--- title: EUVD - actively exploited vulnerabilities around the SRP go-live last_check: 2026-10-13 last_change: 2026-10-13 source: https://euvd.enisa.europa.eu/ (API: euvdservices.enisa.europa.eu/api/search?exploited=true) window: exploitedSince or a KEV event from 2026-09-01 entries_in_window: 60 entries_total_in_euvd: 1752 --- # EUVD: actively exploited vulnerabilities, from 1 September 2026 **No reliable statement yet on which of these was the first actively exploited vulnerability reported through the SRP.** Nothing in the EUVD says how an entry reached ENISA, and the SRP's own notifications are not public. What follows is a record of what the EUVD shows, not a finding about the SRP. The section "SRP candidates" below lists entries whose catalogue dates fit an early notification, by criteria stated there; it is a list of indications, not of reports. The SRP went live on 11 September 2026: the first hosts answered with SRP content at 11:24:01 UTC (`srp-domains-baseline.md`); notifications were technically possible only from then. EUVD and KEV dates are days without a time, so entries dated 11 September cannot be placed before or after that moment. ## What this list can and cannot say - **`exploitedSince` is a date, not a time, and not the date of any report.** It says when exploitation is recorded as having started, usually taken from another catalogue. The SRP went live on 11 September 2026 at 11:24 UTC, so entries dated 11 September cannot be placed before or after it. - **No field names the reporting route.** The public record has `assigner`, `references`, `enisaIdVendor` and `exploitedSince`. An entry that began as an SRP notification would most likely be published under the manufacturer as assigner, like any other. - **The list is largely a mirror of CISA's KEV catalogue.** Checked on 4 October 2026 against the catalogue (version 2026.10.02): 49 of the 52 entries are in it. For 46, the EUVD's KEV event day equals CISA's `dateAdded`, and `exploitedSince` equals it too. Three were added by CISA in July but carry a KEV event in the EUVD on 9 or 21 September (`EUVD-2026-45279`, `45280`, `50404`), which `exploitedSince` alone would not show. Only three entries are not in CISA's catalogue at all (`EUVD-2026-70645`, `70647`, `72024`: GeoNetwork twice and MikroTik RouterOS). Since 6 October the source is known: all three are in the **EU KEV** catalogue (added 2 and 5 September, before the go-live), which the EUVD keeps alongside CISA's and reports per entry (`/api/kevEntries`). The KEV filter covers both catalogues. - **The EU KEV is not the SRP.** It holds 71 of the 1,746 exploited entries (11 of them only there). Its dates run from 17 January 2025, and the EUVD already carried 25 EU KEV entries on 4 May 2026 (archived dump), long before the go-live; between 11 and 20 September it took none. Its dates can be back-dated, so they are not the day an entry was added. The section "EU KEV register" below dates each entry's insertion from the EUVD's row order and records the day this monitor first saw it. See [`euvd/EU-KEV.md`](euvd/EU-KEV.md), which also dates when an SRP route into the EU KEV, if it runs, became visible: 22 September 2026. Of the 60 entries both catalogues list, the EU KEV was earlier for 13, the same day for 11 and later for 36 (checked 6 October 2026). The "EU KEV added" and "CISA KEV added" columns below give the day per catalogue. An early EU KEV date has other explanations than an SRP notification: ENISA is the root CNA for European CNAs such as DIVD, so their CVEs reach the EUVD directly. - **A notification goes to the CSIRT of the manufacturer's main establishment**, which forwards it to ENISA through the SRP (NCSC-NL states this for the Netherlands, ncsc.nl, "Melden onder de Cyber Resilience Act"). Anyone else, such as an affected user, may notify voluntarily. Where a vendor's seat is known it says which national route a manufacturer's own notification would have taken. - **IDs and assigners show no break at the go-live.** Checked on 15,872 entries published 1 September to 4 October 2026 against 22,136 from July and August: IDs run on without a jump (the largest gap between consecutive IDs is about 100), and of the 53 assigners that first appear in September, none clusters after the go-live. No assigner is called SRP, CRA or CSIRT; `ENISA` as assigner (17 entries July to September) predates the go-live and carries national CERT reports. - **Volume is only an indication, in both directions.