CVE Exploitation Report

September 2026 CVE exploitation

methodology 1.0 · window 2026-09-01 → 2026-09-30 (30/30 days of sensor data)

Seen before KEV

HoneyDB sensors recorded exploitation attempts against these CVEs before CISA added them to its Known Exploited Vulnerabilities catalog.

1. CVE-2014-6271 · first seen 2016-12-01 · KEV 2022-01-28 1,884 days before KEV (at least)
2. CVE-2017-12615 · first seen 2019-10-17 · KEV 2022-03-25 890 days before KEV
3. CVE-2017-12617 · first seen 2019-10-17 · KEV 2022-03-25 890 days before KEV

Movers

rank change vs last month · positions climbed (+) or dropped (−)

What the report tells you

Every month HoneyDB counts the exploitation attempts its honeypot network recorded against known CVEs — one observation per source IP, per CVE, per day — and ranks the CVEs by that activity. Each CVE is cross-checked against the CISA Known Exploited Vulnerabilities catalog, so you can see which ones attackers are working on before they are officially listed, and how much of the traffic still targets vulnerabilities that are years old.

Coverage caveat. HoneyDB can only observe exploitation of vulnerabilities its sensors and analyzers detect. These figures describe activity against HoneyDB's honeypot network, not internet-wide prevalence.

Signed-in users get the full ranking of every observed CVE with KEV detail and lead times, the source networks and countries behind each one, new, returning and dropped CVEs, the CVE age distribution — plus the whole dataset through the API.