Topic
Latest CISA KEV coverage — 27 articles.
CISA put an Apple WebKit flaw patched in May 2024 on KEV. It scores 5.5, yet Sekoia ties it to an exploit chain that ends in cookie theft. Here is who is affected, the fixed versions, and what to do.
A WordPress Core race condition that runs code during a core update is now on CISA KEV. Attackers are polling the staging path and waiting for sites to update. Here is who is affected, the fixed versions, and what to do.
Nine CVEs from eight vendors joined CISA KEV last week, from a 2.7 VMware logging flaw to a CVSS 10.0 GitLab bug. Same SSVC tags got three-day and 14-day deadlines, so here is what to patch first and why.
A 7.0 rated Ivanti Connect Secure flaw is now on CISA KEV. It was the last step of a three-exploit chain that reached root on a fully patched appliance. Here are the fixed builds and why a clean integrity check is not enough.
CISA added a Cisco firewall VPN flaw and a CVSS 10.0 GitLab RCE to KEV on the same day, both due November 1. Here are the affected versions, the fixes, and why checking the version alone can leave you exposed.
A VMware ESX logging flaw scored 2.7 out of 10 is now on CISA KEV. CrowdStrike says the China-nexus group Warp Panda used it as a zero-day to perform admin operations without being logged. Here is who is affected, the fixed builds, and what to do.
CISA added the Linux kernel flaw Fragnesia to KEV on Oct 28. A 7.8 on its own, it was chained with PHP2Shell to root 25 servers. Fixed kernels and what to check.
CISA added the Adobe Commerce PolyShell flaw and a Google Brotli decoder bug to KEV on Oct 27. One was patched in July, the other six days earlier. Affected versions and what to check.
CISA added both PHP2Shell flaws to KEV on Oct 26. Exploitation is confirmed on a honeypot and exploit code is public. Fixed PHP versions, affected products and what to check.
Eight CVEs from five vendors joined CISA KEV this week, with scores from 4.3 to 9.9. Plex2Shell, Siemens ClickFix, SiteGuard, Arista and Collabora, plus where PHP2Shell fits.
Two critical flaws joined CISA KEV on Oct 23, both due Oct 26. One turns any VeloCloud Orchestrator user into a superuser operator. The other allows unauthenticated command execution on Nextcloud servers.
Eight exploited CVEs from seven vendors entered CISA's KEV catalog between October 13 and 16. Five sit on edge or remote access products, seven had an EPSS of 5% or less, and all are marked Active in SSVC. Here is the list, the angle and what to patch first.
BeyondTrust patched a critical Remote Support flaw on October 15, but a China-linked group had been exploiting it since August 29. Here is what the attackers did, who must patch, and how to check an appliance for compromise.
Fortinet fixed CVE-2025-61624 in April and rated it Medium. In October, CISA added it to KEV after Unit 42 showed it helping deploy PEERSTITCH, a memory-only implant on FortiGate firewalls. Here are the fixed versions and what to hunt for.
CISA added four CVEs to KEV on October 14: Cisco Secure Email Gateway, AhsayCBS, and Palo Alto PAN-OS. All were exploited before a full fix existed, and the due date for every one is October 17.
Ivanti warned that CVE-2026-104935, an authentication bypass in Connect Secure, is exploited in the wild. Volexity saw a three-flaw chain reach root on a fully patched VPN, and the third flaw still has no fix.
Microsoft's October 2026 Patch Tuesday is the largest ever, with roughly 1,400 fixes. One Windows Shell flaw, CVE-2026-96951, was exploited and has an October 16 CISA deadline. Here is what to patch first.
CISA added five CVEs to KEV on October 8, all from 2015 to 2023: ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts, and ISC BIND. A joint advisory ties them to a China-linked campaign, and EPSS scores range from 3.6 to 99.5 percent.
Six exploited CVEs reached CISA's KEV catalog between September 29 and October 4, covering Apple, Cisco, Fortinet, Zammad, and NetScaler. Each calls for a different first move, from a simple upgrade to a workaround because no patch exists.
Citrix calls CVE-2026-88779 a NetScaler denial of service, but admins logged shell commands in SAML login requests and a patched honeypot ran a malware binary. Citrix has not confirmed code execution. Appliances with the earlier fixes need this update too.
DIVD, the nonprofit that discloses vulnerabilities for a living, was breached through its own Zammad helpdesk in what it calls an agentic AI-powered attack chaining CVE-2026-102489 and CVE-2026-102490. The RCE half is patchable. The root-level flaw still has no fix.
Fortinet disclosed CVE-2026-104286, a CVSS 9.8 path traversal flaw in FortiMail, with active exploitation already underway and no fixed release available for any affected branch. Here's the mechanism, the IOCs to check, and the workaround Fortinet is recommending until patches ship.
A CVSS 9.8 authentication bypass in Cisco Catalyst SD-WAN Manager, found by Cisco's own support team during a TAC case and now under active exploitation. No workaround exists. Here's the mechanism, who's affected, and what to check in your logs.
Citrix confirmed active exploitation of two NetScaler zero-days, CVE-2026-88771 and CVE-2026-88772, after a weekend of quiet shutdown warnings and NCSC pre-notifications. Here's the mechanism, who's affected, and the September 30 deadline.
CISA added nine actively exploited CVEs to KEV last week, from F5 and Arista to WordPress, SharePoint, MikroTik, and a fresh pair of Citrix NetScaler zero-days. Here's what happened, and what's still due.
WatchTowr's honeypot network caught active exploitation of a WSO2 JWT algorithm bypass, with forged tokens granting full access to every backend API a compromised gateway proxies. CISA added it to KEV; federal agencies must patch by September 27.
CISA confirmed active exploitation of a Zyxel GS1900 switch vulnerability patched back in June, after GreyNoise found nearly 1,000 compromised devices across 48 countries. Here is the mechanism, who is affected, and what is due by September 24.