** Because the list mostly follows CISA's catalogue, its growth reflects what CISA adds, not what reaches the SRP; the EUVD takes entries from many sources, so not every entry here came through the SRP. And where the Implementing Act allows a notification to be held back or delayed, a reported vulnerability may not appear yet. Read the counts as a rough picture, not as a tally of SRP notifications. - **A honeypot sighting is evidence of scanning, not of a report.** The EUVD shows, per entry, what Shadowserver's honeypot sensors saw ("Honeypot sensors"; "Seen in Honeypot" in the list view), read from `/api/honeypotObservations`. The column "Honeypot first seen" records the first day the sensors saw attempts against the CVE, which can lag `exploitedSince` by weeks or precede the window by years. Connections, unique IPs, averages and trend move daily; they are kept as last seen and recorded once a day, without counting as a change. The EUVD's UPTICK flag compares one day with the 7-day average and fires for dozens of entries a day; the statistics page marks a **surge** only at 20 times the 30-day average from 25 or more addresses, or at 10 times from 10 or more addresses on three recorded days in a row (until 2026-10-12: three UPTICK days in a row, which marked 57 entries that day), and the monitor reports only those. An empty cell means no sighting, not "not exploited". ENISA does not document this endpoint. ## Where to read each entry [`euvd/index.html`](euvd/index.html) shows, for every entry, what the sources publish: the full EUVD record (products and versions, references, advisories), the NIST NVD record (status, CVSS metrics, weaknesses, references), the CISA KEV catalogue entry (every field of CISA's schema) and the CERT and CSIRT links and advisories (CERT-Bund, NCSC-NL and others, plus vendor advisories). The raw records are in [`euvd/details/`](euvd/details/), one JSON file per entry. EPSS and EUVD's `dataProcessed` stamp change daily and are kept as last seen without counting as a change; so do the honeypot counts and trend, which the daily heartbeat records once a day. ## Entries per month (by `exploitedSince`) | Month | Entries | |---|---| | 2025-11 | 11 | | 2025-12 | 20 | | 2026-01 | 19 | | 2026-02 | 28 | | 2026-03 | 26 | | 2026-04 | 30 | | 2026-05 | 21 | | 2026-06 | 23 | | 2026-07 | 27 | | 2026-08 | 35 | | 2026-09 | 49 | | 2026-10 | 7 | 25 of the 60 entries below have `exploitedSince` before the go-live and 35 on or after 11 September (that day included). Entries are listed when `exploitedSince` or a KEV event falls in the window; the KEV column shows the event days. ## SRP candidates (indications, not findings) Entries the EU KEV added on or after the go-live day (11 September 2026) that CISA's catalogue does not list, or listed later. **No public field records the reporting route; this is not a statement that any of them was reported through the SRP.** The EU KEV existed before the SRP and took no entry between 11 and 20 September. "Vendor is assigner" marks the pattern a manufacturer's own notification would leave, nothing more. | EUVD ID | EU KEV added | CISA KEV added | Criterion | Vendor | Assigner | Vendor is assigner | CVE | |---|---|---|---|---|---|---|---| | [EUVD-2026-84555](https://euvd.enisa.europa.eu/enisa/EUVD-2026-84555) | 2026-09-23 | 2026-09-25 | EU KEV 2 days before CISA | WordPress | hackerone | no | CVE-2026-87902 | | [EUVD-2026-75010](https://euvd.enisa.europa.eu/enisa/EUVD-2026-75010) | 2026-09-25 | — | EU KEV only | checkpoint | checkpoint | yes | CVE-2026-85103 | | [EUVD-2026-90080](https://euvd.enisa.europa.eu/enisa/EUVD-2026-90080) | 2026-09-30 | 2026-10-02 | EU KEV 2 days before CISA | Zammad GmbH | DIVD | no | CVE-2026-102489 | | [EUVD-2026-90081](https://euvd.enisa.europa.eu/enisa/EUVD-2026-90081) | 2026-09-30 | 2026-10-02 | EU KEV 2 days before CISA | Zammad GmbH | DIVD | no | CVE-2026-102490 | | [EUVD-2026-92065](https://euvd.enisa.europa.eu/enisa/EUVD-2026-92065) | 2026-10-02 | 2026-10-04 | EU KEV 2 days before CISA | NetScaler | NetScaler | yes | CVE-2026-88779 | ## Entries | EUVD ID | Exploited since | KEV event(s) in window | EU KEV added | CISA KEV added | Published | Updated | Vendor | Assigner | CVE | Honeypot first seen | |---|---|---|---|---|---|---|---|---|---|---| | [EUVD-2026-22589](https://euvd.enisa.europa.eu/enisa/EUVD-2026-22589) | 2026-04-28 | 2026-10-07 | 2026-10-07 | 2026-04-28 | 2026-04-14 | 2026-09-25 17:26 | Microsoft | microsoft | CVE-2026-32202 | | | [EUVD-2026-45279](https://euvd.enisa.europa.eu/enisa/EUVD-2026-45279) | 2026-07-21 | 2026-09-21 | 2026-09-21 | 2026-07-21 | 2026-07-17 | 2026-10-07 18:16 | WordPress | WPScan | CVE-2026-60137 | | | [EUVD-2026-45280](https://euvd.enisa.europa.eu/enisa/EUVD-2026-45280) | 2026-07-21 | 2026-09-21 | 2026-09-21 | 2026-07-21 | 2026-07-17 | 2026-10-07 18:26 | WordPress | WPScan | CVE-2026-63030 | | | [EUVD-2026-50404](https://euvd.enisa.europa.eu/enisa/EUVD-2026-50404) | 2026-07-29 | 2026-09-09 | 2026-09-09 | 2026-07-29 | 2026-07-29 | 2026-09-16 20:14 | Cisco | cisco | CVE-2026-20316 | | | [EUVD-2026-32016](https://euvd.enisa.europa.eu/enisa/EUVD-2026-32016) | 2026-09-02 | 2026-09-02 | | 2026-09-02 | 2026-05-26 | 2026-10-01 17:41 | Kludex | GitHub_M | CVE-2026-48710 | | | [EUVD-2026-39922](https://euvd.enisa.europa.eu/enisa/EUVD-2026-39922) | 2026-09-02 | 2026-09-02 | | 2026-09-02 | 2026-06-26 | 2026-09-03 03:55 | kestra-io | GitHub_M | CVE-2026-49869 | | | [EUVD-2026-42359](https://euvd.enisa.europa.eu/enisa/EUVD-2026-42359) | 2026-09-02 | 2026-09-02 | | 2026-09-02 | 2026-07-08 | 2026-09-03 03:56 | berriai | GitHub_M | CVE-2026-59822 | | | [EUVD-2026-45205](https://euvd.enisa.europa.eu/enisa/EUVD-2026-45205) | 2026-09-02 | 2026-09-02 | | 2026-09-02 | 2026-07-17 | 2026-09-03 03:55 | Sangoma | SRA | CVE-2026-9586 | 2026-09-04 | | [EUVD-2026-67861](https://euvd.enisa.europa.eu/enisa/EUVD-2026-67861) | 2026-09-02 | 2026-09-02, 2026-10-01 | 2026-10-01 | 2026-09-02 | 2026-08-28 | 2026-09-03 03:56 | JFrog | JFROG | CVE-2026-82329 | 2026-10-04 | | [EUVD-2026-69704](https://euvd.enisa.europa.eu/enisa/EUVD-2026-69704) | 2026-09-02 | 2026-09-02 | | 2026-09-02 | 2026-09-01 | 2026-09-03 03:55 | SonicWall | sonicwall | CVE-2026-83548 | | | [EUVD-2026-69707](https://euvd.enisa.europa.eu/enisa/EUVD-2026-69707) | 2026-09-02 | 2026-09-02 | | 2026-09-02 | 2026-09-01 | 2026-09-21 13:07 | SonicWall | sonicwall | CVE-2026-83549 | | | [EUVD-2026-70645](https://euvd.enisa.europa.eu/enisa/EUVD-2026-70645) | 2026-09-02 | 2026-09-02 | 2026-09-02 | | 2026-09-03 | 2026-09-04 13:42 | geonetwork | GitHub_M | CVE-2026-58400 | | | [EUVD-2026-70647](https://euvd.enisa.europa.eu/enisa/EUVD-2026-70647) | 2026-09-02 | 2026-09-02 | 2026-09-02 | | 2026-09-03 | 2026-09-03 17:40 | geonetwork | GitHub_M | CVE-2026-63219 | | | [EUVD-2026-70702](https://euvd.enisa.europa.eu/enisa/EUVD-2026-70702) | 2026-09-04 | 2026-09-04 | | 2026-09-04 | 2026-09-03 | 2026-09-21 12:53 | Google | Chrome | CVE-2026-85046 | | | [EUVD-2026-72024](https://euvd.enisa.europa.eu/enisa/EUVD-2026-72024) | 2026-09-05 | 2026-09-05 | 2026-09-05 | | 2026-09-05 | 2026-09-09 04:26 | MikroTik | CERT-PL | CVE-2026-67276 | | | [EUVD-2026-72025](https://euvd.enisa.europa.eu/enisa/EUVD-2026-72025) | 2026-09-05 | 2026-09-05, 2026-09-10 | 2026-09-05 | 2026-09-10 | 2026-09-05 | 2026-09-11 03:55 | MikroTik | CERT-PL | CVE-2026-67277 | | | [EUVD-2026-72029](https://euvd.enisa.europa.eu/enisa/EUVD-2026-72029) | 2026-09-05 | 2026-09-05, 2026-09-10 | 2026-09-05 | 2026-09-10 | 2026-09-05 | 2026-09-11 03:55 | MikroTik | CERT-PL | CVE-2026-86060 | | | [EUVD-2026-72041](https://euvd.enisa.europa.eu/enisa/EUVD-2026-72041) | 2026-09-08 | 2026-09-08 | | 2026-09-08 | 2026-09-06 | 2026-09-09 04:25 | N-Able | N-able | CVE-2026-86218 | | | [EUVD-2026-72530](https://euvd.enisa.europa.eu/enisa/EUVD-2026-72530) | 2026-09-08 | 2026-09-08 | | 2026-09-08 | 2026-09-07 | 2026-09-09 04:25 | Adobe | adobe | CVE-2026-75650 | | | [EUVD-2026-73365](https://euvd.enisa.europa.eu/enisa/EUVD-2026-73365) | 2026-09-08 | 2026-09-08 | | 2026-09-08 | 2026-09-08 | 2026-10-08 18:15 | Microsoft | microsoft | CVE-2026-85880 | | | [EUVD-2026-73889](https://euvd.enisa.europa.eu/enisa/EUVD-2026-73889) | 2026-09-08 | 2026-09-08 | | 2026-09-08 | 2026-09-08 | 2026-10-08 18:20 | Microsoft | microsoft | CVE-2026-81963 | | | [EUVD-2026-2223](https://euvd.enisa.europa.eu/enisa/EUVD-2026-2223) | 2026-09-09 | 2026-09-09 | | 2026-09-09 | 2026-01-13 | 2026-10-07 17:56 | Fortinet | fortinet | CVE-2025-25249 | | | [EUVD-2026-62395](https://euvd.enisa.europa.eu/enisa/EUVD-2026-62395) | 2026-09-09 | 2026-09-09 | | 2026-09-09 | 2026-08-19 | 2026-10-07 18:01 | NetScaler | NetScaler | CVE-2026-19490 | | | [EUVD-2026-74529](https://euvd.enisa.europa.eu/enisa/EUVD-2026-74529) | 2026-09-09 | 2026-09-09 | | 2026-09-09 | 2026-09-09 | 2026-09-21 12:51 | Google | Chrome | CVE-2026-87491 | | | [EUVD-2026-9438](https://euvd.enisa.europa.eu/enisa/EUVD-2026-9438) | 2026-09-09 | 2026-09-09 | 2026-09-09 | 2026-09-09 | 2026-03-04 | 2026-09-16 20:08 | Cisco | cisco | CVE-2026-20079 | | | [EUVD-2026-49566](https://euvd.enisa.europa.eu/enisa/EUVD-2026-49566) | 2026-09-11 (go-live day) | 2026-09-11 | | 2026-09-11 | 2026-07-27 | 2026-09-12 03:55 | JFrog | JFROG | CVE-2026-42016 | | | [EUVD-2026-57388](https://euvd.enisa.europa.eu/enisa/EUVD-2026-57388) | 2026-09-11 (go-live day) | 2026-09-11 | | 2026-09-11 | 2026-08-12 | 2026-10-01 18:06 | JFrog | JFROG | CVE-2026-42018 | | | [EUVD-2026-74053](https://euvd.enisa.europa.eu/enisa/EUVD-2026-74053) | 2026-09-11 (go-live day) | 2026-09-11 | | 2026-09-11 | 2026-09-08 | 2026-09-12 03:55 | ConnectWise | ConnectWise | CVE-2026-84869 | | | [EUVD-2026-76779](https://euvd.enisa.europa.eu/enisa/EUVD-2026-76779) | 2026-09-11 (go-live day) | 2026-09-11 | | 2026-09-11 | 2026-09-12 | 2026-09-23 21:03 | GitLab | GitLab | CVE-2026-85706 | 2026-10-08 | | [EUVD-2026-77625](https://euvd.enisa.europa.eu/enisa/EUVD-2026-77625) | 2026-09-14 | 2026-09-14 | | 2026-09-14 | 2026-09-14 | 2026-09-18 12:10 | Cisco | cisco | CVE-2026-76461 | | | [EUVD-2026-79004](https://euvd.enisa.europa.eu/enisa/EUVD-2026-79004) | 2026-09-16 | 2026-09-16 | | 2026-09-16 | 2026-09-15 | 2026-10-07 18:14 | Google | Google_Devices | CVE-2026-58704 | | | [EUVD-2026-81122](https://euvd.enisa.europa.eu/enisa/EUVD-2026-81122) | 2026-09-16 | 2026-09-16 | | 2026-09-16 | 2026-09-16 | 2026-10-07 18:27 | Cisco | cisco | CVE-2026-76460 | | | [EUVD-2026-82595](https://euvd.enisa.europa.eu/enisa/EUVD-2026-82595) | 2026-09-16 | 2026-09-16 | | 2026-09-16 | 2026-09-17 | 2026-09-18 14:33 | Acronis | Acronis | CVE-2026-87886 | | | [EUVD-2025-31542](https://euvd.enisa.europa.eu/enisa/EUVD-2025-31542) | 2026-09-18 | 2026-09-18 | | 2026-09-18 | 2025-09-05 | 2026-10-07 17:56 | Linux | Linux | CVE-2025-39682 | | | [EUVD-2025-34068](https://euvd.enisa.europa.eu/enisa/EUVD-2025-34068) | 2026-09-18 | 2026-09-18 | | 2026-09-18 | 2025-10-13 | 2026-09-19 03:56 | Linux | Linux | CVE-2025-39964 | | | [EUVD-2026-39217](https://euvd.enisa.europa.eu/enisa/EUVD-2026-39217) | 2026-09-18 | 2026-09-18 | | 2026-09-18 | 2026-06-25 | 2026-09-19 03:56 | Linux | Linux | CVE-2026-53266 | | | [EUVD-2026-37030](https://euvd.enisa.europa.eu/enisa/EUVD-2026-37030) | 2026-09-21 | 2026-09-21 | | 2026-09-21 | 2026-06-16 | 2026-09-22 03:55 | Zyxel | Zyxel | CVE-2026-7273 | | | [EUVD-2026-75009](https://euvd.enisa.europa.eu/enisa/EUVD-2026-75009) | 2026-09-22 | 2026-09-22 | 2026-09-22 | 2026-09-22 | 2026-09-09 | 2026-09-23 03:55 | checkpoint | checkpoint | CVE-2026-85102 | | | [EUVD-2026-84296](https://euvd.enisa.europa.eu/enisa/EUVD-2026-84296) | 2026-09-22 | 2026-09-22 | 2026-09-22 | 2026-09-22 | 2026-09-22 | 2026-09-23 03:55 | Arista Networks | Arista | CVE-2026-93952 | | | [EUVD-2026-84375](https://euvd.enisa.europa.eu/enisa/EUVD-2026-84375) | 2026-09-22 | 2026-09-22 | 2026-09-22 | 2026-09-22 | 2026-09-22 | 2026-09-23 03:55 | checkpoint | checkpoint | CVE-2026-93616 | 2026-09-26 | | [EUVD-2026-84427](https://euvd.enisa.europa.eu/enisa/EUVD-2026-84427) | 2026-09-22 | 2026-09-22 | 2026-09-22 | 2026-09-22 | 2026-09-22 | 2026-09-23 03:55 | F5 | f5 | CVE-2026-94127 | | | [EUVD-2026-84555](https://euvd.enisa.europa.eu/enisa/EUVD-2026-84555) | 2026-09-23 | 2026-09-23, 2026-09-25 | 2026-09-23 | 2026-09-25 | 2026-09-22 | 2026-09-26 03:55 | WordPress | hackerone | CVE-2026-87902 | | | [EUVD-2026-53822](https://euvd.enisa.europa.eu/enisa/EUVD-2026-53822) | 2026-09-24 | 2026-09-24 | | 2026-09-24 | 2026-08-06 | 2026-09-25 03:55 | WSO2 | WSO2 | CVE-2026-5430 | | | [EUVD-2026-56844](https://euvd.enisa.europa.eu/enisa/EUVD-2026-56844) | 2026-09-24 | 2026-09-24 | | 2026-09-24 | 2026-08-11 | 2026-09-25 03:55 | Adobe | adobe | CVE-2026-71362 | | | [EUVD-2026-56431](https://euvd.enisa.europa.eu/enisa/EUVD-2026-56431) | 2026-09-25 | 2026-09-25 | 2026-09-25 | 2026-09-25 | 2026-08-11 | 2026-10-08 18:11 | Microsoft | microsoft | CVE-2026-65660 | | | [EUVD-2026-72027](https://euvd.enisa.europa.eu/enisa/EUVD-2026-72027) | 2026-09-25 | 2026-09-25, 2026-09-27 | 2026-09-27 | 2026-09-25 | 2026-09-05 | 2026-09-26 03:55 | MikroTik | CERT-PL | CVE-2026-67279 | | | [EUVD-2026-75010](https://euvd.enisa.europa.eu/enisa/EUVD-2026-75010) | 2026-09-25 | 2026-09-25 | 2026-09-25 | | 2026-09-09 | 2026-09-10 03:56 | checkpoint | checkpoint | CVE-2026-85103 | | | [EUVD-2026-87958](https://euvd.enisa.europa.eu/enisa/EUVD-2026-87958) | 2026-09-27 | 2026-09-27 | 2026-09-27 | 2026-09-27 | 2026-09-27 | 2026-09-29 03:55 | Citrix NetScaler | NetScaler | CVE-2026-88771 | 2026-09-29 | | [EUVD-2026-87959](https://euvd.enisa.europa.eu/enisa/EUVD-2026-87959) | 2026-09-27 | 2026-09-27 | 2026-09-27 | 2026-09-27 | 2026-09-27 | 2026-09-28 03:55 | Citrix NetScaler | NetScaler | CVE-2026-88772 | | | [EUVD-2026-88445](https://euvd.enisa.europa.eu/enisa/EUVD-2026-88445) | 2026-09-29 | 2026-09-29 | | 2026-09-29 | 2026-09-28 | 2026-10-01 17:15 | Apple | apple | CVE-2026-86950 | | | [EUVD-2026-89950](https://euvd.enisa.europa.eu/enisa/EUVD-2026-89950) | 2026-09-30 | 2026-09-30 | | 2026-09-30 | 2026-09-30 | 2026-10-02 23:23 | Cisco | cisco | CVE-2026-76504 | 2026-10-09 | | [EUVD-2026-90080](https://euvd.enisa.europa.eu/enisa/EUVD-2026-90080) | 2026-09-30 | 2026-09-30, 2026-10-02 | 2026-09-30 | 2026-10-02 | 2026-09-30 | 2026-10-10 03:55 | Zammad GmbH | DIVD | CVE-2026-102489 | | | [EUVD-2026-90081](https://euvd.enisa.europa.eu/enisa/EUVD-2026-90081) | 2026-09-30 | 2026-09-30, 2026-10-02 | 2026-09-30 | 2026-10-02 | 2026-09-30 | 2026-10-08 19:55 | Zammad GmbH | DIVD | CVE-2026-102490 | | | [EUVD-2026-91042](https://euvd.enisa.europa.eu/enisa/EUVD-2026-91042) | 2026-10-01 | 2026-10-01 | 2026-10-01 | 2026-10-01 | 2026-10-01 | 2026-10-07 17:59 | Fortinet | fortinet | CVE-2026-104286 | | | [EUVD-2026-92065](https://euvd.enisa.europa.eu/enisa/EUVD-2026-92065) | 2026-10-02 | 2026-10-02, 2026-10-04 | 2026-10-02 | 2026-10-04 | 2026-10-04 | 2026-10-05 03:55 | NetScaler | NetScaler | CVE-2026-88779 | | | [EUVD-2015-3352](https://euvd.enisa.europa.eu/enisa/EUVD-2015-3352) | 2026-10-08 | 2026-10-08 | | 2026-10-08 | 2015-05-18 | 2026-10-09 16:02 | n/a | mitre | CVE-2015-3306 | | | [EUVD-2015-5432](https://euvd.enisa.europa.eu/enisa/EUVD-2015-5432) | 2026-10-08 | 2026-10-08 | | 2026-10-08 | 2015-07-29 | 2026-10-09 03:55 | n/a | mitre | CVE-2015-5477 | | | [EUVD-2021-26539](https://euvd.enisa.europa.eu/enisa/EUVD-2021-26539) | 2026-10-08 | 2026-10-08 | | 2026-10-08 | 2021-01-22 | 2026-10-09 03:55 | n/a | mitre | CVE-2021-3199 | | | [EUVD-2022-3161](https://euvd.enisa.europa.eu/enisa/EUVD-2022-3161) | 2026-10-08 | 2026-10-08 | | 2026-10-08 | 2016-04-26 | 2026-10-09 03:55 | n/a | redhat | CVE-2016-3081 | | | [EUVD-2023-1342](https://euvd.enisa.europa.eu/enisa/EUVD-2023-1342) | 2026-10-08 | 2026-10-08 | | 2026-10-08 | 2023-04-19 | 2026-10-09 03:55 | n/a | mitre | CVE-2023-22894 | | ## EU KEV register The EUVD lists 73 EU KEV entries (`euvd/eukev.json`, kept since 2026-10-08). The EU KEV's date is not the day an entry was added. The EUVD numbers its KEV rows in insertion order, and the CISA rows around an EU KEV row date its insertion: "Inserted" runs from the latest CISA date before it (a hard lower bound) to the next CISA date (an upper bound if the EUVD imports CISA entries the same day). By that clock the first 24 entries arrived together, inserted between 2026-03-20 and 2026-03-26; of the 49 inserted since, 21 carry a date at least one day before their insertion, and 18 were inserted on or after the go-live day. "First seen here" is the first check of this monitor that listed the entry, with the previous check, which did not. | EUVD ID | EU KEV date | Inserted | Back-dated by at least | First seen here | Origin | Vendor | CISA KEV added | |---|---|---|---|---|---|---|---| | [EUVD-2026-70645](https://euvd.enisa.europa.eu/enisa/EUVD-2026-70645) | 2026-09-02 | 2026-09-02 to 2026-09-04 | - | at register start | CNW | geonetwork | - | | [EUVD-2026-70647](https://euvd.enisa.europa.eu/enisa/EUVD-2026-70647) | 2026-09-02 | 2026-09-02 to 2026-09-04 | - | at register start | CNW | geonetwork | - | | [EUVD-2026-72025](https://euvd.enisa.europa.eu/enisa/EUVD-2026-72025) | 2026-09-05 | 2026-09-04 to 2026-09-08 | - | at register start | CERT.PL | MikroTik | 2026-09-10 | | [EUVD-2026-72024](https://euvd.enisa.europa.eu/enisa/EUVD-2026-72024) | 2026-09-05 | 2026-09-04 to 2026-09-08 | - | at register start | CERT.PL | MikroTik | - | | [EUVD-2026-72029](https://euvd.enisa.europa.eu/enisa/EUVD-2026-72029) | 2026-09-05 | 2026-09-04 to 2026-09-08 | - | at register start | CERT.PL | MikroTik | 2026-09-10 | | [EUVD-2026-50404](https://euvd.enisa.europa.eu/enisa/EUVD-2026-50404) | 2026-09-09 | 2026-09-09 to 2026-09-10 | - | at register start | ENISA | Cisco | 2026-07-29 | | [EUVD-2026-9438](https://euvd.enisa.europa.eu/enisa/EUVD-2026-9438) | 2026-09-09 | 2026-09-09 to 2026-09-10 | - | at register start | ENISA | Cisco | 2026-09-09 | | [EUVD-2026-84375](https://euvd.enisa.europa.eu/enisa/EUVD-2026-84375) | 2026-09-22 | 2026-09-22 to 2026-09-24 | - | at register start | ENISA | checkpoint | 2026-09-22 | | [EUVD-2026-75009](https://euvd.enisa.europa.eu/enisa/EUVD-2026-75009) | 2026-09-22 | 2026-09-22 to 2026-09-24 | - | at register start | ENISA | checkpoint | 2026-09-22 | | [EUVD-2026-45280](https://euvd.enisa.europa.eu/enisa/EUVD-2026-45280) | 2026-09-21 | 2026-09-22 to 2026-09-24 | 1 day | at register start | ENISA | WordPress Foundation | 2026-07-21 | | [EUVD-2026-45279](https://euvd.enisa.europa.eu/enisa/EUVD-2026-45279) | 2026-09-21 | 2026-09-22 to 2026-09-24 | 1 day | at register start | ENISA | WordPress Foundation | 2026-07-21 | | [EUVD-2026-84427](https://euvd.enisa.europa.eu/enisa/EUVD-2026-84427) | 2026-09-22 | 2026-09-22 to 2026-09-24 | - | at register start | ENISA | F5 | 2026-09-22 | | [EUVD-2026-84555](https://euvd.enisa.europa.eu/enisa/EUVD-2026-84555) | 2026-09-23 | 2026-09-25 to 2026-09-25 | 2 days | at