KEV 2026.09.231,721 entries+8 in 7d8 open federal deadlinesas of / search ? keys
Telemetry

Weakness / #19

CWE-434: Unrestricted file upload in CISA KEV

Unrestricted Upload of File with Dangerous Type

Catalog
2026.09.23
Rank
#19 of 185
MITRE
CWE-434 definition

Answer 23 KEV entries list CWE-434 (Unrestricted file upload) as of catalog 2026.09.23, 1.3% of the catalog and rank 19 of 185 weaknesses. The most affected vendor is Apache (2).

An attacker can upload a file, such as a web shell, that the server will then execute.

KEV entries
231.3% of catalog
Vendors
22affected
Ransomware: known
626.1%
First added
2021-11-03
Latest added
2026-07-10

VVendors

Vendors with CWE-434 KEV entries
VendorEntriesShare
Apache28.7%
Balbooa14.3%
iCagenda14.3%
JoomShaper14.3%
Samsung14.3%
Kentico14.3%
TeamT514.3%
SmarterTools14.3%
Sierra Wireless14.3%
OpenPLC14.3%
SAP14.3%
Advantive14.3%

TAdditions by year

CWE-434 KEV additions per yearColumn chart of KEV additions per calendar year. 2021: 6; 2022: 4; 2023: 0; 2024: 2; 2025: 4; 2026: 7.024682021: 6 added620212022: 4 added420222023: 0 added20232024: 2 added220242025: 4 added420252026: 7 added (year to date)72026
CWE-434 KEV additions by year
YearAdded
20216
20224
20230
20242
20254
20267

PProducts

Products with CWE-434 KEV entries
ProductEntriesShare
Apache Tomcat28.7%
Balbooa Forms14.3%
iCagenda iCagenda14.3%
JoomShaper SP Page Builder14.3%
Samsung MagicINFO 9 Server14.3%
Kentico Kentico Xperience14.3%
TeamT5 ThreatSonar Anti-Ransomware14.3%
SmarterTools SmarterMail14.3%

EAll entries

KEV entries listing CWE-434
CVEVendorProductAddedRansomware
CVE-2026-56291BalbooaFormsUnknown
CVE-2026-48939iCagendaiCagendaUnknown
CVE-2026-48908JoomShaperSP Page BuilderUnknown
CVE-2024-7399SamsungMagicINFO 9 ServerUnknown
CVE-2025-2749KenticoKentico XperienceUnknown
CVE-2024-7694TeamT5ThreatSonar Anti-RansomwareUnknown
CVE-2025-52691SmarterToolsSmarterMailKnown
CVE-2018-4063Sierra WirelessAirLink ALEOSUnknown
CVE-2021-26828OpenPLCScadaBRUnknown
CVE-2025-31324SAPNetWeaverKnown
CVE-2024-57968AdvantiveVeraCoreUnknown
CVE-2024-50623CleoMultiple ProductsKnown
CVE-2024-39717VersaDirectorUnknown
CVE-2017-12617ApacheTomcatUnknown
CVE-2017-12615ApacheTomcatKnown
CVE-2020-13671DrupalDrupal coreUnknown
CVE-2021-27860FatPipeWARP, IPVPN, and MPVPN softwareUnknown
CVE-2021-31207MicrosoftExchange ServerKnown
CVE-2021-20022SonicWallSonicWall Email SecurityKnown
CVE-2020-8260IvantiPulse Connect SecureUnknown
CVE-2020-25213WordPressFile Manager PluginUnknown
CVE-2019-8394ZohoManageEngineUnknown
CVE-2018-15961AdobeColdFusionUnknown

Cite this

23 CISA KEV entries list CWE-434 (Unrestricted file upload), 1.3% of the catalog. Source: Telemetry analysis of the CISA Known Exploited Vulnerabilities catalog, version 2026.09.23 (released 2026-09-23). https://glide-telemetry.pages.dev/cwe/cwe-434/

Source: CISA KEV catalog v2026.09.23, released 2026-09-23. Windows end 2026-09-23.

Keyboard shortcuts

Keyboard shortcuts
/Focus search
?Show this panel
EscClose panel or clear search
g dGo to Dashboard
g kGo to KEV
g vGo to Vendors
g pGo to Products
g wGo to Weaknesses
g sGo to Stats
g rGo to Regulations
g bGo to Briefings
g aGo to API