Contacts
1207 Delaware Avenue, Suite 1228 Wilmington, DE 19806
Contact
Business Address: 1207 Delaware Avenue, Suite 1228 Wilmington, DE 19806
Contact
Contact

Zero-Day Tracker 2026: Actively Exploited Vulnerabilities

Last checked 2026-11-08 · Last verified 2026-11-08 · Last updated · Dataset 2026-11-08.894d63c3 · Download CSV · CC BY 4.0

This tracker lists 7 vulnerabilities exploited as zero-days in 2026 (latest: October 13, 2026). Each one is backed by the vendor's own statement that the flaw was exploited and was either stated in the release that shipped the fix or confirmed by CISA within a day of disclosure. 77 more were added to CISA's Known Exploited Vulnerabilities catalog within a day of disclosure and are being checked against the vendor's advisory; they are not counted.

Zero-days in 20267Vendor statement of exploitation + exploited at disclosure
Vendors4Microsoft (4), Cisco (1), Fortinet (1), Google (1)
3-day federal deadline57%4 of 2026 zero-days (CISA KEV)
Mean Score–Deadline Divergence-1.08Entries with a 3- to 14-day window (n=6)
Vendor-reported, not counted0"May have been exploited" and similar wording
Under verification77In KEV within a day of disclosure; vendor statement not yet read

Recently added

  • CVE-2026-96951 — Microsoft Windows
  • CVE-2026-32201 — Microsoft SharePoint Server

Zero-days exploited in 2026

First publicCVEVendor / productVulnerabilityVendor statementKEV addedFix windowCNA CVSSSDD
CVE-2026-96951MicrosoftWindowsMicrosoft Windows Command Injection VulnerabilityMicrosoft Security Update Guidemsrc.microsoft.com · read 2026-11-082026-10-133 d8.8-0.2
CVE-2026-20316CiscoSecure Firewall Management Center (FMC)Cisco Secure Firewall Management Center Use of Hard-coded Password VulnerabilityVendor advisory (read by Axis Research)sec.cloudapps.cisco.com · read 2026-08-092026-07-293 d5.3-3.7
CVE-2026-56164MicrosoftSharePoint ServerMicrosoft SharePoint Server Missing Authentication for Critical Function VulnerabilityVendor advisory (read by Axis Research)msrc.microsoft.com · read 2026-08-092026-07-143 d5.3-3.7
CVE-2026-56155MicrosoftActive Directory Federation ServicesMicrosoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability Vendor advisory (read by Axis Research)msrc.microsoft.com · read 2026-08-092026-07-1414 d7.8+0.8
CVE-2026-32201MicrosoftSharePoint ServerMicrosoft SharePoint Server Improper Input Validation VulnerabilityMicrosoft Security Update Guidemsrc.microsoft.com · read 2026-11-082026-04-1414 d6.5-0.5
CVE-2026-35616FortinetFortiClient EMSFortinet FortiClient EMS Improper Access Control VulnerabilityVendor advisory (read by Axis Research)fortiguard.fortinet.com · read 2026-08-092026-04-063 d9.8+0.8
CVE-2026-2441GoogleChromiumGoogle Chromium CSS Use-After-Free VulnerabilityVendor advisory (read by Axis Research)chromereleases.googleblog.com · read 2026-08-092026-02-1721 d——
Under verification (77)

CISA added these to the KEV catalog within a day of the CVE record's publication, which means exploitation was known at disclosure. They are counted only once the vendor's own advisory has been read and states exploitation.

