KEV-Exposure Radar
Every 12 hours, when Shodan query credits allow, we search Shodan’s banner data for servers running a software version with a known, actively-exploited vulnerability — one on CISA’s Known-Exploited-Vulnerabilities (KEV) list. Then we cross-reference our CVE + KEV + EPSS feed. The result is a count of internet-facing services (distinct ip:port) whose banner reports a software version inside the documented vulnerable range of a vulnerability CISA lists as exploited in the wild. It is a banner-version match: an exposure signal, not proof of a breach.
These counts are derived from Shodan data. Shodan data is owned by Shodan, which holds its copyright (© Shodan). EchelonGraph claims no ownership of it or copyright in it.
How it counts: every 12 hours, when Shodan query credits allow, the radar runs one Shodan query per tracked product, reads up to 100 ip:port services per query, and keeps a service when its banner version matches a CISA-KEV or high-EPSS CVE; the counts on this page are the CISA-KEV matches. A service is dropped when neither a search nor a Shodan InternetDB port re-check has refreshed it for 21 days. A re-check that finds the port still listed by Shodan InternetDB refreshes the service without re-reading the banner, so a patched service can stay counted while its port stays open. A count is a banner-version inference over a sample, not an exploit test and not an internet-wide census, and the unit is a service, not a machine: a machine answering on two ports counts twice.
Why this is a risk
A KEV is a vulnerability CISA has confirmed is being exploited in the wild today — working, public exploit code exists and attackers are using it. So when a server on the internet is running an affected version, it is effectively pre-breach:
- • No research needed by the attacker — the exploit is off-the-shelf.
- • These are the exact flaws behind real ransomware and nation-state breaches (e.g. Citrix Bleed, MOVEit, Tomcat RCE).
- • CISA legally mandates U.S. federal agencies to patch KEVs within a deadline — that’s how urgent they are.
Each CVE below links to its full detail — description, the exploited weakness, and remediation.
Newest CISA-KEV additions — and the exposure we have on record
We check CISA’s Known-Exploited-Vulnerabilities catalog every 5 minutes. When it adds a CVE, the radar runs its Shodan search straight away instead of waiting for its next 12-hour cycle, when Shodan query credits allow; a new KEV shows exposure here only if it affects a product the radar tracks. Here are the latest additions — and how many exposed services we have on record for each.
| CVE | Added to KEV | Severity | EPSS | Exposed services |
|---|---|---|---|---|
| CVE-2026-106931 | 2026-10-20 | HIGH | 0.7% | — |
| CVE-2026-96656 | 2026-10-20 | HIGH | 0.4% | — |
| CVE-2026-110936 | 2026-10-20 | MEDIUM | 0.1% | — |
| CVE-2026-96654 | 2026-10-20 | MEDIUM | 0.2% | — |
| CVE-2026-96652 | 2026-10-20 | MEDIUM | 0.2% | — |
| CVE-2026-96655 | 2026-10-20 | MEDIUM | 0.2% | — |
| CVE-2026-102764 | 2026-10-16 | CRITICAL | 1.2% | — |
| CVE-2025-61624 | 2026-10-16 | MEDIUM | 1.1% | — |
| CVE-2026-21589 | 2026-10-15 | HIGH | 13% | — |
| CVE-2026-105134 | 2026-10-14 | CRITICAL | 4.8% | — |
| CVE-2026-76519 | 2026-10-14 | CRITICAL | 1.6% | — |
| CVE-2026-105133 | 2026-10-14 | HIGH | 0.9% | — |
| CVE-2026-0322 | 2026-10-14 | HIGH | 1.2% | — |
| CVE-2026-96951 | 2026-10-13 | HIGH | 1.5% | — |
| CVE-2026-104935 | 2026-10-13 | HIGH | 26% | — |
New exposures detected per week
Service × CVE exposures we first detected each week (last 12 weeks) — the inflow of newly-exposed internet-facing services (distinct ip:port) running an actively-exploited version.