register start | NCSC-NL | WordPress Foundation | 2026-09-25 | | [EUVD-2026-72027](https://euvd.enisa.europa.eu/enisa/EUVD-2026-72027) | 2026-09-27 | 2026-09-25 to 2026-09-27 | - | at register start | CERT.PL | MikroTik | 2026-09-25 | | [EUVD-2026-84296](https://euvd.enisa.europa.eu/enisa/EUVD-2026-84296) | 2026-09-22 | 2026-09-27 to 2026-09-29 | 5 days | at register start | CSIRT-IE | Arista Networks | 2026-09-22 | | [EUVD-2026-87959](https://euvd.enisa.europa.eu/enisa/EUVD-2026-87959) | 2026-09-27 | 2026-09-27 to 2026-09-29 | - | at register start | CNW | Citrix | 2026-09-27 | | [EUVD-2026-87958](https://euvd.enisa.europa.eu/enisa/EUVD-2026-87958) | 2026-09-27 | 2026-09-27 to 2026-09-29 | - | at register start | CNW | Citrix | 2026-09-27 | | [EUVD-2026-56431](https://euvd.enisa.europa.eu/enisa/EUVD-2026-56431) | 2026-09-25 | 2026-09-27 to 2026-09-29 | 2 days | at register start | CSIRT-IE | Microsoft | 2026-09-25 | | [EUVD-2026-90081](https://euvd.enisa.europa.eu/enisa/EUVD-2026-90081) | 2026-09-30 | 2026-09-30 to 2026-10-01 | - | at register start | NCSC-NL | Zammad | 2026-10-02 | | [EUVD-2026-90080](https://euvd.enisa.europa.eu/enisa/EUVD-2026-90080) | 2026-09-30 | 2026-09-30 to 2026-10-01 | - | at register start | NCSC-NL | Zammad | 2026-10-02 | | [EUVD-2026-67861](https://euvd.enisa.europa.eu/enisa/EUVD-2026-67861) | 2026-10-01 | 2026-09-30 to 2026-10-01 | - | at register start | ENISA | JFrog | 2026-09-02 | | [EUVD-2026-91042](https://euvd.enisa.europa.eu/enisa/EUVD-2026-91042) | 2026-10-01 | 2026-10-01 to 2026-10-02 | - | at register start | CNW | Fortinet | 2026-10-01 | | [EUVD-2026-92065](https://euvd.enisa.europa.eu/enisa/EUVD-2026-92065) | 2026-10-02 | 2026-10-02 to 2026-10-04 | - | at register start | CNW | Citrix | 2026-10-04 | | [EUVD-2026-75010](https://euvd.enisa.europa.eu/enisa/EUVD-2026-75010) | 2026-09-25 | 2026-10-04 to 2026-10-08 | 9 days | at register start | CNW | Check Point | - | | [EUVD-2026-22589](https://euvd.enisa.europa.eu/enisa/EUVD-2026-22589) | 2026-10-07 | 2026-10-04 to 2026-10-08 | - | at register start | CNW | Microsoft | 2026-04-28 | ## Change log ### 2026-10-13 05:00 UTC (vs. 2026-10-12 04:55) Nothing was added or removed; only honeypot sensor detail moved, and 20 honeypot surges are new, all "broad". **Changed** - Honeypot detail moved on `EUVD-2026-45205` (Sangoma Switchvox: 8 connections from 7 IPs, trend now UPTICK), `-87958` (NetScaler: 1839 connections from 11 IPs, was 2697 from 6) and `-89950` (Cisco SD-WAN Manager: sensor fields empty today). No `exploitedSince` changed. **Watch** - 20 new honeypot surges (sensor traffic, not reports, not proof of a campaign). Largest: `EUVD-2026-14546` (CVE-2026-3055, Citrix NetScaler ADC/Gateway) 19117 connections from 80 IPs, 682.8x, broad+persistent; `EUVD-2018-5323` (CVE-2018-13379, Fortinet FortiOS) 10342 from 28 IPs, 154.4x, broad+persistent; `EUVD-2021-12905` (CVE-2021-26084, Atlassian Confluence) 2703 from 27 IPs, 386.1x. The rest are in `euvd/history.jsonl`. **Unchanged** - EU KEV register unchanged, no SRP candidates new. 60 entries in the window, 1752 in the EUVD. ### 2026-10-12 04:55 UTC (vs. 2026-10-11 07:30) Nothing was added or removed; only honeypot sensor detail moved, and 61 honeypot surges are new, four of them broad. **Changed** - Honeypot detail moved on `EUVD-2026-45205` (Sangoma Switchvox; sensor fields now filled), `-76779` (GitLab; sensor fields empty today), `-87958` (NetScaler: 2697 connections from 6 IPs, was 2857 from 27) and `-89950` (Cisco SD-WAN Manager: 7 connections, was 6). No `exploitedSince` changed. **Watch** - 61 new honeypot surges (sensor traffic, not reports, not proof of a campaign): 4 "broad+persistent", 57 "persistent" (UPTICK on three recorded days; several at or below the 30-day average). Broad: `EUVD-2018-5323` (CVE-2018-13379, Fortinet FortiOS) 25568 connections from 29 IPs, 376.0x; `EUVD-2025-200983` (CVE-2025-55182, React Server Components) 5965 from 107 IPs, 21.7x; `EUVD-2025-18497` (CVE-2025-5777, Citrix NetScaler) 3607 from 77 IPs, 41.5x; `EUVD-2023-27838` (CVE-2023-23752, Joomla) 328 from 25 IPs, 54.7x. The rest are in `euvd/history.jsonl`. **Unchanged** - EU KEV register unchanged, no SRP candidates new. 60 entries in the window, 1752 in the EUVD. ### 2026-10-11 07:30 UTC (vs. 2026-10-10 04:54) The honeypot sensors saw a Cisco entry for the first time and moved the first-seen day of the GitLab entry back; twelve new honeypot surges; nothing was added or removed. **New** - Honeypot first-seen: `EUVD-2026-89950` (CVE-2026-76504, Cisco Catalyst SD-WAN Manager), 2026-10-09, six connections from one IP. **Changed** - `EUVD-2026-76779` (GitLab): the sensors now give first-seen 