We analyzed every CVE added to CISA KEV in the last 30 days.

Breakdown:

41% remote management tools

23% network perimeter devices

18% enterprise software with exposed APIs

11% AI/ML serving infrastructure

That last number was 0% two years ago.

The AI/ML serving infrastructure CVEs are the ones to watch.

Not because they are the most common yet.

Because when they are exploited, the blast radius is unlimited.

An attacker inside your LLM inference layer has access to every prompt and every piece of context your models process.

Three real cases this month:

SimpleHelp RMM: 2 CVEs, both actively exploited in the wild

Tenda AC18: Remote code exec, no patch available

Samsung MagicINFO: Pre-auth file write, weaponized within 48 hours

All flagged by Lyrie Sentinel within 4 minutes of NVD publication.

research.lyrie.ai/streams/active-exploitation

Lyrie ingests NVD + MITRE + CISA KEV + Project Zero + 8 more sources automatically. 24/7. No alert fatigue.

#cybersecurity #CISA #CVE #threatintel #zerodayattack