CISA | Alerts - TheNote.app

CISA | Alerts
Follow

The website is for the Cybersecurity and Infrastructure Security Agency (CISA). CISA is a part of the U.S. Department of Homeland Security and is responsible for enhancing the security, resilience, and reliability of the nation's cyber and physical infrastructure. The agency plays a crucial role in protecting against cybersecurity threats, ensuring critical infrastructure is secure, and responding to cyber incidents. On the website, you can find information about various cybersecurity initiatives, resources for individuals and organizations to improve their cyber defenses, alerts and updates on emerging threats, and guidelines for incident response. The site also provides details on critical infrastructure sectors, partnerships, training programs, and opportunities to collaborate with CISA on security efforts.

Alerts cisa.gov

RSS feeds.feedburner.com

RSS Hunter • Aug 19, 2024

Thread Of Notes

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog due to active exploitation. The first is CVE-2025-68686, affecting Fortinet FortiOS and allowing unauthorized information exposure. The second is CVE-2026-16812, a command injection vulnerability in Arista VeloCloud Orchestrator On-Prem OS. These exploited vulnerabilities are common attack methods and present substantial risks. Federal Civilian Executive Branch (FCEB) agencies must follow Binding Operational Directive (BOD) 26-04 for vulnerability management. This directive mandates prioritizing the rapid remediation of high-risk vulnerabilities from the KEV Catalog, particularly those on publicly exposed assets leading to total control. Lower-risk vulnerabilities can see deferred action. BOD 26-04 also sets expectations for checking for compromises before applying patches. CISA urges all organizations to adopt risk-based vulnerability management and prioritize KEV Catalog vulnerabilities. The agency will continue adding qualifying vulnerabilities to the KEV Catalog. Organizations can nominate exploited vulnerabilities not yet listed via CISA's KEV Nomination Form, provided they have a CVE ID, exploitation evidence, and mitigation guidance.

https://www.cisa.gov/news-events/alerts/2026/07/27/cisa-adds-two-known-exploited-vulnerabilities-catalog cisa.gov

RSS Hunter • Yesterday

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog due to evidence of active exploitation. These include CVE-2026-16232, a Check Point SmartConsole improper authentication vulnerability, and CVE-2026-50522, a Microsoft SharePoint deserialization of untrusted data vulnerability. Such vulnerabilities are common attack vectors for cyber actors and pose significant risks. Binding Operational Directive (BOD) 26-04 mandates vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. This directive emphasizes the KEV Catalog and requires agencies to prioritize rapid remediation of high-risk vulnerabilities listed within it on publicly exposed assets. BOD 26-04 also sets expectations for agencies to check for compromises before patches are applied. While BOD 26-04 applies specifically to FCEB agencies, CISA urges all organizations to implement risk-based vulnerability management. They encourage prioritizing the remediation of vulnerabilities already documented in the KEV Catalog. CISA will persist in adding newly identified exploited vulnerabilities to the catalog. Organizations can submit exploited vulnerabilities not yet listed to CISA via their KEV Nomination Form, provided they have a CVE ID, exploitation evidence, and clear mitigation guidance.

https://www.cisa.gov/news-events/alerts/2026/07/22/cisa-adds-two-known-exploited-vulnerabilities-catalog cisa.gov

RSS Hunter • Jul 22

CISA Adds Four Known Exploited Vulnerabilities to Catalog

CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog due to evidence of active exploitation. The newly listed vulnerabilities include issues in DD-WRT, Langflow, and two in WordPress Core. These types of vulnerabilities are common attack methods for cybercriminals and present considerable dangers to federal systems. Binding Operational Directive 26-04 mandates that Federal Civilian Executive Branch agencies prioritize security updates based on risk. This directive emphasizes the KEV Catalog and requires agencies to quickly fix high-risk vulnerabilities listed there on exposed assets. It also sets expectations for checking systems for compromise before applying patches. Although BOD 26-04 specifically targets FCEB agencies, CISA advises all organizations to implement risk-based vulnerability management. Prioritizing the remediation of KEV Catalog vulnerabilities is strongly recommended for everyone. CISA will continue to update the KEV Catalog with newly identified exploited vulnerabilities. Organizations can nominate vulnerabilities not yet in the KEV Catalog if they have a CVE ID, proof of exploitation, and clear mitigation steps.

https://www.cisa.gov/news-events/alerts/2026/07/21/cisa-adds-four-known-exploited-vulnerabilities-catalog cisa.gov

RSS Hunter • Jul 21

CISA Adds Three Known Exploited Vulnerabilities to Catalog

CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog. These include two Fortinet FortiSandbox OS command injection vulnerabilities and one Microsoft SharePoint deserialization vulnerability. These vulnerabilities are actively being exploited by cyber actors and present significant risks. The Binding Operational Directive (BOD) 26-04 mandates that Federal Civilian Executive Branch agencies prioritize the remediation of vulnerabilities listed in the KEV Catalog. This directive emphasizes addressing high-risk vulnerabilities on publicly exposed assets that grant full control after exploitation. BOD 26-04 also sets expectations for agencies to check for compromises before applying patches. While BOD 26-04 specifically applies to federal agencies, CISA recommends all organizations adopt similar risk-based vulnerability management. CISA will continue to add vulnerabilities to the KEV Catalog as they are identified and exploited. Organizations can submit potential KEV additions to CISA if they have a CVE ID, evidence of exploitation, and mitigation guidance.

https://www.cisa.gov/news-events/alerts/2026/07/16/cisa-adds-three-known-exploited-vulnerabilities-catalog cisa.gov

RSS Hunter • Jul 16

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog due to active exploitation. These include CVE-2023-4346 affecting the KNX Protocol Connection Authorization Option 1 and CVE-2026-46817 in Oracle E-Business Suite. Exploited vulnerabilities are common attack methods posing significant risks to federal systems. Binding Operational Directive (BOD) 26-04 mandates federal agencies to prioritize the remediation of vulnerabilities listed in the KEV Catalog. This directive focuses on high-risk vulnerabilities on publicly exposed assets that grant full control after exploitation. BOD 26-04 also outlines requirements for agencies to check for compromises before applying patches. While the directive applies to federal civilian agencies, CISA recommends all organizations adopt a risk-based approach. CISA will continue to update the KEV Catalog with new exploited vulnerabilities. Organizations can nominate vulnerabilities for the KEV Catalog if they have a CVE ID, exploitation evidence, and mitigation steps.

https://www.cisa.gov/news-events/alerts/2026/07/15/cisa-adds-two-known-exploited-vulnerabilities-catalog cisa.gov

RSS Hunter • Jul 15

CISA Adds Four Known Exploited Vulnerabilities to Catalog

CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog due to active exploitation. These include two SonicWall SMA1000 Appliances vulnerabilities (CVE-2026-15409 and CVE-2026-15410) and two Microsoft vulnerabilities for Active Directory Federation Services (CVE-2026-56155) and SharePoint Server (CVE-2026-56164). These types of vulnerabilities are common attack vectors posing significant risks. Binding Operational Directive 26-04 mandates that federal civilian executive branch agencies prioritize the remediation of vulnerabilities on the KEV Catalog, especially those on publicly exposed assets that grant total control post-exploitation. The directive also sets expectations for checking for prior compromise before applying patches. While BOD 26-04 is specific to FCEB agencies, CISA urges all organizations to adopt risk-based vulnerability management and address KEV Catalog items. CISA plans to continue adding vulnerabilities that meet their criteria to the KEV Catalog. Organizations can nominate newly discovered, actively exploited vulnerabilities with a CVE ID and mitigation guidance for inclusion.

