KEV 2026.09.231,721 entries+8 in 7d8 open federal deadlinesas of / search ? keys
Telemetry

Weakness / #8

CWE-94: Code injection in CISA KEV

Improper Control of Generation of Code ('Code Injection')

Catalog
2026.09.23
Rank
#8 of 185
MITRE
CWE-94 definition

Answer 70 KEV entries list CWE-94 (Code injection) as of catalog 2026.09.23, 4.1% of the catalog and rank 8 of 185 weaknesses. The most affected vendor is Microsoft (16).

Attacker input is treated as code and executed by the application.

KEV entries
704.1% of catalog
Vendors
37affected
Ransomware: known
1115.7%
First added
2021-11-03
Latest added
2026-08-25

VVendors

Vendors with CWE-94 KEV entries
VendorEntriesShare
Microsoft1622.9%
Ivanti710%
IBM34.3%
Apache34.3%
Craft CMS34.3%
VMware34.3%
Cisco22.9%
Citrix22.9%
VMware Tanzu22.9%
Adobe22.9%
Gitea11.4%
TrueConf11.4%

TAdditions by year

CWE-94 KEV additions per yearColumn chart of KEV additions per calendar year. 2021: 9; 2022: 23; 2023: 9; 2024: 6; 2025: 6; 2026: 17.01020302021: 9 added920212022: 23 added2320222023: 9 added920232024: 6 added620242025: 6 added620252026: 17 added (year to date)172026
CWE-94 KEV additions by year
YearAdded
20219
202223
20239
20246
20256
202617

PProducts

Products with CWE-94 KEV entries
ProductEntriesShare
Microsoft Windows45.7%
Microsoft Office45.7%
Ivanti Endpoint Manager Mobile (EPMM)34.3%
Craft CMS Craft CMS34.3%
Ivanti Pulse Connect Secure34.3%
Citrix NetScaler ADC and NetScaler Gateway22.9%
Microsoft Internet Explorer22.9%
Gitea Gitea11.4%

EAll entries

KEV entries listing CWE-94
CVEVendorProductAddedRansomware
CVE-2026-60004GiteaGiteaUnknown
CVE-2026-72530TrueConfServerUnknown
CVE-2025-62593Ray-ProjectRayUnknown
CVE-2026-9198IBMLangflowUnknown
CVE-2026-15410SonicWallSMA1000 AppliancesKnown
CVE-2025-67038LantronixEDS5000Unknown
CVE-2008-4250MicrosoftWindowsUnknown
CVE-2026-34197ApacheActiveMQUnknown
CVE-2009-0238MicrosoftOfficeUnknown
CVE-2026-1340IvantiEndpoint Manager Mobile (EPMM)Unknown
CVE-2026-33017LangflowLangflowUnknown
CVE-2025-54068LaravelLivewireUnknown
CVE-2025-32432Craft CMSCraft CMSUnknown
CVE-2026-1281IvantiEndpoint Manager Mobile (EPMM)Unknown
CVE-2026-20045CiscoUnified Communications ManagerUnknown
CVE-2025-37164Hewlett Packard Enterprise (HPE)OneViewUnknown
CVE-2009-0556MicrosoftOfficeUnknown
CVE-2025-6204Dassault SystèmesDELMIA AprisoUnknown
CVE-2025-49704MicrosoftSharePointKnown
CVE-2024-56145Craft CMSCraft CMSUnknown
CVE-2025-4428IvantiEndpoint Manager Mobile (EPMM)Unknown
CVE-2025-1976BroadcomBrocade Fabric OSUnknown
CVE-2025-23209Craft CMSCraft CMSUnknown
CVE-2022-24816OSGeoJAI-EXTUnknown
CVE-2024-20359CiscoAdaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)Unknown
CVE-2023-24955MicrosoftSharePoint ServerKnown
CVE-2021-44529IvantiEndpoint Manager Cloud Service Appliance (EPM CSA)Known
CVE-2024-21351MicrosoftWindowsUnknown
CVE-2023-6548CitrixNetScaler ADC and NetScaler GatewayUnknown
CVE-2018-14667Red HatJBoss RichFaces FrameworkUnknown
CVE-2023-33246ApacheRocketMQUnknown
CVE-2023-3519CitrixNetScaler ADC and NetScaler GatewayKnown
CVE-2023-25717Ruckus WirelessMultiple ProductsUnknown
CVE-2023-29492Novi SurveyNovi SurveyUnknown
CVE-2017-7494SambaSambaKnown
CVE-2013-3163MicrosoftInternet ExplorerUnknown
CVE-2021-39144XStreamXStreamUnknown
CVE-2022-41223MitelMiVoice ConnectKnown
CVE-2022-3236SophosFirewallUnknown
CVE-2022-22963VMware TanzuSpring CloudUnknown
CVE-2009-1862AdobeAcrobat and Reader, Flash PlayerUnknown
CVE-2009-0557MicrosoftOfficeUnknown
CVE-2014-4148MicrosoftWindowsUnknown
CVE-2022-22947VMwareSpring Cloud GatewayUnknown
CVE-2022-22954VMwareWorkspace ONE Access and Identity ManagerKnown
CVE-2022-22965VMwareSpring FrameworkUnknown
CVE-2018-1273VMware TanzuSpring Data CommonsKnown
CVE-2014-6287RejettoHTTP File Server (HFS)Unknown
CVE-2013-4810Hewlett Packard (HP)ProCurve Manager (PCM), PCM+, Identity Driven Manager (IDM), and Application Lifecycle ManagementUnknown
CVE-2009-1151phpMyAdminphpMyAdminUnknown
CVE-2020-8218Pulse SecurePulse Connect SecureUnknown
CVE-2013-1347MicrosoftInternet ExplorerUnknown
CVE-2012-1856MicrosoftOfficeUnknown
CVE-2010-0188AdobeReader and AcrobatKnown
CVE-2009-3129MicrosoftExcelUnknown
CVE-2014-6352MicrosoftWindowsUnknown
CVE-2017-9841PHPUnitPHPUnitUnknown
CVE-2013-3906MicrosoftGraphics ComponentUnknown
CVE-2015-1635MicrosoftHTTP.sysUnknown
CVE-2019-7609ElasticKibanaUnknown
CVE-2015-7450IBMWebSphere Application Server and Server Hypervisor EditionUnknown
CVE-2019-0193ApacheSolrUnknown
CVE-2021-22900IvantiPulse Connect SecureUnknown
CVE-2021-22894IvantiPulse Connect SecureUnknown
CVE-2020-8644PlaySMSPlaySMSUnknown
CVE-2020-8243IvantiPulse Connect SecureUnknown
CVE-2019-9082ThinkPHPThinkPHPUnknown
CVE-2019-4716IBMPlanning AnalyticsUnknown
CVE-2019-16759vBulletinvBulletinUnknown
CVE-2012-0158MicrosoftMSCOMCTL.OCXKnown

Cite this

70 CISA KEV entries list CWE-94 (Code injection), 4.1% of the catalog. Source: Telemetry analysis of the CISA Known Exploited Vulnerabilities catalog, version 2026.09.23 (released 2026-09-23). https://glide-telemetry.pages.dev/cwe/cwe-94/

Source: CISA KEV catalog v2026.09.23, released 2026-09-23. Windows end 2026-09-23.

Keyboard shortcuts

Keyboard shortcuts
/Focus search
?Show this panel
EscClose panel or clear search
g dGo to Dashboard
g kGo to KEV
g vGo to Vendors
g pGo to Products
g wGo to Weaknesses
g sGo to Stats
g rGo to Regulations
g bGo to Briefings
g aGo to API