Research · Sector

Exploited Vulnerabilities in Retail

11 confirmed exploited · 1 ransomware-linked · as of 2026-11-01

11 vulnerabilities we’ve flagged as relevant to Retail are confirmed exploited in the wild (CISA KEV), and 1 (9%) are tied to ransomware.

Ransomware in Retail, exploitation trends, and the full list — below.

Exploited Retail-relevant vulnerabilities

CVEProductKEV added
CVE-2026-97229GitLab Community Edition And Enterprise Edition2026-10-29
CVE-2026-111497Google Brotli2026-10-27
CVE-2026-109618PHP Group PHP2026-10-26
CVE-2026-109619PHP Group PHP2026-10-26
CVE-2026-86950Apple Multiple Products2026-09-29
CVE-2026-93952Arista VeloCloud Orchestrator2026-09-22
CVE-2026-94127F5 BIG-IP APM2026-09-22
CVE-2026-85046Google Chromium V82026-09-04
CVE-2026-16812Arista VeloCloud Orchestrator2026-07-27
CVE-2026-41940WebPros CPanel & WHM And WP2 (WordPress Squared)2026-04-30ransomware
CVE-2024-7399Samsung MagicINFO 9 Server2026-04-24

How we count

This counts vulnerabilities that (a) defend.network has editorially tagged as relevant to the Retail sector in our vulnerability reports, and (b) CISA has confirmed exploited in the wild (in the KEV catalog). The sector tag reflects our editorial judgment about relevance, not a claim of exclusive impact — most vulnerabilities affect multiple sectors. Product names come from NVD/CISA (authoritative). Rows our reconciliation gate flags as mis-attributed are excluded. “Ransomware” uses CISA’s knownRansomwareUse flag. As of 2026-11-01.

Other sectors: Finance · Government · Healthcare · Technology  ·  State of Exploited Vulnerabilities

🤖 Generated deterministically from our editorial sector tags reconciled against the CISA KEV catalog. Free to cite with attribution to defend.network.