KEV 2020

Zimbra Collaboration Suite — Server-Side Request Forgery via the WebEx Zimlet's JSP Proxy

Sophos XG Firewall — Unauthenticated RCE via HTTP/S Bookmark Buffer Overflow

Sophos CyberoamOS WebAdmin — Unauthenticated SQL Injection Enables Arbitrary Database Manipulation; EOL Product with No Patch, Added to KEV February 2025

Oracle WebLogic Server — Unauthenticated RCE via IIOP/T3 Java Deserialization

DrayTek Vigor Routers — Unauthenticated OS Command Injection via File Upload

Oracle WebLogic — Unauthenticated RCE via Java Deserialization over T3/IIOP Protocols; July 2020 CPU, Added to KEV September 2024 After Continued Exploitation

Oracle WebLogic Server — Unauthenticated Takeover via IIOP, Reverse-Engineered From the Patch Within Days

Roundcube Webmail — RCE via Shell Metacharacters in ImageMagick Path Configuration

QNAP QTS and QuTS hero — Unauthenticated Command Injection in NAS Management Interface Enables Remote Code Execution as Root; Mass-Exploited by Ransomware and Botnets

Palo Alto PAN-OS — SAML Authentication Bypass, CVSS 10.0 Perfect Score

Sophos SG UTM WebAdmin — Unauthenticated OS Command Injection in WebAdmin Interface Enables Remote Code Execution on Unified Threat Management Appliance

OpenSMTPD — Qualys-Found Root RCE via smtp_mailaddr(), Mass-Exploited Within 24 Hours

Zyxel NAS Devices — Pre-Auth Root Command Injection, Weaponized by the Mukashi Mirai Variant Within Days

SonicWall SonicOS VPN Portal — Stack Buffer Overflow in HTTP/HTTPS Request Handling Enables Unauthenticated Remote Code Execution or DoS; Affects Thousands of Internet-Facing Firewalls

Apache Tomcat — "Ghostcat": File Read/Inclusion via the Overtrusted AJP Connector

Microsoft SMBv3 — "SMBGhost": Wormable Pre-Auth RCE via SMBv3.1.1 Compression, Leaked Before Its Patch Shipped

Grandstream UCM6200 IP PBX — Unauthenticated SQL Injection Leading to Root RCE

Apache Airflow Experimental API — Missing Authentication on /api/experimental Endpoints Allows Unauthenticated DAG Trigger and Arbitrary Code Execution on Workers

FUEL CMS — Unauthenticated SQL Injection via 'col' Parameter in Admin Panel Items Endpoints Enables Database Extraction and Potentially Remote Code Execution

SIGRed — Windows DNS Server Integer Overflow in SIG Record Parsing Enables Unauthenticated Wormable RCE; CVSS 10.0, CISA Emergency Directive ED 20-03

Oracle Solaris — Out-of-Bounds Write in PAM Authentication Framework Enables Unauthenticated Remote Code Execution via SunSSH; CVSS 10.0, Exploited by UNC1945 Against Financial Sector

WordPress File Manager Plugin (elFinder) — Unauthenticated File Upload via Exposed Connector Enables PHP Code Execution; 300,000+ Sites Targeted Within Hours of Disclosure

SAP NetWeaver AS Java — RECON: Unauthenticated Access to LM Config Wizard Enables Admin User Creation; CVSS 10.0, Affects 40,000+ SAP Systems, NSA/CISA Joint Alert

Microsoft .NET Framework — Remote Code Execution via Improper Input Validation, Patched January 2020

SolarWinds Orion API — Authentication Bypass via URL Path Parameter Manipulation Enables Unauthenticated API Command Execution; Disclosed During SUNBURST Supply Chain Crisis

Sumavision Enhanced Multimedia Router (EMR) — Unauthenticated Admin Account Creation via Cross-Site Request Forgery

Zoho ManageEngine Desktop Central — Unauthenticated Deserialization RCE, Exploited by APT41 Within Weeks

Tenda AC15 — OS Command Injection via deviceName POST Parameter in SetOnlineDevName Enables Unauthenticated Remote Code Execution; No Patch Available

SaltStack Salt — Unauthenticated Access to ClearFuncs Yields Root on All Minions

Sophos XG Firewall SFOS — Zero-Day SQL Injection Exploited by Chinese APT Before Patch

