Topic · kev

CISA KEV

CISA's Known Exploited Vulnerabilities catalog and additions to it. Pair with vuln-advisory when CISA adds CVEs to KEV.

RSS feed ↗

trade-press
Russian Zero-Click Zimbra Exploit Steals Government Emails
Zimbra's smaller government footprint means fewer eyes on the logs, and this is the third zero-click nation-state email campaign in 18 months.
U.S. cyber agencies warned Thursday that Russian state-backed group Laundry Bear is exploiting a zero-click vulnerability in Zimbra Collaboration Suite that requires only that a victim open or preview a malicious email, no link click, no download. Active since July 2025, the campaign has hit more than 10 organizations across the defense industrial base, federal and local government, law enforcement, and other sectors. The exploit steals email archives up to 90 days, passwords, and two-factor authentication tokens. Zimbra's smaller government footprint compared with Exchange means these intrusions are less likely to be detected quickly.
THU
regulator
CISA adds four KEV flaws under BOD 26-04
The directive turns KEV triage into an agency obligation, which contractors can no longer treat as advisory hygiene.
CISA added CVE-2021-27137 in DD-WRT, CVE-2026-0770 in Langflow, and two WordPress Core flaws, CVE-2026-63030 and CVE-2026-60137, to the Known Exploited Vulnerabilities Catalog based on active exploitation. Binding Operational Directive 26-04 requires Federal Civilian Executive Branch agencies to prioritize rapid remediation of KEV-listed CVEs on publicly exposed assets that grant total post-exploitation control. Government contractors, primes, subcontractors and C3PAOs now have a cleaner compliance baseline, even though CISA’s alert does not spell out the patch timeline or verification mechanics for these four entries.
TUE
regulator
CISA adds three Fortinet and SharePoint CVEs to KEV
BOD 26-04 turns these listings into federal patch priority, while the alert itself does not state a standalone remediation deadline.
CISA added CVE-2026-25089 and CVE-2026-39808, both Fortinet FortiSandbox OS command injection flaws, and CVE-2026-58644, a Microsoft SharePoint deserialization flaw, to the Known Exploited Vulnerabilities (KEV) Catalog. Binding Operational Directive (BOD) 26-04 requires Federal Civilian Executive Branch agencies to prioritize rapid remediation of KEV-listed CVEs on publicly exposed assets that grant total control after exploitation. Contractors and managed service providers inherit the urgency when they operate those federal environments.
JUL 16
trade-press
CISA adds exploited SonicWall SMA1000 zero-days to KEV
SMA1000 operators need to upgrade, check SonicWall’s indicators of compromise, and treat suspicious activity as a live intrusion.
SonicWall disclosed CVE-2026-15409 and CVE-2026-15410 for SMA1000 appliances Tuesday, and CISA added both to the Known Exploited Vulnerabilities catalog the same day. Rapid7 told CyberScoop exploitation began June 22 and likely aimed at ransomware. SonicWall says fewer than 5,000 SMA1000 units sit within its roughly one million monitored sensors, but also warned customers that patching alone is insufficient.
JUL 15
trade-press
ISACs weigh risk triage as AI swells CVE backlog
The feed-everything model cannot survive a vulnerability market where discovery accelerates faster than patch capacity.
Inside Cybersecurity reports that IT-ISAC, Health-ISAC and Retail and Hospitality-ISAC leaders are exploring risk-based triage for vulnerability intelligence as AI-driven discovery increases volume. The CVE program logged 48,244 records in 2025 and 35,872 in the first half of 2026. For members, the operative question is no longer whether to patch everything; it is which exposed, exploitable systems move first.
JUL 15
regulator
CISA adds CVE-2023-4346, CVE-2026-46817 to KEV catalog
BOD 26-04 makes high-risk KEV entries binding work on exposed federal assets, and contractors that run them inherit urgency.