https://www.cisa.gov/news-events/alerts/2026/07/14/cisa-adds-four-known-exploited-vulnerabilities-catalog cisa.gov

RSS Hunter • Jul 14

CISA Urges SharePoint Hardening After New Exploitations

CISA is aware of active exploitation of vulnerabilities in on-premises SharePoint Server instances, specifically CVE-2026-32201, CVE-2026-45659, and CVE-2026-56164, which enable cyber threat actors to gain unauthorized access. These vulnerabilities affect all supported on-premises SharePoint Server versions and involve establishing remote code execution and post-exploitation activities. Organizations should monitor affected SharePoint Servers closely for any signs of exploitation or unusual activity. CISA urges organizations to detect and remediate potential compromises by implementing recommendations such as applying the latest patches and security updates from Microsoft. Additionally, CISA recommends verifying that Antimalware Scan Interface integration is enabled for each SharePoint web application and using specific AMSI and Microsoft Defender Antivirus detections. Organizations should also implement SharePoint Server hardening measures, including rotating IIS machine keys, establishing tailored logging mechanisms, and avoiding exposing SharePoint Servers directly to the internet. CISA added the vulnerabilities to its Known Exploited Vulnerabilities Catalog and urges users and administrators to review the Alert and apply necessary updates. The agency also recommends reporting incidents or anomalous activity to CISA via its 24/7 Operations Center. CISA may update this Alert to reflect new guidance issued by CISA or other parties, and the information in this report is being provided for informational purposes only. Overall, CISA's guidance aims to help organizations protect themselves against potential cyber threats by taking proactive measures to secure their SharePoint Server instances.

https://www.cisa.gov/news-events/alerts/2026/07/14/cisa-urges-sharepoint-hardening-after-new-exploitations cisa.gov

RSS Hunter • Jul 14

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added a new vulnerability, CVE-2008-4128, to its Known Exploited Vulnerabilities (KEV) Catalog due to evidence of active exploitation. This cross-site request forgery vulnerability in Cisco IOS is a common attack vector that poses significant risks. Binding Operational Directive (BOD) 26-04 mandates that Federal Civilian Executive Branch (FCEB) agencies prioritize the remediation of high-risk vulnerabilities listed in the KEV Catalog on publicly exposed assets. This directive requires agencies to address vulnerabilities that grant total control post-exploitation promptly. BOD 26-04 also outlines when agencies must check for compromises before applying patches. While this directive specifically targets FCEB agencies, CISA recommends that all organizations implement risk-based vulnerability management. They urge all entities to prioritize the remediation of vulnerabilities found in the KEV Catalog. CISA will continue to add vulnerabilities to the KEV Catalog that meet the established criteria. Organizations aware of exploited vulnerabilities not yet in the catalog can submit them for consideration. Such submissions require a CVE ID, proof of exploitation, and clear mitigation steps.

https://www.cisa.gov/news-events/alerts/2026/07/13/cisa-adds-one-known-exploited-vulnerability-catalog cisa.gov

RSS Hunter • Jul 13

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA has added two new vulnerabilities, CVE-2026-48939 affecting iCagenda and CVE-2026-56291 affecting Balbooa Forms, to its Known Exploited Vulnerabilities (KEV) Catalog. These vulnerabilities involve the unrestricted upload of dangerous file types, a common attack method for cybercriminals. Such vulnerabilities present substantial risks to federal systems. Binding Operational Directive (BOD) 26-04 mandates that Federal Civilian Executive Branch agencies prioritize the remediation of vulnerabilities listed in the KEV Catalog. This directive emphasizes rapid patching of high-risk vulnerabilities on publicly exposed assets that allow complete control after exploitation. Agencies are also expected to verify if systems were compromised before patching. While BOD 26-04 specifically targets federal agencies, CISA advises all organizations to implement risk-based vulnerability management and address KEV Catalog entries. CISA will continue to add vulnerabilities that meet the established criteria. Organizations can submit vulnerabilities for consideration if they have a CVE ID, proof of exploitation, and clear mitigation steps, using CISA's KEV Nomination Form.

https://www.cisa.gov/news-events/alerts/2026/07/10/cisa-adds-two-known-exploited-vulnerabilities-catalog cisa.gov

RSS Hunter • Jul 10

CISA Adds Three Known Exploited Vulnerabilities to Catalog

CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog due to evidence of active exploitation. These vulnerabilities are CVE-2026-48908 in JoomShaper SP Page Builder, CVE-2026-55255 in Langflow, and CVE-2026-56290 in Joomlack Page Builder. Exploited vulnerabilities are common attack methods that pose significant risks to federal systems. Binding Operational Directive (BOD) 26-04 mandates that Federal Civilian Executive Branch (FCEB) agencies prioritize fixing vulnerabilities listed in the KEV Catalog, especially those allowing complete control after exploitation. This directive also requires agencies to check for compromises before patching. Although BOD 26-04 is for FCEB agencies, CISA recommends all organizations use a risk-based approach to vulnerability management. CISA will continue to update the KEV Catalog with new exploited vulnerabilities. Organizations can nominate potential additions for the KEV Catalog. Nominated vulnerabilities must have a CVE ID, proof of exploitation, and available mitigation steps.

https://www.cisa.gov/news-events/alerts/2026/07/07/cisa-adds-three-known-exploited-vulnerabilities-catalog cisa.gov

RSS Hunter • Jul 7

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added CVE-2026-48282, an Adobe ColdFusion Path Traversal Vulnerability, to its Known Exploited Vulnerabilities (KEV) Catalog. This type of vulnerability is a common attack method for cybercriminals, posing serious threats to federal systems. Binding Operational Directive (BOD) 26-04 mandates that Federal Civilian Executive Branch agencies manage vulnerabilities by prioritizing those on the KEV Catalog. This directive specifically requires rapid remediation of high-risk KEV vulnerabilities on publicly accessible assets that allow full control after exploitation. Agencies are also expected to regularly check for compromises preceding patch application. Although BOD 26-04 applies only to federal agencies, CISA recommends all organizations implement risk-based vulnerability management. They encourage prioritizing remediation of KEV Catalog vulnerabilities regardless of sector. CISA will continue to add vulnerabilities meeting their criteria to the KEV Catalog. Organizations aware of exploited vulnerabilities not yet in the catalog can submit them for consideration. Submissions require a CVE ID, proof of exploitation, and clear mitigation steps.

https://www.cisa.gov/news-events/alerts/2026/07/07/cisa-adds-one-known-exploited-vulnerability-catalog cisa.gov

