VPN Appliance CVE Watch
VPN and remote-access flaws that CISA has confirmed exploited in the wild, matched from the KEV catalogue, for the people who run those appliances: sorted by a patch priority built from ransomware use, listing age and EPSS, with CISA due dates and 30-day EPSS trends.
For people who run a VPN appliance. On a commercial VPN app there is nothing here to patch: try the VPN leak test.
Loading the catalogue
Fetching the VPN and remote-access entries from CISA KEV, then EPSS trends from FIRST.
Loading…
How the CVE watch works
Our API at vpn.pwnsy.com reads the CISA Known Exploited Vulnerabilities catalogue from CISA's GitHub mirror and keeps the entries for VPN and remote-access products, which fall into two categories: SSL VPN appliances and VPN-capable firewalls. Each match is grouped by vendor and appliance family. The catalogue only lists a flaw once exploitation in the wild is confirmed, so every row here has already been used in attacks.
Your browser then asks FIRST for each CVE's current EPSS score, its percentile and the last 30 days of scores, and works out the 30-day change. If FIRST does not answer, the page keeps the scores that came with the catalogue feed and says so under the table.
Each entry then gets a patch priority from a points rule:
- +3 known ransomware use (CISA).
- +3 added to KEV in the last 90 days, or +1 in the last year.
- +2 EPSS at or above 50%, or +1 at or above 10%.
- +1 EPSS rose by 5 points or more over 30 days (FIRST time series).
P1 is 5 points or more, P2 is 3 to 4, P3 is 2 or less. Hover or open a row to see its breakdown.
How to read the result
- Priority. Every entry here is already exploited, so P3 means patch in the normal cycle, and it still needs patching. Start with the patch-first list above the table, which follows your filters.
- EPSS bar. The modelled chance of exploitation in the next 30 days. "Top 1.6%" means the CVE scores higher than 98.4% of all scored CVEs. A red arrow is a rise over 30 days, a green arrow a fall. On a KEV entry exploitation already happened, so a low score points to targeted use.
- Due date. CISA's deadline for US federal civilian agencies. It binds nobody else and marks how urgent CISA judged the bug. Dates within a week are flagged.
- Ransomware. "known" means CISA records use of this flaw in ransomware campaigns.
This is a curated match on VPN and remote-access products in CISA KEV. A device missing here is not certified clean: check the vendor advisory for your model and firmware.
VPN CVE FAQ
What is the CISA KEV catalogue?
The Known Exploited Vulnerabilities catalogue is CISA's list of flaws with confirmed exploitation in the wild. This page keeps only the entries for VPN and remote-access products: SSL VPN appliances and VPN-capable firewalls.
How is the patch priority calculated?
Each entry scores 3 points for known ransomware use, 3 points if CISA added it in the last 90 days or 1 point within a year, 2 points for EPSS at or above 50% or 1 point at or above 10%, and 1 point if EPSS rose by 5 points or more over 30 days. P1 is 5 points or more, P2 is 3 to 4 and P3 is 2 or less.
Why does a CVE with a low EPSS score still matter?
EPSS is the modelled chance of exploitation in the next 30 days. Every entry here is already exploited, so a low score usually points to targeted use against fewer organisations. It still needs patching.
Does the CISA due date apply to my organisation?
The due date is CISA's deadline for US federal civilian agencies. It binds nobody else, and it shows how urgent CISA judged the flaw.
My appliance is not in the list. Is it safe?
Not necessarily. This is a curated match on VPN and remote-access products in CISA KEV, and a device missing here is not certified clean. Check the vendor advisory for your model and firmware.
Records from the CISA KEV catalogue, scores and 30-day trends from FIRST EPSS. Product matching, grouping and the priority rule are ours.