CISA added CVE-2023-4346 in KNX Protocol and CVE-2026-46817 in Oracle E-Business Suite to the Known Exploited Vulnerabilities (KEV) Catalog after evidence of active exploitation. Federal Civilian Executive Branch agencies must prioritize high-risk KEV flaws on publicly exposed assets that grant total control after exploitation under Binding Operational Directive (BOD) 26-04. Contractors and managed service providers that administer those systems inherit the urgency, but CISA’s alert does not list specific due dates for these two CVEs.
JUL 15
regulator
CISA adds four SonicWall, AD FS, SharePoint CVEs to KEV
CISA's catalog entry matters because BOD 26-04 turns edge-device patching into a federal compliance clock.
CISA added CVE-2026-15409 and CVE-2026-15410 in SonicWall SMA1000 appliances, CVE-2026-56155 in Microsoft Active Directory Federation Services, and CVE-2026-56164 in Microsoft SharePoint Server to the Known Exploited Vulnerabilities Catalog. Federal Civilian Executive Branch agencies must prioritize rapid remediation under Binding Operational Directive 26-04 for KEV flaws on publicly exposed assets that grant total control after exploitation. Contractors, vendors, and managed service providers supporting those environments inherit the urgency, even where the CISA alert leaves the exact agency deadline unstated.
JUL 14
regulator
CISA links three SharePoint CVEs to active exploitation
This is now a coordinated SharePoint server problem, not three vulnerability tickets waiting for the next maintenance window.
CISA says CVE-2026-32201, CVE-2026-45659, and CVE-2026-56164 are being actively exploited against all supported on-premises SharePoint Server versions, enabling remote code execution, IIS machine-key theft, persistence, and malware deployment. Contractors, managed service providers, municipalities, and government operators running SharePoint Server 2016, 2019, or Subscription Edition should patch, enable AMSI in Full Mode where feasible, hunt for compromise before rotating keys, and treat positive detections as incident-response triggers.
JUL 14
regulator
CISA adds Cisco IOS CVE-2008-4128 to KEV
Federal agencies get a binding remediation priority, but CISA’s alert leaves the exact BOD 26-04 deadline unstated.
CISA added CVE-2008-4128, a Cisco IOS cross-site request forgery vulnerability, to the Known Exploited Vulnerabilities Catalog after evidence of active exploitation. Federal Civilian Executive Branch agencies must prioritize remediation under Binding Operational Directive 26-04 for qualifying publicly exposed assets. State CISOs and contractors servicing federal networks should treat the listing as a practical audit and remediation trigger.
JUL 13
regulator
CISA puts Adobe ColdFusion CVE-2026-48282 in KEV
The operational burden is asset discovery first, patching second, because KEV only matters where exposed ColdFusion can hand over control.
CISA added CVE-2026-48282, an actively exploited Adobe ColdFusion path traversal vulnerability, to the Known Exploited Vulnerabilities Catalog. Under Binding Operational Directive 26-04, Federal Civilian Executive Branch agencies must prioritize remediation for KEV-listed CVEs on publicly exposed assets that can grant total control after exploitation. Contractors supporting federal systems should expect the same urgency through prime flowdowns. CISA’s alert does not supply exploit code, detection signatures, or a specific deadline.
JUL 7
regulator
CISA adds three CVEs to KEV Catalog
For exposed federal assets, the practical question is ownership speed, because CISA’s alert does not give the deadline.
CISA added CVE-2026-48908, CVE-2026-55255 and CVE-2026-56290 to the Known Exploited Vulnerabilities Catalog based on active exploitation evidence. Federal Civilian Executive Branch agencies must prioritize rapid remediation under Binding Operational Directive 26-04 for qualifying publicly exposed assets. Contractors, primes and assessors using affected JoomShaper, Langflow or Joomlack products should treat the listing as an immediate vulnerability-management input, though CISA’s alert does not state a specific deadline.
JUL 7
trade-press
AI vulnerability surge strains CVE and KEV programs
A record every seven minutes turns vulnerability disclosure from a cataloging problem into a triage failure for downstream patch teams.
