KEV 2026.09.231,721 entries+8 in 7d8 open federal deadlinesas of / search ? keys
Telemetry

Weakness / #2

CWE-78: OS command injection in CISA KEV

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Catalog
2026.09.23
Rank
#2 of 185
MITRE
CWE-78 definition

Answer 110 KEV entries list CWE-78 (OS command injection) as of catalog 2026.09.23, 6.4% of the catalog and rank 2 of 185 weaknesses. The most affected vendor is D-Link (11).

Attacker input is passed to an operating-system shell, letting the attacker run their own commands.

KEV entries
1106.4% of catalog
Vendors
65affected
Ransomware: known
1210.9%
First added
2021-11-03
Latest added
2026-09-02

VVendors

Vendors with CWE-78 KEV entries
VendorEntriesShare
D-Link1110%
Zyxel87.3%
Cisco43.6%
Nagios43.6%
SonicWall32.7%
Fortinet32.7%
Ivanti32.7%
GNU32.7%
DrayTek32.7%
QNAP32.7%
Apache32.7%
BeyondTrust21.8%

TAdditions by year

CWE-78 KEV additions per yearColumn chart of KEV additions per calendar year. 2021: 19; 2022: 32; 2023: 14; 2024: 14; 2025: 18; 2026: 13.0102030402021: 19 added1920212022: 32 added3220222023: 14 added1420232024: 14 added1420242025: 18 added1820252026: 13 added (year to date)132026
CWE-78 KEV additions by year
YearAdded
202119
202232
202314
202414
202518
202613

PProducts

Products with CWE-78 KEV entries
ProductEntriesShare
Nagios Nagios XI43.6%
D-Link Multiple Routers32.7%
Fortinet FortiSandbox21.8%
CWP Control Web Panel21.8%
GeoVision Multiple Devices21.8%
SonicWall SMA100 Appliances21.8%
Zyxel DSL CPE Devices21.8%
DrayTek Multiple Vigor Routers21.8%

