Alerts

CISA Adds One Known Exploited Vulnerability to Catalog

CISA — Fri, 18 Sep 26 12:00:00 +0000

CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

CVE-2025-39682 Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability

This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.

Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA’s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied.

While BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.

Aware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through CISA’s KEV Nomination Form. Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance.

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA — Fri, 18 Sep 26 12:00:00 +0000

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

CVE-2025-39964 Linux Kernel Race Condition Vulnerability
CVE-2026-53266 Linux Kernel Out-of-Bounds Write Vulnerability

These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA — Wed, 16 Sep 26 12:00:00 +0000

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

CVE-2026-76460 Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability
CVE-2026-87886 Acronis Backup Incorrect Default Permissions Vulnerability

These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.

CISA Adds One Known Exploited Vulnerability to Catalog

CISA — Wed, 16 Sep 26 12:00:00 +0000

CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

CVE-2026-58704 Google Pixel Improper Authorization Vulnerability

This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.

CISA Adds One Known Exploited Vulnerability to Catalog

CISA — Mon, 14 Sep 26 12:00:00 +0000

CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

CVE-2026-76461 Cisco Secure Email Gateway SQL Injection Vulnerability

This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.

CISA Adds One Known Exploited Vulnerability to Catalog

CISA — Fri, 11 Sep 26 12:00:00 +0000

CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

CVE-2026-85706 GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability

This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.

CISA Adds Three Known Exploited Vulnerabilities to Catalog

CISA — Fri, 11 Sep 26 12:00:00 +0000

CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

CVE-2026-42016 JFrog Artifactory Incorrect Authorization Vulnerability
CVE-2026-42018 JFrog Artifactory Improper Authentication Vulnerability
CVE-2026-84869 ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability

These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA — Thu, 10 Sep 26 12:00:00 +0000

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

CVE-2026-67277 MikroTik RouterOS Missing Authentication for Critical Function Vulnerability
CVE-2026-86060 MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability

These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.

CISA Adds Four Known Exploited Vulnerabilities to Catalog

CISA — Wed, 09 Sep 26 12:00:00 +0000

CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

CVE-2025-25249 Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability
CVE-2026-19490 Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability
CVE-2026-87491 Google Chromium V8 Out of Bounds Write Vulnerability
CVE-2026-20079 Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability

These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.

CISA Adds Four Known Exploited Vulnerabilities to Catalog

CISA — Tue, 08 Sep 26 12:00:00 +0000

CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

CVE-2026-75650 Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability
CVE-2026-81963 Microsoft Windows Link Following Vulnerability
CVE-2026-85880 Microsoft Windows Heap-Based Buffer Overflow Vulnerability
CVE-2026-86218 N-able N-central Static Code Injection Vulnerability

These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.

CISA Adds One Known Exploited Vulnerability to Catalog

CISA — Fri, 04 Sep 26 12:00:00 +0000

CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

CVE-2026-85046 Google Chromium V8 Type Confusion Vulnerability

This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.

CISA Adds Seven Known Exploited Vulnerabilities to Catalog

CISA — Wed, 02 Sep 26 12:00:00 +0000

CISA has added seven new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

CVE-2026-9586 Sangoma Switchvox SQL Injection Vulnerability

CVE-2026-48710 Kludex Starlette HTTP Request/Response Smuggling Vulnerability

CVE-2026-49869 Kestra OSS OS Command Injection Vulnerability

CVE-2026-59822 BerriAI LiteLLM Improper Authentication Vulnerability

CVE-2026-82329 JFrog Artifactory Improper Authentication Vulnerability

CVE-2026-83548 SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability

CVE-2026-83549 SonicWall SMA1000 Appliances OS Command Injection Vulnerability

These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA — Mon, 31 Aug 26 12:00:00 +0000

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

CVE-2026-81578 PaperCut NG/MF Missing Authentication for Critical Function Vulnerability
CVE-2026-82078 PaperCut NG/MF Unsafe Reflection Vulnerability

These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.

CISA Adds Three Known Exploited Vulnerabilities to Catalog

CISA — Thu, 27 Aug 26 12:00:00 +0000

CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

CVE-2023-49105 ownCloud Improper Authentication Vulnerability
CVE-2026-53362 Linux Kernel Unspecified Vulnerability
CVE-2026-66384 JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability

These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.

CISA Adds Six Known Exploited Vulnerabilities to Catalog

CISA — Wed, 26 Aug 26 12:00:00 +0000

CISA has added six new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

CVE-2015-3246 Red Hat Libuser Race Condition Vulnerability
CVE-2015-5287 Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability
CVE-2019-1068 Microsoft SQL Server Remote Code Execution Vulnerability
CVE-2021-23758 Ajax.NET Professional Deserialization of Untrusted Data Vulnerability
CVE-2022-0995 Linux Kernel Out-of-Bounds Write Vulnerability
CVE-2026-8452 Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability

These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.

CISA Adds One Known Exploited Vulnerability to Catalog

CISA — Tue, 25 Aug 26 12:00:00 +0000

CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

CVE-2026-60004 Gitea Code Injection Vulnerability

This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.

CISA Adds One Known Exploited Vulnerability to Catalog

CISA — Mon, 24 Aug 26 12:00:00 +0000

CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

CVE-2026-21962 Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability

This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.

CISA Adds One Known Exploited Vulnerability to Catalog

CISA — Fri, 21 Aug 26 12:00:00 +0000

CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

CVE-2026-73570 Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability

This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA — Thu, 20 Aug 26 12:00:00 +0000

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

CVE-2026-72529 TrueConf Server Missing Authentication for Critical Function Vulnerability
CVE-2026-72530 TrueConf Server Code Injection Vulnerability

These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.