RSS Hunter • Jul 7

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added CVE-2026-45659, a Microsoft SharePoint Server deserialization vulnerability, to its Known Exploited Vulnerabilities (KEV) Catalog due to active exploitation. This vulnerability represents a significant threat to federal networks, as deserialization flaws are common attack methods. Binding Operational Directive (BOD) 26-04 mandates that Federal Civilian Executive Branch (FCEB) agencies manage vulnerabilities based on risk. This directive emphasizes the KEV Catalog and requires agencies to quickly fix high-risk vulnerabilities listed there on exposed assets. Such vulnerabilities, when exploited, can grant attackers complete control over affected systems. BOD 26-04 also sets expectations for agencies to check for compromises before patching. Although BOD 26-04 applies only to FCEB agencies, CISA strongly recommends that all organizations adopt a risk-based approach to vulnerability management. CISA will consistently update the KEV Catalog with vulnerabilities that meet their criteria. Organizations can nominate vulnerabilities for the KEV Catalog if they have a CVE ID, proof of exploitation, and clear remediation steps.

https://www.cisa.gov/news-events/alerts/2026/07/01/cisa-adds-one-known-exploited-vulnerability-catalog cisa.gov

RSS Hunter • Jul 1

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added a new vulnerability, CVE-2026-48558, to its Known Exploited Vulnerabilities (KEV) Catalog due to active exploitation. This SimpleHelp Authentication Bypass Vulnerability is a common attack method. Federal agencies are required by Binding Operational Directive (BOD) 26-04 to manage vulnerabilities based on risk. BOD 26-04 mandates rapid remediation of high-risk vulnerabilities found in the KEV Catalog on publicly exposed assets. This directive also sets expectations for agencies to check for compromises before patching. While BOD 26-04 is for Federal Civilian Executive Branch agencies, CISA urges all organizations to adopt similar risk-based vulnerability management. CISA will continue to add qualifying vulnerabilities to the KEV Catalog. Organizations can nominate exploited vulnerabilities not yet in the catalog using CISA's KEV Nomination Form. Nominations require a CVE ID, proof of exploitation, and clear mitigation steps.

https://www.cisa.gov/news-events/alerts/2026/06/29/cisa-adds-one-known-exploited-vulnerability-catalog cisa.gov

RSS Hunter • Jun 29

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA has added two new vulnerabilities, CVE-2026-12569 and CVE-2026-20230, to its Known Exploited Vulnerabilities (KEV) Catalog due to active exploitation. These vulnerabilities, affecting PTC Windchill/FlexPLM and Cisco Unified Communications Manager respectively, are common targets for cyberattacks. Federal Civilian Executive Branch (FCEB) agencies must adhere to Binding Operational Directive 26-04. This directive mandates prioritizing the rapid remediation of vulnerabilities listed in the KEV Catalog, particularly those on publicly exposed assets that offer complete control after exploitation. Agencies are also required to check for compromises before applying patches for high-risk vulnerabilities. While BOD 26-04 is for FCEB agencies, CISA strongly recommends all organizations adopt similar risk-based vulnerability management practices. CISA will continuously update the KEV Catalog with newly identified exploited vulnerabilities. Organizations can nominate vulnerabilities for inclusion if they have a CVE ID, proof of exploitation, and clear mitigation steps.

https://www.cisa.gov/news-events/alerts/2026/06/25/cisa-adds-two-known-exploited-vulnerabilities-catalog cisa.gov

RSS Hunter • Jun 25

CISA Adds Four Known Exploited Vulnerabilities to Catalog

CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog due to evidence of active exploitation. These vulnerabilities affect Lantronix EDS5000 (code injection) and Ubiquiti UniFi OS (improper access control, path traversal, and improper input validation). Such vulnerabilities are common attack vectors for cybercriminals and pose significant risks to federal systems. CISA’s Binding Operational Directive (BOD) 26-04 requires federal agencies to prioritize the remediation of vulnerabilities listed in the KEV Catalog. This directive specifically targets vulnerabilities on publicly exposed assets that grant full control after exploitation. BOD 26-04 also sets expectations for agencies to check for compromises before applying patches. Although BOD 26-04 applies only to Federal Civilian Executive Branch agencies, CISA advises all organizations to adopt similar risk-based vulnerability management. CISA will consistently update the KEV Catalog with newly identified exploited vulnerabilities. Organizations aware of exploited vulnerabilities not yet in the catalog are encouraged to submit them for consideration. Submissions require a CVE ID, proof of exploitation, and clear mitigation instructions.

https://www.cisa.gov/news-events/alerts/2026/06/23/cisa-adds-four-known-exploited-vulnerabilities-catalog cisa.gov

RSS Hunter • Jun 23

CISA Urges Hardening Fortinet Devices After Reports of Credential Exposure

CISA has identified a global cyber threat targeting internet-accessible Fortinet devices, including firewalls and VPN gateways. This activity, known as FortiBleed, has exposed credentials for approximately 74,000 Fortinet devices. Malicious actors are exploiting these leaked credentials to compromise government and private sector organizations. To mitigate this threat, CISA strongly advises affected Fortinet customers to take immediate action.Essential steps include terminating active sessions and resetting all VPN and administrative passwords, prioritizing internet-facing systems. Organizations must also verify the secure storage of administrator credentials, ensuring the use of the PBKDF2 algorithm and removing legacy hashes. Reviewing firewall, VPN, authentication, and domain controller logs is crucial for detecting suspicious activity. Implementing phishing-resistant multi-factor authentication for all remote access and administrative accounts is a high priority.Furthermore, reducing the attack surface by restricting access to Fortinet management interfaces from the public internet and disabling unnecessary accounts is recommended. CISA provides links to external resources for further information on the scope of the compromise. These resources detail the impact of the FortiBleed campaign on Fortinet devices worldwide. The provided information is for informational purposes and does not constitute an endorsement of any commercial entity or product.

https://www.cisa.gov/news-events/alerts/2026/06/18/cisa-urges-hardening-fortinet-devices-after-reports-credential-exposure cisa.gov

RSS Hunter • Jun 18

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added CVE-2026-20253, a Splunk Enterprise vulnerability, to its Known Exploited Vulnerabilities (KEV) Catalog due to active exploitation. This critical vulnerability allows unauthorized access and poses significant risks to government systems. Binding Operational Directive (BOD) 26-04 now mandates that Federal Civilian Executive Branch agencies prioritize the remediation of vulnerabilities listed in the KEV Catalog. This directive, updating BOD 22-01, emphasizes rapid action on high-risk vulnerabilities that provide complete control after exploitation. Lower-risk vulnerabilities can be deferred, but agencies must now proactively check for compromises before patching. While BOD 26-04 specifically targets federal agencies, CISA strongly recommends all organizations adopt similar risk-based vulnerability management practices. The agency will continue to add vulnerabilities to the KEV Catalog as they are identified and exploited. Organizations can nominate vulnerabilities for inclusion in the KEV Catalog if they have a CVE ID, proof of exploitation, and clear mitigation steps. This proactive approach aims to strengthen cybersecurity defenses against prevalent threats.

https://www.cisa.gov/news-events/alerts/2026/06/18/cisa-adds-one-known-exploited-vulnerability-catalog cisa.gov

RSS Hunter • Jun 18

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added CVE-2026-48907, an improper access control vulnerability in the Widget Factory Joomla Content Editor, to its Known Exploited Vulnerabilities (KEV) catalog. This vulnerability is actively being exploited and presents a significant risk to federal systems. Binding Operational Directive (BOD) 26-04 updates requirements for Federal Civilian Executive Branch (FCEB) agencies regarding vulnerability management. The directive emphasizes prioritizing the remediation of high-risk vulnerabilities, particularly those listed in the KEV catalog that grant full control after exploitation on public-facing assets. Lower-risk vulnerabilities can be addressed with less urgency. BOD 26-04 also outlines when agencies must check for system compromise before patching. Although BOD 26-04 is specific to FCEB agencies, CISA recommends all organizations adopt a risk-based approach to vulnerability management. They encourage prioritizing KEV catalog vulnerabilities for remediation. CISA will continue to add vulnerabilities meeting their criteria to the KEV catalog. Organizations can nominate exploited vulnerabilities for inclusion if they have a CVE ID, proof of exploitation, and mitigation guidance.