FortiOS SSL-VPN — Case-Sensitivity Bypass Allows MFA Skip When Username Case Is Changed; Exploited by Ransomware Groups Targeting FortiGate Devices

Oracle WebLogic — Unauthenticated RCE via Console Authentication Bypass; Emergency Patch for Incomplete Fix of CVE-2020-14882, Mass-Exploited Within Days of Disclosure

Oracle WebLogic — Unauthenticated Console Authentication Bypass via Path Traversal Enables Admin Panel Access; Mass-Exploited Within 48 Hours, Chained with CVE-2020-14883 for Code Execution

MobileIron Core / Sentry / Connector — Unauthenticated RCE via Apache/Tomcat ACL Bypass and Hessian Java Deserialization

SaltStack Salt — Unauthenticated RCE via Salt API SSH Client

vBulletin — Unauthenticated RCE via Crafted subWidgets Data in Widget Render Endpoint; Bypass of Incomplete CVE-2019-16759 Patch, Exploited Within Hours of Disclosure

Apache Struts S2-061 — Forced OGNL Evaluation in Tag Attributes Enables Unauthenticated Remote Code Execution; Bypass of S2-059 Fix in Struts 2.5.26

D-Link DNS-320 NAS — Unauthenticated OS Command Injection in system_mgr.cgi Enables Remote Code Execution; No Patch Available for End-of-Life Device

Oracle Coherence — Unauthenticated Deserialization RCE via T3, Reaching Products That Bundle It as a Hidden Dependency

NETGEAR JGS516PE ProSAFE Plus — Unauthenticated Access to Switch Management Functions via Missing Access Control; Enables Full Switch Takeover and Network Manipulation

D-Link DIR-825 R1 Router — Buffer Overflow in Web Interface Enables Unauthenticated Remote Code Execution; No Patch Available for Revision 1 Hardware

Zyxel Firewalls and AP Controllers — Hardcoded 'zyfwp' Admin Account with Fixed Password Enables Unauthenticated Network Takeover; Discovered by Eye Control

Cisco IP Phones — Unauthenticated RCE or DoS via HTTP Request Handling Flaw

VMware vCenter Server — vmdir LDAP Access Control Bypass Exposes All Credentials

VMware ESXi OpenSLP — Use-After-Free in Service Location Protocol Daemon Enables Unauthenticated RCE from Management Network; Exploited by ESXiArgs and BlackBasta Ransomware

IBM Data Risk Manager — Authentication Bypass Giving Full Admin Access

Unraid — PHP extract() Abuse Enabling Root RCE, Chained with CVE-2020-5849 Auth Bypass

F5 BIG-IP — Unauthenticated RCE via TMUI Path Traversal (CVE of the Year 2020)

SAP Solution Manager — Unauthenticated EEM Servlet Access Leads to Landscape-Wide SMD Agent Compromise

Liferay Portal — Unauthenticated RCE via JSON Web Services Java Deserialization

DrayTek Vigor3900/2960/300B — Unauthenticated OS Command Injection in the Web Management Interface

Trend Micro Apex One and OfficeScan — Critical Unauthenticated Auth Bypass via Vulnerable EXE Grants Admin Access Without Credentials; Enables CVE-2020-8467 RCE Chain

PlaySMS — Server-Side Template Injection via the SMS Banner Feature Leads to RCE

EyesOfNetwork — Shared Default API Key Lets Any Attacker Compute the Admin Access Token

Chrome FreeType — Heap Buffer Overflow in PNG-in-Font Processing Enables Renderer Code Execution; Zero-Day Chained with CVE-2020-17087 (Windows) and CVE-2020-16010 (Android)

Chrome for Android — Heap Buffer Overflow in Chrome UI Enables Compromised Renderer to Escape Android Sandbox; Zero-Day Chained with CVE-2020-15999 for Full Device Compromise

Chrome Site Isolation — Use-After-Free in Site Isolation Enables Compromised Renderer to Escape Sandbox; Zero-Day Used with V8 Bug CVE-2020-16013

VMware Workspace ONE Access — Command Injection in Admin Configurator Enables OS Command Execution; NSA-Attributed Russian SVR Exploitation for SAML Token Forgery

IBM Data Risk Manager — OS Command Injection RCE, Chainable from Auth Bypass

Hyper-V RemoteFX vGPU — Authenticated Guest VM User Achieves Host Hypervisor Code Execution via Crafted Input; VM Escape Patched July 2020, RemoteFX vGPU Subsequently Removed