KEV 2026.09.231,721 entries+8 in 7d8 open federal deadlinesas of / search ? keys
Telemetry

Weakness / #7

CWE-502: Unsafe deserialization in CISA KEV

Deserialization of Untrusted Data

Catalog
2026.09.23
Rank
#7 of 185
MITRE
CWE-502 definition

Answer 71 KEV entries list CWE-502 (Unsafe deserialization) as of catalog 2026.09.23, 4.1% of the catalog and rank 7 of 185 weaknesses. The most affected vendor is Microsoft (14).

The software rebuilds objects from attacker-controlled data, which can trigger code execution.

KEV entries
714.1% of catalog
Vendors
36affected
Ransomware: known
2940.8%
First added
2021-11-03
Latest added
2026-08-26

VVendors

Vendors with CWE-502 KEV entries
VendorEntriesShare
Microsoft1419.7%
Oracle68.5%
Adobe57%
Sitecore45.6%
Apache45.6%
SolarWinds34.2%
Cisco22.8%
Fortra22.8%
SAP22.8%
Progress22.8%
Zoho22.8%
Ajax.NET Professional11.4%

TAdditions by year

CWE-502 KEV additions per yearColumn chart of KEV additions per calendar year. 2021: 13; 2022: 11; 2023: 8; 2024: 11; 2025: 15; 2026: 13.0510152021: 13 added1320212022: 11 added1120222023: 8 added820232024: 11 added1120242025: 15 added1520252026: 13 added (year to date)132026
CWE-502 KEV additions by year
YearAdded
202113
202211
20238
202411
202515
202613

PProducts

Products with CWE-502 KEV entries
ProductEntriesShare
Microsoft SharePoint57%
Adobe ColdFusion57%
Microsoft Exchange Server45.6%
SolarWinds Web Help Desk34.2%
Microsoft Windows22.8%
Fortra GoAnywhere MFT22.8%
Sitecore CMS and Experience Platform (XP)22.8%
Zoho ManageEngine22.8%

EAll entries

KEV entries listing CWE-502
CVEVendorProductAddedRansomware
CVE-2021-23758Ajax.NET ProfessionalAjax.NET ProfessionalUnknown
CVE-2026-63077JetBrainsTeamCityKnown
CVE-2026-50522MicrosoftSharePointUnknown
CVE-2026-58644MicrosoftSharePointUnknown
CVE-2026-45659MicrosoftSharePoint ServerKnown
CVE-2026-12569PTCWindchill and FlexPLMKnown
CVE-2026-45247MirasvitMirasvit Full Page Cache WarmerUnknown
CVE-2023-21529MicrosoftExchange ServerKnown
CVE-2026-20131CiscoSecure Firewall Management Center (FMC)Known
CVE-2026-20963MicrosoftSharePointUnknown
CVE-2025-26399SolarWindsWeb Help DeskKnown
CVE-2025-49113RoundcubeWebmailUnknown
CVE-2025-40551SolarWindsWeb Help DeskUnknown
CVE-2025-59287MicrosoftWindowsUnknown
CVE-2025-10035FortraGoAnywhere MFTKnown
CVE-2025-5086Dassault SystèmesDELMIA AprisoUnknown
CVE-2025-53690SitecoreMultiple ProductsUnknown
CVE-2024-8069CitrixSession RecordingUnknown
CVE-2025-53770MicrosoftSharePointKnown
CVE-2025-24016WazuhWazuh ServerUnknown
CVE-2025-42999SAPNetWeaverKnown
CVE-2025-24813ApacheTomcatUnknown
CVE-2019-9875SitecoreCMS and Experience Platform (XP)Unknown
CVE-2019-9874SitecoreCMS and Experience Platform (XP)Unknown
CVE-2024-20953OracleAgile Product Lifecycle Management (PLM)Unknown
CVE-2017-3066AdobeColdFusionUnknown
CVE-2025-0994TrimbleCityworksUnknown
CVE-2025-23006SonicWallSMA1000 AppliancesKnown
CVE-2024-38094MicrosoftSharePointKnown
CVE-2024-40711VeeamBackup & ReplicationKnown
CVE-2019-0344SAPCommerce CloudUnknown
CVE-2022-21445OracleADF FacesUnknown
CVE-2020-0618MicrosoftSQL ServerKnown
CVE-2024-28986SolarWindsWeb Help DeskUnknown
CVE-2018-0824MicrosoftWindowsUnknown
CVE-2023-43208NextGen HealthcareMirth ConnectKnown
CVE-2018-15133LaravelLaravel FrameworkUnknown
CVE-2023-38203AdobeColdFusionKnown
CVE-2023-29300AdobeColdFusionKnown
CVE-2023-46604ApacheActiveMQKnown
CVE-2023-40044ProgressWS_FTP ServerKnown
CVE-2023-26359AdobeColdFusionUnknown
CVE-2022-31199NetwrixAuditorKnown
CVE-2021-39144XStreamXStreamUnknown
CVE-2020-5741PlexMedia ServerUnknown
CVE-2022-47986IBMAspera FaspexKnown
CVE-2023-0669FortraGoAnywhere MFTKnown
CVE-2021-35587OracleFusion MiddlewareUnknown
CVE-2022-41082MicrosoftExchange ServerKnown
CVE-2022-35405ZohoManageEngineUnknown
CVE-2018-2628OracleWebLogic ServerUnknown
CVE-2021-31010AppleiOS, macOS, watchOSUnknown
CVE-2019-15271CiscoRV Series RoutersUnknown
CVE-2021-27852CheckboxCheckbox SurveyUnknown
CVE-2021-42237SitecoreXPKnown
CVE-2019-6340DrupalCoreUnknown
CVE-2019-10068KenticoXperienceUnknown
CVE-2018-1000861JenkinsJenkins Stapler Web FrameworkUnknown
CVE-2021-44228ApacheLog4j2Known
CVE-2017-12149Red HatJBoss Application ServerKnown
CVE-2021-42321MicrosoftExchangeKnown
CVE-2021-35464ForgeRockAccess Management (AM)Known
CVE-2021-26857MicrosoftExchange ServerKnown
CVE-2020-7961LiferayLiferay PortalUnknown
CVE-2020-2555OracleMultiple ProductsUnknown
CVE-2020-17144MicrosoftExchange ServerUnknown
CVE-2020-10189ZohoManageEngineUnknown
CVE-2019-18935ProgressTelerik UI for ASP.NET AJAXKnown
CVE-2018-4939AdobeColdFusionUnknown
CVE-2017-9805ApacheStrutsUnknown
CVE-2015-4852OracleWebLogic ServerUnknown

Cite this

71 CISA KEV entries list CWE-502 (Unsafe deserialization), 4.1% of the catalog. Source: Telemetry analysis of the CISA Known Exploited Vulnerabilities catalog, version 2026.09.23 (released 2026-09-23). https://glide-telemetry.pages.dev/cwe/cwe-502/

Source: CISA KEV catalog v2026.09.23, released 2026-09-23. Windows end 2026-09-23.

Keyboard shortcuts

Keyboard shortcuts
/Focus search
?Show this panel
EscClose panel or clear search
g dGo to Dashboard
g kGo to KEV
g vGo to Vendors
g pGo to Products
g wGo to Weaknesses
g sGo to Stats
g rGo to Regulations
g bGo to Briefings
g aGo to API