https://www.cisa.gov/news-events/alerts/2026/06/16/cisa-adds-one-known-exploited-vulnerability-catalog cisa.gov

RSS Hunter • Jun 16

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog. These are CVE-2026-20262 affecting Cisco Catalyst SD-WAN Manager and CVE-2026-54420 impacting LiteSpeed cPanel Plugin. Such vulnerabilities are common attack methods for cybercriminals. Federal agencies are mandated to address these risks through Binding Operational Directive (BOD) 26-04. This directive requires FCEB agencies to prioritize patching vulnerabilities listed in the KEV catalog that are on public-facing assets and offer complete system control. BOD 26-04 updates previous directives and reinforces the significance of the KEV catalog. It also outlines expectations for agencies to check for potential compromises before applying patches. While this directive specifically targets FCEB agencies, CISA urges all organizations to adopt similar risk-based vulnerability management. CISA will continue to update the KEV catalog with newly identified exploited vulnerabilities. Organizations can nominate vulnerabilities for inclusion in the KEV catalog if they have a CVE ID, proof of exploitation, and clear mitigation steps.

https://www.cisa.gov/news-events/alerts/2026/06/15/cisa-adds-two-known-exploited-vulnerabilities-catalog cisa.gov

RSS Hunter • Jun 15

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added CVE-2026-35273, an Oracle PeopleSoft vulnerability, to its Known Exploited Vulnerabilities catalog. This vulnerability involves missing authentication for critical functions and is a common attack method for malicious actors. It presents considerable risks to federal systems. Binding Operational Directive (BOD) 26-04, which updates BOD 22-01, sets vulnerability management requirements for federal agencies. This directive emphasizes the KEV catalog and mandates rapid patching of high-risk vulnerabilities on publicly exposed assets that lead to complete control post-exploitation. Lower-risk vulnerabilities can be addressed later according to BOD 26-04. The directive also outlines expectations for agencies to check for compromise before applying patches. Although BOD 26-04 is specific to federal agencies, CISA recommends all organizations implement risk-based vulnerability management. Prioritizing KEV catalog vulnerabilities is encouraged for everyone. CISA will continue to augment the KEV catalog with qualifying vulnerabilities. Organizations can submit vulnerabilities for consideration if they have a CVE ID, evidence of exploitation, and clear mitigation guidance.

https://www.cisa.gov/news-events/alerts/2026/06/12/cisa-adds-one-known-exploited-vulnerability-catalog cisa.gov

RSS Hunter • Jun 12

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added a new vulnerability, CVE-2026-10520 concerning Ivanti Sentry OS Command Injection, to its Known Exploited Vulnerabilities (KEV) catalog. This vulnerability has been actively exploited and presents a significant threat. Command injection vulnerabilities are a common attack method used by malicious actors. Federal Civilian Executive Branch (FCEB) agencies are now subject to Binding Operational Directive (BOD) 26-04. This directive mandates prioritizing security updates based on risk, superseding BOD 22-01. BOD 26-04 emphasizes the KEV catalog and requires FCEB agencies to quickly fix high-risk vulnerabilities, particularly those on public assets that grant full control post-exploitation. Lower-risk vulnerabilities can have their remediation deferred. The directive also sets expectations for agencies regarding system compromise checks before patching. While BOD 26-04 is for FCEB agencies, CISA urges all organizations to adopt risk-based vulnerability management. CISA will continue to add qualifying vulnerabilities to the KEV catalog. Organizations can nominate vulnerabilities for inclusion if they have a CVE ID, proof of exploitation, and mitigation guidance.

https://www.cisa.gov/news-events/alerts/2026/06/11/cisa-adds-one-known-exploited-vulnerability-catalog cisa.gov

RSS Hunter • Jun 11

CISA Adds Three Known Exploited Vulnerabilities to Catalog

CISA has recently added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog. These include a vulnerability in Arista Extensible Operating System, another in Google Chromium's V8 engine, and a third in Cisco Catalyst SD-WAN Manager. Evidence confirms that these vulnerabilities are being actively exploited by malicious actors. Such vulnerabilities represent a common and significant threat to federal networks. The KEV Catalog was established by Binding Operational Directive (BOD) 22-01 to track these high-risk vulnerabilities. This directive mandates that Federal Civilian Executive Branch (FCEB) agencies must fix these identified vulnerabilities by their deadlines. The goal of BOD 22-01 is to safeguard FCEB networks from current cyber threats. While BOD 22-01 specifically applies to FCEB agencies, CISA strongly recommends all organizations take similar action. Prioritizing the remediation of KEV Catalog vulnerabilities is crucial for reducing overall cyberattack exposure. CISA will continue to update the KEV Catalog as new vulnerabilities meeting the criteria are identified.

https://www.cisa.gov/news-events/alerts/2026/06/09/cisa-adds-three-known-exploited-vulnerabilities-catalog cisa.gov

RSS Hunter • Jun 9

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA has identified two new vulnerabilities that are actively being exploited and added them to its Known Exploited Vulnerabilities (KEV) Catalog. These newly added vulnerabilities are CVE-2026-42271 affecting BerriAI LiteLLM and CVE-2026-50751 impacting Check Point Security Gateway. Such vulnerabilities represent common attack methods for cybercriminals and pose substantial threats to federal networks. The KEV Catalog, established by Binding Operational Directive 22-01, lists known vulnerabilities with significant risk to the federal enterprise. This directive mandates that Federal Civilian Executive Branch (FCEB) agencies must fix these identified vulnerabilities by a specific deadline. The goal is to safeguard FCEB networks from current cyber threats. Although BOD 22-01 specifically targets FCEB agencies, CISA strongly advises all organizations to address these KEV Catalog vulnerabilities. Prioritizing their remediation is crucial for enhancing an organization's cybersecurity posture. CISA will continue to update the KEV Catalog with new vulnerabilities that meet the established criteria. This ongoing effort aims to provide timely information on critical security issues.

https://www.cisa.gov/news-events/alerts/2026/06/08/cisa-adds-two-known-exploited-vulnerabilities-catalog cisa.gov

RSS Hunter • Jun 8

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added a new vulnerability, CVE-2026-28318, to its Known Exploited Vulnerabilities (KEV) Catalog. This vulnerability in SolarWinds Serv-U involves uncontrolled resource consumption. Actively exploited vulnerabilities like this are common attack vectors for cybercriminals. Such vulnerabilities present substantial risks to federal agencies. The KEV Catalog was established by Binding Operational Directive (BOD) 22-01 to combat these significant risks. BOD 22-01 mandates that Federal Civilian Executive Branch (FCEB) agencies fix these vulnerabilities by a deadline. This is to safeguard FCEB networks from active cyber threats. While BOD 22-01 specifically targets FCEB agencies, CISA recommends all organizations prioritize fixing KEV Catalog vulnerabilities. This action helps reduce their susceptibility to cyberattacks. CISA will keep updating the KEV Catalog with new vulnerabilities that fit the criteria.

