PlexTrac vulnerabilities (CVEs)

3 CVEs have an estimated 10%-or-higher chance of having already been exploited despite not appearing on CISA's KEV catalog. KEV is a curated record of confirmed cases rather than a complete census, so this is where its coverage is likely thinnest — an estimate from EPSS history, not a finding. Based on a median of 2 EPSS observations per CVE.

Likely-exploited estimates here rest on a median of 2 EPSS observations per CVE — too little history to read as a trend yet. It deepens daily as scores are collected.

• CVE-2022-37145 ↗EPSS 1.0%LEV ≥37%Elevated risk

  The PlexTrac platform prior to version 1.17.0 does not restrict excessive authentication attempts for accounts configured to use the PlexTrac authentication pro…

• CVE-2022-37144 ↗EPSS 0.9%LEV ≥34%Elevated risk

  The PlexTrac platform prior to API version 1.17.0 does not restrict excessive MFA TOTP submission attempts. An unauthenticated remote attacker in possession of …

• CVE-2022-37146 ↗EPSS 0.8%LEV ≥31%Elevated risk

• CVE-2024-11837 is now estimated at a 10% chance of having already been exploited, despite not appearing on CISA's Known Exploited Vulnerabilities catalog.2026-10-20 · NVD ↗
• CVE-2024-11833 is now estimated at a 10% chance of having already been exploited, despite not appearing on CISA's Known Exploited Vulnerabilities catalog.2026-09-08 · NVD ↗
• CVE-2024-11834 is now estimated at a 10% chance of having already been exploited, despite not appearing on CISA's Known Exploited Vulnerabilities catalog.2026-09-08 · NVD ↗
• CVE-2022-37145 is now estimated at a 36% chance of having already been exploited, despite not appearing on CISA's Known Exploited Vulnerabilities catalog.2026-09-01 · NVD ↗
• CVE-2024-12687 is now estimated at a 13% chance of having already been exploited, despite not appearing on CISA's Known Exploited Vulnerabilities catalog.2026-08-31 · NVD ↗

EPSS is FIRST's estimate of the chance a CVE is exploited in the next 30 days. It measures likelihood, not impact.

• CVE-2024-12687 ↗CRITICAL 9.82024

  Deserialization of Untrusted Data vulnerability in PlexTrac (Runbooks modules) which allows Object Injection and arbitrary file writes. This issue affects PlexTrac: from 1.61.3 before 2.8.1.

• CVE-2024-11839 ↗HIGH 7.52024

  Deserialization of Untrusted Data vulnerability in PlexTrac (Runbooks modules) which allows Object Injection and arbitrary file writes.This issue affects PlexTrac: from 1.61.3 before 2.8.1.

• ↗

• CVEs come from the US National Vulnerability Database (NVD) and are matched to PlexTrac by vendor name. A name match can include CVEs that concern a similarly named product, and can miss ones filed under another name. The count reflects how widely a vendor's software is deployed and examined as much as anything else, so it is not a measure of how secure the vendor is and should not be used to rank vendors. Latest CVE added here: 2026-07-12.
• Known-exploited status comes from the CISA Known Exploited Vulnerabilities (KEV) catalog. Last checked: 2026-10-21.
• Exploit probability (EPSS) comes from FIRST. Latest score date: 2026-10-20.