Alerts

CISA Adds One Known Exploited Vulnerability to Catalog

CISA — Fri, 23 Oct 26 12:00:00 +0000

CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

CVE-2026-110447 Collabora Online – Built-in CODE Server OS Command Injection Vulnerability

This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.

Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA’s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied.

While BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.

Aware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through CISA’s KEV Nomination Form. Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance.

CISA Adds One Known Exploited Vulnerability to Catalog

CISA — Fri, 23 Oct 26 12:00:00 +0000

CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

CVE-2026-114625 Arista VeloCloud Orchestrator SQL Injection Vulnerability

This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.

Critical Vulnerabilities in PHP Require Immediate Patching

CISA — Wed, 21 Oct 26 12:00:00 +0000

Update October 23, 2026:

CISA has updated this Alert to: (1) provide a SIGMA detection rule to help identify potentially suspicious activity; (2) incorporate partner resources; and (3) reinforce existing mitigation guidance.

Purpose

CISA strongly urges organizations to immediately patch the recently disclosed critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619. These vulnerabilities, known as “php2shell,” allow for unauthenticated remote code execution in PHP. The vulnerabilities affect all PHP installations serving web requests, including Apache with mod_php (Note: PHP considers this highest risk), PHP-FPM, php-cgi, FrankenPHP and LiteSpeed. Organizations should immediately update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 to fix these vulnerabilities. While CISA has not observed successful exploitation of these vulnerabilities in the wild as of the time of publication, they pose a risk to organizations if left unpatched.

Actions to Take

CISA urges organizations to take the following actions:

Identify and inventory systems running any version of PHP across your organization.
- PHP is often a component of other software and prevalence may not be directly observable.
Apply the patch immediately, prioritizing internet-facing systems.
Organizations that cannot update immediately, or that continue to use PHP 8.1 or earlier unsupported versions, should take PHP-based systems offline until they can be patched or updated.
A web application firewall may provide some protection until systems are updated or patched.
Review the official PHP security advisory for guidance on patching.
Monitor for suspicious activity, including PHP worker processes launching shells or downloading tools.

Resources

CISA urges network defenders to review the following advisories and resources and apply necessary updates: 

PHP’s Guidance

PHP’s Security Advisory: Critical Remote Code Execution Vulnerabilities, Update Now
PHP’s Blog: Today's PHP Security Release, and How We're Strengthening PHP Security

Partner Guidance

United States National Security Agency’s (NSA) Advisory: Critical Patches Recommended for PHP Vulnerabilities
United Kingdom National Cyber Security Centre’s (NCSC-UK) Alert: Critical security issue affecting PHP
Australian Signals Directorate’s Australian Cyber Security Centre’s (ASD’s ACSC) Alert: Critical vulnerabilities in PHP
National Cyber Security Centre’s (NCSC-NL) GitHub repository: php2shell
New Zealand National Cyber Security Centre’s (NCSC-NZ) NCSC encourages immediate patching against PHP vulnerability
Canadian Centre for Cyber Security’s (Cyber Centre) Alert: Critical vulnerabilities impacting PHP - CVE-2026-109618 and CVE-2026-109619

Organizations may also review CISA’s SIGMA detection rule to help identify potentially suspicious activity in relevant log sources (Note: CISA may update this resource as more information becomes available):

CISA’s SIGMA Rules GitHub Repository

Disclaimer

The information in this report is being provided “as is” for informational purposes only. CISA does not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this document. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by CISA. 

CISA Adds Six Known Exploited Vulnerabilities to Catalog

CISA — Tue, 20 Oct 26 12:00:00 +0000

CISA has added six new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

CVE-2026-96652 Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
CVE-2026-96654 Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability
CVE-2026-96655 Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
CVE-2026-96656 Plex Media Server External Control of File Name or Path Vulnerability
CVE-2026-106931 EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability
CVE-2026-110936 Siemens Software Center Uncontrolled Search Path Element Vulnerability

These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.

CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support

CISA — Fri, 16 Oct 26 12:00:00 +0000

CISA is aware of critical authentication bypass vulnerability CVE-2026-102764, affecting BeyondTrust Remote Support (formerly Bomgar) versions 26.2.3 and earlier. Patches are available for supported versions (24.3.1 and later); organizations using older versions must upgrade first. Cyber threat actors are actively exploiting the vulnerability to gain initial access, then establishing persistence, escalating privileges, and moving laterally. CISA added CVE-2026-102764 to its Known Exploited Vulnerabilities (KEV) catalog on Oct. 16, 2026.