https://www.cisa.gov/news-events/alerts/2026/06/05/cisa-adds-one-known-exploited-vulnerability-catalog cisa.gov

RSS Hunter • Jun 5

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added a new vulnerability, CVE-2026-45247, to its Known Exploited Vulnerabilities (KEV) Catalog. This vulnerability affects Mirasvit Full Page Cache Warmer and is due to deserialization of untrusted data. Such vulnerabilities are common attack vectors for cyber actors and present significant risks. CISA's Binding Operational Directive 22-01 created the KEV Catalog to highlight vulnerabilities posing a serious threat to the federal enterprise. This directive mandates that Federal Civilian Executive Branch agencies fix these vulnerabilities by specific deadlines. The goal is to protect FCEB networks from active threats. While BOD 22-01 specifically targets FCEB agencies, CISA encourages all organizations to address KEV Catalog vulnerabilities. Prioritizing remediation is crucial for reducing exposure to cyberattacks. CISA will continue to update the KEV Catalog with vulnerabilities that meet its criteria. This ongoing effort aims to enhance overall cybersecurity posture.

https://www.cisa.gov/news-events/alerts/2026/06/03/cisa-adds-one-known-exploited-vulnerability-catalog cisa.gov

RSS Hunter • Jun 3

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog. These new additions are CVE-2022-0492, a Linux Kernel Improper Authentication Vulnerability, and CVE-2025-48595, an Android Framework Integer Overflow Vulnerability. Both have demonstrated evidence of active exploitation by malicious actors. Such vulnerabilities frequently serve as attack vectors. They present significant risks to federal networks and the broader enterprise. Binding Operational Directive (BOD) 22-01 established the KEV Catalog to address these serious threats. This directive mandates that Federal Civilian Executive Branch (FCEB) agencies remediate these identified vulnerabilities by a specified deadline. The goal is to protect FCEB networks from ongoing cyber threats. Although BOD 22-01 specifically targets FCEB agencies, CISA strongly advises all organizations to remediate KEV Catalog vulnerabilities. Prioritizing these remediations is crucial for effective vulnerability management and reducing overall cyberattack exposure. CISA will continue to update the catalog as new vulnerabilities meeting the criteria are identified.

https://www.cisa.gov/news-events/alerts/2026/06/02/cisa-adds-two-known-exploited-vulnerabilities-catalog cisa.gov

RSS Hunter • Jun 2

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added a new vulnerability, CVE-2024-21182, to its Known Exploited Vulnerabilities (KEV) Catalog. This vulnerability affects Oracle WebLogic Server and has been observed being actively exploited by malicious actors. Such vulnerabilities represent frequent attack vectors that pose significant risks to federal systems. CISA's Binding Operational Directive (BOD) 22-01 established the KEV Catalog to identify vulnerabilities with substantial risk to the federal enterprise. This directive mandates that Federal Civilian Executive Branch (FCEB) agencies remediate these identified vulnerabilities by a specified deadline. The goal of BOD 22-01 is to protect FCEB networks against ongoing cyber threats. While BOD 22-01 specifically applies to FCEB agencies, CISA strongly recommends that all organizations adopt similar practices. Prioritizing the timely remediation of KEV Catalog vulnerabilities is crucial for reducing overall cyberattack exposure. Organizations should integrate this into their regular vulnerability management processes. CISA will consistently update the KEV Catalog with new vulnerabilities that meet its established criteria.

https://www.cisa.gov/news-events/alerts/2026/06/01/cisa-adds-one-known-exploited-vulnerability-catalog cisa.gov

RSS Hunter • Jun 1

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has updated its Known Exploited Vulnerabilities (KEV) Catalog, adding a new vulnerability. The newly added vulnerability is CVE-2026-0257, a Palo Alto Networks PAN-OS authentication bypass. This vulnerability is actively exploited by malicious actors, posing a significant risk. The KEV Catalog is a list of vulnerabilities considered high risk. The KEV Catalog was created by Binding Operational Directive (BOD) 22-01. BOD 22-01 directs Federal Civilian Executive Branch (FCEB) agencies to remediate KEV vulnerabilities promptly. Agencies must meet deadlines to protect their networks from active threats. CISA encourages all organizations, not just FCEB agencies, to prioritize KEV remediation. Timely remediation helps organizations reduce their cyberattack exposure. CISA will continue to update the catalog with new vulnerabilities that fit the criteria.

https://www.cisa.gov/news-events/alerts/2026/05/29/cisa-adds-one-known-exploited-vulnerability-catalog cisa.gov

RSS Hunter • May 29

Supply Chain Compromises Impact Nx Console and GitHub Repositories

CISA is addressing escalating cyberattacks exploiting software supply chain vulnerabilities, focusing on CI/CD pipelines and developer ecosystems. Recent breaches showcase threat actors targeting tools within enterprise, cloud, and DevOps environments. A significant incident involved a malicious Nx Console VS Code extension, leading to GitHub repository access and data exfiltration. The compromised extension (version 18.95.0) auto-updated, potentially affecting developers with Nx Console installed. CISA assigned CVE-2026-48027 and added the compromised version to its KEV Catalog.The "Megalodon" campaign injected malicious GitHub Action workflows to steal CI/CD secrets and credentials. CISA recommends monitoring workflow activity and reverting suspicious changes by automated accounts. Organizations should conduct forensic reviews if compromised and rotate secrets like API keys and cloud credentials. CISA suggests delaying package downloads for three hours and pinning software to trusted versions. Pulling packages only from trusted sources is critical for security. Several resources are available for detailed information on these compromises. CISA provides this information for informational purposes only and does not endorse any specific products or services.

https://www.cisa.gov/news-events/alerts/2026/05/28/supply-chain-compromises-impact-nx-console-and-github-repositories cisa.gov

RSS Hunter • May 28

CISA Adds Three Known Exploited Vulnerabilities to Catalog

CISA has updated its Known Exploited Vulnerabilities (KEV) Catalog, adding three new vulnerabilities actively being exploited. These vulnerabilities include issues in Daemon Tools Lite, TanStack, and Nx Console. These vulnerabilities can be used by malicious actors and pose a considerable risk. The KEV Catalog is a list of known CVEs representing significant risks, created by Binding Operational Directive (BOD) 22-01. BOD 22-01 requires federal agencies to address KEVs by the due date to protect networks. CISA strongly recommends all organizations prioritize timely remediation of KEV vulnerabilities. This is essential for effective vulnerability management. The catalog serves as a dynamic resource, and CISA will make further additions as required. The updated catalog helps to safeguard against cyberattacks. Organizations must actively manage and remediate listed vulnerabilities.

https://www.cisa.gov/news-events/alerts/2026/05/27/cisa-adds-three-known-exploited-vulnerabilities-catalog cisa.gov