Inside Cybersecurity reports that Common Vulnerabilities and Exposures (CVE) Board and CVE Consumer Working Group members used a July 1 Institute for Security and Technology webinar to warn that the Cybersecurity and Infrastructure Security Agency (CISA)-funded CVE program cannot scale on current process. Jay Jacobs said CVE is publishing about one record every seven minutes, and Tod Beardsley said CISA’s Known Exploited Vulnerabilities (KEV) catalog is similarly exposed. Jen Ellis flagged vendor pressure to bundle multiple flaws under one identifier, which would land hardest on patch teams.
JUL 2
regulator
CISA adds SharePoint flaw CVE-2026-45659 to KEV
For federal teams, the practical instruction is simple: find exposed SharePoint, patch fast, then check whether attackers got there first.
CISA added CVE-2026-45659, a Microsoft SharePoint Server deserialization of untrusted data vulnerability, to the Known Exploited Vulnerabilities Catalog based on active exploitation. Federal Civilian Executive Branch agencies must prioritize KEV vulnerabilities under Binding Operational Directive 26-04, especially on publicly exposed assets that allow total control after exploitation. Contractors, managed service providers, and C3PAOs supporting federal systems should treat the listing as immediate remediation pressure, even though BOD 26-04 applies only to FCEB agencies.
JUL 1
regulator
CISA adds PTC Windchill/FlexPLM, Cisco flaws to KEV
For Federal Civilian Executive Branch teams, catalog status turns vulnerability triage into a Binding Operational Directive 26-04 priority call.
CISA added CVE-2026-12569, an improper input validation vulnerability in PTC Windchill and FlexPLM, and CVE-2026-20230, a Cisco server-side request forgery vulnerability, to the Known Exploited Vulnerabilities (KEV) catalog based on confirmed active exploitation. Federal Civilian Executive Branch agencies must prioritize remediation under Binding Operational Directive 26-04. State CISOs and assessors get the same exploitation signal without the same mandatory federal workflow.
JUN 25
trade-press
CISA CVE-2026-50751 directive exposes six-week intrusion gap
A six-week head start turns remediation into incident response, especially when the perimeter appliance blessed the attacker as legitimate.
CyberScoop’s Brad LaPorte says CISA’s June 21 emergency directive for CVE-2026-50751, a CVSS 9.3 Check Point Remote Access VPN authentication bypass, followed exploitation that began in early May. Federal agencies get the formal patch order; contractors running the same perimeter stack get the same incident-response problem. Check Point disclosed the bug June 8, but a Qilin affiliate had already used it against a few dozen organizations. A green patch report still leaves the May-June access window unresolved.
JUN 25
regulator
CISA adds Lantronix EDS5000, UniFi OS CVEs to KEV
Three entries hit the same UniFi OS line, which makes this a platform exposure problem for federal networks.
CISA added CVE-2025-67038 in Lantronix EDS5000 and three Ubiquiti UniFi OS flaws, CVE-2026-34908, CVE-2026-34909 and CVE-2026-34910, to the Known Exploited Vulnerabilities (KEV) Catalog. Binding Operational Directive (BOD) 26-04 requires Federal Civilian Executive Branch (FCEB) agencies to prioritize rapid remediation of high-risk KEV items on publicly exposed assets; the alert gives no item-specific deadline. Contractors, managed service providers and Cybersecurity Maturity Model Certification (CMMC) third-party assessors supporting federal environments should triage UniFi OS first.
JUN 23
trade-press
NDAA amendment would codify CISA control of CVE
A program that assigns the identifiers behind patch queues should not depend on whether one support contract survives spring cleaning.
A planned fiscal 2027 National Defense Authorization Act amendment would formally place the Common Vulnerabilities and Exposures program under the Cybersecurity and Infrastructure Security Agency, Nextgov/FCW reports. The measure would create a 15-member CVE Board and require a CISA-NIST modernization plan. Primes, agencies, assessors and security teams that build vulnerability workflows around CVE would get statutory footing for a system that MITRE’s contracting scare showed was more fragile than its ubiquity suggested.
JUN 18
trade-press
Attackers exploit two FortiSandbox flaws before CISA lists them in KEV
The risk has moved faster than the mandate, leaving Fortinet customers to triage exposed sandboxes without the federal deadline signal.
