Topic · kev

CISA KEV

CISA's Known Exploited Vulnerabilities catalog and additions to it. Pair with vuln-advisory when CISA adds CVEs to KEV.

RSS feed ↗

standards
CISA puts first PAN-OS GlobalProtect auth bypass on KEV
CVE-2026-0257 exploits a misconfiguration interplay between authentication override cookies and certificate settings, it can't be firewalled away on the data plane, so patching is the only mitigation.
CISA added CVE-2026-0257, an authentication bypass in PAN-OS GlobalProtect portal and gateway interfaces, to its Known Exploited Vulnerabilities catalog on June 22 based on evidence of active exploitation. The vulnerability affects PAN-OS 10.2, 11.1, and 11.2 across dozens of patch trains when GlobalProtect is configured with authentication override cookies enabled and a specific certificate configuration present. Palo Alto Networks reports limited exploit attempts in the wild. Prisma Access customers are on a managed upgrade schedule; self-managed PAN-OS instances require immediate patching.
YESTERDAY
trade-press
Microsoft ships record 973 patches; CISA flags two actively exploited flaws
One of the two actively exploited bugs lives in the Windows update stack: the very component defenders rely on to verify they're patched.
Microsoft's September Patch Tuesday landed at 973 vulnerabilities, the fourth consecutive record-breaking month. CISA added two of them, CVE-2026-81963 and CVE-2026-85880, to its Known Exploited Vulnerabilities catalog, giving federal civilian agencies until September 22 to patch under BOD 22-01. CVE-2026-81963 is the more alarming of the two: it lives in the Windows update stack, the mechanism that installs patches. As Automox engineer Serena DiPenti put it, "an attacker who owns the update stack owns the thing you'd use to evict them."
TUE
trade-press
Gold Eagle consolidates findings, but 69% of breaches start elsewhere
The White House's AI vulnerability-coordination initiative addresses the 31% of breaches that begin with exploited CVEs, zero-trust and data-flow controls are the necessary complement for the rest.
The White House Gold Eagle initiative, an AI-backed clearinghouse, aims to consolidate vulnerability findings from government and industry, prioritize the most consequential flaws, and coordinate remediation across critical infrastructure. The program reflects a shift from volume-based vulnerability management to signal-driven, AI-assisted prioritization. But Verizon's 2026 DBIR found exploited vulnerabilities accounted for only 31% of breaches, up 20% from the prior year, yet still the path for the first time in the report's history. The other 69% started elsewhere: unmanaged data, misconfigurations, shadow IT, and AI exposures. The median disclosure-to-patch window sits at 43 days and rising. Gold Eagle can tell agencies what to fix first; it can't stop data from being exposed while a fix is pending.
AUG 31
regulator
CISA Adds Six SharePoint Server RCE Bugs to KEV Catalog
The accelerating cadence (one in April, five more between July and August, all affecting on-prem Subscription Edition, 2019, and 2016) points to a methodical campaign, not opportunistic scanning.
CISA added six SharePoint Server RCE vulnerabilities to its Known Exploited Vulnerabilities catalog between April 14 and August 18, 2026, confirming active exploitation against all supported on-premises versions. The post-exploitation playbook (IIS machine-key theft, deserialization, persistence, malware deployment) mirrors the 2025 ToolShell campaign but with six entry points instead of two. CISA's hardening guidance calls for removing SharePoint from direct internet exposure, patching, and enabling AMSI in Full Mode.
AUG 26
regulator
CISA Lays Vulnerability Baseline Before AI Floods the Pipeline
The review frames Secure by Design not as an aspirational slogan but as the only systemic alternative to a reactive patching model that won't scale.
CISA published a vulnerability review analyzing FY2024, 2025 data to establish a baseline of today's vulnerability landscape before AI-enabled discovery becomes more widespread. The review identifies common software weaknesses and shows organizations how to prioritize remediation using BOD 26-04's four criteria: exposure status, KEV catalog status, automation potential, and technical impact. The framing matters: CISA is telling organizations to fix classes of vulnerabilities systemically, not play whack-a-mole with individual CVEs.
AUG 26
regulator
CISA Adds Gitea Code Injection Flaw to KEV Catalog
Code injection on a self-hosted Git server meets BOD 26-04's "total control" threshold: patching isn't optional for agencies, and contractors running Gitea face the same risk.