RSS Hunter • May 27

CISA Adds One Known Exploited Vulnerability to Catalog

CISA updated its Known Exploited Vulnerabilities (KEV) Catalog, adding a new vulnerability. The new vulnerability is CVE-2026-48172, a privilege escalation flaw in the LiteSpeed cPanel Plugin. This type of vulnerability is often exploited by attackers, posing significant risks. The KEV Catalog is a list of known vulnerabilities with substantial risks, as established by Binding Operational Directive 22-01. BOD 22-01 mandates that Federal Civilian Executive Branch agencies fix identified vulnerabilities promptly. This directive aims to protect federal networks from existing threats. The provided fact sheet offers further details about BOD 22-01. While BOD 22-01 mainly applies to federal agencies, other organizations are strongly encouraged to use the KEV Catalog. Prioritizing remediation of KEV vulnerabilities helps reduce exposure to cyberattacks. CISA plans to continuously add vulnerabilities to the catalog as needed.

https://www.cisa.gov/news-events/alerts/2026/05/26/cisa-adds-one-known-exploited-vulnerability-catalog cisa.gov

RSS Hunter • May 26

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has updated its Known Exploited Vulnerabilities (KEV) Catalog by adding one new vulnerability, CVE-2026-9082, a Drupal Core SQL Injection vulnerability. This vulnerability is included due to evidence of active exploitation by malicious actors. SQL injection vulnerabilities are commonly exploited, posing a considerable risk to systems. The KEV Catalog is maintained under Binding Operational Directive (BOD) 22-01. This directive requires Federal Civilian Executive Branch (FCEB) agencies to patch these vulnerabilities by specified deadlines. The goal is to protect federal networks from existing threats and vulnerabilities. The BOD 22-01 fact sheet provides further details on the directive and its implementation. While BOD 22-01 focuses on FCEB agencies, CISA recommends that all organizations address these vulnerabilities promptly. Organizations outside the FCEB should also prioritize the remediation of KEV vulnerabilities to stay secure. CISA will regularly update the catalog as new vulnerabilities meeting the criteria emerge. This proactive approach helps to improve overall cybersecurity posture and minimize potential damage.

https://www.cisa.gov/news-events/alerts/2026/05/22/cisa-adds-one-known-exploited-vulnerability-catalog cisa.gov

RSS Hunter • May 22

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA has updated its Known Exploited Vulnerabilities (KEV) Catalog, a list of actively exploited vulnerabilities. Two new vulnerabilities, CVE-2025-34291 and CVE-2026-34926, were added due to confirmed active exploitation. These vulnerabilities, like others in the catalog, are often used as attack vectors. These pose great risks to federal networks and other organizations. The KEV Catalog was established by Binding Operational Directive (BOD) 22-01. BOD 22-01 mandates that Federal Civilian Executive Branch (FCEB) agencies remediate listed vulnerabilities. Agencies must follow the specified due dates in order to protect against threats. While BOD 22-01 directs FCEB agencies, CISA advises all organizations to prioritize KEV remediation. Timely remediation is a strong part of any proper vulnerability management strategy. CISA will continually update the catalog with new vulnerabilities to enhance protection.

https://www.cisa.gov/news-events/alerts/2026/05/21/cisa-adds-two-known-exploited-vulnerabilities-catalog cisa.gov

RSS Hunter • May 21

CISA Adds Seven Known Exploited Vulnerabilities to Catalog

CISA has updated its Known Exploited Vulnerabilities (KEV) Catalog, adding seven new vulnerabilities actively being exploited. These newly added vulnerabilities span multiple software products including Microsoft Windows, DirectX, Adobe Acrobat, and Internet Explorer. The vulnerabilities involve issues like buffer overflows, use-after-free, and denial-of-service, enabling malicious cyber activities. CISA recognizes these vulnerabilities as significant risks, particularly for federal organizations. Binding Operational Directive (BOD) 22-01 mandates FCEB agencies remediate these vulnerabilities promptly. The KEV Catalog is a dynamic list intended to inform and protect against known threats. Remediation deadlines are established to reduce exploitable attack surfaces across the federal network. While BOD 22-01 primarily targets federal agencies, CISA encourages all organizations to use the KEV Catalog. Prioritizing remediation of known exploited vulnerabilities is a crucial element of effective cybersecurity. CISA will continue to update the catalog as new vulnerabilities become actively exploited in the wild.

https://www.cisa.gov/news-events/alerts/2026/05/20/cisa-adds-seven-known-exploited-vulnerabilities-catalog cisa.gov

RSS Hunter • May 20

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added a new vulnerability, CVE-2026-42897, to its Known Exploited Vulnerabilities (KEV) Catalog due to active exploitation. This vulnerability targets Microsoft Exchange Server and involves cross-site scripting, a common attack method. The KEV Catalog identifies vulnerabilities posing significant risks, especially to the federal enterprise. Binding Operational Directive (BOD) 22-01 mandates FCEB agencies remediate KEV vulnerabilities by set deadlines. This directive aims to protect federal networks from existing threats. The provided fact sheet offers further details regarding BOD 22-01 implementation. While BOD 22-01 specifically affects FCEB agencies, CISA advises all organizations to prioritize KEV remediation. Timely addressing these vulnerabilities is crucial for reducing cyberattack exposure. Organizations should integrate KEV remediation into their overall vulnerability management strategies. CISA will continuously update the catalog with qualifying vulnerabilities.

https://www.cisa.gov/news-events/alerts/2026/05/15/cisa-adds-one-known-exploited-vulnerability-catalog cisa.gov

RSS Hunter • May 15

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added a new vulnerability, CVE-2026-20182, to its Known Exploited Vulnerabilities (KEV) Catalog. This Cisco Catalyst SD-WAN Controller authentication bypass vulnerability is actively exploited by malicious actors. This type of vulnerability presents significant risks, particularly to federal agencies. CISA urges adherence to Emergency Directive 26-03 and Supplemental Direction ED 26-03 for mitigation, as well as BOD 22-01. The KEV Catalog serves as a list of high-risk vulnerabilities and is a key component of BOD 22-01. Federal agencies must remediate vulnerabilities in the KEV Catalog by their due dates. BOD 22-01 primarily affects federal agencies, but CISA recommends all organizations prioritize KEV Catalog vulnerability remediation. This proactive approach helps reduce exposure to cyberattacks. CISA plans to continue updating the KEV Catalog with vulnerabilities meeting specific criteria.

https://www.cisa.gov/news-events/alerts/2026/05/14/cisa-adds-one-known-exploited-vulnerability-catalog cisa.gov

RSS Hunter • May 14

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has updated its Known Exploited Vulnerabilities (KEV) Catalog, a list of actively exploited vulnerabilities. A new vulnerability, identified as CVE-2026-42208 affecting BerriAI LiteLLM, has been added due to active exploitation. This vulnerability specifically involves SQL injection, a common attack method. This poses a significant risk to the federal enterprise. The KEV Catalog was created by Binding Operational Directive (BOD) 22-01 to address known exploitable vulnerabilities. BOD 22-01 mandates federal agencies to remediate listed vulnerabilities to protect their networks. Agencies must address these vulnerabilities by specified deadlines. While BOD 22-01 applies to federal agencies, CISA recommends all organizations prioritize KEV remediation. Timely remediation of KEV vulnerabilities is crucial for reducing cyberattack exposure. CISA will continue to update the catalog as new exploitable vulnerabilities are identified.

https://www.cisa.gov/news-events/alerts/2026/05/08/cisa-adds-one-known-exploited-vulnerability-catalog cisa.gov

RSS Hunter • May 8

CISA Adds One Known Exploited Vulnerability to Catalog

CISA updated its Known Exploited Vulnerabilities (KEV) Catalog, adding a new vulnerability. The newly added vulnerability is CVE-2026-6973, concerning Improper Input Validation in Ivanti Endpoint Manager Mobile (EPMM). This vulnerability is actively being exploited by malicious actors, presenting a serious risk. The KEV Catalog is a list of known vulnerabilities that significantly threaten the federal enterprise. This catalog was established under Binding Operational Directive (BOD) 22-01. BOD 22-01 mandates Federal Civilian Executive Branch agencies to remediate identified vulnerabilities promptly. The goal is to safeguard FCEB networks from active cyber threats. CISA recommends that all organizations address KEV Catalog vulnerabilities. Prioritizing remediation is crucial for reducing exposure to cyberattacks. CISA emphasizes the importance of timely vulnerability management practices. The agency will continue to update the catalog with new vulnerabilities as they are discovered.

https://www.cisa.gov/news-events/alerts/2026/05/07/cisa-adds-one-known-exploited-vulnerability-catalog cisa.gov

RSS Hunter • May 7

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has updated its Known Exploited Vulnerabilities (KEV) Catalog, adding a new vulnerability. The newly added vulnerability is CVE-2026-0300, an out-of-bounds write vulnerability in Palo Alto Networks PAN-OS. This type of vulnerability is frequently exploited by malicious actors, presenting substantial risk to the federal enterprise. The KEV Catalog is a list of known CVEs that pose significant threats, established by Binding Operational Directive (BOD) 22-01. BOD 22-01 mandates that Federal Civilian Executive Branch (FCEB) agencies remediate KEV vulnerabilities by specified deadlines. This action aims to safeguard FCEB networks from ongoing cyber threats. While BOD 22-01 primarily affects FCEB agencies, CISA recommends all organizations prioritize KEV Catalog vulnerability remediation. Timely addressing of these vulnerabilities is crucial for reducing cyberattack exposure. CISA will continue to incorporate vulnerabilities that meet the necessary criteria into the KEV catalog.

https://www.cisa.gov/news-events/alerts/2026/05/06/cisa-adds-one-known-exploited-vulnerability-catalog cisa.gov

RSS Hunter • May 6

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added a new vulnerability, CVE-2026-31431, to its Known Exploited Vulnerabilities (KEV) Catalog. This Linux Kernel vulnerability is actively being exploited by malicious actors. Such vulnerabilities present a significant risk to federal government systems. The KEV Catalog was established by Binding Operational Directive (BOD) 22-01. This directive mandates that Federal Civilian Executive Branch (FCEB) agencies fix KEV vulnerabilities by a set deadline. The goal is to protect FCEB networks from active cyber threats. While BOD 22-01 specifically targets FCEB agencies, CISA strongly advises all organizations to address these vulnerabilities. Prioritizing remediation of KEV Catalog entries is crucial for reducing cyberattack exposure. This proactive approach should be integrated into regular vulnerability management. CISA will continue to update the KEV Catalog with newly identified vulnerabilities that meet the established criteria.

https://www.cisa.gov/news-events/alerts/2026/05/01/cisa-adds-one-known-exploited-vulnerability-catalog cisa.gov

RSS Hunter • May 1

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added a new vulnerability, CVE-2026-41940, to its Known Exploited Vulnerabilities (KEV) Catalog. This vulnerability affects WebPros cPanel & WHM and WP2, specifically a missing authentication for a critical function. Such vulnerabilities are commonly exploited by malicious actors and present significant risks. The KEV Catalog was established by Binding Operational Directive 22-01 to list vulnerabilities posing significant risk to the federal enterprise. This directive mandates that Federal Civilian Executive Branch (FCEB) agencies remediate these vulnerabilities by a set deadline. The goal is to protect FCEB networks from active threats. While BOD 22-01 is specific to FCEB agencies, CISA strongly recommends all organizations follow suit. Prioritizing the remediation of KEV Catalog vulnerabilities is crucial for reducing cyberattack exposure. This practice should be integrated into overall vulnerability management. CISA intends to continue adding vulnerabilities that meet their criteria to the catalog.

https://www.cisa.gov/news-events/alerts/2026/04/30/cisa-adds-one-known-exploited-vulnerability-catalog cisa.gov

RSS Hunter • Apr 30

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA has included two new vulnerabilities in its Known Exploited Vulnerabilities (KEV) Catalog. These vulnerabilities, CVE-2024-1708 (ConnectWise ScreenConnect) and CVE-2026-32202 (Microsoft Windows), are actively being exploited. These types of flaws often lead to cyberattacks and pose substantial risks, especially to government networks. BOD 22-01 established the KEV Catalog to identify and mandate the patching of critical vulnerabilities. This directive requires Federal Civilian Executive Branch agencies to fix these vulnerabilities promptly. The due dates for remediation are set to protect networks from current threats. While BOD 22-01 focuses on federal agencies, CISA advises all organizations to prioritize KEV Catalog remediation. This proactive action helps reduce their vulnerability to cyberattacks. Organizations should integrate KEV remediation into their established vulnerability management processes. CISA will continue monitoring and adding vulnerabilities to the catalog as new threats emerge.

https://www.cisa.gov/news-events/alerts/2026/04/28/cisa-adds-two-known-exploited-vulnerabilities-catalog cisa.gov

RSS Hunter • Apr 28

CISA Adds Four Known Exploited Vulnerabilities to Catalog

CISA has updated its Known Exploited Vulnerabilities (KEV) Catalog with four new vulnerabilities, confirmed to be actively exploited. These include path traversal flaws in Samsung MagicINFO 9 Server and SimpleHelp, a missing authorization issue in SimpleHelp, and a command injection vulnerability in D-Link DIR-823X. Such vulnerabilities are commonly exploited by malicious actors, posing substantial risks to federal systems. The KEV Catalog was established by Binding Operational Directive (BOD) 22-01 to address significant cyber risks to the federal enterprise. This directive mandates Federal Civilian Executive Branch (FCEB) agencies to remediate listed vulnerabilities by specified deadlines. This action is crucial for safeguarding FCEB networks from ongoing cyber threats. While BOD 22-01 primarily targets FCEB agencies, CISA strongly advises all organizations to prioritize KEV Catalog remediation. Timely patching of these vulnerabilities is a critical component of effective vulnerability management practices. CISA remains committed to continuously updating the catalog with new vulnerabilities that meet its defined criteria.

https://www.cisa.gov/news-events/alerts/2026/04/24/cisa-adds-four-known-exploited-vulnerabilities-catalog cisa.gov

RSS Hunter • Apr 24

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has identified and added CVE-2026-39987, a Marimo Remote Code Execution Vulnerability, to its Known Exploited Vulnerabilities (KEV) Catalog. This vulnerability is currently being actively exploited by malicious actors. Remote code execution vulnerabilities are common attack methods that present substantial risks to federal systems. CISA established the KEV Catalog through Binding Operational Directive (BOD) 22-01 to identify high-risk vulnerabilities. BOD 22-01 mandates that Federal Civilian Executive Branch (FCEB) agencies must fix these vulnerabilities by a specific deadline. This directive aims to protect FCEB networks from ongoing cyber threats. While BOD 22-01 applies only to FCEB agencies, CISA strongly recommends all organizations address these vulnerabilities. Prioritizing the remediation of cataloged vulnerabilities is crucial for effective vulnerability management. CISA will continue to update the KEV Catalog with new vulnerabilities that meet its criteria. This ongoing effort helps organizations mitigate significant cyber risks.

