:50
CVE-2024-37014 Langflow · langflow-ai	300	—	13 Jul · 04:36	13 Aug · 06:36
CVE-2025-61882 Oracle Concurrent Processing · Oracle Corporation	276	—	01 Jul · 01:33	01 Jul · 03:19
CVE-2026-48282 ColdFusion · Adobe	255	—	02 Jul · 16:52	17 Aug · 09:37
CVE-2020-5902 BIG-IP · F5	244	—	12 Jun · 00:32	17 Aug · 12:12
CVE-2018-13379 Fortinet FortiOS, FortiProxy · Fortinet	235	—	29 Jun · 18:59	18 Aug · 18:36
CVE-2022-46169 cacti · Cacti	233	—	10 Jul · 03:21	19 Aug · 09:48
CVE-2023-1389 TP-Link Archer AX21 (AX1800) · TP-Link	206	—	11 Jun · 06:25	18 Aug · 20:59
CVE-2026-16723 Fastjson · Alibaba	192	—	27 Jul · 01:37	27 Jul · 02:05
CVE-2020-3452 Cisco Adaptive Security Appliance (ASA) Software · Cisco	182	—	29 Jun · 18:59	19 Aug · 04:22
CVE-2017-10271 WebLogic Server · Oracle Corporation	176	—	12 Jun · 00:32	15 Aug · 01:54
CVE-2023-26801 BL-AC1900_2.0, BL-WR9000, BL-X26, BL-LTE300 · LB-LINK	171	—	25 Jun · 17:17	06 Aug · 08:11
CVE-2017-9822 DotNetNuke CMS Fixed in 9.1.1 · DotNetNuke	162	—	12 Jun · 00:32	23 Jul · 09:26
CVE-2025-71334 Flowise · Flowise	159	—	03 Jul · 09:04	15 Aug · 02:03
CVE-2024-20767 ColdFusion · Adobe	127	—	12 Jun · 00:33	18 Aug · 06:48
CVE-2025-1302 jsonpath-plus · JSONPath-Plus	126	—	12 Jun · 00:34	12 Aug · 21:48
CVE-2025-34037 E4200, E3200, E3000, E2500 v1/v2, E2100L v1, E2000, E1550, E1500 v1, E1200 v1, E1000 v1, E900 v1 · Linksys	116	—	07 Jul · 16:17	07 Aug · 09:50
CVE-2020-17518 Apache Flink · Apache Software Foundation	113	—	12 Jun · 00:32	23 Jul · 11:21
CVE-2023-20198 Cisco IOS XE Software · Cisco	111	—	12 Jun · 00:33	15 Aug · 14:46
CVE-2021-41277 metabase · metabase	102	—	30 Jun · 18:33	13 Aug · 20:51
CVE-2020-14883 WebLogic Server · Oracle Corporation	97	—	12 Jun · 00:32	18 Aug · 10:09
CVE-2024-8181 Flowise · FlowiseAI	91	—	12 Jun · 00:34	18 Aug · 05:38
CVE-2026-39813 FortiSandbox, FortiSandbox Cloud · Fortinet	90	—	15 Jun · 12:48	05 Aug · 03:48
CVE-2021-24212 WooCommerce Help Scout · Unknown	89	—	12 Jun · 00:32	30 Jul · 19:52
CVE-2013-3821 PeopleSoft Products · Oracle	87	—	14 Jul · 03:14	08 Aug · 10:30
CVE-2013-2251 Struts · Apache	83	—	11 Jul · 16:18	12 Aug · 12:02

CVE-2017-9841

PHPUnit

Attempts: 40,360
Attacker IPs: —

CVE-2026-10520

Sentry

ivanti

Attempts: 8,162
Attacker IPs: —

CVE-2021-41773

Apache HTTP Server

Apache Software Foundation

Attempts: 6,730
Attacker IPs: —

CVE-2022-47945

ThinkPHP Framework

ThinkPHP

Attempts: 6,589
Attacker IPs: —

CVE-2018-20062

NoneCms

Attempts: 3,834
Attacker IPs: —

CVE-2026-63030

WordPress

Attempts: 2,908
Attacker IPs: —

CVE-2025-55182

react-server-dom-webpack, react-server-dom-turbopack, react-server-dom-parcel

Get alerts on high-impact exploitation

Receive curator-selected alerts when exploitation activity warrants attention. Each alert includes the evidence and context needed to decide what requires attention now.