CISA urges organizations with affected self-hosted Remote Support appliances to immediately take the following actions:

Apply the BT26-05-RS patch, as outlined in BeyondTrust’s Security Advisory BT26-05. Organizations on a self-hosted Remote Support version older than 24.3.1 will need to upgrade to a newer version to apply the patch. Organizations using BeyondTrust-hosted (SaaS) Remote Support deployments have already been patched. Review BeyondTrust’s blog ARMORY CASTLE and BT26-05: What Security Teams Need to Know for detailed information on the vulnerability and recommended response and mitigation actions.
Limit external access to the Remote Support appliance to the services needed to support users and customers. Restrict access to administrative interfaces to trusted networks. Review BeyondTrust’s B Series Appliance on-premises security for additional guidance on securing network connectivity for self-hosted Remote Support appliances.

Organizations with affected self-hosted Remote Support appliances should conduct network and memory forensics to identify evidence of potential compromise. If your organization suspects a compromise, CISA recommends taking the following actions:

Isolate any suspected or confirmed compromised appliances. Collect a snapshot of virtual appliances or forensic image for physical appliances to conduct future forensics, immediately forward appliance syslog and session events to the SIEM, and collect any additional logs, such as web application firewall, reverse-proxy, or perimeter firewall logs for the exposure window. Consult BeyondTrust’s Syslog guide for additional information on forwarding appliance logs and session events.
Conduct network and forensic investigations for evidence of compromise. Additionally, hunt for indicators of threat actor activity, including unrecognized privileged or administrative sessions, unrecognized script files, unexpected gaps in logs or log forwarding, and unauthorized account, permission, or session-policy changes. Consult CISA’s Binding Operational Directive (BOD) 26-04: Implementation Guidance for Prioritizing Security Updates Based on Risk to assist with prioritizing vulnerability remediation.
Rebuild from a known-good state and apply the BT26-05-RS patch. Then rotate every credential the appliance stored or injected, revoke all active support sessions, and review new multifactor authentication registrations on privileged accounts.

CISA urges organizations to review the BeyondTrust security advisory and resources noted above and apply necessary updates. CISA also recommends reviewing Mandiant’s blog, ARMORY CASTLE Exploits BeyondTrust, for additional hunt and isolation guidance and detections.

Disclaimer

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA — Fri, 16 Oct 26 12:00:00 +0000

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

CVE-2025-61624 Fortinet Multiple Products Path Traversal Vulnerability
CVE-2026-102764 BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability

These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.

CISA Adds One Known Exploited Vulnerability to Catalog

CISA — Thu, 15 Oct 26 12:00:00 +0000

CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

CVE-2026-21589 Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability

This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.

CISA Adds Four Known Exploited Vulnerabilities to Catalog

CISA — Wed, 14 Oct 26 12:00:00 +0000

CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

CVE-2026-0322 Palo Alto Networks PAN-OS Code Injection Vulnerability
CVE-2026-76519 Cisco Secure Email Gateway Relative Path Traversal Vulnerability
CVE-2026-105133 Ahsay AhsayCBS Improper Authentication Vulnerability
CVE-2026-105134 Ahsay AhsayCBS Command Injection Vulnerability

These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.

CISA Urges Patching Newly Exploited Vulnerability in Ivanti Connect Secure

CISA — Tue, 13 Oct 26 12:00:00 +0000

CISA is aware of Ivanti’s disclosure of a newly exploited vulnerability, CVE-2026-104935, affecting Ivanti Connect Secure versions 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior. CISA is aware of cyber threat actors exploiting this zero-day authentication bypass vulnerability, which allows remote, unauthenticated execution of arbitrary commands, to conduct credential theft and data exfiltration. CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities (KEV) Catalog on Oct. 13, 2026.

CISA urges organizations with affected Ivanti Connect Secure appliances and deployments to immediately update to the latest version, as outlined in Ivanti’s Security Advisory Ivanti Connect Secure (CVE-2026-104935). Organizations should also review the Ivanti Connect Secure 25.x Upgrade and Migration Compatibility Guide for detailed patching guidance for hardware and virtual appliance deployments. Ivanti Connect Secure version 22.8 reaches end of life on Jan. 31, 2027.