  • CVE-2026-19868 — SonicWall SonicOS SSLVPN · CVE published 2026-11-06, added to KEV 2026-11-06
  • CVE-2026-118527 — Ivanti Connect Secure · CVE published 2026-11-03, added to KEV 2026-10-30
  • CVE-2026-76418 — Cisco Secure Firewall ASA Software and Cisco Secure FTD Software · CVE published 2026-10-28, added to KEV 2026-10-29
  • CVE-2026-114625 — Arista VeloCloud Orchestrator · CVE published 2026-10-22, added to KEV 2026-10-23
  • CVE-2026-102764 — BeyondTrust Remote Support · CVE published 2026-10-15, added to KEV 2026-10-16
  • CVE-2026-76519 — Cisco Secure Email Gateway · CVE published 2026-10-14, added to KEV 2026-10-14
  • CVE-2026-0322 — Palo Alto Networks PAN-OS · CVE published 2026-10-14, added to KEV 2026-10-14
  • CVE-2026-104935 — Ivanti Connect Secure · CVE published 2026-10-13, added to KEV 2026-10-13
  • CVE-2026-88779 — Citrix NetScaler · CVE published 2026-10-04, added to KEV 2026-10-04
  • CVE-2026-104286 — Fortinet FortiMail · CVE published 2026-10-01, added to KEV 2026-10-01
  • CVE-2026-76504 — Cisco Catalyst SD-WAN Manager · CVE published 2026-09-30, added to KEV 2026-09-30
  • CVE-2026-86950 — Apple Multiple Products · CVE published 2026-09-28, added to KEV 2026-09-29
  • CVE-2026-88772 — Citrix NetScaler · CVE published 2026-09-27, added to KEV 2026-09-27
  • CVE-2026-88771 — Citrix NetScaler · CVE published 2026-09-27, added to KEV 2026-09-27
  • CVE-2026-94127 — F5 BIG-IP APM · CVE published 2026-09-22, added to KEV 2026-09-22
  • CVE-2026-93952 — Arista VeloCloud Orchestrator · CVE published 2026-09-22, added to KEV 2026-09-22
  • CVE-2026-93616 — Check Point Multiple Products · CVE published 2026-09-22, added to KEV 2026-09-22
  • CVE-2026-87886 — Acronis Backup · CVE published 2026-09-17, added to KEV 2026-09-16
  • CVE-2026-76460 — Cisco Identity Services Engine · CVE published 2026-09-16, added to KEV 2026-09-16
  • CVE-2026-58704 — Google Pixel · CVE published 2026-09-15, added to KEV 2026-09-16
  • CVE-2026-76461 — Cisco Secure Email Gateway · CVE published 2026-09-14, added to KEV 2026-09-14
  • CVE-2026-85706 — GitLab Community Edition and Enterprise Edition · CVE published 2026-09-12, added to KEV 2026-09-11
  • CVE-2026-87491 — Google Chromium V8 · CVE published 2026-09-09, added to KEV 2026-09-09
  • CVE-2026-85880 — Microsoft Windows · CVE published 2026-09-08, added to KEV 2026-09-08
  • CVE-2026-81963 — Microsoft Windows · CVE published 2026-09-08, added to KEV 2026-09-08
  • CVE-2026-75650 — Adobe Commerce and Magento · CVE published 2026-09-07, added to KEV 2026-09-08
  • CVE-2026-85046 — Google Chromium V8 · CVE published 2026-09-03, added to KEV 2026-09-04
  • CVE-2026-83549 — SonicWall SMA1000 Appliances · CVE published 2026-09-01, added to KEV 2026-09-02
  • CVE-2026-83548 — SonicWall SMA1000 Appliances · CVE published 2026-09-01, added to KEV 2026-09-02
  • CVE-2026-60004 — Gitea Gitea · CVE published 2026-08-26, added to KEV 2026-08-25
  • CVE-2026-72530 — TrueConf Server · CVE published 2026-08-19, added to KEV 2026-08-20
  • CVE-2026-72529 — TrueConf Server · CVE published 2026-08-19, added to KEV 2026-08-20
  • CVE-2026-68820 — Microsoft Windows Ancillary Function Driver for WinSock · CVE published 2026-08-11, added to KEV 2026-08-11
  • CVE-2026-20349 — Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) · CVE published 2026-08-11, added to KEV 2026-08-11
  • CVE-2026-72898 — Metabase Metabase · CVE published 2026-08-10, added to KEV 2026-08-11
  • CVE-2026-18577 — N-able N-central · CVE published 2026-08-02, added to KEV 2026-08-03
  • CVE-2026-16812 — Arista VeloCloud Orchestrator · CVE published 2026-07-27, added to KEV 2026-07-27
  • CVE-2026-16232 — Check Point SmartConsole · CVE published 2026-07-22, added to KEV 2026-07-22
  • CVE-2026-15410 — SonicWall SMA1000 Appliances · CVE published 2026-07-14, added to KEV 2026-07-14
  • CVE-2026-15409 — SonicWall SMA1000 Appliances · CVE published 2026-07-14, added to KEV 2026-07-14
  • CVE-2026-56291 — Balbooa Forms · CVE published 2026-07-09, added to KEV 2026-07-10
  • CVE-2026-20262 — Cisco Catalyst SD-WAN Manager · CVE published 2026-06-15, added to KEV 2026-06-15
  • CVE-2026-54420 — LiteSpeed cPanel Plugin · CVE published 2026-06-14, added to KEV 2026-06-15
  • CVE-2026-35273 — Oracle PeopleSoft Enterprise PeopleTools · CVE published 2026-06-11, added to KEV 2026-06-12
  • CVE-2026-50751 — Check Point Security Gateway · CVE published 2026-06-08, added to KEV 2026-06-08
  • CVE-2026-11645 — Google Chromium V8 · CVE published 2026-06-08, added to KEV 2026-06-09
  • CVE-2026-28318 — SolarWinds Serv-U · CVE published 2026-06-04, added to KEV 2026-06-05
  • CVE-2025-48595 — Android Framework · CVE published 2026-06-01, added to KEV 2026-06-02
  • CVE-2026-48027 — Nx Nx Console · CVE published 2026-05-27, added to KEV 2026-05-27
  • CVE-2026-34926 — Trend Micro Apex One · CVE published 2026-05-21, added to KEV 2026-05-21
  • CVE-2026-45498 — Microsoft Defender · CVE published 2026-05-20, added to KEV 2026-05-20
  • CVE-2026-41091 — Microsoft Defender · CVE published 2026-05-20, added to KEV 2026-05-20
  • CVE-2026-42897 — Microsoft Microsoft · CVE published 2026-05-14, added to KEV 2026-05-15
  • CVE-2026-20182 — Cisco Catalyst SD-WAN · CVE published 2026-05-14, added to KEV 2026-05-14
  • CVE-2026-42208 — BerriAI LiteLLM · CVE published 2026-05-08, added to KEV 2026-05-08
  • CVE-2026-6973 — Ivanti Endpoint Manager Mobile (EPMM) · CVE published 2026-05-07, added to KEV 2026-05-07
  • CVE-2026-0300 — Palo Alto Networks PAN-OS · CVE published 2026-05-06, added to KEV 2026-05-06
  • CVE-2026-41940 — WebPros cPanel & WHM and WP2 (WordPress Squared) · CVE published 2026-04-29, added to KEV 2026-04-30
  • CVE-2026-32202 — Microsoft Windows · CVE published 2026-04-14, added to KEV 2026-04-28
  • CVE-2026-5281 — Google Dawn · CVE published 2026-04-01, added to KEV 2026-04-01
  • CVE-2026-3910 — Google Chromium V8 · CVE published 2026-03-12, added to KEV 2026-03-13
  • CVE-2026-3909 — Google Skia · CVE published 2026-03-12, added to KEV 2026-03-13
  • CVE-2026-21385 — Qualcomm Multiple Chipsets · CVE published 2026-03-02, added to KEV 2026-03-03
  • CVE-2026-20127 — Cisco Catalyst SD-WAN Controller and Manager · CVE published 2026-02-25, added to KEV 2026-02-25
  • CVE-2026-22769 — Dell RecoverPoint for Virtual Machines (RP4VMs) · CVE published 2026-02-17, added to KEV 2026-02-18
  • CVE-2026-20700 — Apple Multiple Products · CVE published 2026-02-11, added to KEV 2026-02-12
  • CVE-2026-21533 — Microsoft Windows · CVE published 2026-02-10, added to KEV 2026-02-10
  • CVE-2026-21525 — Microsoft Windows · CVE published 2026-02-10, added to KEV 2026-02-10
  • CVE-2026-21519 — Microsoft Windows · CVE published 2026-02-10, added to KEV 2026-02-10
  • CVE-2026-21514 — Microsoft Office · CVE published 2026-02-10, added to KEV 2026-02-10
  • CVE-2026-21513 — Microsoft Windows · CVE published 2026-02-10, added to KEV 2026-02-10
  • CVE-2026-21510 — Microsoft Windows · CVE published 2026-02-10, added to KEV 2026-02-10
  • CVE-2026-1281 — Ivanti Endpoint Manager Mobile (EPMM) · CVE published 2026-01-29, added to KEV 2026-01-29
  • CVE-2026-24858 — Fortinet Multiple Products · CVE published 2026-01-27, added to KEV 2026-01-27
  • CVE-2026-21509 — Microsoft Office · CVE published 2026-01-26, added to KEV 2026-01-26
  • CVE-2026-20045 — Cisco Unified Communications Manager · CVE published 2026-01-21, added to KEV 2026-01-21
  • CVE-2026-20805 — Microsoft Windows · CVE published 2026-01-13, added to KEV 2026-01-13