CyberScoop reports researchers saw exploitation of FortiSandbox CVE-2026-39808 and CVE-2026-39813, plus attempts against CVE-2026-25089; Fortinet has not confirmed exploitation. Fortinet disclosed and patched the first two critical flaws in April and the third on June 9; Defused counted 49 events from 11 IPs over six days. The Cybersecurity and Infrastructure Security Agency had not added the defects to the Known Exploited Vulnerabilities (KEV) catalog as of Wednesday. For a trusted sandbox appliance, absence from KEV changes the federal calendar while leaving the exposure intact.
JUN 17
regulator
CISA adds Cisco, LiteSpeed CVEs to KEV catalog
For agencies and contractors, the practical job is patching exposed systems and checking whether attackers arrived first.
The Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-20262, a Cisco Catalyst SD-WAN Manager directory/path traversal flaw, and CVE-2026-54420, a LiteSpeed cPanel plugin UNIX symlink-following flaw, to the Known Exploited Vulnerabilities (KEV) catalog based on active exploitation. Binding Operational Directive (BOD) 26-04 requires Federal Civilian Executive Branch agencies to prioritize rapid remediation on qualifying publicly exposed assets and check for prior compromise. Contractors and managed service providers are not bound, but the de facto pressure follows the KEV list. CISA did not specify whether rapid remediation means emergency patching or accelerated standard cycles.
JUN 15
regulator
CISA adds Oracle PeopleSoft CVE-2026-35273 to KEV
BOD 26-04 turns this from a catalog update into a public-facing asset triage problem with two clocks to track.
CISA added CVE-2026-35273, an Oracle PeopleSoft Enterprise PeopleTools missing-authentication vulnerability, to the Known Exploited Vulnerabilities catalog based on active exploitation. Federal Civilian Executive Branch agencies must prioritize rapid remediation under Binding Operational Directive 26-04 when KEV flaws sit on publicly exposed assets that grant total control after exploitation. Contractors and primes supporting federal systems should track that narrower regime separately; the alert does not state the CVE-specific deadline, penalties, or extension criteria.
JUN 12
regulator
CISA adds Ivanti Sentry flaw to KEV catalog
The listing turns an Ivanti patch decision into a federal priority item, with the exact remediation date left to the catalog.
CISA added CVE-2026-10520, an Ivanti Sentry OS command injection vulnerability, to the Known Exploited Vulnerabilities catalog based on evidence of active exploitation. Federal Civilian Executive Branch agencies must prioritize remediation under Binding Operational Directive 26-04 for covered publicly exposed assets. Contractors and C3PAOs supporting federal environments should verify patch status and whether pre-patch compromise checks are required.
JUN 11
trade-press
CISA ties BOD 26-04 patch deadlines to exploitability
CISA is turning attacker tempo, including automated exploitation, into the priority signal federal patch queues must reflect.
CyberScoop reports the Cybersecurity and Infrastructure Security Agency (CISA) issued Binding Operational Directive (BOD) 26-04, requiring federal agencies to rank vulnerabilities by public exposure, automated exploitability, system-control impact and active exploitation. Vulnerabilities meeting all four criteria get a three-day fix window and forensic triage. Contractors, primes and managed service providers are not directly bound, but agency customers now have 3-to-180-day timelines to meet against a reported 43-day median full-resolution time for known exploited vulnerabilities (KEVs).
JUN 10
trade-press
CISA issues BOD 24-02 for four-factor patch triage
The relief is real only if agencies can classify exposure, automation and impact faster than attackers can industrialize the exploit.
CISA issued Binding Operational Directive (BOD) 24-02, requiring federal civilian agencies to rank remediation by asset exposure, Known Exploited Vulnerabilities (KEV) status, exploit automation and technical impact, replacing BOD 22-01’s KEV-only trigger. Agencies must revise policies immediately, update processes within 60 days and finish broader asset/reporting work within 180 days. State CISOs get a benchmark rather than a mandate. The unresolved question is whether the table buys relief or turns bad risk scoring into compliance evidence.