2026-10-08, not 2026-10-10 as logged yesterday. `EUVD-2026-90080` has a new `dateUpdated` (2026-10-10); no `exploitedSince` changed. **Watch** - Twelve new honeypot surges, all "broad" (sensor traffic, not reports, not proof of a campaign). Largest: `EUVD-2026-14546` (CVE-2026-3055, Citrix NetScaler): 17957 connections from 51 IPs, 665.1x the 30-day average; `EUVD-2019-9380` (Citrix ADC): 5987 from 33 IPs, 374.2x; `EUVD-2023-26655` (Atlassian Confluence): 4158 from 29 IPs, 693.0x; `EUVD-2018-5323` (Fortinet FortiOS): 3410 from 33 IPs, 48.7x. `EUVD-2026-87958` (Citrix NetScaler, in the window) is among them: 2857 from 27 IPs, 317.4x. The rest are in `euvd/history.jsonl`. **Unchanged** - EU KEV register unchanged, no SRP candidates new. 60 entries in the window, 1752 in the EUVD. ### 2026-10-10 04:54 UTC (vs. 2026-10-09 04:55) The honeypot sensors saw a GitLab entry for the first time, five older entries surged, and nine entries were re-stamped; nothing was added or removed. **New** - Honeypot first-seen: `EUVD-2026-76779` (CVE-2026-85706, GitLab), 2026-10-10, one connection. **Changed** - Seven entries have a new `dateUpdated` (2026-10-09): the five old CVEs of 8 October (`2015-3352`, `2015-5432`, `2021-26539`, `2022-3161`, `2023-1342`) and `90080`. NVD, CISA or EUVD details also moved for these and for `45205`, `76779`, `87958`; no `exploitedSince` changed. **Watch** - Five honeypot surges, all "broad" (sensor traffic, not reports, not proof of a campaign): `EUVD-2024-26057` (SolarWinds Serv-U): 8031 connections from 40 IPs, 501.9x the 30-day average; `EUVD-2024-19498` (Ivanti Connect Secure): 6247 from 44 IPs, 624.7x; `EUVD-2025-18497` (Citrix NetScaler): 3507 from 81 IPs, 40.3x; `EUVD-2024-19504` (Ivanti): 2252 from 27 IPs, 1126.0x; `EUVD-2025-1505` (Palo Alto PAN-OS): 1907 from 28 IPs, 158.9x. - `EUVD-2026-87958` (Citrix NetScaler) stays at UPTICK: 2967 connections. **Unchanged** - EU KEV register unchanged, no SRP candidates new. 60 entries in the window, 1752 in the EUVD. ### 2026-10-09 04:55 UTC (vs. 2026-10-08 06:23) Five old CVEs (2015 to 2023) joined the window on 8 October, all with a CISA KEV event that day; five existing entries were re-stamped by the EUVD. **New** - `EUVD-2015-3352` (CVE-2015-3306, assigner mitre), `EUVD-2015-5432` (CVE-2015-5477, mitre), `EUVD-2021-26539` (CVE-2021-3199, mitre), `EUVD-2022-3161` (CVE-2016-3081, redhat), `EUVD-2023-1342` (CVE-2023-22894, mitre): vendor "n/a", `exploitedSince` 2026-10-08, CISA lists all five (2026-10-08). Old vulnerabilities added late; no SRP candidates, no EU KEV entry. **Changed** - Five entries have a new `dateUpdated` (2026-10-08): `56431`, `73365`, `73889`, `90080`, `90081`. No `exploitedSince` moved. Details also moved for `88445` and `92065`. **Watch** - `EUVD-2026-87958` (Citrix NetScaler) stays at UPTICK: 596 connections from 18 unique IPs (7-day average 11). `EUVD-2026-45205` (Sangoma Switchvox) is UPTICK too: 327 connections from 1 IP. **Unchanged** - Nothing removed, no new honeypot first-seen day, EU KEV register unchanged. 60 entries in the window, 1752 in the EUVD. ### 2026-10-08 06:23 UTC (vs. 2026-10-07 06:23) Two entries joined the window, both through an EU KEV event on 7 October or earlier than the check; twelve existing entries were re-stamped by the EUVD. **New** - `EUVD-2026-75010` (CVE-2026-85103, Check Point Quantum; vendor is assigner): `exploitedSince` 2026-09-25, EU KEV 2026-09-25, not in CISA's catalogue. Listed in the SRP candidates table as "EU KEV only", an indication, not a report. The EUVD record itself dates from 9 September. - `EUVD-2026-22589` (CVE-2026-32202, Microsoft Windows Shell): `exploitedSince` 2026-04-28 (CISA the same day), but EU KEV only on 2026-10-07, so it enters the window by its KEV event. **Changed** - Twelve entries have a new `dateUpdated` (all 2026-10-07, previously July to 1 October), among them `45279` and `45280`, `90080` and `90081`. Details of the NVD, CISA or EUVD records moved for all of them; no `exploitedSince` changed. **Watch** - `EUVD-2026-87958` (Citrix NetScaler) stays at UPTICK: 395 connections from 19 unique IPs on the last day (7-day average 24). **Unchanged** - Nothing removed, no new honeypot first-seen day. 55 entries in the window, 1747 in the EUVD. ### 2026-10-07 06:23 UTC (vs. 2026-10-06 10:48) One honeypot first-seen day moved back two days; no entry was added or removed. **Changed** - `EUVD-2026-67861` (CVE-2026-82329, JFrog Artifactory): honeypot first-seen now 2026-10-04, previously 2026-10-06. The sensor record is also slimmer than yesterday's (no counts, vendor or product fields), so the earlier date may be a backfill rather than new activity. **Watch** - `EUVD-2026-87958` (Citrix