What counts. A vulnerability counts when the vendor's own document states that it was exploited, and that statement was made in the release that shipped the fix, or CISA confirmed exploitation within one day of the CVE record's publication. A high CVSS score, a proof-of-concept or exploitation that starts after the patch does not count.

Score–Deadline Divergence (SDD). SDD = CNA CVSS v3.1 base score − Deadline-Implied Severity, where the KEV remediation window maps to 9.0 (≤3 days), 8.0 (4–7), 7.0 (8–14) or 6.0 (15–21). The headline mean covers entries with a window of 14 days or less; entries with the earlier 21-day window are averaged separately (none with a CNA score yet). It is an Axis calculation; every value can be recomputed from the CSV.

Sources. CISA Known Exploited Vulnerabilities catalog; CVE Program records (CNA scores, CISA SSVC); vendor documents: Microsoft Security Update Guide (CVRF API), Chrome Releases, Apple security releases, Android Security Bulletins, Mozilla Security Advisories, and the vendor advisory cited in each KEV entry. Vendor pages are named but not linked where our outbound-link policy does not allow it.

Axis Intelligence Research

Stay ahead on tech & data

Get notified when we publish or update datasets, trackers, research, and reports across technology, business, AI, cybersecurity, finance, infrastructure, energy, and more.

Research updates only. No spam. Unsubscribe anytime.