CISA Adds One Known Exploited Vulnerability to Catalog

CISA — Wed, 19 Aug 26 12:00:00 +0000

CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

CVE-2026-64849 MLflow Server-Side Request Forgery Vulnerability

This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.

CISA Adds Four Known Exploited Vulnerabilities to Catalog

CISA — Tue, 18 Aug 26 12:00:00 +0000

CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

CVE-2026-33824 Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability
CVE-2026-55040 Microsoft SharePoint Weak Authentication Vulnerability
CVE-2026-59310 Broadcom VMware vCenter Path Traversal Vulnerability
CVE-2026-65400 Apple macOS Improper Authentication Vulnerability

These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.

CISA Adds One Known Exploited Vulnerability to Catalog

CISA — Mon, 17 Aug 26 12:00:00 +0000

CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

CVE-2025-62593 Ray-Project Ray Code Injection Vulnerability

This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.

CISA Adds Three Known Exploited Vulnerabilities to Catalog

CISA — Tue, 11 Aug 26 12:00:00 +0000

CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

CVE-2026-20349 Cisco Secure Firewall Adaptive Security Appliance (ASA) and Firewall Threat Defense (FTD) Heap Inspection Vulnerability
CVE-2026-68820 Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability
CVE-2026-72898 Metabase SQL Injection Vulnerability

These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.

CISA Adds One Known Exploited Vulnerability to Catalog

CISA — Fri, 07 Aug 26 12:00:00 +0000

CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

CVE-2026-8037 Progress LoadMaster Command Injection Vulnerability

This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.

CISA Adds One Known Exploited Vulnerability to Catalog

CISA — Wed, 05 Aug 26 12:00:00 +0000

CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

CVE-2026-63077 JetBrains TeamCity Deserialization of Untrusted Data Vulnerability

This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.

CISA Adds Three Known Exploited Vulnerabilities to Catalog

CISA — Tue, 04 Aug 26 12:00:00 +0000

CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

CVE-2026-9198 IBM Langflow Code Injection Vulnerability
CVE-2026-18556 N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability
CVE-2026-34486 Apache Tomcat Missing Encryption of Sensitive Data Vulnerability

These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.

CISA Adds One Known Exploited Vulnerability to Catalog

CISA — Mon, 03 Aug 26 12:00:00 +0000

CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

CVE-2026-18577 N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability

This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.

CISA Urges Water and Wastewater Systems Sector to Protect OT Against Activity Targeting PLCs

CISA — Thu, 30 Jul 26 12:00:00 +0000

CISA is currently observing a significant increase in cyber threat actors targeting programmable logic controllers (PLCs) in the Water and Wastewater Systems (WWS) Sector. CISA urges critical infrastructure owners, operators, and integrators to remove publicly exposed PLCs and other operational technology (OT) from the internet as soon as possible. Threat actors targeting exposed PLCs have modified passwords to lock out operators and disconnected the PLCs by changing their IP addresses. This activity has resulted in boil water notices and sustained manual operations.

These threat actors are targeting water entities of all sizes. Even water organizations with mature cybersecurity processes should validate their external connections, as this targeting activity includes cellular modems installed by operators, vendors, or system integrators that may not be documented or included in routine attack surface scans. OT assets exposed to the internet have an increased risk of defacement, configuration changes, operational disruptions, and, in severe cases, physical damage.

CISA recommends organizations implement the following mitigations:

Disconnect the PLC from the internet. Remote access for operational purposes should go through a VPN or gateway device, not directly to the PLC.
Enable password protection and change default passwords.
Allowlist IPs to only allow remote access from known engineering laptops or other critical OT assets.

After disconnecting PLCs from the internet, operators should ensure they have a known clean backup of the PLC image in case they are locked out by a modified password. Note: Owners, operators, and integrators of Rockwell Automation MicroLogix 1400 PLCs should see Rockwell Automation’s IMPORTANT NOTICE: Restoring Access to a MicroLogix™ 1400 Controller When the Password Is Unknown for guidance addressing this activity.

To securely enable remote access to your OT systems, CISA recommends system owners, operators, and integrators see the following resources for guidance:

CISA: Primary Mitigations to Reduce Cyber Threats to Operational Technology
United Kingdom's National Cyber Security Center: Secure Connectivity Principles for Operational Technology
Federal Bureau of Investigation (FBI): Malicious Cyber Actors Targeting Water and Wastewater Sector Internet Facing Programmable Logic Controllers, Causing Operational Disruptions

For additional support, contact the Environmental Protection Agency’s Cybersecurity Technical Assistance Program for the Water Sector or your CISA Regional Office.

To report a cyber incident, contact CISA’s 24/7 Operations Center (contact@cisa.dhs.gov), or call 1-844-Say-CISA (1-844-729-2472). Please see Reporting a Cyber Incident for more details or contact FBI’s Internet Crime Complaint Center (IC3) or your local FBI field office.

When available, please include the following information regarding the incident:

Date, time, and location of the incident
Type of activity
Number of people affected
Type of equipment used for the activity
Name of the submitting company or organization, and a designated point of contact

Disclaimer

The information in this report is being provided “as is” for informational purposes only. CISA does not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this document. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by CISA. 

Acknowledgements

The Environmental Protection Agency and the Federal Bureau of Investigation contributed to this Alert.

CISA Adds One Known Exploited Vulnerability to Catalog

CISA — Wed, 29 Jul 26 12:00:00 +0000

CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

CVE-2026-20316 Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability

This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA — Mon, 27 Jul 26 12:00:00 +0000

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

CVE-2025-68686 Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability
CVE-2026-16812 Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability

These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.