JUN 10
regulator
CISA adds three Arista, Chrome V8, Cisco flaws to KEV
The binding clock now matters more than the alert text, because the specific remediation due dates were not included here.
CISA added CVE-2026-7473 in Arista Extensible Operating System, CVE-2026-11645 in Google Chromium V8 and CVE-2026-20245 in Cisco Catalyst SD-WAN Manager to the Known Exploited Vulnerabilities Catalog after evidence of active exploitation. Binding Operational Directive 22-01 requires Federal Civilian Executive Branch agencies to remediate KEV entries by their due dates, though this alert does not state those dates. Contractors, primes and managed service providers supporting FCEB networks should treat the catalog entry, not the press alert, as the operational source.
JUN 9
trade-press
CISA BOD shifts agencies from patch speed to risk triage
Federal patch metrics are finally meeting the asset inventory problem most dashboards have been politely avoiding.
CyberScoop reports CISA will publish a binding operational directive (BOD) Wednesday moving federal vulnerability management away from uniform patch speed and toward risk scored by asset exposure, Known Exploited Vulnerabilities (KEV) status, exploitability and criticality. Federal agencies are first in line; state CISOs and contractors supporting federal systems should expect the same vocabulary in oversight and performance conversations. The missing piece is whether the BOD gives agencies a scoring method and implementation deadlines.
JUN 9
trade-press
Researchers fault Trump AI EO on vulnerability management
A new clearinghouse does little for defenders if the real failure point is remediation speed at the network edge.
Security researchers told an IST webinar that President Trump’s June 2 artificial intelligence executive order relies on older vulnerability-management assumptions while exploit timelines compress from months or years to days, hours or minutes. The order tasks Treasury with a voluntary AI cybersecurity clearinghouse and directs the Cybersecurity and Infrastructure Security Agency to issue binding operational directives. The critique lands on a familiar asymmetry: attackers do not need a Common Vulnerabilities and Exposures record; defenders often do.
JUN 9
regulator
CISA adds LiteLLM and Check Point flaws to KEV
For federal networks, KEV placement turns active exploitation into a remediation clock, even when version scope still needs vendor confirmation.
CISA added CVE-2026-42271, a BerriAI LiteLLM command injection flaw, and CVE-2026-50751, a Check Point Security Gateway improper authentication flaw, to the Known Exploited Vulnerabilities Catalog based on active exploitation. Federal Civilian Executive Branch agencies must remediate KEV-listed vulnerabilities under Binding Operational Directive 22-01; contractors supporting federal systems should treat the entries as contract-driven patch priorities.
JUN 8
regulator
CISA adds SolarWinds Serv-U CVE-2026-28318 to KEV
For federal civilian agencies, the listing turns an exploited Serv-U flaw into a BOD 22-01 remediation clock.
CISA added CVE-2026-28318, a SolarWinds Serv-U uncontrolled resource consumption vulnerability, to the Known Exploited Vulnerabilities Catalog after evidence of active exploitation. Federal Civilian Executive Branch agencies covered by Binding Operational Directive 22-01 must remediate KEV-listed flaws by CISA’s due date. The supplied alert text does not state the deadline or whether SolarWinds had issued a patch as of publication.
JUN 5
regulator
CISA adds Mirasvit deserialization flaw to KEV Catalog
For FCEB agencies, the catalog entry turns a patch priority into a BOD 22-01 compliance deadline.
CISA added CVE-2026-45247, a Mirasvit Full Page Cache Warmer deserialization of untrusted data flaw, to the Known Exploited Vulnerabilities Catalog based on active exploitation. Binding Operational Directive 22-01 requires Federal Civilian Executive Branch agencies to remediate KEV-listed vulnerabilities by the applicable due date. Contractors and vendors supporting FCEB systems should coordinate patching, but CISA’s alert does not state a specific due date or workaround.
JUN 3
regulator
CISA adds Linux and Android flaws to KEV
For federal teams, the important fact is not novelty, but active exploitation and the BOD 22-01 remediation clock.
