KEV 2026.10.301,766 entries+10 in 7d11 open federal deadlinesas of / search ? keys
KEV Now

Weakness / #20

CWE-918: Server-side request forgery in CISA KEV

Server-Side Request Forgery (SSRF)

Catalog
2026.10.30
Rank
#20 of 198
MITRE
CWE-918 definition

Answer 24 KEV entries list CWE-918 (Server-side request forgery) as of catalog 2026.10.30, 1.4% of the catalog and rank 20 of 198 weaknesses. The most affected vendor is Microsoft (4).

An attacker makes the server send requests to destinations of the attacker's choosing, often internal systems.

KEV entries
241.4% of catalog
Vendors
15affected
Ransomware: known
1041.7%
First added
2021-11-03
Latest added
2026-10-20

VVendors

Vendors with CWE-918 KEV entries
VendorEntriesShare
Microsoft416.7%
VMware312.5%
Plex28.3%
SonicWall28.3%
GitLab28.3%
Synacor28.3%
Kestra14.2%
MLflow14.2%
Cisco14.2%
Omnissa14.2%
Oracle14.2%
Adminer14.2%

TAdditions by year

CWE-918 KEV additions per yearColumn chart of KEV additions per calendar year. 2021: 5; 2022: 3; 2023: 1; 2024: 1; 2025: 3; 2026: 11.0510152021: 5 added520212022: 3 added320222023: 1 added120232024: 1 added120242025: 3 added320252026: 11 added (year to date)112026
CWE-918 KEV additions by year
YearAdded
20215
20223
20231
20241
20253
202611

PProducts

Products with CWE-918 KEV entries
ProductEntriesShare
Microsoft Exchange Server312.5%
Plex Media Server28.3%
SonicWall SMA1000 Appliances28.3%
Kestra Kestra OSS14.2%
MLflow MLflow14.2%
Cisco Unified Communications Manager14.2%
Omnissa Workspace One UEM14.2%
GitLab GitLab14.2%

EAll entries

KEV entries listing CWE-918
CVEVendorProductAddedRansomware
CVE-2026-96655PlexMedia ServerUnknown
CVE-2026-96652PlexMedia ServerUnknown
CVE-2026-83548SonicWallSMA1000 AppliancesUnknown
CVE-2026-49869KestraKestra OSSUnknown
CVE-2026-64849MLflowMLflowUnknown
CVE-2026-15409SonicWallSMA1000 AppliancesKnown
CVE-2026-20230CiscoUnified Communications ManagerUnknown
CVE-2021-22054OmnissaWorkspace One UEMUnknown
CVE-2021-22175GitLabGitLabUnknown
CVE-2020-7796SynacorZimbra Collaboration SuiteUnknown
CVE-2021-39935GitLabCommunity and Enterprise EditionsUnknown
CVE-2025-61884OracleE-Business SuiteKnown
CVE-2021-21311AdminerAdminerUnknown
CVE-2019-9621SynacorZimbra Collaboration Suite (ZCS)Unknown
CVE-2024-21893IvantiConnect Secure, Policy Secure, and NeuronsKnown
CVE-2023-41763MicrosoftSkype for BusinessUnknown
CVE-2022-41040MicrosoftExchange ServerKnown
CVE-2021-21973VMwarevCenter Server and Cloud FoundationUnknown
CVE-2021-21975VMwarevRealize Operations Manager APIKnown
CVE-2021-40438ApacheApacheKnown
CVE-2021-34473MicrosoftExchange ServerKnown
CVE-2021-27103AccellionFTAKnown
CVE-2021-26855MicrosoftExchange ServerKnown
CVE-2021-21985VMwarevCenter ServerKnown

Cite this

24 CISA KEV entries list CWE-918 (Server-side request forgery), 1.4% of the catalog. Source: KEV Now analysis of the CISA Known Exploited Vulnerabilities catalog, version 2026.10.30 (released 2026-10-30). https://kevnow.com/cwe/cwe-918/

Source: CISA KEV catalog v2026.10.30, released 2026-10-30. Windows end 2026-10-30.

Keyboard shortcuts

Keyboard shortcuts
/Focus search
?Show this panel
EscClose panel or clear search
g dGo to Dashboard
g kGo to KEV
g vGo to Vendors
g pGo to Products
g wGo to Weaknesses
g sGo to Stats
g rGo to Regulations
g bGo to Briefings