Organizations seeking to determine whether they were compromised will need to conduct network and memory forensics to identify evidence of exploitation. Note: Ivanti’s Integrity Checker Tool may not detect evidence of exploitation of CVE-2026-104935 because threat actor commands execute in memory.

If your organization suspects a compromise, CISA recommends implementing the following actions from Ivanti Connect Secure Recovery Procedures:

Create a backup of the appliance configuration. Review Ivanti’s How to Backup & Restore the Binary Configuration Using Archiving Server for more information.
Conduct a factory reset and upgrade the appliance to the latest version.
1. For cloud and virtual systems, rebuild the virtual instance and upgrade to the latest version.
Restore the appliance configuration from the backup created in step 1.
Reset passwords for all accounts, including domain, administrator, and local accounts. Revoke and reissue stored certificates; reset stored API keys and license server credentials.

CISA urges organizations to review the Ivanti security advisory and guide noted above and apply necessary updates. CISA also recommends reviewing the Volexity blog, A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days.

Disclaimer

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA — Tue, 13 Oct 26 12:00:00 +0000

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

CVE-2026-96951 Microsoft Windows Command Injection Vulnerability
CVE-2026-104935 Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability

These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.

CISA Adds One Known Exploited Vulnerability to Catalog

CISA — Sun, 04 Oct 26 12:00:00 +0000

CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

CVE-2026-88779 Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability

This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA — Fri, 02 Oct 26 12:00:00 +0000

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

CVE-2026-102489 Zammad GmbH Zammad Session Fixation Vulnerability
CVE-2026-102490 Zammad GmbH Zammad Improper Privilege Management Vulnerability

These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.

CISA Adds One Known Exploited Vulnerability to Catalog

CISA — Thu, 01 Oct 26 12:00:00 +0000

CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

CVE-2026-104286 Fortinet FortiMail Path Traversal Vulnerability

This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.

CISA Adds One Known Exploited Vulnerability to Catalog

CISA — Wed, 30 Sep 26 12:00:00 +0000

CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

CVE-2026-76504 Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability

This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.

CISA Adds One Known Exploited Vulnerability to Catalog

CISA — Tue, 29 Sep 26 12:00:00 +0000

CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

CVE-2026-86950 Apple Multiple Products Out-of-Bounds Write Vulnerability

This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA — Sun, 27 Sep 26 12:00:00 +0000

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

CVE-2026-88771 Citrix NetScaler Improper Input Validation Vulnerability
CVE-2026-88772 Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability

These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.

Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA’s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied.

While BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.

Aware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through CISA’s KEV Nomination Form. Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance.

Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC, Gateway

CISA — Sun, 27 Sep 26 12:00:00 +0000

Update October 9, 2026:

CISA has updated this Alert to: (1) include CVE-2026-107406; (2) include CVE-2026-88779 following its addition to the KEV Catalog on Oct. 4, 2026; (3) clarify the potential relationship between CVE-2026-88779 and CVE-2026-88771; and (4) emphasize the importance of promptly applying patches for CVE-2026-88771 through CVE-2026-88779 and CVE-2026-107406, as well as reviewing Citrix guidance for suspected or confirmed compromises involving NetScaler ADC or Gateway.

Update October 2, 2026:

CISA has updated this Alert to provide a SIGMA detection rule resource to help identify potentially suspicious activity.

CISA is amplifying Citrix’s disclosure of ten new vulnerabilities affecting Citrix NetScaler ADC and Citrix NetScaler Gateway products: CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, CVE-2026-88778, CVE-2026-88779, and CVE-2026-107406.

CISA added CVE-2026-88771 and CVE-2026-88772 to its Known Exploited Vulnerabilities (KEV) Catalog on Sept. 27, 2026. Both are critical, zero-day vulnerabilities that can independently enable remote code execution. CISA received reports and partner threat intelligence confirming threat actors are actively exploiting these vulnerabilities globally.

CISA also added CVE-2026-88779 to the KEV Catalog on Oct. 4, 2026. In Citrix NetScaler deployments configured as a security assertion markup language (SAML) Service Provider (SP) or Identity Provider (IdP), CVE-2026-88779 can independently create a denial of service condition. In unpatched Citrix NetScaler deployments, cyber threat actors may also exploit CVE-2026-88779 to force a reboot and accelerate conditions to allow execution of code previously injected through exploitation of CVE-2026-88771.

