Post-EoL Security Exposure
Post-security-support SKUs matched to affected platforms in CISA's Known Exploited Vulnerabilities catalog.
Networking coverage audit
Platform mapping and support-date coverage are separate. These counts describe the current KEV snapshot, not installed-device exposure. Reviewed out-of-catalog entries concern other product lines; unmapped entries remain unresolved.
| Vendor | Vendor KEVs | Mapped | Unmapped | Reviewed outside catalog | Products with unknown support end |
|---|---|---|---|---|---|
| dell | 2 | 0 | 0 | 2 | 0 |
| mikrotik | 5 | 5 | 0 | 0 | 121 |
| nvidia | 0 | 0 | 0 | 0 | 0 |
| ubiquiti | 4 | 0 | 4 | 0 | 0 |
KEV mapping coverage gaps
These KEV product groups have no correlation rule. They are not included in the matched-SKU counter; this is unknown coverage, not a finding of no exposure.
| Vendor | KEV product group | KEV entries |
|---|---|---|
| Cisco | Catalyst SD-WAN Manager | 5 |
| Arista | VeloCloud Orchestrator | 3 |
| Cisco | Identity Services Engine | 3 |
| Ubiquiti | UniFi OS | 3 |
| Fortinet | FortiClient EMS | 3 |
| Palo Alto Networks | Expedition | 3 |
| Atlassian | Confluence Data Center and Server | 3 |
| D-Link | Multiple Routers | 3 |
| Kaseya | Virtual System/Server Administrator (VSA) | 3 |
| VMware | Multiple Products | 3 |
| IBM | Data Risk Manager | 3 |
| Fortinet | Multiple Products | 2 |
| Cisco | Secure Email Gateway | 2 |
| Cisco | Secure Firewall Management Center (FMC) | 2 |
| Cisco | Unified Communications Manager | 2 |
| Trend Micro | Apex One | 2 |
| Citrix | Session Recording | 2 |
| Atlassian | Jira Server and Data Center | 2 |
| DrayTek | VigorConnect | 2 |
| Cisco | AnyConnect Secure | 2 |
| NETGEAR | Multiple Devices | 2 |
| Elastic | Elasticsearch | 2 |
| Atlassian | Confluence Server and Data Center | 2 |
| Cisco | HyperFlex HX | 2 |
| Trend Micro | Apex One and OfficeScan | 2 |
| Trend Micro | Apex One, Apex One as a Service, and Worry-Free Business Security | 2 |
| BeyondTrust | Remote Support | 1 |
| Fortinet | FortiMail | 1 |
| Check Point | Multiple Products | 1 |
| Zyxel | GS1900 Series Switches | 1 |
| Acronis | Backup | 1 |
| Cisco | Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management | 1 |
| Progress | LoadMaster | 1 |
| IBM | Langflow | 1 |
| Check Point | SmartConsole | 1 |
| Lantronix | EDS5000 | 1 |
| Cisco | Catalyst SD-WAN | 1 |
| D-Link | DIR-823X | 1 |
| Cisco | Catalyst SD-WAN Manger | 1 |
| Hikvision | Multiple Products | 1 |
| Cisco | SD-WAN | 1 |
| Cisco | Catalyst SD-WAN Controller and Manager | 1 |
| BeyondTrust | Remote Support (RS) and Privileged Remote Access (PRA) | 1 |
| Cisco | Multiple Products | 1 |
| D-Link | Routers | 1 |
| Cisco | Smart Licensing Utility | 1 |
| BeyondTrust | Privileged Remote Access (PRA) and Remote Support (RS) | 1 |
| NUUO | NVRmini2 Devices | 1 |
| NUUO | NVRmini Devices | 1 |
| Progress | Kemp LoadMaster | 1 |
| Fortinet | FortiManager | 1 |
| D-Link | DIR-820 Router | 1 |
| Progress | Telerik Report Server | 1 |
| D-Link | DSL-2750B Devices | 1 |
| QNAP | VioStor NVR | 1 |
| Sophos | Web Appliance | 1 |
| Progress | WS_FTP Server | 1 |
| Trend Micro | Apex One and Worry-Free Business Security | 1 |
| Citrix | Content Collaboration | 1 |
| Zyxel | P660HN-T1A Routers | 1 |
| D-Link | DWL-2600AP Access Point | 1 |
| VMware | Tools | 1 |
| VMware | Aria Operations for Networks | 1 |
| Progress | MOVEit Transfer | 1 |
| IBM | Aspera Faspex | 1 |
| Intel | Ethernet Diagnostics Driver for Windows | 1 |
| Atlassian | Bitbucket Server and Data Center | 1 |
| Trend Micro | Apex One and Apex One as a Service | 1 |
| D-Link | DIR-300 Router | 1 |
| Atlassian | Confluence | 1 |