EAll entries

KEV entries listing CWE-78
CVEVendorProductAddedRansomware
CVE-2026-83549SonicWallSMA1000 AppliancesUnknown
CVE-2026-49869KestraKestra OSSUnknown
CVE-2026-73570SynacorZimbra Collaboration Suite (ZCS)Unknown
CVE-2026-16812AristaVeloCloud OrchestratorUnknown
CVE-2026-39808FortinetFortiSandboxUnknown
CVE-2026-25089FortinetFortiSandboxUnknown
CVE-2025-67038LantronixEDS5000Unknown
CVE-2026-10520IvantiSentryUnknown
CVE-2026-42271BerriAILiteLLMUnknown
CVE-2026-25108Soliton Systems K.KFileZenUnknown
CVE-2026-1731BeyondTrustRemote Support (RS) and Privileged Remote Access (PRA)Known
CVE-2025-11953React Native CommunityCLIUnknown
CVE-2025-64328SangomaFreePBX Unknown
CVE-2025-66644Array Networks ArrayOS AGUnknown
CVE-2025-58034FortinetFortiWebUnknown
CVE-2025-48703CWPControl Web PanelUnknown
CVE-2014-6278GNUGNU BashUnknown
CVE-2025-9377TP-LinkMultiple RoutersUnknown
CVE-2025-54948Trend MicroApex OneUnknown
CVE-2023-39780ASUSRT-AX55 RoutersUnknown
CVE-2024-12987DrayTekVigor RoutersUnknown
CVE-2024-6047GeoVisionMultiple DevicesUnknown
CVE-2024-11120GeoVisionMultiple DevicesUnknown
CVE-2023-44221SonicWallSMA100 AppliancesUnknown
CVE-2021-20035SonicWallSMA100 AppliancesUnknown
CVE-2025-1316EdimaxIC-7100 IP CameraUnknown
CVE-2024-40891ZyxelDSL CPE DevicesUnknown
CVE-2024-40890ZyxelDSL CPE DevicesUnknown
CVE-2018-9276PaesslerPRTG Network MonitorUnknown
CVE-2024-50603AviatrixControllersUnknown
CVE-2024-12686BeyondTrustPrivileged Remote Access (PRA) and Remote Support (RS)Unknown
CVE-2021-40407ReolinkRLC-410W IP CameraUnknown
CVE-2019-11001ReolinkMultiple IP CamerasUnknown
CVE-2018-14933NUUONVRmini DevicesUnknown
CVE-2024-1212ProgressKemp LoadMasterUnknown
CVE-2024-9463Palo Alto NetworksExpeditionUnknown
CVE-2024-8957PTZOpticsPT30X-SDI/NDI CamerasUnknown
CVE-2023-25280D-LinkDIR-820 RouterUnknown
CVE-2020-15415DrayTekMultiple Vigor RoutersUnknown
CVE-2024-8190IvantiCloud Services ApplianceUnknown
CVE-2024-20399CiscoNX-OSUnknown
CVE-2024-4577PHP GroupPHPKnown
CVE-2017-3506OracleWebLogic ServerUnknown
CVE-2019-7256NiceLinear eMerge E3-SeriesUnknown
CVE-2021-36380SunhilloSureLineUnknown
CVE-2023-49897FXCAE1021, AE1021PEUnknown
CVE-2023-47565QNAPVioStor NVRUnknown
CVE-2023-20273CiscoCisco IOS XE Web UIUnknown
CVE-2017-6884ZyxelEMG2926 RoutersKnown
CVE-2017-18368ZyxelP660HN-T1A RoutersUnknown
CVE-2022-29303SolarViewCompactUnknown
CVE-2019-20500D-LinkDWL-2600AP Access PointUnknown
CVE-2019-17621D-LinkDIR-859 RouterUnknown
CVE-2023-27992ZyxelMultiple Network-Attached Storage (NAS) DevicesUnknown
CVE-2020-12641RoundcubeRoundcube WebmailUnknown
CVE-2023-28771ZyxelMultiple FirewallsUnknown
CVE-2022-33891ApacheSparkUnknown
CVE-2022-28810ZohoManageEngineUnknown
CVE-2022-44877CWPControl Web PanelUnknown
CVE-2022-36804AtlassianBitbucket Server and Data CenterUnknown
CVE-2022-26258D-LinkDIR-820LUnknown
CVE-2018-6530D-LinkMultiple RoutersKnown
CVE-2018-19949QNAPNetwork Attached Storage (NAS)Known
CVE-2022-30525ZyxelMultiple FirewallsUnknown
CVE-2019-16057D-LinkDNS-320 Storage DeviceKnown
CVE-2020-2509QNAPQNAP Network-Attached Storage (NAS)Unknown
CVE-2021-45382D-LinkMultiple RoutersUnknown
CVE-2018-10562DasanGigabit Passive Optical Network (GPON) RoutersKnown
CVE-2020-9377D-LinkDIR-610 DevicesUnknown
CVE-2020-9054ZyxelMultiple Network-Attached Storage (NAS) DevicesUnknown
CVE-2020-7247OpenBSDOpenSMTPDUnknown
CVE-2020-25223SophosSG UTMUnknown
CVE-2020-1956ApacheKylinUnknown
CVE-2019-16920D-LinkMultiple RoutersUnknown
CVE-2019-15107WebminWebminKnown
CVE-2019-12991CitrixSD-WAN and NetScalerUnknown
CVE-2018-6961VMwareSD-WAN EdgeUnknown
CVE-2018-14839LGN1A1 NASUnknown
CVE-2018-11138QuestKACE System Management ApplianceKnown
CVE-2017-6334NETGEARDGN2200 DevicesUnknown
CVE-2016-11021D-LinkDCS-930L DevicesUnknown
CVE-2017-6077NETGEARWireless Router DGN2200Unknown
CVE-2014-7169GNUBourne-Again Shell (Bash)Unknown
CVE-2014-6271GNUBourne-Again Shell (Bash)Unknown
CVE-2021-25298NagiosNagios XIUnknown
CVE-2021-25297NagiosNagios XIUnknown
CVE-2021-25296NagiosNagios XIUnknown
CVE-2021-21315Npm packageSystem Information Library for Node.JSUnknown
CVE-2020-11978ApacheAirflowUnknown
CVE-2021-36260HikvisionSecurity cameras web serverUnknown
CVE-2019-10149EximMail Transfer Agent (MTA)Unknown
CVE-2021-35394RealtekJungle Software Development Kit (SDK)Unknown
CVE-2020-8816Pi-holeAdminLTEUnknown
CVE-2021-27561YealinkDevice ManagementUnknown
CVE-2021-27104AccellionFTAKnown
CVE-2021-27102AccellionFTAKnown
CVE-2021-22502Micro FocusOperation Bridge Reporter (OBR)Unknown
CVE-2021-1498CiscoHyperFlex HXUnknown
CVE-2021-1497CiscoHyperFlex HXUnknown
CVE-2020-8515DrayTekMultiple Vigor RoutersUnknown
CVE-2020-4428IBMData Risk ManagerUnknown
CVE-2020-4006VMwareMultiple ProductsUnknown
CVE-2020-25506D-LinkDNS-320 DeviceUnknown
CVE-2020-16846SaltStackSaltUnknown
CVE-2020-10987TendaAC1900 Router AC15 ModelUnknown
CVE-2020-10221rConfigrConfigUnknown
CVE-2019-19356NetisWF2419 DevicesUnknown
CVE-2019-15949NagiosNagios XIUnknown
CVE-2019-11539IvantiPulse Connect Secure and Pulse Policy SecureKnown
CVE-2018-14558TendaAC7, AC9, and AC10 RoutersUnknown

Cite this

110 CISA KEV entries list CWE-78 (OS command injection), 6.4% of the catalog. Source: Telemetry analysis of the CISA Known Exploited Vulnerabilities catalog, version 2026.09.23 (released 2026-09-23). https://glide-telemetry.pages.dev/cwe/cwe-78/

Source: CISA KEV catalog v2026.09.23, released 2026-09-23. Windows end 2026-09-23.

Keyboard shortcuts

Keyboard shortcuts
/Focus search
?Show this panel
EscClose panel or clear search
g dGo to Dashboard
g kGo to KEV
g vGo to Vendors
g pGo to Products
g wGo to Weaknesses
g sGo to Stats
g rGo to Regulations
g bGo to Briefings
g aGo to API