KEV-Exposure Radar
We continuously scan the public internet (via Shodan’s banner data) for servers running a software version with a known, actively-exploited vulnerability — one on CISA’s Known-Exploited-Vulnerabilities (KEV) list. Then we cross-reference our live CVE + KEV + EPSS feed. The result is a list of systems that run a software version that falls inside the documented vulnerable range of a vulnerability attackers are exploiting right now. It’s an exposure signal — not proof of a breach — but a high-fidelity, pre-incident one.
Why this is a risk
A KEV is a vulnerability CISA has confirmed is being exploited in the wild today — working, public exploit code exists and attackers are using it. So when a server on the internet is running an affected version, it is effectively pre-breach:
- • No research needed by the attacker — the exploit is off-the-shelf.
- • These are the exact flaws behind real ransomware and nation-state breaches (e.g. Citrix Bleed, MOVEit, Tomcat RCE).
- • CISA legally mandates U.S. federal agencies to patch KEVs within a deadline — that’s how urgent they are.
Each CVE below links to its full detail — description, the exploited weakness, and remediation.
Newest CISA-KEV additions — and our live exposure
The moment CISA adds a CVE to the Known-Exploited-Vulnerabilities catalog, we re-correlate it against the internet within minutes. Here are the latest additions — and how many exposed hosts we already see for each.
| CVE | Added to KEV | Severity | EPSS | Exposed hosts |
|---|---|---|---|---|
| CVE-2026-0770 | 2026-07-21 | CRITICAL | 10% | — |
| CVE-2026-60137 | 2026-07-21 | CRITICAL | 4% | — |
| CVE-2021-27137 | 2026-07-21 | HIGH | 5% | — |
| CVE-2026-63030 | 2026-07-21 | HIGH | 9% | — |
| CVE-2026-25089 | 2026-07-16 | CRITICAL | 36% | — |
| CVE-2026-39808 | 2026-07-16 | CRITICAL | 84% | — |
| CVE-2026-58644 | 2026-07-16 | CRITICAL | 1% | — |
| CVE-2026-46817 | 2026-07-15 | CRITICAL | 1% | — |
| CVE-2023-4346 | 2026-07-15 | HIGH | 1% | — |
| CVE-2026-15409 | 2026-07-14 | CRITICAL | 1% | — |
| CVE-2026-56155 | 2026-07-14 | HIGH | 0% | — |
| CVE-2026-15410 | 2026-07-14 | HIGH | 1% | — |
| CVE-2026-56164 | 2026-07-14 | MEDIUM | 6% | — |
| CVE-2008-4128 | 2026-07-13 | MEDIUM | 24% | — |
| CVE-2026-56291 | 2026-07-10 | CRITICAL | 9% | — |
New exposures detected per week
Host × CVE exposures we first detected each week (last 12 weeks) — the inflow of newly-exposed internet-facing systems running an actively-exploited version.
Most-exposed actively-exploited CVEs
| CVE | Severity | CVSS | EPSS | Exposed hosts |
|---|---|---|---|---|
| CVE-2025-24813 | CRITICAL | 9.8 | 100% | 4,642 |
| CVE-2016-8735 | CRITICAL | 9.8 | 90% | 4,484 |
| CVE-2023-44487 | HIGH | 7.5 | 100% | 3,013 |
| CVE-2025-14847 | HIGH | 7.5 | 83% | 2,401 |
| CVE-2023-29552 | HIGH | 7.5 | 66% | 1,468 |
| CVE-2024-38475 | CRITICAL | 9.1 | 100% | 874 |
| CVE-2025-7775 | CRITICAL | 9.8 | 19% | 760 |
| CVE-2025-5777🔒 ransomware | HIGH | 7.5 | 100% | 758 |
| CVE-2025-6543 | CRITICAL | 9.8 | 10% | 758 |
| CVE-2023-6549 | HIGH | 8.2 | 80% | 750 |
| CVE-2023-6548 | MEDIUM | 5.5 | 6% | 750 |
| CVE-2023-4966🔒 ransomware | HIGH | 9.4 | 100% | 744 |
By software
- Tomcat4,642
- Mongodb2,401
- Esxi1,468
- Http Server1,397
- Nginx917
- Netscaler Gateway763
- Jenkins626
- Wordpress175
- Internet Information Services70
- Fortios64
- Drupal5
- Pan Os2
By country
- United States2,446
- China1,867
- Germany902
- Australia784
- France629
- Korea, Republic of458
- Japan397
- Brazil361
- India334
- Singapore318
Are you exposed?
Want to know if your infrastructure is in this dataset? Run a free, passive scan of your own internet-facing surface — no agent, no signup required.
Check your exposure →How it works
How do you know it's actually exploitable?
We only count CVEs that are CISA-KEV listed (confirmed exploited in the wild) or carry a high EPSS score (high modeled probability of exploitation). The match is version-precise: we read the product + version from the public banner and check it against the affected ranges in our CVE feed — so we never claim “vulnerable” for a patched version.
Is this passive and legal?
Yes. We read Shodan’s already-public banner catalogue and correlate it with our own CVE/KEV/EPSS data. We never connect to, probe, log into, or access the hosts. It’s standard, read-only threat intelligence — the same data class as Shodan, Censys, and Shadowserver.
Why don't you show the individual IPs?
A public list of vulnerable IPs is a ready-made attacker target list — that would be irresponsible. We keep host details private for responsible disclosure to the affected organisations, and we publish only aggregate counts here. (Use the scanner above to see your own exposure.)
Frequently asked questions
What is the KEV-Exposure Radar?
A live count of internet-facing servers running software versions affected by vulnerabilities CISA lists as actively exploited — its Known Exploited Vulnerabilities (KEV) catalog. EchelonGraph correlates public internet-scan banners with its live CVE, KEV and EPSS feed. The exploits are public and in active use, so these are pre-breach exposures. Counts are aggregate and host-redacted.
What does CISA-KEV (actively exploited) mean?
CISA's Known Exploited Vulnerabilities catalog lists CVEs with confirmed, in-the-wild exploitation. Exposure to a KEV vulnerability is not a theoretical risk — attackers already have a working exploit and are using it now, which is why these should be patched first.
How does EchelonGraph find this without scanning my servers?
Passively. It reads public internet-wide scan banners that advertise a product and version, then matches that version against its live CVE feed and the CISA-KEV catalog. It never exploits or logs in — detect-only — and publishes only aggregate, host-redacted counts.
What should I do if I run an affected version?
Treat it as urgent: upgrade to a fixed release and take the service off the public internet if it does not need to be there. Because the CVE is actively exploited, assume it is being targeted. Cross-check your installed versions against the CISA-KEV catalog.
EchelonGraph-<Radar>/1.0 (+echelongraph.io/responsible-disclosure; support@echelongraph.io) and a From: support@echelongraph.io header. It is a single, passive, read-only check — we never log in, exploit, write, or read your data. Who we are, how we confirm exposures read-only, and how to opt out → Genuine requests also carry a signed receipt you can validate at /verify-scan.