| Cisco | RV Series Routers | 1 |
| Atlassian | Confluence Server/Data Center | 1 |
| IBM | InfoSphere BigInsights | 1 |
| VMware | Spring Cloud Gateway | 1 |
| Ubiquiti | AirOS | 1 |
| VMware | Workspace ONE Access and Identity Manager | 1 |
| VMware | Spring Framework | 1 |
| Trend Micro | Apex Central | 1 |
| Atlassian | Confluence Server | 1 |
| SonicWall | Secure Remote Access (SRA) | 1 |
| Citrix | ShareFile | 1 |
| D-Link | DIR-610 Devices | 1 |
| Sophos | SG UTM | 1 |
| VMware | SD-WAN Edge | 1 |
| Cisco | Secure Access Control System (ACS) | 1 |
| Cisco | VPN Routers | 1 |
| NETGEAR | DGN2200 Devices | 1 |
| NETGEAR | WNR2000v5 Router | 1 |
| Cisco | Prime Data Center Network Manager (DCNM) | 1 |
| D-Link | DSL-2760U | 1 |
| NETGEAR | Wireless Router DGN2200 | 1 |
| NETGEAR | Multiple Routers | 1 |
| Intel | Active Management Technology (AMT), Small Business Technology (SBT), and Standard Manageability | 1 |
| VMware | vRealize Operations Manager API | 1 |
| Hikvision | Security cameras web server | 1 |
| IBM | WebSphere Application Server and Server Hypervisor Edition | 1 |
| Elastic | Kibana | 1 |
| Atlassian | Crowd and Crowd Data Center | 1 |
| Atlassian | Confluence Server and Data Server | 1 |
| Cisco | Cisco IP Phones | 1 |
| Citrix | StoreFront Server | 1 |
| Citrix | Workspace Application and Receiver for Windows | 1 |
| D-Link | DIR-825 R1 Devices | 1 |
| IBM | Planning Analytics | 1 |
| Progress | Telerik UI for ASP.NET AJAX | 1 |
| Sophos | SFOS | 1 |
| Progress | ASP.NET AJAX and Sitefinity | 1 |
| Trend Micro | OfficeScan | 1 |
| Trend Micro | Apex One, OfficeScan and Worry-Free Business Security Agents | 1 |
| Trend Micro | Apex One, OfficeScan, and Worry-Free Business Security | 1 |
| Yealink | Device Management | 1 |
This is not a CVE search tool. Every entry below is a specific device in our catalog that (1) is past the vendor's end-of-vulnerability-security-support or last-date-of-support date and (2) runs a platform listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. The vendor is not patching these devices. The vulnerabilities are being exploited in the wild.
Correlation is at the platform level (Junos OS, PAN-OS, BIG-IP, SonicOS, Firebox, etc.). A specific CVE may affect only certain OS versions; the device may have received the patch before the vendor cut off support. Counts represent SKUs, including variants, rather than deployed devices or unique hardware models.
By vendor
Counts reflect post-EoL models running on an affected platform. A specific firmware version may not be vulnerable — verify with the vendor's PSIRT advisory.
| Vendor | Models on platform | Distinct CVEs | Ransomware-linked |
|---|---|---|---|
| Cisco | 2356 | 71 | 3 |
| Juniper | 1142 | 7 | 0 |
| Fortinet | 527 | 25 | 13 |
| QNAP | 217 | 10 | 9 |
| Arista | 210 | 1 | 0 |
| SonicWall | 105 | 18 | 12 |
| WatchGuard | 93 | 4 | 1 |
| Check Point | 81 | 3 | 2 |
| F5 Networks | 52 | 8 | 4 |
| Zyxel | 45 | 10 | 1 |
| Sophos | 39 | 3 | 0 |
| Zimbra | 37 | 19 | 6 |
| NETGEAR | 36 | 2 | 0 |
| Citrix | 22 | 21 | 4 |
| Atlassian | 19 | 1 | 0 |
| Palo Alto | 19 | 13 | 6 |
| Progress | 19 | 2 | 1 |
| BeyondTrust | 18 | 1 | 0 |
| D-Link | 13 | 14 | 1 |
| VMware (Broadcom) | 8 | 16 | 7 |
| Sangoma | 7 | 3 | 0 |
| Acronis | 1 | 1 | 0 |
| Veeam | 1 | 3 | 3 |
Flagged models
200 of 5067 flagged devices.
Operators running any device in this list should treat it as a compensating-control scenario under NIST SA-22 and the equivalent PCI-DSS, HIPAA, and cyber-insurance guidance. See the Compliance and Insurance page for clause-level context and control options.
Source: CISA Known Exploited Vulnerabilities catalog. Snapshot refreshed weekly.