KEV 2020

Zimbra Collaboration Suite - Server-Side Request Forgery via the WebEx Zimlet's JSP Proxy

Sophos XG Firewall - Unauthenticated RCE via HTTP/S Bookmark Buffer Overflow

Sophos CyberoamOS WebAdmin - Unauthenticated SQL Injection Enables Arbitrary Database Manipulation; EOL Product with No Patch, Added to KEV February 2025

Oracle WebLogic Server - Unauthenticated RCE via IIOP/T3 Java Deserialization

DrayTek Vigor Routers - Unauthenticated OS Command Injection via File Upload

Oracle WebLogic - Unauthenticated RCE via Java Deserialization over T3/IIOP Protocols; July 2020 CPU, Added to KEV September 2024 After Continued Exploitation

Oracle WebLogic Server - Unauthenticated Takeover via IIOP, Reverse-Engineered From the Patch Within Days

Roundcube Webmail - RCE via Shell Metacharacters in ImageMagick Path Configuration

QNAP QTS and QuTS hero - Unauthenticated Command Injection in NAS Management Interface Enables Remote Code Execution as Root; Mass-Exploited by Ransomware and Botnets

Palo Alto PAN-OS - SAML Authentication Bypass, CVSS 10.0 Perfect Score

Sophos SG UTM WebAdmin - Unauthenticated OS Command Injection in WebAdmin Interface Enables Remote Code Execution on Unified Threat Management Appliance

OpenSMTPD - Qualys-Found Root RCE via smtp_mailaddr(), Mass-Exploited Within 24 Hours

Zyxel NAS Devices - Pre-Auth Root Command Injection, Weaponized by the Mukashi Mirai Variant Within Days

SonicWall SonicOS VPN Portal - Stack Buffer Overflow in HTTP/HTTPS Request Handling Enables Unauthenticated Remote Code Execution or DoS; Affects Thousands of Internet-Facing Firewalls

Apache Tomcat - "Ghostcat": File Read/Inclusion via the Overtrusted AJP Connector

Microsoft SMBv3 - "SMBGhost": Wormable Pre-Auth RCE via SMBv3.1.1 Compression, Leaked Before Its Patch Shipped

Grandstream UCM6200 IP PBX - Unauthenticated SQL Injection Leading to Root RCE

Apache Airflow Experimental API - Missing Authentication on /api/experimental Endpoints Allows Unauthenticated DAG Trigger and Arbitrary Code Execution on Workers

FUEL CMS - Unauthenticated SQL Injection via 'col' Parameter in Admin Panel Items Endpoints Enables Database Extraction and Potentially Remote Code Execution

SIGRed - Windows DNS Server Integer Overflow in SIG Record Parsing Enables Unauthenticated Wormable RCE; CVSS 10.0, CISA Emergency Directive ED 20-03

Oracle Solaris - Out-of-Bounds Write in PAM Authentication Framework Enables Unauthenticated Remote Code Execution via SunSSH; CVSS 10.0, Exploited by UNC1945 Against Financial Sector

WordPress File Manager Plugin (elFinder) - Unauthenticated File Upload via Exposed Connector Enables PHP Code Execution; 300,000+ Sites Targeted Within Hours of Disclosure

SAP NetWeaver AS Java - RECON: Unauthenticated Access to LM Config Wizard Enables Admin User Creation; CVSS 10.0, Affects 40,000+ SAP Systems, NSA/CISA Joint Alert

Microsoft .NET Framework - Remote Code Execution via Improper Input Validation, Patched January 2020

SolarWinds Orion API - Authentication Bypass via URL Path Parameter Manipulation Enables Unauthenticated API Command Execution; Disclosed During SUNBURST Supply Chain Crisis

Sumavision Enhanced Multimedia Router (EMR) - Unauthenticated Admin Account Creation via Cross-Site Request Forgery

Zoho ManageEngine Desktop Central - Unauthenticated Deserialization RCE, Exploited by APT41 Within Weeks

Tenda AC15 - OS Command Injection via deviceName POST Parameter in SetOnlineDevName Enables Unauthenticated Remote Code Execution; No Patch Available

SaltStack Salt - Unauthenticated Access to ClearFuncs Yields Root on All Minions

Sophos XG Firewall SFOS - Zero-Day SQL Injection Exploited by Chinese APT Before Patch

