# Ollama vulnerabilities & exploitation > As of 2026-10-05, Threadlinqs tracks 6 Ollama CVEs, 0 in the CISA Known Exploited Vulnerabilities catalog, linked to 7 tracked threat campaigns and 1 named threat actor. **Data as of:** 2026-10-05 ## Exploitation timeline Threadlinqs has recorded 6 Ollama CVEs published between 2024-05-15 and 2026-05-15. The busiest month was 2024-10 (4 new CVEs). None of them is listed in CISA KEV yet. ## Most exploited vulnerabilities Ranked with CISA KEV listings first, then EPSS exploit probability, then CVSS score. Showing 6 of 6 tracked Ollama CVEs. - [CVE-2024-37032](https://intel.threadlinqs.com/cve/CVE-2024-37032) — HIGH 8.8 · EPSS 93.6% · 2024-05-31 - [CVE-2024-39722](https://intel.threadlinqs.com/cve/CVE-2024-39722) — HIGH 7.5 · EPSS 60.5% · 2024-10-31 - [CVE-2024-39719](https://intel.threadlinqs.com/cve/CVE-2024-39719) — HIGH 7.5 · EPSS 39.2% · 2024-10-31 - [CVE-2026-7482](https://intel.threadlinqs.com/cve/CVE-2026-7482) — CRITICAL 9.1 · EPSS 1% · 2026-05-04 - [CVE-2024-39720](https://intel.threadlinqs.com/cve/CVE-2024-39720) — HIGH 8.2 · EPSS 0.3% · 2024-10-31 - [CVE-2024-39721](https://intel.threadlinqs.com/cve/CVE-2024-39721) — HIGH 7.5 · EPSS 0.3% · 2024-10-31 ## Products affected Threadlinqs normalises CPE and CNA product records across all 6 CVEs; 1 distinct Ollama product is affected. The most frequently affected: - Ollama — 6 CVEs ## Threat activity 7 tracked threat campaigns reference Ollama products or exploit Ollama CVEs: - [AI Agent Identities Emerge as the Enterprise's Fastest-Growing Attack Surface: OAuth Tokens, Shadow AI, and AI-Driven EDR Evasion (STAC6994, UNC6395, NadMesh)](https://intel.threadlinqs.com/threat/TL-2026-1686) — MEDIUM — 2026-07-25 - [AI Compute Hijacking: Stolen Ollama Server Wired Into Autonomous "VAPT" Exploit Pipeline (Sysdig)](https://intel.threadlinqs.com/threat/TL-2026-1076) — HIGH — 2026-07-02 - [Stealthy P2P Cryptominer Targeting Ollama Endpoints — Custom Go-Based 'vc' RAT/Dropper (Akamai SIRT)](https://intel.threadlinqs.com/threat/TL-2026-0553) — HIGH — 2026-05-21 - [Pwn2Own Berlin 2026 Day Two: Microsoft Exchange RCE-as-SYSTEM Chain and 14 Other Zero-Days Disclosed](https://intel.threadlinqs.com/threat/TL-2026-1547) — HIGH — 2026-05-15 - [175,000 Exposed Ollama LLM Hosts Enable AI Model Abuse](https://intel.threadlinqs.com/threat/TL-2026-0047) — HIGH — 2026-02-03 - [175,000 Exposed Ollama Hosts Enabling LLM Abuse](https://intel.threadlinqs.com/threat/TL-2026-0020) — MEDIUM — 2026-02-02 - [LLMJacking: 175,000 Exposed Ollama AI Servers Targeted for Abuse](https://intel.threadlinqs.com/threat/TL-2026-0012) — HIGH — 2026-02-02 ## Threat actors targeting Ollama Named threat actors attributed to campaigns that involve Ollama products or CVEs, with the number of linked campaigns: - [UNC6395](https://intel.threadlinqs.com/actor/UNC6395) — 1 campaign ## How to prioritise Ollama patching This order follows the data Threadlinqs holds for Ollama, not a generic severity checklist: - No Ollama CVE is in CISA KEV yet, so rank by exploit probability instead. - Outside KEV, the highest EPSS scores are [CVE-2024-37032](https://intel.threadlinqs.com/cve/CVE-2024-37032) (93.6%), [CVE-2024-39722](https://intel.threadlinqs.com/cve/CVE-2024-39722) (60.5%), [CVE-2024-39719](https://intel.threadlinqs.com/cve/CVE-2024-39719) (39.2%). - 1 CVE scores Critical and 5 High on CVSS v3 (maximum 9.1, average 8.1); sequence these after KEV and high-EPSS items. ## About this data Vendor attribution comes from the CNA and CPE product records of each CVE, folded to one vendor name; CVSS, EPSS and KEV status are read from the Threadlinqs CVE catalog; campaign and actor links come from tracked threat records. Counts reflect the data as of 2026-10-05 and refresh daily. Canonical: https://intel.threadlinqs.com/vendors/ollama All vendors: https://intel.threadlinqs.com/vendors Full detection coverage and IOCs via the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp