CISA | Alerts - TheNote.app

CISA | Alerts
Follow

The website is for the Cybersecurity and Infrastructure Security Agency (CISA). CISA is a part of the U.S. Department of Homeland Security and is responsible for enhancing the security, resilience, and reliability of the nation's cyber and physical infrastructure. The agency plays a crucial role in protecting against cybersecurity threats, ensuring critical infrastructure is secure, and responding to cyber incidents. On the website, you can find information about various cybersecurity initiatives, resources for individuals and organizations to improve their cyber defenses, alerts and updates on emerging threats, and guidelines for incident response. The site also provides details on critical infrastructure sectors, partnerships, training programs, and opportunities to collaborate with CISA on security efforts.

Alerts cisa.gov

RSS feeds.feedburner.com

RSS Hunter • Aug 19, 2024

Thread Of Notes

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added CVE-2025-39682, a Linux Kernel vulnerability, to its Known Exploited Vulnerabilities (KEV) Catalog. This vulnerability has evidence of active exploitation, making it a significant threat. CVE-2025-39682 allows malicious actors to gain total control of an asset post-exploitation. Federal Civilian Executive Branch (FCEB) agencies must prioritize the remediation of such high-risk vulnerabilities. This requirement is established by Binding Operational Directive (BOD) 26-04, which focuses on risk-based vulnerability management. BOD 26-04 mandates rapid patching of vulnerabilities listed in the KEV Catalog on publicly exposed assets. The directive also outlines expectations for agencies to check for compromises before applying patches. While BOD 26-04 is for FCEB agencies, CISA recommends all organizations adopt similar risk-based practices. CISA will continue to update the KEV Catalog as new exploited vulnerabilities are identified. Organizations can nominate potential additions to the KEV Catalog if they have a CVE ID, proof of exploitation, and mitigation steps.

https://www.cisa.gov/news-events/alerts/2026/09/18/cisa-adds-one-known-exploited-vulnerability-catalog cisa.gov

RSS Hunter • Sep 18

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA has added two new Linux kernel vulnerabilities, CVE-2025-39964 and CVE-2026-53266, to its Known Exploited Vulnerabilities (KEV) Catalog. These vulnerabilities are actively being exploited by malicious actors and pose significant risks. Binding Operational Directive 26-04 requires Federal Civilian Executive Branch (FCEB) agencies to prioritize the remediation of vulnerabilities listed in the KEV Catalog, especially those on public-facing assets. This directive emphasizes a risk-based approach, focusing on vulnerabilities that grant full control of an asset upon exploitation. Agencies are also expected to check for compromise before applying patches. While BOD 26-04 is specific to FCEB agencies, CISA urges all organizations to adopt similar risk-based vulnerability management practices. CISA will continue to update the KEV Catalog with newly identified exploited vulnerabilities. Organizations can nominate vulnerabilities for inclusion in the KEV Catalog if they have a CVE ID, evidence of exploitation, and clear mitigation guidance.

https://www.cisa.gov/news-events/alerts/2026/09/18/cisa-adds-two-known-exploited-vulnerabilities-catalog cisa.gov

RSS Hunter • Sep 18

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog due to active exploitation. The vulnerabilities are CVE-2026-76460 affecting Cisco Identity Services Engine and CVE-2026-87886 impacting Acronis Backup. Exploited vulnerabilities are common attack methods, presenting significant risks to federal systems. Binding Operational Directive 26-04 requires federal agencies to prioritize fixing high-risk vulnerabilities listed in the KEV Catalog. This directive specifically targets vulnerabilities on public-facing assets that allow full control upon exploitation. Federal agencies must also implement checks for prior compromise before applying patches. While BOD 26-04 is for federal agencies, CISA recommends all organizations adopt similar risk-based vulnerability management. CISA will continue to add qualifying vulnerabilities to the KEV Catalog. Organizations can nominate exploited vulnerabilities not yet in the catalog via CISA's KEV Nomination Form. Submitted vulnerabilities must have a CVE ID, proof of exploitation, and clear mitigation steps.

https://www.cisa.gov/news-events/alerts/2026/09/16/cisa-adds-two-known-exploited-vulnerabilities-catalog cisa.gov

RSS Hunter • Sep 16

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added CVE-2026-58704, a Google Pixel improper authorization vulnerability, to its Known Exploited Vulnerabilities (KEV) Catalog. This vulnerability has been observed being actively exploited by malicious actors. Such vulnerabilities present significant risks to federal agencies. CISA's Binding Operational Directive (BOD) 26-04 mandates that federal civilian executive branch agencies prioritize the remediation of vulnerabilities listed in the KEV Catalog. This directive specifically targets high-risk vulnerabilities on publicly exposed assets that, once exploited, grant total control. BOD 26-04 also outlines requirements for agencies to check for compromises before applying patches. While BOD 26-04 applies only to FCEB agencies, CISA recommends that all organizations adopt similar risk-based vulnerability management practices. CISA will continue to add vulnerabilities meeting the criteria to the KEV Catalog. Organizations can nominate vulnerabilities for inclusion if they have a CVE ID, evidence of exploitation, and clear mitigation guidance.

https://www.cisa.gov/news-events/alerts/2026/09/16/cisa-adds-one-known-exploited-vulnerability-catalog cisa.gov

RSS Hunter • Sep 16

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added a new vulnerability, CVE-2026-76461, concerning Cisco Secure Email Gateway SQL injection, to its Known Exploited Vulnerabilities (KEV) Catalog. This vulnerability is actively being exploited by malicious actors and presents substantial risks to federal systems. Binding Operational Directive 26-04 mandates that Federal Civilian Executive Branch agencies prioritize patching vulnerabilities listed in the KEV Catalog on their public-facing assets. This directive focuses on vulnerabilities that, once exploited, grant complete control of the affected system. BOD 26-04 also outlines requirements for agencies to check for compromises prior to patching. Although BOD 26-04 specifically targets FCEB agencies, CISA strongly advises all organizations to implement risk-based vulnerability management. This includes prioritizing the remediation of vulnerabilities identified in the KEV Catalog. CISA will continue to identify and add vulnerabilities to the KEV Catalog as they are discovered and exploited. Organizations aware of exploited vulnerabilities not yet in the catalog can submit them for consideration using CISA's KEV Nomination Form. To be nominated, a vulnerability must have a CVE ID, proof of exploitation, and documented mitigation steps.

https://www.cisa.gov/news-events/alerts/2026/09/14/cisa-adds-one-known-exploited-vulnerability-catalog cisa.gov

RSS Hunter • Sep 14

CISA Adds Three Known Exploited Vulnerabilities to Catalog

CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog due to evidence of active exploitation. These identified vulnerabilities are CVE-2026-42016 and CVE-2026-42018 affecting JFrog Artifactory, and CVE-2026-84869 impacting ConnectWise ScreenConnect. Exploited vulnerabilities are a common method for cyberattacks and present substantial dangers. Federal Civilian Executive Branch (FCEB) agencies must follow Binding Operational Directive (BOD) 26-04 for vulnerability management. This directive emphasizes the significance of the KEV Catalog for prioritizing the swift patching of high-risk vulnerabilities on public-facing systems. BOD 26-04 also sets requirements for agencies to check for compromises before applying patches. Although BOD 26-04 is for FCEB agencies, CISA recommends all organizations implement risk-based vulnerability management. Prioritizing the remediation of KEV Catalog vulnerabilities is highly encouraged. CISA will continue to update the KEV Catalog with qualifying vulnerabilities. Organizations can nominate exploited vulnerabilities not yet in the catalog via CISA's KEV Nomination Form.

https://www.cisa.gov/news-events/alerts/2026/09/11/cisa-adds-three-known-exploited-vulnerabilities-catalog cisa.gov

RSS Hunter • Sep 11

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added a new vulnerability, CVE-2026-85706, to its Known Exploited Vulnerabilities (KEV) Catalog due to evidence of active exploitation. This adds a path traversal vulnerability affecting GitLab Community Edition and Enterprise Edition to the catalog. Path traversal vulnerabilities are common attack methods for cybercriminals. The addition highlights the risks these vulnerabilities pose to federal systems. Binding Operational Directive (BOD) 26-04 mandates that Federal Civilian Executive Branch (FCEB) agencies prioritize patching vulnerabilities listed in the KEV Catalog. This directive emphasizes rapid remediation of high-risk vulnerabilities on public-facing assets that grant full control post-exploitation. BOD 26-04 also sets expectations for agencies to check for compromise before applying patches. Although BOD 26-04 is specific to FCEB agencies, CISA recommends all organizations adopt this risk-based approach to vulnerability management. CISA will continue to update the KEV Catalog with qualifying vulnerabilities. Organizations can nominate vulnerabilities they believe should be added to the KEV Catalog if they have a CVE ID, proof of exploitation, and mitigation details.

https://www.cisa.gov/news-events/alerts/2026/09/11/cisa-adds-one-known-exploited-vulnerability-catalog cisa.gov

RSS Hunter • Sep 11

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA has added two new vulnerabilities, CVE-2026-67277 and CVE-2026-86060, to its Known Exploited Vulnerabilities (KEV) Catalog due to active exploitation. Both vulnerabilities affect MikroTik RouterOS. These types of vulnerabilities are common attack vectors for cybercriminals. Federal Civilian Executive Branch (FCEB) agencies are required by Binding Operational Directive (BOD) 26-04 to prioritize remediation of vulnerabilities listed in the KEV Catalog on publicly exposed assets. BOD 26-04 emphasizes rapid patching of high-risk vulnerabilities that grant total control post-exploitation. The directive also sets expectations for agencies to check for compromises before applying patches. While BOD 26-04 is specific to FCEB agencies, CISA urges all organizations to adopt similar risk-based vulnerability management. CISA will continue to add qualifying vulnerabilities to the KEV Catalog. Organizations can nominate exploited vulnerabilities not yet on the catalog for review. A nomination requires a CVE ID, evidence of exploitation, and clear mitigation steps.

https://www.cisa.gov/news-events/alerts/2026/09/10/cisa-adds-two-known-exploited-vulnerabilities-catalog cisa.gov

RSS Hunter • Sep 10

CISA Adds Four Known Exploited Vulnerabilities to Catalog

CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog. These vulnerabilities are actively being exploited by malicious actors and pose significant risks. The newly added vulnerabilities include heap-based buffer overflows in Fortinet products and authentication bypasses in Citrix NetScaler and Cisco Firewall Management Center. A Google Chromium V8 out-of-bounds write vulnerability has also been added. These types of vulnerabilities are common attack vectors. Binding Operational Directive 26-04 mandates that Federal Civilian Executive Branch agencies prioritize the remediation of vulnerabilities listed in the KEV Catalog. This directive emphasizes rapid patching of high-risk vulnerabilities on publicly exposed assets. It also sets expectations for agencies to check for compromises before applying patches. While this directive applies only to federal agencies, CISA urges all organizations to implement risk-based vulnerability management. CISA will continue to add vulnerabilities to the KEV Catalog as they are identified and exploited. Organizations can nominate potential KEV additions with a CVE ID, exploitation evidence, and mitigation guidance.

https://www.cisa.gov/news-events/alerts/2026/09/09/cisa-adds-four-known-exploited-vulnerabilities-catalog cisa.gov

RSS Hunter • Sep 9

CISA Adds Four Known Exploited Vulnerabilities to Catalog

CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog due to active exploitation. These include vulnerabilities in Adobe Commerce and Magento, two in Microsoft Windows, and one in N-able N-central. These vulnerabilities represent significant risks as they are common attack vectors for malicious actors. Binding Operational Directive (BOD) 26-04 mandates that Federal Civilian Executive Branch (FCEB) agencies prioritize the remediation of vulnerabilities listed in the KEV Catalog on publicly exposed assets. The directive requires agencies to implement risk-based vulnerability management to address high-risk vulnerabilities rapidly. It also sets expectations for how agencies should check for compromises before applying patches. Although BOD 26-04 applies specifically to FCEB agencies, CISA strongly recommends that all organizations adopt similar risk-based approaches to vulnerability management. CISA will continue to add vulnerabilities to the KEV Catalog as they are identified and meet the established criteria. Organizations can nominate exploited vulnerabilities not yet in the catalog by providing a CVE ID, evidence of exploitation, and clear mitigation guidance.

https://www.cisa.gov/news-events/alerts/2026/09/08/cisa-adds-four-known-exploited-vulnerabilities-catalog cisa.gov

RSS Hunter • Sep 8

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added CVE-2026-85046, a Google Chromium V8 type confusion vulnerability, to its Known Exploited Vulnerabilities (KEV) Catalog. This vulnerability is actively being exploited and presents a significant risk to federal agencies. Binding Operational Directive (BOD) 26-04 mandates that Federal Civilian Executive Branch (FCEB) agencies prioritize fixing vulnerabilities listed in the KEV Catalog. This directive specifically targets high-risk vulnerabilities on publicly exposed assets that lead to complete control upon exploitation. BOD 26-04 also outlines requirements for federal agencies to check for compromise before patching. While the BOD applies only to FCEB agencies, CISA recommends that all organizations adopt this risk-based approach. The agency will continue to add vulnerabilities to the KEV Catalog as they meet the criteria. Organizations can nominate vulnerabilities for inclusion if they have a CVE ID, proof of exploitation, and clear mitigation steps. This active management of exploited vulnerabilities is crucial for cybersecurity.

https://www.cisa.gov/news-events/alerts/2026/09/04/cisa-adds-one-known-exploited-vulnerability-catalog cisa.gov

RSS Hunter • Sep 4

CISA Adds Seven Known Exploited Vulnerabilities to Catalog

CISA has added seven new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog due to active exploitation. These include vulnerabilities in Sangoma Switchvox, Kludex Starlette, Kestra OSS, BerriAI LiteLLM, JFrog Artifactory, and two in SonicWall SMA1000 appliances. These types of vulnerabilities are common attack methods for cybercriminals and pose risks to federal systems. Federal Civilian Executive Branch (FCEB) agencies are required by Binding Operational Directive (BOD) 26-04 to prioritize the remediation of high-risk vulnerabilities listed in the KEV Catalog. BOD 26-04 specifically mandates rapid patching of vulnerabilities on publicly exposed assets that allow for total control after exploitation. The directive also sets expectations for agencies to check for compromises before applying patches. Although BOD 26-04 applies only to FCEB agencies, CISA recommends that all organizations implement risk-based vulnerability management. CISA will continue to add vulnerabilities to the KEV Catalog as they meet the criteria. Organizations aware of exploited vulnerabilities not on the catalog can nominate them for inclusion.

https://www.cisa.gov/news-events/alerts/2026/09/02/cisa-adds-seven-known-exploited-vulnerabilities-catalog cisa.gov

RSS Hunter • Sep 2

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA has recently added two new PaperCut NG/MF vulnerabilities, CVE-2026-81578 and CVE-2026-82078, to its Known Exploited Vulnerabilities (KEV) Catalog due to active exploitation. These vulnerabilities, often exploited by malicious actors, pose significant risks. Binding Operational Directive (BOD) 26-04 mandates vulnerability management for Federal Civilian Executive Branch (FCEB) agencies. This directive emphasizes the criticality of the KEV Catalog, requiring federal agencies to swiftly remediate high-risk vulnerabilities, especially those in the KEV Catalog on publicly exposed assets that grant total control. It also sets expectations for agencies to check for system compromise before applying patches. Although BOD 26-04 targets FCEB agencies, CISA strongly advises all organizations to implement risk-based vulnerability management and prioritize KEV Catalog remediations. CISA consistently updates the catalog with vulnerabilities meeting specific criteria. Organizations aware of exploited vulnerabilities not yet listed can nominate them through CISA's KEV Nomination Form. Nominations require a CVE ID, evidence of exploitation, and explicit mitigation guidance.

https://www.cisa.gov/news-events/alerts/2026/08/31/cisa-adds-two-known-exploited-vulnerabilities-catalog cisa.gov

RSS Hunter • Aug 31

CISA Adds Three Known Exploited Vulnerabilities to Catalog

CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog. These include CVE-2023-49105 in ownCloud, CVE-2026-53362 in the Linux Kernel, and CVE-2026-66384 in JFrog Artifactory. These vulnerabilities are frequently exploited by malicious actors and pose substantial risks. Federal Civilian Executive Branch agencies must comply with Binding Operational Directive (BOD) 26-04, which mandates prioritizing the remediation of high-risk vulnerabilities. Specifically, BOD 26-04 requires agencies to focus on vulnerabilities listed in the KEV Catalog on publicly exposed assets that grant full control after exploitation. The directive also outlines expectations for agencies to check for system compromises before applying patches. While BOD 26-04 applies only to federal agencies, CISA recommends all organizations adopt a risk-based approach to vulnerability management. This includes prioritizing the remediation of vulnerabilities found in the KEV Catalog. CISA will continue to add vulnerabilities to the KEV Catalog as they meet the criteria. Organizations can submit potential KEV additions via CISA's KEV Nomination Form if they are aware of exploited vulnerabilities not yet listed. Submissions require a CVE ID, evidence of exploitation, and clear mitigation guidance.

https://www.cisa.gov/news-events/alerts/2026/08/27/cisa-adds-three-known-exploited-vulnerabilities-catalog cisa.gov

RSS Hunter • Aug 27

CISA Adds Six Known Exploited Vulnerabilities to Catalog

CISA has added six new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog due to active exploitation. These vulnerabilities include issues in Red Hat Libuser, Red Hat Automatic Bug Reporting Tool, Microsoft SQL Server, Ajax.NET Professional, Linux Kernel, and Citrix NetScaler. Exploited vulnerabilities are frequently used by cyber actors and pose significant risks to federal systems. Federal Civilian Executive Branch agencies are required by Binding Operational Directive (BOD) 26-04 to prioritize the remediation of vulnerabilities listed in the KEV Catalog. This directive emphasizes addressing high-risk vulnerabilities on publicly exposed assets that grant complete control after exploitation. BOD 26-04 also outlines expectations for agencies regarding pre-patch compromise checks. While the directive applies specifically to FCEB agencies, CISA encourages all organizations to adopt this risk-based approach. CISA will continuously monitor and add new vulnerabilities to the KEV Catalog. Organizations can submit potential KEV additions that demonstrate exploitation and have clear mitigation.

https://www.cisa.gov/news-events/alerts/2026/08/26/cisa-adds-six-known-exploited-vulnerabilities-catalog cisa.gov

RSS Hunter • Aug 26

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added a critical Gitea code injection vulnerability, CVE-2026-60004, to its Known Exploited Vulnerabilities (KEV) Catalog due to active exploitation. This type of vulnerability is a common attack method for malicious actors and presents major risks. Binding Operational Directive (BOD) 26-04 mandates that Federal Civilian Executive Branch (FCEB) agencies prioritize security updates for vulnerabilities listed in the KEV Catalog. This directive emphasizes rapid remediation of high-risk vulnerabilities on publicly exposed assets that grant complete control post-exploitation. BOD 26-04 also sets expectations for agencies to check for system compromises before applying patches. While the directive specifically targets FCEB agencies, CISA urges all organizations to implement risk-based vulnerability management. Organizations are encouraged to prioritize fixing vulnerabilities found in the KEV Catalog. CISA will continue to add vulnerabilities that meet the criteria for active exploitation. If an exploited vulnerability is known but not yet in the KEV Catalog, it can be nominated for addition. Nominations require a CVE ID, evidence of exploitation, and clear mitigation information.

https://www.cisa.gov/news-events/alerts/2026/08/25/cisa-adds-one-known-exploited-vulnerability-catalog cisa.gov

RSS Hunter • Aug 25

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added CVE-2026-21962, an Oracle HTTP Server and Oracle Weblogic Server vulnerability, to its Known Exploited Vulnerabilities (KEV) Catalog. This vulnerability is actively being exploited by malicious actors and presents serious risks. Binding Operational Directive (BOD) 26-04 mandates that Federal Civilian Executive Branch (FCEB) agencies prioritize fixing high-risk vulnerabilities found in CISA's KEV Catalog. This directive specifically targets vulnerabilities on publicly exposed assets that allow complete system control after exploitation. BOD 26-04 also outlines requirements for agencies to check for system compromise before applying patches. Although BOD 26-04 is for FCEB agencies, CISA recommends all organizations adopt similar risk-based vulnerability management. CISA will continue to add vulnerabilities to the KEV Catalog that meet the established criteria. Organizations can nominate exploited vulnerabilities not yet in the KEV Catalog via CISA's nomination form. Submitted vulnerabilities must have a CVE ID, proof of exploitation, and clear mitigation steps.

https://www.cisa.gov/news-events/alerts/2026/08/24/cisa-adds-one-known-exploited-vulnerability-catalog cisa.gov

RSS Hunter • Aug 24

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has updated its Known Exploited Vulnerabilities (KEV) Catalog with a new entry, CVE-2026-73570, an OS Command Injection Vulnerability in Zimbra Collaboration Suite (ZCS). This vulnerability has documented evidence of active exploitation, making its inclusion critical. OS command injection vulnerabilities are frequently targeted by threat actors and present significant risks to organizations, including federal agencies. Binding Operational Directive (BOD) 26-04 mandates vulnerability management for Federal Civilian Executive Branch (FCEB) agencies. This directive emphasizes the KEV Catalog, requiring rapid remediation of its listed high-risk vulnerabilities on publicly exposed assets that allow full control post-exploitation. BOD 26-04 also sets expectations for agencies to check for prior compromise before applying patches. Although BOD 26-04 applies strictly to FCEB agencies, CISA strongly advises all organizations to adopt a risk-based approach to vulnerability management. Prioritizing the remediation of KEV Catalog vulnerabilities is crucial for all entities. CISA will continuously expand the catalog with vulnerabilities meeting its specific criteria. Organizations aware of exploited vulnerabilities not yet listed in the KEV Catalog are encouraged to submit them for consideration via CISA’s KEV Nomination Form, provided they have a CVE ID, evidence of exploitation, and clear mitigation guidance.

https://www.cisa.gov/news-events/alerts/2026/08/21/cisa-adds-one-known-exploited-vulnerability-catalog cisa.gov

RSS Hunter • Aug 21

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA has added two new vulnerabilities, CVE-2026-72529 and CVE-2026-72530, affecting TrueConf Server to its Known Exploited Vulnerabilities (KEV) Catalog. These vulnerabilities have been confirmed to be actively exploited by malicious actors. Such vulnerabilities represent a significant threat to the federal enterprise due to their common use in cyberattacks. Binding Operational Directive 26-04 mandates that Federal Civilian Executive Branch (FCEB) agencies prioritize the remediation of vulnerabilities listed in the KEV Catalog, especially those on publicly accessible assets. This directive emphasizes a risk-based approach, focusing on high-risk vulnerabilities that grant complete control after exploitation. Agencies are also required to check for system compromise before applying patches for listed vulnerabilities. Although BOD 26-04 is specific to FCEB agencies, CISA strongly recommends that all organizations implement similar risk-based vulnerability management practices. CISA plans to continue adding vulnerabilities to the KEV Catalog as evidence of exploitation emerges. Organizations can nominate vulnerabilities for potential inclusion to the KEV Catalog if they have a CVE ID, proof of exploitation, and accessible mitigation steps.

https://www.cisa.gov/news-events/alerts/2026/08/20/cisa-adds-two-known-exploited-vulnerabilities-catalog cisa.gov

RSS Hunter • Aug 20

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added a new vulnerability, CVE-2026-64849, to its Known Exploited Vulnerabilities (KEV) Catalog. This is due to evidence of its active exploitation, posing significant risks to federal systems. Server-Side Request Forgery vulnerabilities are a common attack method for malicious actors. Binding Operational Directive 26-04 mandates that Federal Civilian Executive Branch agencies prioritize the remediation of vulnerabilities listed in the KEV Catalog. This directive emphasizes addressing high-risk vulnerabilities on publicly exposed assets that grant complete control upon exploitation. Agencies are also expected to check for prior compromise before applying patches. Although BOD 26-04 is for federal agencies, CISA urges all organizations to adopt risk-based vulnerability management. CISA will continue to add vulnerabilities to the KEV Catalog that meet the established criteria. Organizations can nominate exploited vulnerabilities not yet on the list via CISA’s KEV Nomination Form. Submitted nominations require a CVE ID, proof of exploitation, and clear mitigation steps.

https://www.cisa.gov/news-events/alerts/2026/08/19/cisa-adds-one-known-exploited-vulnerability-catalog cisa.gov

RSS Hunter • Aug 19

CISA Adds Four Known Exploited Vulnerabilities to Catalog

CISA has updated its Known Exploited Vulnerabilities (KEV) Catalog with four new vulnerabilities, each showing signs of active exploitation. These additions include a double free vulnerability in Microsoft IKE Service Extensions and a weak authentication flaw in Microsoft SharePoint. Broadcom's VMware vCenter has a new path traversal vulnerability, and Apple macOS users face an improper authentication vulnerability. Such vulnerabilities are commonly targeted by cyber attackers and pose significant threats to federal systems.Binding Operational Directive (BOD) 26-04 mandates rigorous vulnerability management for Federal Civilian Executive Branch (FCEB) agencies. This directive emphasizes the critical role of the KEV Catalog in guiding remediation efforts. Federal agencies must quickly address high-risk vulnerabilities, particularly those in the KEV Catalog, especially on public-facing assets where exploitation could grant full control. The directive also sets expectations for agencies to check for system compromises before patching.Although BOD 26-04 specifically targets FCEB agencies, CISA strongly recommends that all organizations adopt a risk-based approach to vulnerability management. Prioritizing the remediation of KEV Catalog vulnerabilities is crucial for all entities. CISA will consistently add new vulnerabilities to the catalog if they meet the established criteria. Organizations aware of exploited vulnerabilities not yet listed in the KEV Catalog can nominate them for inclusion via CISA’s KEV Nomination Form. Nominated vulnerabilities must have a CVE ID, confirmed exploitation evidence, and clear mitigation advice.

https://www.cisa.gov/news-events/alerts/2026/08/18/cisa-adds-four-known-exploited-vulnerabilities-catalog cisa.gov

RSS Hunter • Aug 18

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added CVE-2025-62593, a Ray-Project Ray code injection vulnerability, to its Known Exploited Vulnerabilities (KEV) Catalog due to active exploitation. This type of vulnerability is a common attack method used by malicious actors and presents considerable risks. Binding Operational Directive (BOD) 26-04 mandates vulnerability management for Federal Civilian Executive Branch agencies. This directive emphasizes the KEV Catalog and requires agencies to quickly fix high-risk vulnerabilities on public assets that offer complete control after exploitation. Lower-risk vulnerabilities can be addressed later. BOD 26-04 also sets requirements for agencies to check for system compromise before applying patches. Although BOD 26-04 is for federal agencies, CISA urges all organizations to use risk-based vulnerability management and fix KEV Catalog items. CISA will continue to add vulnerabilities that meet their criteria to the catalog. Organizations can nominate exploited vulnerabilities not yet in the KEV Catalog via a nomination form, provided they have a CVE ID, exploitation evidence, and clear mitigation steps.

https://www.cisa.gov/news-events/alerts/2026/08/17/cisa-adds-one-known-exploited-vulnerability-catalog cisa.gov

RSS Hunter • Aug 17

CISA Adds Three Known Exploited Vulnerabilities to Catalog

CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog due to their active exploitation. These include a Cisco Secure Firewall vulnerability, a Microsoft Windows WinSock vulnerability, and a Metabase SQL injection vulnerability. Such vulnerabilities are common attack methods for cybercriminals and present significant dangers to federal networks. Binding Operational Directive (BOD) 26-04 mandates that Federal Civilian Executive Branch (FCEB) agencies prioritize fixing vulnerabilities listed in the KEV Catalog. This directive specifically targets publicly exposed assets granting full control post-exploitation. Agencies are also required to assess systems for compromise before applying patches. Although BOD 26-04 is specific to FCEB agencies, CISA urges all organizations to use a risk-based approach for managing vulnerabilities. CISA will continue to add vulnerabilities to the KEV Catalog that meet the stated conditions. Organizations can nominate exploited vulnerabilities not yet in the catalog via CISA’s KEV Nomination Form. Submissions require a CVE ID, proof of exploitation, and clear guidance on mitigation.

https://www.cisa.gov/news-events/alerts/2026/08/11/cisa-adds-three-known-exploited-vulnerabilities-catalog cisa.gov

RSS Hunter • Aug 11

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added a new vulnerability, CVE-2026-8037, concerning Progress LoadMaster Command Injection, to its Known Exploited Vulnerabilities catalog. This vulnerability is actively being exploited by malicious actors and poses a significant risk. Binding Operational Directive 26-04 mandates that Federal Civilian Executive Branch agencies prioritize fixing vulnerabilities listed in the KEV catalog. This directive emphasizes rapid remediation of high-risk vulnerabilities on publicly exposed assets that lead to full control after exploitation. Agencies are also required to check for compromises before applying patches. While BOD 26-04 specifically targets FCEB agencies, CISA urges all organizations to adopt a risk-based approach to vulnerability management. They encourage prioritizing the remediation of KEV cataloged vulnerabilities. CISA will continue to add vulnerabilities that meet the criteria for active exploitation. Organizations aware of exploited vulnerabilities not yet in the catalog can submit them for consideration. These nominations require a CVE ID, proof of exploitation, and clear mitigation steps.

https://www.cisa.gov/news-events/alerts/2026/08/07/cisa-adds-one-known-exploited-vulnerability-catalog cisa.gov

RSS Hunter • Aug 7

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added CVE-2026-63077, a JetBrains TeamCity deserialization vulnerability, to its Known Exploited Vulnerabilities (KEV) Catalog due to active exploitation. This type of vulnerability is a common attack vector posing significant risks. Binding Operational Directive 26-04 mandates Federal Civilian Executive Branch (FCEB) agencies to prioritize the remediation of vulnerabilities listed in the KEV Catalog, especially those on public-facing assets. The directive emphasizes a risk-based approach, requiring rapid action for high-risk vulnerabilities and deferring lower-risk ones. BOD 26-04 also sets expectations for agencies to check for compromises before applying patches. While the directive is specific to FCEB agencies, CISA encourages all organizations to adopt similar risk-based vulnerability management practices. CISA will continue to add vulnerabilities to the KEV Catalog as they are identified and meet the criteria. Organizations can nominate exploited vulnerabilities not yet in the KEV Catalog via CISA's KEV Nomination Form. For a nomination, a CVE ID, evidence of exploitation, and clear mitigation guidance are required.

https://www.cisa.gov/news-events/alerts/2026/08/05/cisa-adds-one-known-exploited-vulnerability-catalog cisa.gov

RSS Hunter • Aug 5

CISA Adds Three Known Exploited Vulnerabilities to Catalog

CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog. These include an IBM Langflow code injection vulnerability, an N-able N-central authentication bypass, and an Apache Tomcat missing encryption vulnerability. Actively exploited vulnerabilities are common attack vectors for cyber actors, posing serious risks to federal systems. Binding Operational Directive (BOD) 26-04 mandates that Federal Civilian Executive Branch (FCEB) agencies prioritize the rapid remediation of high-risk vulnerabilities identified in the KEV Catalog. This directive specifically focuses on vulnerabilities that grant total control of publicly exposed assets after exploitation. BOD 26-04 also outlines requirements for agencies to check for compromises before applying patches. While the directive applies only to FCEB agencies, CISA recommends all organizations adopt a risk-based approach. CISA will continue to add qualifying vulnerabilities to the KEV Catalog. Organizations aware of exploited vulnerabilities not yet in the catalog can submit them for consideration. Submissions require a CVE ID, evidence of exploitation, and clear mitigation guidance.

https://www.cisa.gov/news-events/alerts/2026/08/04/cisa-adds-three-known-exploited-vulnerabilities-catalog cisa.gov

RSS Hunter • Aug 4

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added a new vulnerability, CVE-2026-18577, to its Known Exploited Vulnerabilities (KEV) Catalog due to active exploitation. This authentication bypass vulnerability in N-able N-central is a common attack method. CISA's Binding Operational Directive (BOD) 26-04 mandates Federal Civilian Executive Branch (FCEB) agencies to prioritize fixing vulnerabilities listed in the KEV Catalog. This directive focuses on high-risk vulnerabilities on publicly exposed assets that allow complete control after exploitation. Agencies must also check for compromises before applying patches to these critical vulnerabilities. While BOD 26-04 applies to FCEB agencies, CISA strongly recommends all organizations adopt this risk-based approach. CISA will continue to identify and add exploited vulnerabilities to the KEV Catalog. Organizations can nominate vulnerabilities for inclusion if they have a CVE ID, proof of exploitation, and mitigation steps. This proactive approach aims to bolster cybersecurity defenses across critical infrastructure.

https://www.cisa.gov/news-events/alerts/2026/08/03/cisa-adds-one-known-exploited-vulnerability-catalog cisa.gov

RSS Hunter • Aug 3

CISA Urges Water and Wastewater Systems Sector to Protect OT Against Activity Targeting PLCs

CISA is warning of a rise in cyberattacks targeting programmable logic controllers (PLCs) within the Water and Wastewater Systems Sector. Threat actors are exploiting publicly exposed PLCs by changing passwords and IP addresses, leading to operational disruptions like boil water notices. These attacks affect water organizations of all sizes, even those with established cybersecurity measures. Exposed operational technology (OT) assets face increased risks of data manipulation, operational shutdowns, and even physical damage.CISA strongly advises disconnecting PLCs from the internet and utilizing VPNs or gateway devices for any necessary remote access. It is crucial to enable password protection and change all default passwords. IP allowlisting should be implemented to restrict remote access to known, trusted sources. After disconnecting, operators must ensure they have clean, verified backups of PLC configurations. For Rockwell Automation MicroLogix 1400 users, specific guidance is available to restore access lost due to password modifications.Secure remote access for OT systems can be achieved by following CISA's primary mitigations and the UK's National Cyber Security Centre's secure connectivity principles. Further assistance is available through the EPA's Cybersecurity Technical Assistance Program or a local CISA Regional Office. Cyber incidents should be reported to CISA's Operations Center or designated law enforcement agencies, providing specific details about the event.

https://www.cisa.gov/news-events/alerts/2026/07/30/cisa-urges-water-and-wastewater-systems-sector-protect-ot-against-activity-targeting-plcs cisa.gov

RSS Hunter • Jul 30

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added CVE-2026-20316, a Cisco Secure Firewall Management Center vulnerability involving a hard-coded password, to its Known Exploited Vulnerabilities (KEV) Catalog. This vulnerability is a common attack method that presents serious risks to federal systems. Federal agencies are mandated by Binding Operational Directive (BOD) 26-04 to prioritize the rapid patching of vulnerabilities listed in the KEV Catalog, especially those on public-facing assets granting full control after exploitation. BOD 26-04 also sets requirements for agencies to check for compromises before applying patches. Although BOD 26-04 is specific to Federal Civilian Executive Branch agencies, CISA recommends that all organizations implement risk-based vulnerability management and address KEV Catalog items. CISA will continue to update the KEV Catalog as new exploited vulnerabilities are identified. Organizations can nominate exploited vulnerabilities not yet in the catalog via CISA's KEV Nomination Form. Nominations require a CVE ID, proof of exploitation, and clear mitigation steps.

https://www.cisa.gov/news-events/alerts/2026/07/29/cisa-adds-one-known-exploited-vulnerability-catalog cisa.gov

RSS Hunter • Jul 29

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog due to active exploitation. The first is CVE-2025-68686, affecting Fortinet FortiOS and allowing unauthorized information exposure. The second is CVE-2026-16812, a command injection vulnerability in Arista VeloCloud Orchestrator On-Prem OS. These exploited vulnerabilities are common attack methods and present substantial risks. Federal Civilian Executive Branch (FCEB) agencies must follow Binding Operational Directive (BOD) 26-04 for vulnerability management. This directive mandates prioritizing the rapid remediation of high-risk vulnerabilities from the KEV Catalog, particularly those on publicly exposed assets leading to total control. Lower-risk vulnerabilities can see deferred action. BOD 26-04 also sets expectations for checking for compromises before applying patches. CISA urges all organizations to adopt risk-based vulnerability management and prioritize KEV Catalog vulnerabilities. The agency will continue adding qualifying vulnerabilities to the KEV Catalog. Organizations can nominate exploited vulnerabilities not yet listed via CISA's KEV Nomination Form, provided they have a CVE ID, exploitation evidence, and mitigation guidance.

https://www.cisa.gov/news-events/alerts/2026/07/27/cisa-adds-two-known-exploited-vulnerabilities-catalog cisa.gov

RSS Hunter • Jul 27

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog due to evidence of active exploitation. These include CVE-2026-16232, a Check Point SmartConsole improper authentication vulnerability, and CVE-2026-50522, a Microsoft SharePoint deserialization of untrusted data vulnerability. Such vulnerabilities are common attack vectors for cyber actors and pose significant risks. Binding Operational Directive (BOD) 26-04 mandates vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. This directive emphasizes the KEV Catalog and requires agencies to prioritize rapid remediation of high-risk vulnerabilities listed within it on publicly exposed assets. BOD 26-04 also sets expectations for agencies to check for compromises before patches are applied. While BOD 26-04 applies specifically to FCEB agencies, CISA urges all organizations to implement risk-based vulnerability management. They encourage prioritizing the remediation of vulnerabilities already documented in the KEV Catalog. CISA will persist in adding newly identified exploited vulnerabilities to the catalog. Organizations can submit exploited vulnerabilities not yet listed to CISA via their KEV Nomination Form, provided they have a CVE ID, exploitation evidence, and clear mitigation guidance.

https://www.cisa.gov/news-events/alerts/2026/07/22/cisa-adds-two-known-exploited-vulnerabilities-catalog cisa.gov

RSS Hunter • Jul 22

CISA Adds Four Known Exploited Vulnerabilities to Catalog

CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog due to evidence of active exploitation. The newly listed vulnerabilities include issues in DD-WRT, Langflow, and two in WordPress Core. These types of vulnerabilities are common attack methods for cybercriminals and present considerable dangers to federal systems. Binding Operational Directive 26-04 mandates that Federal Civilian Executive Branch agencies prioritize security updates based on risk. This directive emphasizes the KEV Catalog and requires agencies to quickly fix high-risk vulnerabilities listed there on exposed assets. It also sets expectations for checking systems for compromise before applying patches. Although BOD 26-04 specifically targets FCEB agencies, CISA advises all organizations to implement risk-based vulnerability management. Prioritizing the remediation of KEV Catalog vulnerabilities is strongly recommended for everyone. CISA will continue to update the KEV Catalog with newly identified exploited vulnerabilities. Organizations can nominate vulnerabilities not yet in the KEV Catalog if they have a CVE ID, proof of exploitation, and clear mitigation steps.

https://www.cisa.gov/news-events/alerts/2026/07/21/cisa-adds-four-known-exploited-vulnerabilities-catalog cisa.gov

RSS Hunter • Jul 21

CISA Adds Three Known Exploited Vulnerabilities to Catalog

CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog. These include two Fortinet FortiSandbox OS command injection vulnerabilities and one Microsoft SharePoint deserialization vulnerability. These vulnerabilities are actively being exploited by cyber actors and present significant risks. The Binding Operational Directive (BOD) 26-04 mandates that Federal Civilian Executive Branch agencies prioritize the remediation of vulnerabilities listed in the KEV Catalog. This directive emphasizes addressing high-risk vulnerabilities on publicly exposed assets that grant full control after exploitation. BOD 26-04 also sets expectations for agencies to check for compromises before applying patches. While BOD 26-04 specifically applies to federal agencies, CISA recommends all organizations adopt similar risk-based vulnerability management. CISA will continue to add vulnerabilities to the KEV Catalog as they are identified and exploited. Organizations can submit potential KEV additions to CISA if they have a CVE ID, evidence of exploitation, and mitigation guidance.

https://www.cisa.gov/news-events/alerts/2026/07/16/cisa-adds-three-known-exploited-vulnerabilities-catalog cisa.gov

RSS Hunter • Jul 16

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog due to active exploitation. These include CVE-2023-4346 affecting the KNX Protocol Connection Authorization Option 1 and CVE-2026-46817 in Oracle E-Business Suite. Exploited vulnerabilities are common attack methods posing significant risks to federal systems. Binding Operational Directive (BOD) 26-04 mandates federal agencies to prioritize the remediation of vulnerabilities listed in the KEV Catalog. This directive focuses on high-risk vulnerabilities on publicly exposed assets that grant full control after exploitation. BOD 26-04 also outlines requirements for agencies to check for compromises before applying patches. While the directive applies to federal civilian agencies, CISA recommends all organizations adopt a risk-based approach. CISA will continue to update the KEV Catalog with new exploited vulnerabilities. Organizations can nominate vulnerabilities for the KEV Catalog if they have a CVE ID, exploitation evidence, and mitigation steps.

https://www.cisa.gov/news-events/alerts/2026/07/15/cisa-adds-two-known-exploited-vulnerabilities-catalog cisa.gov

RSS Hunter • Jul 15

CISA Urges SharePoint Hardening After New Exploitations

CISA is aware of active exploitation of vulnerabilities in on-premises SharePoint Server instances, specifically CVE-2026-32201, CVE-2026-45659, and CVE-2026-56164, which enable cyber threat actors to gain unauthorized access. These vulnerabilities affect all supported on-premises SharePoint Server versions and involve establishing remote code execution and post-exploitation activities. Organizations should monitor affected SharePoint Servers closely for any signs of exploitation or unusual activity. CISA urges organizations to detect and remediate potential compromises by implementing recommendations such as applying the latest patches and security updates from Microsoft. Additionally, CISA recommends verifying that Antimalware Scan Interface integration is enabled for each SharePoint web application and using specific AMSI and Microsoft Defender Antivirus detections. Organizations should also implement SharePoint Server hardening measures, including rotating IIS machine keys, establishing tailored logging mechanisms, and avoiding exposing SharePoint Servers directly to the internet. CISA added the vulnerabilities to its Known Exploited Vulnerabilities Catalog and urges users and administrators to review the Alert and apply necessary updates. The agency also recommends reporting incidents or anomalous activity to CISA via its 24/7 Operations Center. CISA may update this Alert to reflect new guidance issued by CISA or other parties, and the information in this report is being provided for informational purposes only. Overall, CISA's guidance aims to help organizations protect themselves against potential cyber threats by taking proactive measures to secure their SharePoint Server instances.

https://www.cisa.gov/news-events/alerts/2026/07/14/cisa-urges-sharepoint-hardening-after-new-exploitations cisa.gov

RSS Hunter • Jul 14

CISA Adds Four Known Exploited Vulnerabilities to Catalog

CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog due to active exploitation. These include two SonicWall SMA1000 Appliances vulnerabilities (CVE-2026-15409 and CVE-2026-15410) and two Microsoft vulnerabilities for Active Directory Federation Services (CVE-2026-56155) and SharePoint Server (CVE-2026-56164). These types of vulnerabilities are common attack vectors posing significant risks. Binding Operational Directive 26-04 mandates that federal civilian executive branch agencies prioritize the remediation of vulnerabilities on the KEV Catalog, especially those on publicly exposed assets that grant total control post-exploitation. The directive also sets expectations for checking for prior compromise before applying patches. While BOD 26-04 is specific to FCEB agencies, CISA urges all organizations to adopt risk-based vulnerability management and address KEV Catalog items. CISA plans to continue adding vulnerabilities that meet their criteria to the KEV Catalog. Organizations can nominate newly discovered, actively exploited vulnerabilities with a CVE ID and mitigation guidance for inclusion.

https://www.cisa.gov/news-events/alerts/2026/07/14/cisa-adds-four-known-exploited-vulnerabilities-catalog cisa.gov

RSS Hunter • Jul 14

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added a new vulnerability, CVE-2008-4128, to its Known Exploited Vulnerabilities (KEV) Catalog due to evidence of active exploitation. This cross-site request forgery vulnerability in Cisco IOS is a common attack vector that poses significant risks. Binding Operational Directive (BOD) 26-04 mandates that Federal Civilian Executive Branch (FCEB) agencies prioritize the remediation of high-risk vulnerabilities listed in the KEV Catalog on publicly exposed assets. This directive requires agencies to address vulnerabilities that grant total control post-exploitation promptly. BOD 26-04 also outlines when agencies must check for compromises before applying patches. While this directive specifically targets FCEB agencies, CISA recommends that all organizations implement risk-based vulnerability management. They urge all entities to prioritize the remediation of vulnerabilities found in the KEV Catalog. CISA will continue to add vulnerabilities to the KEV Catalog that meet the established criteria. Organizations aware of exploited vulnerabilities not yet in the catalog can submit them for consideration. Such submissions require a CVE ID, proof of exploitation, and clear mitigation steps.

https://www.cisa.gov/news-events/alerts/2026/07/13/cisa-adds-one-known-exploited-vulnerability-catalog cisa.gov

RSS Hunter • Jul 13

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA has added two new vulnerabilities, CVE-2026-48939 affecting iCagenda and CVE-2026-56291 affecting Balbooa Forms, to its Known Exploited Vulnerabilities (KEV) Catalog. These vulnerabilities involve the unrestricted upload of dangerous file types, a common attack method for cybercriminals. Such vulnerabilities present substantial risks to federal systems. Binding Operational Directive (BOD) 26-04 mandates that Federal Civilian Executive Branch agencies prioritize the remediation of vulnerabilities listed in the KEV Catalog. This directive emphasizes rapid patching of high-risk vulnerabilities on publicly exposed assets that allow complete control after exploitation. Agencies are also expected to verify if systems were compromised before patching. While BOD 26-04 specifically targets federal agencies, CISA advises all organizations to implement risk-based vulnerability management and address KEV Catalog entries. CISA will continue to add vulnerabilities that meet the established criteria. Organizations can submit vulnerabilities for consideration if they have a CVE ID, proof of exploitation, and clear mitigation steps, using CISA's KEV Nomination Form.

https://www.cisa.gov/news-events/alerts/2026/07/10/cisa-adds-two-known-exploited-vulnerabilities-catalog cisa.gov

RSS Hunter • Jul 10

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added CVE-2026-48282, an Adobe ColdFusion Path Traversal Vulnerability, to its Known Exploited Vulnerabilities (KEV) Catalog. This type of vulnerability is a common attack method for cybercriminals, posing serious threats to federal systems. Binding Operational Directive (BOD) 26-04 mandates that Federal Civilian Executive Branch agencies manage vulnerabilities by prioritizing those on the KEV Catalog. This directive specifically requires rapid remediation of high-risk KEV vulnerabilities on publicly accessible assets that allow full control after exploitation. Agencies are also expected to regularly check for compromises preceding patch application. Although BOD 26-04 applies only to federal agencies, CISA recommends all organizations implement risk-based vulnerability management. They encourage prioritizing remediation of KEV Catalog vulnerabilities regardless of sector. CISA will continue to add vulnerabilities meeting their criteria to the KEV Catalog. Organizations aware of exploited vulnerabilities not yet in the catalog can submit them for consideration. Submissions require a CVE ID, proof of exploitation, and clear mitigation steps.

https://www.cisa.gov/news-events/alerts/2026/07/07/cisa-adds-one-known-exploited-vulnerability-catalog cisa.gov

RSS Hunter • Jul 7

CISA Adds Three Known Exploited Vulnerabilities to Catalog

CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog due to evidence of active exploitation. These vulnerabilities are CVE-2026-48908 in JoomShaper SP Page Builder, CVE-2026-55255 in Langflow, and CVE-2026-56290 in Joomlack Page Builder. Exploited vulnerabilities are common attack methods that pose significant risks to federal systems. Binding Operational Directive (BOD) 26-04 mandates that Federal Civilian Executive Branch (FCEB) agencies prioritize fixing vulnerabilities listed in the KEV Catalog, especially those allowing complete control after exploitation. This directive also requires agencies to check for compromises before patching. Although BOD 26-04 is for FCEB agencies, CISA recommends all organizations use a risk-based approach to vulnerability management. CISA will continue to update the KEV Catalog with new exploited vulnerabilities. Organizations can nominate potential additions for the KEV Catalog. Nominated vulnerabilities must have a CVE ID, proof of exploitation, and available mitigation steps.

https://www.cisa.gov/news-events/alerts/2026/07/07/cisa-adds-three-known-exploited-vulnerabilities-catalog cisa.gov

RSS Hunter • Jul 7

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added CVE-2026-45659, a Microsoft SharePoint Server deserialization vulnerability, to its Known Exploited Vulnerabilities (KEV) Catalog due to active exploitation. This vulnerability represents a significant threat to federal networks, as deserialization flaws are common attack methods. Binding Operational Directive (BOD) 26-04 mandates that Federal Civilian Executive Branch (FCEB) agencies manage vulnerabilities based on risk. This directive emphasizes the KEV Catalog and requires agencies to quickly fix high-risk vulnerabilities listed there on exposed assets. Such vulnerabilities, when exploited, can grant attackers complete control over affected systems. BOD 26-04 also sets expectations for agencies to check for compromises before patching. Although BOD 26-04 applies only to FCEB agencies, CISA strongly recommends that all organizations adopt a risk-based approach to vulnerability management. CISA will consistently update the KEV Catalog with vulnerabilities that meet their criteria. Organizations can nominate vulnerabilities for the KEV Catalog if they have a CVE ID, proof of exploitation, and clear remediation steps.

https://www.cisa.gov/news-events/alerts/2026/07/01/cisa-adds-one-known-exploited-vulnerability-catalog cisa.gov

RSS Hunter • Jul 1

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added a new vulnerability, CVE-2026-48558, to its Known Exploited Vulnerabilities (KEV) Catalog due to active exploitation. This SimpleHelp Authentication Bypass Vulnerability is a common attack method. Federal agencies are required by Binding Operational Directive (BOD) 26-04 to manage vulnerabilities based on risk. BOD 26-04 mandates rapid remediation of high-risk vulnerabilities found in the KEV Catalog on publicly exposed assets. This directive also sets expectations for agencies to check for compromises before patching. While BOD 26-04 is for Federal Civilian Executive Branch agencies, CISA urges all organizations to adopt similar risk-based vulnerability management. CISA will continue to add qualifying vulnerabilities to the KEV Catalog. Organizations can nominate exploited vulnerabilities not yet in the catalog using CISA's KEV Nomination Form. Nominations require a CVE ID, proof of exploitation, and clear mitigation steps.

https://www.cisa.gov/news-events/alerts/2026/06/29/cisa-adds-one-known-exploited-vulnerability-catalog cisa.gov

RSS Hunter • Jun 29

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA has added two new vulnerabilities, CVE-2026-12569 and CVE-2026-20230, to its Known Exploited Vulnerabilities (KEV) Catalog due to active exploitation. These vulnerabilities, affecting PTC Windchill/FlexPLM and Cisco Unified Communications Manager respectively, are common targets for cyberattacks. Federal Civilian Executive Branch (FCEB) agencies must adhere to Binding Operational Directive 26-04. This directive mandates prioritizing the rapid remediation of vulnerabilities listed in the KEV Catalog, particularly those on publicly exposed assets that offer complete control after exploitation. Agencies are also required to check for compromises before applying patches for high-risk vulnerabilities. While BOD 26-04 is for FCEB agencies, CISA strongly recommends all organizations adopt similar risk-based vulnerability management practices. CISA will continuously update the KEV Catalog with newly identified exploited vulnerabilities. Organizations can nominate vulnerabilities for inclusion if they have a CVE ID, proof of exploitation, and clear mitigation steps.

https://www.cisa.gov/news-events/alerts/2026/06/25/cisa-adds-two-known-exploited-vulnerabilities-catalog cisa.gov

RSS Hunter • Jun 25

CISA Adds Four Known Exploited Vulnerabilities to Catalog

CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog due to evidence of active exploitation. These vulnerabilities affect Lantronix EDS5000 (code injection) and Ubiquiti UniFi OS (improper access control, path traversal, and improper input validation). Such vulnerabilities are common attack vectors for cybercriminals and pose significant risks to federal systems. CISA’s Binding Operational Directive (BOD) 26-04 requires federal agencies to prioritize the remediation of vulnerabilities listed in the KEV Catalog. This directive specifically targets vulnerabilities on publicly exposed assets that grant full control after exploitation. BOD 26-04 also sets expectations for agencies to check for compromises before applying patches. Although BOD 26-04 applies only to Federal Civilian Executive Branch agencies, CISA advises all organizations to adopt similar risk-based vulnerability management. CISA will consistently update the KEV Catalog with newly identified exploited vulnerabilities. Organizations aware of exploited vulnerabilities not yet in the catalog are encouraged to submit them for consideration. Submissions require a CVE ID, proof of exploitation, and clear mitigation instructions.

https://www.cisa.gov/news-events/alerts/2026/06/23/cisa-adds-four-known-exploited-vulnerabilities-catalog cisa.gov

RSS Hunter • Jun 23

CISA Urges Hardening Fortinet Devices After Reports of Credential Exposure

CISA has identified a global cyber threat targeting internet-accessible Fortinet devices, including firewalls and VPN gateways. This activity, known as FortiBleed, has exposed credentials for approximately 74,000 Fortinet devices. Malicious actors are exploiting these leaked credentials to compromise government and private sector organizations. To mitigate this threat, CISA strongly advises affected Fortinet customers to take immediate action.Essential steps include terminating active sessions and resetting all VPN and administrative passwords, prioritizing internet-facing systems. Organizations must also verify the secure storage of administrator credentials, ensuring the use of the PBKDF2 algorithm and removing legacy hashes. Reviewing firewall, VPN, authentication, and domain controller logs is crucial for detecting suspicious activity. Implementing phishing-resistant multi-factor authentication for all remote access and administrative accounts is a high priority.Furthermore, reducing the attack surface by restricting access to Fortinet management interfaces from the public internet and disabling unnecessary accounts is recommended. CISA provides links to external resources for further information on the scope of the compromise. These resources detail the impact of the FortiBleed campaign on Fortinet devices worldwide. The provided information is for informational purposes and does not constitute an endorsement of any commercial entity or product.

https://www.cisa.gov/news-events/alerts/2026/06/18/cisa-urges-hardening-fortinet-devices-after-reports-credential-exposure cisa.gov

RSS Hunter • Jun 18

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added CVE-2026-20253, a Splunk Enterprise vulnerability, to its Known Exploited Vulnerabilities (KEV) Catalog due to active exploitation. This critical vulnerability allows unauthorized access and poses significant risks to government systems. Binding Operational Directive (BOD) 26-04 now mandates that Federal Civilian Executive Branch agencies prioritize the remediation of vulnerabilities listed in the KEV Catalog. This directive, updating BOD 22-01, emphasizes rapid action on high-risk vulnerabilities that provide complete control after exploitation. Lower-risk vulnerabilities can be deferred, but agencies must now proactively check for compromises before patching. While BOD 26-04 specifically targets federal agencies, CISA strongly recommends all organizations adopt similar risk-based vulnerability management practices. The agency will continue to add vulnerabilities to the KEV Catalog as they are identified and exploited. Organizations can nominate vulnerabilities for inclusion in the KEV Catalog if they have a CVE ID, proof of exploitation, and clear mitigation steps. This proactive approach aims to strengthen cybersecurity defenses against prevalent threats.

https://www.cisa.gov/news-events/alerts/2026/06/18/cisa-adds-one-known-exploited-vulnerability-catalog cisa.gov

RSS Hunter • Jun 18

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added CVE-2026-48907, an improper access control vulnerability in the Widget Factory Joomla Content Editor, to its Known Exploited Vulnerabilities (KEV) catalog. This vulnerability is actively being exploited and presents a significant risk to federal systems. Binding Operational Directive (BOD) 26-04 updates requirements for Federal Civilian Executive Branch (FCEB) agencies regarding vulnerability management. The directive emphasizes prioritizing the remediation of high-risk vulnerabilities, particularly those listed in the KEV catalog that grant full control after exploitation on public-facing assets. Lower-risk vulnerabilities can be addressed with less urgency. BOD 26-04 also outlines when agencies must check for system compromise before patching. Although BOD 26-04 is specific to FCEB agencies, CISA recommends all organizations adopt a risk-based approach to vulnerability management. They encourage prioritizing KEV catalog vulnerabilities for remediation. CISA will continue to add vulnerabilities meeting their criteria to the KEV catalog. Organizations can nominate exploited vulnerabilities for inclusion if they have a CVE ID, proof of exploitation, and mitigation guidance.

https://www.cisa.gov/news-events/alerts/2026/06/16/cisa-adds-one-known-exploited-vulnerability-catalog cisa.gov

RSS Hunter • Jun 16

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog. These are CVE-2026-20262 affecting Cisco Catalyst SD-WAN Manager and CVE-2026-54420 impacting LiteSpeed cPanel Plugin. Such vulnerabilities are common attack methods for cybercriminals. Federal agencies are mandated to address these risks through Binding Operational Directive (BOD) 26-04. This directive requires FCEB agencies to prioritize patching vulnerabilities listed in the KEV catalog that are on public-facing assets and offer complete system control. BOD 26-04 updates previous directives and reinforces the significance of the KEV catalog. It also outlines expectations for agencies to check for potential compromises before applying patches. While this directive specifically targets FCEB agencies, CISA urges all organizations to adopt similar risk-based vulnerability management. CISA will continue to update the KEV catalog with newly identified exploited vulnerabilities. Organizations can nominate vulnerabilities for inclusion in the KEV catalog if they have a CVE ID, proof of exploitation, and clear mitigation steps.

https://www.cisa.gov/news-events/alerts/2026/06/15/cisa-adds-two-known-exploited-vulnerabilities-catalog cisa.gov

RSS Hunter • Jun 15

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added CVE-2026-35273, an Oracle PeopleSoft vulnerability, to its Known Exploited Vulnerabilities catalog. This vulnerability involves missing authentication for critical functions and is a common attack method for malicious actors. It presents considerable risks to federal systems. Binding Operational Directive (BOD) 26-04, which updates BOD 22-01, sets vulnerability management requirements for federal agencies. This directive emphasizes the KEV catalog and mandates rapid patching of high-risk vulnerabilities on publicly exposed assets that lead to complete control post-exploitation. Lower-risk vulnerabilities can be addressed later according to BOD 26-04. The directive also outlines expectations for agencies to check for compromise before applying patches. Although BOD 26-04 is specific to federal agencies, CISA recommends all organizations implement risk-based vulnerability management. Prioritizing KEV catalog vulnerabilities is encouraged for everyone. CISA will continue to augment the KEV catalog with qualifying vulnerabilities. Organizations can submit vulnerabilities for consideration if they have a CVE ID, evidence of exploitation, and clear mitigation guidance.

https://www.cisa.gov/news-events/alerts/2026/06/12/cisa-adds-one-known-exploited-vulnerability-catalog cisa.gov

RSS Hunter • Jun 12

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added a new vulnerability, CVE-2026-10520 concerning Ivanti Sentry OS Command Injection, to its Known Exploited Vulnerabilities (KEV) catalog. This vulnerability has been actively exploited and presents a significant threat. Command injection vulnerabilities are a common attack method used by malicious actors. Federal Civilian Executive Branch (FCEB) agencies are now subject to Binding Operational Directive (BOD) 26-04. This directive mandates prioritizing security updates based on risk, superseding BOD 22-01. BOD 26-04 emphasizes the KEV catalog and requires FCEB agencies to quickly fix high-risk vulnerabilities, particularly those on public assets that grant full control post-exploitation. Lower-risk vulnerabilities can have their remediation deferred. The directive also sets expectations for agencies regarding system compromise checks before patching. While BOD 26-04 is for FCEB agencies, CISA urges all organizations to adopt risk-based vulnerability management. CISA will continue to add qualifying vulnerabilities to the KEV catalog. Organizations can nominate vulnerabilities for inclusion if they have a CVE ID, proof of exploitation, and mitigation guidance.

https://www.cisa.gov/news-events/alerts/2026/06/11/cisa-adds-one-known-exploited-vulnerability-catalog cisa.gov

RSS Hunter • Jun 11