FortiOS SSL-VPN - Case-Sensitivity Bypass Allows MFA Skip When Username Case Is Changed; Exploited by Ransomware Groups Targeting FortiGate Devices

Oracle WebLogic - Unauthenticated RCE via Console Authentication Bypass; Emergency Patch for Incomplete Fix of CVE-2020-14882, Mass-Exploited Within Days of Disclosure

Oracle WebLogic - Unauthenticated Console Authentication Bypass via Path Traversal Enables Admin Panel Access; Mass-Exploited Within 48 Hours, Chained with CVE-2020-14883 for Code Execution

MobileIron Core / Sentry / Connector - Unauthenticated RCE via Apache/Tomcat ACL Bypass and Hessian Java Deserialization

SaltStack Salt - Unauthenticated RCE via Salt API SSH Client

vBulletin - Unauthenticated RCE via Crafted subWidgets Data in Widget Render Endpoint; Bypass of Incomplete CVE-2019-16759 Patch, Exploited Within Hours of Disclosure

Apache Struts S2-061 - Forced OGNL Evaluation in Tag Attributes Enables Unauthenticated Remote Code Execution; Bypass of S2-059 Fix in Struts 2.5.26

D-Link DNS-320 NAS - Unauthenticated OS Command Injection in system_mgr.cgi Enables Remote Code Execution; No Patch Available for End-of-Life Device

Oracle Coherence - Unauthenticated Deserialization RCE via T3, Reaching Products That Bundle It as a Hidden Dependency

NETGEAR JGS516PE ProSAFE Plus - Unauthenticated Access to Switch Management Functions via Missing Access Control; Enables Full Switch Takeover and Network Manipulation

D-Link DIR-825 R1 Router - Buffer Overflow in Web Interface Enables Unauthenticated Remote Code Execution; No Patch Available for Revision 1 Hardware

Zyxel Firewalls and AP Controllers - Hardcoded 'zyfwp' Admin Account with Fixed Password Enables Unauthenticated Network Takeover; Discovered by Eye Control

Cisco IP Phones - Unauthenticated RCE or DoS via HTTP Request Handling Flaw

VMware vCenter Server - vmdir LDAP Access Control Bypass Exposes All Credentials

VMware ESXi OpenSLP - Use-After-Free in Service Location Protocol Daemon Enables Unauthenticated RCE from Management Network; Exploited by ESXiArgs and BlackBasta Ransomware

IBM Data Risk Manager - Authentication Bypass Giving Full Admin Access

Unraid - PHP extract() Abuse Enabling Root RCE, Chained with CVE-2020-5849 Auth Bypass

F5 BIG-IP - Unauthenticated RCE via TMUI Path Traversal (CVE of the Year 2020)

SAP Solution Manager - Unauthenticated EEM Servlet Access Leads to Landscape-Wide SMD Agent Compromise

Liferay Portal - Unauthenticated RCE via JSON Web Services Java Deserialization

DrayTek Vigor3900/2960/300B - Unauthenticated OS Command Injection in the Web Management Interface

Trend Micro Apex One and OfficeScan - Critical Unauthenticated Auth Bypass via Vulnerable EXE Grants Admin Access Without Credentials; Enables CVE-2020-8467 RCE Chain

PlaySMS - Server-Side Template Injection via the SMS Banner Feature Leads to RCE

EyesOfNetwork - Shared Default API Key Lets Any Attacker Compute the Admin Access Token

Chrome FreeType - Heap Buffer Overflow in PNG-in-Font Processing Enables Renderer Code Execution; Zero-Day Chained with CVE-2020-17087 (Windows) and CVE-2020-16010 (Android)

Chrome for Android - Heap Buffer Overflow in Chrome UI Enables Compromised Renderer to Escape Android Sandbox; Zero-Day Chained with CVE-2020-15999 for Full Device Compromise

Chrome Site Isolation - Use-After-Free in Site Isolation Enables Compromised Renderer to Escape Sandbox; Zero-Day Used with V8 Bug CVE-2020-16013

VMware Workspace ONE Access - Command Injection in Admin Configurator Enables OS Command Execution; NSA-Attributed Russian SVR Exploitation for SAML Token Forgery

IBM Data Risk Manager - OS Command Injection RCE, Chainable from Auth Bypass

Hyper-V RemoteFX vGPU - Authenticated Guest VM User Achieves Host Hypervisor Code Execution via Crafted Input; VM Escape Patched July 2020, RemoteFX vGPU Subsequently Removed