{"description":"Technique heat over the 405 CVEs that carry an exploitation mapping in the CTID KEV mappings snapshot. Scores count distinct mapped CVEs per technique and are a floor: most known-exploited CVEs carry no technique mapping, so an unscored technique means unmapped, never unused.","domain":"enterprise-attack","gradient":{"colors":["#fff5eb","#7f2704"],"maxValue":154,"minValue":0},"metadata":[{"name":"sample basis","value":"405 CVEs carry an exploitation mapping in the CTID KEV mappings snapshot; separately, the tracker holds 5062 CVEs listed in a Known Exploited Vulnerabilities catalog (CISA, VulnCheck, or ENISA)"},{"name":"heat","value":"score = count of distinct mapped CVEs per technique. A FLOOR, not the whole of what attackers do: most known-exploited CVEs carry no technique mapping"},{"name":"source","value":"MITRE Engenuity Center for Threat-Informed Defense (CTID) KEV mappings; attack_version 16.1; framework 07/28/2025; last_update 08/28/2025"},{"name":"mappings ingested","value":"2026-07-09T23:26:54Z"}],"name":"Cybersecurity Tracker: exploited CVE technique heat","sorting":3,"techniques":[{"comment":"1 distinct CVE(s) with a CTID KEV exploitation mapping to this technique","score":1,"techniqueID":"T1021.004"},{"comment":"14 distinct CVE(s) with a CTID KEV exploitation mapping to this technique","score":14,"techniqueID":"T1055"},{"comment":"1 distinct CVE(s) with a CTID KEV exploitation mapping to this technique","score":1,"techniqueID":"T1055.012"},{"comment":"2 distinct CVE(s) with a CTID KEV exploitation mapping to this technique","score":2,"techniqueID":"T1056"},{"comment":"13 distinct CVE(s) with a CTID KEV exploitation mapping to this technique","score":13,"techniqueID":"T1059"},{"comment":"1 distinct CVE(s) with a CTID KEV exploitation mapping to this technique","score":1,"techniqueID":"T1059.001"},{"comment":"8 distinct CVE(s) with a CTID KEV exploitation mapping to this technique","score":8,"techniqueID":"T1059.007"},{"comment":"40 distinct CVE(s) with a CTID KEV exploitation mapping to this technique","score":40,"techniqueID":"T1068"},{"comment":"34 distinct CVE(s) with a CTID KEV exploitation mapping to this technique","score":34,"techniqueID":"T1078"},{"comment":"1 distinct CVE(s) with a CTID KEV exploitation mapping to this technique","score":1,"techniqueID":"T1078.003"},{"comment":"6 distinct CVE(s) with a CTID KEV exploitation mapping to this technique","score":6,"techniqueID":"T1091"},{"comment":"4 distinct CVE(s) with a CTID KEV exploitation mapping to this technique","score":4,"techniqueID":"T1106"},{"comment":"1 distinct CVE(s) with a CTID KEV exploitation mapping to this technique","score":1,"techniqueID":"T1110"},{"comment":"1 distinct CVE(s) with a CTID KEV exploitation mapping to this technique","score":1,"techniqueID":"T1112"},{"comment":"23 distinct CVE(s) with a CTID KEV exploitation mapping to this technique","score":23,"techniqueID":"T1133"},{"comment":"21 distinct CVE(s) with a CTID KEV exploitation mapping to this technique","score":21,"techniqueID":"T1189"},{"comment":"154 distinct CVE(s) with a CTID KEV exploitation mapping to this technique","score":154,"techniqueID":"T1190"},{"comment":"1 distinct CVE(s) with a CTID KEV exploitation mapping to this technique","score":1,"techniqueID":"T1195.002"},{"comment":"1 distinct CVE(s) with a CTID KEV exploitation mapping to this technique","score":1,"techniqueID":"T1199"},{"comment":"5 distinct CVE(s) with a CTID KEV exploitation mapping to this technique","score":5,"techniqueID":"T1202"},{"comment":"32 distinct CVE(s) with a CTID KEV exploitation mapping to this technique","score":32,"techniqueID":"T1203"},{"comment":"2 distinct CVE(s) with a CTID KEV exploitation mapping to this technique","score":2,"techniqueID":"T1204"},{"comment":"11 distinct CVE(s) with a CTID KEV exploitation mapping to this technique","score":11,"techniqueID":"T1204.001"},{"comment":"31 distinct CVE(s) with a CTID KEV exploitation mapping to this technique","score":31,"techniqueID":"T1204.002"},{"comment":"2 distinct CVE(s) with a CTID KEV exploitation mapping to this technique","score":2,"techniqueID":"T1210"},{"comment":"3 distinct CVE(s) with a CTID KEV exploitation mapping to this technique","score":3,"techniqueID":"T1212"},{"comment":"3 distinct CVE(s) with a CTID KEV exploitation mapping to this technique","score":3,"techniqueID":"T1221"},{"comment":"1 distinct CVE(s) with a CTID KEV exploitation mapping to this technique","score":1,"techniqueID":"T1222"},{"comment":"1 distinct CVE(s) with a CTID KEV exploitation mapping to this technique","score":1,"techniqueID":"T1505"},{"comment":"1 distinct CVE(s) with a CTID KEV exploitation mapping to this technique","score":1,"techniqueID":"T1505.003"},{"comment":"2 distinct CVE(s) with a CTID KEV exploitation mapping to this technique","score":2,"techniqueID":"T1548"},{"comment":"1 distinct CVE(s) with a CTID KEV exploitation mapping to this technique","score":1,"techniqueID":"T1548.001"},{"comment":"1 distinct CVE(s) with a CTID KEV exploitation mapping to this technique","score":1,"techniqueID":"T1548.002"},{"comment":"1 distinct CVE(s) with a CTID KEV exploitation mapping to this technique","score":1,"techniqueID":"T1552"},{"comment":"1 distinct CVE(s) with a CTID KEV exploitation mapping to this technique","score":1,"techniqueID":"T1552.001"},{"comment":"1 distinct CVE(s) with a CTID KEV exploitation mapping to this technique","score":1,"techniqueID":"T1553.005"},{"comment":"2 distinct CVE(s) with a CTID KEV exploitation mapping to this technique","score":2,"techniqueID":"T1556"},{"comment":"3 distinct CVE(s) with a CTID KEV exploitation mapping to this technique","score":3,"techniqueID":"T1558"},{"comment":"6 distinct CVE(s) with a CTID KEV exploitation mapping to this technique","score":6,"techniqueID":"T1566"},{"comment":"7 distinct CVE(s) with a CTID KEV exploitation mapping to this technique","score":7,"techniqueID":"T1566.001"},{"comment":"5 distinct CVE(s) with a CTID KEV exploitation mapping to this technique","score":5,"techniqueID":"T1566.002"},{"comment":"7 distinct CVE(s) with a CTID KEV exploitation mapping to this technique","score":7,"techniqueID":"T1574"},{"comment":"1 distinct CVE(s) with a CTID KEV exploitation mapping to this technique","score":1,"techniqueID":"T1588"},{"comment":"1 distinct CVE(s) with a CTID KEV exploitation mapping to this technique","score":1,"techniqueID":"T1588.006"},{"comment":"1 distinct CVE(s) with a CTID KEV exploitation mapping to this technique","score":1,"techniqueID":"T1595"},{"comment":"1 distinct CVE(s) with a CTID KEV exploitation mapping to this technique","score":1,"techniqueID":"T1598.002"}],"versions":{"attack":"16.1","layer":"4.5","navigator":"4.9.0"}}