Most-exposed actively-exploited CVEs
| CVE | Severity | CVSS | EPSS | Exposed services |
|---|---|---|---|---|
| CVE-2025-24813 | CRITICAL | 9.8 | 99.9% | 4,385 |
| CVE-2023-44487 | HIGH | 7.5 | >99.9% | 4,331 |
| CVE-2016-8735 | CRITICAL | 9.8 | 90% | 4,155 |
| CVE-2025-14847 | HIGH | 7.5 | 83% | 2,939 |
| CVE-2026-19490 | CRITICAL | 9.8 | 23% | 2,915 |
| CVE-2026-3055 | CRITICAL | 9.8 | 4.0% | 2,915 |
| CVE-2026-8452 | CRITICAL | 9.8 | 1.0% | 2,915 |
| CVE-2026-88772 | HIGH | 8.1 | 1.3% | 2,915 |
| CVE-2026-88771 | CRITICAL | 9.8 | 1.1% | 2,914 |
| CVE-2025-7775 | CRITICAL | 9.8 | 20% | 2,836 |
| CVE-2023-6548 | MEDIUM | 5.5 | 3.2% | 2,818 |
| CVE-2023-6549 | HIGH | 8.2 | 58% | 2,818 |
By software
- Tomcat4,399
- Netscaler Gateway2,940
- Mongodb2,939
- Esxi2,747
- Http Server2,099
- Jenkins1,170
- Nginx963
- Wordpress594
- Fortios211
- Internet Information Services111
- Pan Os22
By country
- United States3,370
- China2,416
- Germany2,332
- Australia1,291
- France964
- Brazil624
- Korea, Republic of595
- Japan508
- Singapore425
- India390
Are you exposed?
Want to know if your infrastructure is in this dataset? Run a free external scan of your internet-facing surface — no agent, no signup required.
Check your exposure →How it works
How do you know it's actually exploitable?
We only count CVEs that are CISA-KEV listed (confirmed exploited in the wild) or carry a high EPSS score (high modeled probability of exploitation). The match is version-precise: we read the product + version from the public banner and check it against the affected ranges in our CVE feed, so a banner that reports a patched version is not counted. A later port re-check does not re-read the banner, so a service patched after it was counted can stay counted while its port stays open (see “How it counts” above).
Is this passive and legal?
Yes. We read Shodan’s already-public banner catalogue and correlate it with our own CVE/KEV/EPSS data. We never connect to, probe, log into, or access the hosts. It’s standard, read-only threat intelligence — the same data class as Shodan, Censys, and Shadowserver.
Why don't you show the individual IPs?
A public list of vulnerable IPs is a ready-made attacker target list — that would be irresponsible. We keep host details private for responsible disclosure to the affected organisations, and we publish only aggregate counts here. (Use the scanner above to see your own exposure.)
Frequently asked questions
What is the KEV-Exposure Radar?
A count of internet-facing services (ip:port) running software versions affected by vulnerabilities CISA lists as actively exploited — its Known Exploited Vulnerabilities (KEV) catalog — searched every 12 hours when Shodan query credits allow. EchelonGraph correlates public internet-scan banners (Shodan data) with its CVE, KEV and EPSS feed. The exploits are public and in active use, so these are pre-breach exposures. Counts are aggregate and host-redacted.
What does CISA-KEV (actively exploited) mean?
CISA's Known Exploited Vulnerabilities catalog lists CVEs with confirmed, in-the-wild exploitation. Exposure to a KEV vulnerability is not a theoretical risk — attackers already have a working exploit and are using it now, which is why these should be patched first.
How does EchelonGraph find this without scanning my servers?
Passively. It reads public internet-wide scan banners that advertise a product and version, then matches that version against its CVE feed and the CISA-KEV catalog. It never exploits or logs in — detect-only — and publishes only aggregate, host-redacted counts.
What should I do if I run an affected version?
Treat it as urgent: upgrade to a fixed release and take the service off the public internet if it does not need to be there. Because the CVE is actively exploited, assume it is being targeted. Cross-check your installed versions against the CISA-KEV catalog.
EchelonGraph-<Radar>/1.0 (+https://echelongraph.io/surface-scanner; opt-out https://echelongraph.io/responsible-disclosure; [email protected]) or, from our radar prober, EchelonGraphBot/1.0 (+https://echelongraph.io/bot), and their HTTP requests to the hosts they check also carry a From: [email protected] header. Some checks are a single identified GET; others send several requests to one host. Confirming an MCP endpoint sends a POST asking the server which protocol versions it supports, a second POST with the older handshake only if the first is refused without a 2026-07-28 error, a DELETE to close any session a POST opened and, if a POST is refused with HTTP 401 or 403, up to two GETs of the server's OAuth protected-resource metadata on the same host; where neither POST finds an MCP endpoint, the older SSE transport's stream is requested with GET, only its first event is read, and the connection is closed. A server that answers the first POST with a DiscoverResult, or with an error the 2026-07-28 revision defines, opens no session and is sent no further POST, so it is not written to; if the POST is refused with HTTP 401 or 403, the metadata GETs above still follow. Confirming an exposed datastore needs a protocol-level exchange, and on Redis our client names itself so the connection is identifiable in your own CLIENT LIST. We never log in, submit credentials or exploit what we find. Who we are, exactly what each check sends, and how to opt out → A radar's HTTP requests to the host it checks also carry a signed receipt you can validate at /verify-scan.