Because updating Citrix NetScaler deployments can be complex and may require downtime, CISA is issuing this Alert to help organizations assess exposure, prioritize mitigation actions, and account for these vulnerabilities in their risk-management activities.

Given the potential consequences of successful exploitation and confirmed malicious activity involving at least some of these vulnerabilities, CISA urges users and administrators to review Citrix’s advisories and install the relevant updated versions as soon as possible. CISA encourages system administrators and network defenders to check for indication of compromise prior to patching. Citrix has made indicators of compromise available through NetScaler Console and published additional guidance in their recent Security Bulletins to support organizations in assessing potential compromise. CISA recommends organizations forward their NetScaler logs to a centralized security information and event management (SIEM) or log retention system, as local logs may rotate quickly and overwrite forensic artifacts.

Organizations that suspect compromise should preserve forensic evidence before applying updates, as updates may reduce forensic visibility. Further, organizations should restore a known good secure backup for their NetScaler deployment that pre-dates any confirmed or suspected compromise and rotate all restored secrets, including local account passwords, key-encryption keys, and SSL certificates. Review Citrix’s Steps to Take if NetScaler ADC is Suspected to be Compromised for best practices.

Organizations should review the following Citrix resources:

CISA’s SIGMA Rules GitHub Repository

Disclaimer

CISA Adds One Known Exploited Vulnerability to Catalog

CISA — Fri, 25 Sep 26 12:00:00 +0000

CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

CVE-2026-87902 WordPress Core Remote File Inclusion Vulnerability

This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA — Fri, 25 Sep 26 12:00:00 +0000

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

CVE-2026-65660 Microsoft SharePoint Code Injection Vulnerability
CVE-2026-67279 Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability

These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA — Thu, 24 Sep 26 12:00:00 +0000

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

CVE-2026-5430 WSO2 Multiple Products Path Traversal Vulnerability
CVE-2026-71362 Adobe Commerce and Magento Incorrect Authorization Vulnerability

These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.

CISA Adds Four Known Exploited Vulnerabilities to Catalog

CISA — Tue, 22 Sep 26 12:00:00 +0000

CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

CVE-2026-85102 Check Point Multiple Products Improper Certificate Validation Vulnerability
CVE-2026-93616 Check Point Multiple Products Path Traversal Vulnerability
CVE-2026-93952 Arista VeloCloud Orchestrator Improper Input Validation Vulnerability
CVE-2026-94127 F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability

These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.

CISA Adds One Known Exploited Vulnerability to Catalog

CISA — Mon, 21 Sep 26 12:00:00 +0000

CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

CVE-2026-7273 Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability

This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.

CISA Adds One Known Exploited Vulnerability to Catalog

CISA — Fri, 18 Sep 26 12:00:00 +0000

CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

CVE-2025-39682 Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability

This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA — Fri, 18 Sep 26 12:00:00 +0000

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

CVE-2025-39964 Linux Kernel Race Condition Vulnerability
CVE-2026-53266 Linux Kernel Out-of-Bounds Write Vulnerability

These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.

CISA Adds One Known Exploited Vulnerability to Catalog

CISA — Wed, 16 Sep 26 12:00:00 +0000

CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

CVE-2026-58704 Google Pixel Improper Authorization Vulnerability

This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA — Wed, 16 Sep 26 12:00:00 +0000

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

CVE-2026-76460 Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability
CVE-2026-87886 Acronis Backup Incorrect Default Permissions Vulnerability

These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.

CISA Adds One Known Exploited Vulnerability to Catalog

CISA — Mon, 14 Sep 26 12:00:00 +0000

CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

CVE-2026-76461 Cisco Secure Email Gateway SQL Injection Vulnerability

This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.

CISA Adds Three Known Exploited Vulnerabilities to Catalog

CISA — Fri, 11 Sep 26 12:00:00 +0000

CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

CVE-2026-42016 JFrog Artifactory Incorrect Authorization Vulnerability
CVE-2026-42018 JFrog Artifactory Improper Authentication Vulnerability
CVE-2026-84869 ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability

These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.

CISA Adds One Known Exploited Vulnerability to Catalog

CISA — Fri, 11 Sep 26 12:00:00 +0000

CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

CVE-2026-85706 GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability

This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA — Thu, 10 Sep 26 12:00:00 +0000

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

CVE-2026-67277 MikroTik RouterOS Missing Authentication for Critical Function Vulnerability
CVE-2026-86060 MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability

These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.