CISA added CVE-2022-0492, a Linux kernel improper authentication flaw, and CVE-2025-48595, an Android Framework integer overflow, to the Known Exploited Vulnerabilities Catalog based on active exploitation. Binding Operational Directive 22-01 requires Federal Civilian Executive Branch agencies to remediate KEV-listed vulnerabilities by their due dates. Contractors supporting those agencies should treat the listings as access-risk items, not ordinary backlog work.
JUN 2
regulator
CISA adds CVE-2024-21182 to KEV Catalog
For agencies, KEV is less advisory than clock: remediation is mandatory even when the public alert leaves implementation details thin.
CISA added CVE-2024-21182, an Oracle WebLogic Server unspecified vulnerability, to the Known Exploited Vulnerabilities Catalog based on active exploitation. Binding Operational Directive 22-01 requires Federal Civilian Executive Branch agencies to remediate KEV entries by CISA’s due date. Contractors and primes supporting federal systems should expect the same pressure through contract terms and access controls, though the alert does not state the specific deadline or workaround status.
JUN 1
regulator
CISA adds PAN-OS auth bypass CVE-2026-0257 to KEV Catalog
BOD 22-01 requires Federal Civilian Executive Branch agencies to remediate; the specific deadline for this CVE is not stated in the advisory.
CISA added CVE-2026-0257, a Palo Alto Networks PAN-OS authentication bypass vulnerability, to the Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. Federal Civilian Executive Branch agencies must remediate by the BOD 22-01 due date assigned to this entry; that date is not specified in the advisory. Contractors and integrators supporting FCEB systems should treat this as an inherited obligation and check the KEV Catalog directly for the deadline.
MAY 29
trade-press
NIST adds CISA SSVC data to NVD starting June 17
With full enrichment capped at 15, 20 percent of new CVEs, the exploitation-status data landing June 17 covers a fraction of what assessors actually need to triage.
NIST will surface Stakeholder-Specific Vulnerability Categorization data from CISA in the National Vulnerability Database on June 17, adding exploitation status and safety-impact signals alongside existing CVSS scores. The addition follows NIST's April 15 decision to limit full enrichment to CVEs in the Known Exploited Vulnerabilities catalog, federal software, and "critical software" under a Biden-era executive order (roughly 15) 20 percent of new CVEs. Assessors and patch managers at contractors, MSPs, and state agencies relying on NVD for remediation decisions will still face gaps on the remaining 80, 85 percent and will need external intelligence platforms to cover them.
MAY 29
regulator
CISA adds CVE-2026-48027 to KEV as Nx Console, GitHub CI/CD attacks widen
The malicious Nx Console extension v18.95.0 deployed silently via auto-update, meaning developers never had to click anything, and every secret their pipeline could touch is now exposed.
CISA added CVE-2026-48027, assigned to the poisoned Nx Console VS Code extension version 18.95.0, to the Known Exploited Vulnerabilities (KEV) Catalog and flagged two linked campaigns: the Nx-to-GitHub pivot that exfiltrated internal GitHub repositories, and "Megalodon," which injected malicious GitHub Actions workflows to harvest CI/CD secrets, cloud credentials, and tokens across public repositories. The extension spread through VS Code's automatic update mechanism, requiring no manual action from developers or pipeline agents. CISA's mandatory remediation: rotate every credential, token, API key, and cloud provider secret that any CI/CD pipeline could access, and treat any organization using Nx Console or GitHub Actions as potentially compromised until forensics say otherwise.
MAY 28
regulator
CISA adds LiteSpeed cPanel privilege escalation CVE to KEV catalog
Federal civilian agencies must patch CVE-2026-48172 by CISA's BOD 22-01 deadline; the specific due date is not published in the advisory.
CISA added CVE-2026-48172, a privilege escalation flaw in the LiteSpeed cPanel plugin, to the Known Exploited Vulnerabilities catalog based on evidence of active exploitation. Federal Civilian Executive Branch agencies must remediate by the catalog-listed due date under Binding Operational Directive 22-01. The advisory does not state the specific deadline. All organizations running LiteSpeed cPanel should treat this as priority patching regardless of BOD 22-01 applicability.
MAY 26