NetScaler, CVE-2026-88771) has trend UPTICK: 2,773 connections from 11 unique IPs on 2026-10-07 (7-day average 30). **Unchanged** - 53 entries in the window, 1746 in the EUVD, monthly counts. Daily honeypot counts of `45205` moved (trend DECLINE). ### 2026-10-06 10:48 UTC (vs. 2026-10-06 09:32) The monitor now records the day each KEV catalogue (EU KEV, CISA KEV) added an entry, and lists SRP candidates by stated criteria. Four entries qualify; none is shown to have come through the SRP. **New** - SRP candidates (EU KEV on or after the go-live day, before CISA or without it): `EUVD-2026-84555` (WordPress, EU KEV 2026-09-23, CISA 09-25), `90080` and `90081` (Zammad, 09-30 vs. 10-02), `92065` (NetScaler, 10-02 vs. 10-04; the only one whose vendor is also the assigner). **Fixed** - The three entries not in CISA's catalogue (`70645`, `70647`, `72024`) are EU KEV entries, added before the go-live; the caveat no longer says "some other source". **Watch** - `92065` was in the EU KEV two days before its EUVD publication (2026-10-04). - Zammad (`90080`, `90081`): Zammad GmbH sits in Berlin, so a manufacturer's notification would have gone through Germany, not NCSC-NL. DIVD was itself breached through these flaws on 21 September and reported them to Zammad on 24 September (DIVD-2026-00015); Zammad said on 1 October it had no technical details of the second one. A voluntary notification by DIVD through NCSC-NL fits the dates; nothing public confirms it. **Unchanged** - Entries, `dateUpdated` stamps, monthly counts, honeypot sightings. All 53 rows gained the per-catalogue fields once. ### 2026-10-06 09:32 UTC (vs. 2026-10-06 06:23) The monitor now also records the EUVD's honeypot sensor data (Shadowserver). 4 of the 53 entries have been seen by the sensors; nothing else moved. **New** - Honeypot sightings, with first-seen day: `EUVD-2026-45205` (CVE-2026-9586, Sangoma Switchvox) 2026-09-04; `EUVD-2026-84375` (CVE-2026-93616, Check Point) 2026-09-26, without current counts; `EUVD-2026-87958` (CVE-2026-88771, Citrix NetScaler) 2026-09-29; `EUVD-2026-67861` (CVE-2026-82329, JFrog Artifactory) 2026-10-06. **Watch** - `EUVD-2026-87958`: 3,331 connections from 4 IPs in 24 h, trend UPTICK (7-day average 29). `EUVD-2026-45205` also UPTICK at a low level (25 connections). - `EUVD-2026-67861` has `exploitedSince` 2026-09-02 but was first seen by the sensors today, five weeks later. **Unchanged** - Entries, `dateUpdated` stamps and monthly counts. All 53 rows and detail records changed only by the new honeypot field. ### 2026-10-06 06:23 UTC (vs. 2026-10-05 06:22) Three entries had their `dateUpdated` stamp advanced by the EUVD; no new or removed entries. 53 entries in the window, 1,746 in total. **Changed** - `EUVD-2026-90080` (CVE-2026-102489) and `EUVD-2026-90081` (CVE-2026-102490), Zammad GmbH: `dateUpdated` 2026-10-03 03:55 -> 2026-10-05 10:25. - `EUVD-2026-91042` (CVE-2026-104286, Fortinet FortiMail): `dateUpdated` 2026-10-02 16:56 -> 2026-10-05 15:28. - In the three detail records only the timestamps (`dateUpdated`, `dataProcessed`) differ; descriptions, scores and `exploitedSince` are the same. **Unchanged** - The other 50 entries; monthly counts unchanged. ### 2026-10-05 06:22 UTC (vs. 2026-10-04 first snapshot) One new entry in the window; nothing removed or changed. 53 entries in the window, 1,746 exploited entries in the EUVD in total (was 1,745). **New** - `EUVD-2026-92065` (CVE-2026-88779, Citrix NetScaler ADC and Gateway, memory-buffer restriction flaw, CVSS 4.0 base score 8.7), `exploitedSince` 2026-10-02, published 2026-10-04. Listed in CISA's catalogue (added 2026-10-04, due 2026-10-07); the KEV column shows events on 2026-10-02 and 2026-10-04. **Unchanged** - The other 52 entries and their `dateUpdated` stamps; the October count in the monthly table moves from 1 to 2. ### 2026-10-04 (first snapshot) Baseline created: 52 entries, 49 with `exploitedSince` from 1 September 2026 and 3 more (`EUVD-2026-45279`, `45280`, `50404`) found only through the KEV filter, exploited since July but flagged again inside the window. 1,745 exploited entries in the EUVD in total. Nothing to compare against yet. ## How it is kept A scheduled Routine (`routines/euvd-exploited-monitor.md`) runs `python3 euvd/check_exploited.py` daily. It pages through the whole exploited set, probes the KEV filter day by day and compares the result with `euvd/exploited.json`. On a difference it rewrites that file and the data region above, and the Routine adds a change-log entry. The prose here and the change log are not touched by the script. `dateUpdated` is recorded per entry, so a correction to an entry shows up as a change.