https://www.cisa.gov/news-events/alerts/2026/04/23/cisa-adds-one-known-exploited-vulnerability-catalog cisa.gov

RSS Hunter • Apr 23

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has updated its Known Exploited Vulnerabilities (KEV) Catalog, adding a new vulnerability. This newly listed vulnerability is CVE-2026-33825, impacting Microsoft Defender. It involves insufficient access control, a common attack vector used by malicious actors. This vulnerability poses considerable risks, particularly for federal agencies. The KEV Catalog is a dynamic list of known vulnerabilities with significant risks, as defined by Binding Operational Directive (BOD) 22-01. BOD 22-01 mandates that Federal Civilian Executive Branch (FCEB) agencies remediate KEV vulnerabilities by set deadlines. Remediation protects FCEB networks from active cyber threats, as outlined in the BOD 22-01 Fact Sheet. While the directive primarily targets FCEB agencies, CISA recommends all organizations address KEV vulnerabilities promptly. Prioritizing remediation helps organizations lessen their vulnerability to cyberattacks. CISA plans to continuously expand the catalog with vulnerabilities meeting its criteria.

https://www.cisa.gov/news-events/alerts/2026/04/22/cisa-adds-one-known-exploited-vulnerability-catalog cisa.gov

RSS Hunter • Apr 22

CISA Adds Eight Known Exploited Vulnerabilities to Catalog

CISA has added eight new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog due to evidence of active exploitation. These include vulnerabilities in PaperCut NG/MF, JetBrains TeamCity, Kentico Xperience, Quest KACE SMA, Synacor Zimbra, and Cisco Catalyst SD-WAN Manager. These types of vulnerabilities are common attack vectors and present significant risks. The KEV Catalog was established by Binding Operational Directive (BOD) 22-01 to identify vulnerabilities posing a substantial risk to the federal enterprise. BOD 22-01 mandates that Federal Civilian Executive Branch (FCEB) agencies fix these vulnerabilities by a specified deadline. This action aims to protect FCEB networks from active cyber threats. While BOD 22-01 specifically targets FCEB agencies, CISA strongly advises all organizations to address KEV Catalog vulnerabilities promptly. Prioritizing remediation is crucial for reducing cyberattack exposure. CISA will continue to update the KEV Catalog with new vulnerabilities that meet the established criteria.

https://www.cisa.gov/news-events/alerts/2026/04/20/cisa-adds-eight-known-exploited-vulnerabilities-catalog cisa.gov

RSS Hunter • Apr 20

Supply Chain Compromise Impacts Axios Node Package Manager

CISA issued an alert regarding a software supply chain compromise affecting the Axios npm package. Malicious versions of Axios, specifically [email protected] and [email protected], injected a dependency called [email protected]. This malicious dependency downloads multi-stage payloads, including a remote access trojan, from actor-controlled infrastructure. Organizations must monitor code repositories, CI/CD pipelines, and developer machines for the compromised Axios versions. They should also check artifact repositories for cached malicious dependencies and pin package versions to known safe releases. If compromised dependencies are found, environments need to be reverted to a safe state and credentials potentially exposed should be rotated. Monitoring for unexpected child processes and anomalous network behavior during npm operations is crucial. Blocking outbound connections to Sfrclak[.]com domains is also recommended. CISA further advises implementing phishing-resistant MFA for developer accounts and configuring npm to ignore scripts and enforce minimum release ages for packages. Establishing normal execution baselines and alerting on anomalous dependency behavior will help detect and prevent future compromises.

https://www.cisa.gov/news-events/alerts/2026/04/20/supply-chain-compromise-impacts-axios-node-package-manager cisa.gov

RSS Hunter • Apr 20

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has identified a new vulnerability, CVE-2026-34197, in its Known Exploited Vulnerabilities (KEV) Catalog. This vulnerability affects Apache ActiveMQ and is due to improper input validation. Evidence indicates this vulnerability is actively being exploited by malicious actors. Such vulnerabilities are common attack methods and present substantial risks to federal systems. Binding Operational Directive 22-01 mandates that Federal Civilian Executive Branch (FCEB) agencies address these KEV Catalog vulnerabilities. The KEV Catalog is a dynamic list of vulnerabilities with significant risk to the federal enterprise. FCEB agencies must remediate listed vulnerabilities by their deadlines to enhance network security. While this directive specifically targets FCEB agencies, CISA strongly recommends all organizations adopt this practice. Prioritizing the remediation of KEV Catalog vulnerabilities is crucial for mitigating cyberattack exposure. CISA will continue to update the KEV Catalog with new vulnerabilities that meet the established criteria.

https://www.cisa.gov/news-events/alerts/2026/04/16/cisa-adds-one-known-exploited-vulnerability-catalog cisa.gov

RSS Hunter • Apr 16

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA has updated its Known Exploited Vulnerabilities (KEV) Catalog, a list of actively exploited vulnerabilities. Two new vulnerabilities have been added to the catalog due to confirmed exploitation. The first vulnerability, CVE-2009-0238, impacts Microsoft Office and involves remote code execution. The second vulnerability, CVE-2026-32201, affects Microsoft SharePoint Server and concerns improper input validation. These vulnerabilities are attractive targets for malicious actors and pose substantial risks primarily to federal networks. The KEV Catalog was created by Binding Operational Directive (BOD) 22-01 to address these risks. BOD 22-01 mandates that Federal Civilian Executive Branch agencies remediate these vulnerabilities promptly. Agencies must meet specified deadlines to safeguard their networks against active threats. CISA encourages all organizations, even those not under BOD 22-01, to prioritize KEV remediation. Timely remediation helps mitigate cyberattack risks within any organization’s vulnerability management program. CISA will regularly update the KEV Catalog with additional vulnerabilities meeting the necessary criteria.

https://www.cisa.gov/news-events/alerts/2026/04/14/cisa-adds-two-known-exploited-vulnerabilities-catalog cisa.gov

RSS Hunter • Apr 14

CISA Adds Seven Known Exploited Vulnerabilities to Catalog

CISA updated its Known Exploited Vulnerabilities (KEV) Catalog with seven newly identified security flaws. These vulnerabilities, affecting products like Microsoft Windows, Adobe Acrobat, Microsoft Exchange Server, and Fortinet, are actively being exploited by malicious actors. The addition is based on evidence indicating that these vulnerabilities are frequent attack vectors. BOD 22-01 mandates that Federal Civilian Executive Branch (FCEB) agencies must remediate vulnerabilities listed in the KEV Catalog by specified deadlines. This directive helps safeguard FCEB networks from existing cyber threats. The KEV Catalog serves as a dynamic list of CVEs that pose substantial risks. While BOD 22-01 is binding for FCEB agencies, CISA recommends all organizations to prioritize patching these vulnerabilities. Timely remediation of KEV Catalog vulnerabilities is crucial for effective vulnerability management. CISA will continue to expand the catalog with new vulnerabilities that meet their established criteria.

https://www.cisa.gov/news-events/alerts/2026/04/13/cisa-adds-seven-known-exploited-vulnerabilities-catalog cisa.gov

RSS Hunter • Apr 13