CISA added CVE-2026-60004, a Gitea code injection vulnerability, to its Known Exploited Vulnerabilities catalog, citing evidence of active exploitation. The addition triggers BOD 26-04 remediation requirements for FCEB agencies: because code injection on a Git server grants total control of the asset post-exploitation, agencies must prioritize patching and investigate whether threat actors compromised systems before the fix was applied. Gitea is widely deployed as a self-hosted Git service across government and contractor environments. This one lands in places where source code and CI/CD pipelines are the prize.
AUG 25
regulator
CISA Adds Zimbra Command-Injection Bug to KEV
Zimbra ZCS has become a perennial KEV entry. This OS command-injection bug is the latest, and BOD 26-04's remediation clock starts now.
CISA added CVE-2026-73570, a Zimbra Collaboration Suite OS command-injection vulnerability, to its Known Exploited Vulnerabilities catalog Thursday, citing active exploitation. Federal agencies under BOD 26-04 must now prioritize remediation on publicly exposed assets. Zimbra vulnerabilities are a recurring fixture in the KEV catalog. This isn't the first, and it won't be the last.
AUG 25
regulator
CISA Adds Two TrueConf Server Vulnerabilities to KEV Catalog
Both carry 2026 CVE IDs and already show active exploitation, triggering BOD 26-04 remediation deadlines for federal agencies.
CISA added CVE-2026-72529 and CVE-2026-72530, a missing-authentication flaw and a code injection vulnerability in TrueConf Server, to its Known Exploited Vulnerabilities catalog on August 20. Both carry 2026 CVE identifiers, meaning they were disclosed this year and are already under active exploitation. Federal Civilian Executive Branch agencies must prioritize remediation under BOD 26-04, which requires rapid patching of KEV-listed CVEs on publicly exposed assets. Two vulnerabilities in the same product landing in KEV simultaneously isn't the routine single-entry update; it's worth a closer look for any agency running on-premises conferencing infrastructure.
AUG 25
trade-press
Clop exploits PTC Windchill zero-day in supply-chain attack
The playbook is familiar (zero-day in supply-chain SaaS, mass exploitation, extortion) but PTC still won't say how many customers were compromised or when exploitation began.
Clop exploited CVE-2026-12569, a zero-day in PTC's Windchill and FlexPLM platforms, stealing data from manufacturers across aerospace, automotive, and other industries. PTC disclosed the flaw June 17 and patched June 18, but Ransom-ISAC says victims were likely compromised by early June. CISA added it to KEV June 25 with a June 28 BOD 26-04 deadline. Toast and Zebra confirmed limited intrusions; GE, Philips, and Shell are among claimed victims. PTC still hasn't disclosed how it discovered the breach, and it won't say when exploitation began or how many customers were affected.
AUG 19
regulator
ANDRITZ HIPASE-250 shipped with plaintext passwords, hard-coded keys
Four CVEs in ANDRITZ HIPASE-250 require no exploit chain, just network access to a product deployed across energy facilities worldwide.
CISA disclosed four vulnerabilities in ANDRITZ HIPASE-250 and 250 SCALA versions 7.20 and earlier, with CVSS scores reaching 8.7. The flaws let attackers recover plaintext-stored passwords, read live process data from an unauthenticated endpoint, suppress audit logging without credentials, and gain VNC access through a hard-coded provisioning password. Every engineering workstation got the same one. ANDRITZ fixed all four in v8.15.00, released July 2026. No exploit chain is needed; just network access to energy OT software that should never have shipped with these failures.
AUG 16
trade-press
CISA Orders 14-Day Patch for Lazarus-Exploited Winsock Bug
Second Lazarus Group exploitation of the same Windows Winsock component in two years, this time delivered through spoofed Lockheed Martin recruiter personas: the kernel-driver layer is now a sustained DPRK targeting priority.
CISA added CVE-2026-68820 to its Known Exploited Vulnerabilities catalog Tuesday, giving federal agencies until August 25 to patch a Windows Winsock use-after-free flaw that Lazarus Group is actively exploiting. The bug enables local privilege escalation to full OS control after an attacker gains initial foothold. It's the second time in two years Lazarus has targeted the same Winsock component, and Operation Dream Job's current wave uses compromised vendor infrastructure and spoofed Lockheed Martin recruiter accounts to deliver the payload, making "spot the phishing link" advice essentially useless.
AUG 12
standards
Cisco AsyncOS RCE added to CISA KEV, no patch available
Active exploitation confirmed, and the only remediation is an appliance rebuild, a worst-case scenario for email gateway operators running Spam Quarantine facing the internet.
CISA added CVE-2025-20393 (an unauthenticated RCE in Cisco AsyncOS) to its Known Exploited Vulnerabilities catalog on December 18, 2025, after Cisco confirmed active exploitation. The vulnerability affects Secure Email Gateway and Secure Email and Web Manager appliances with Spam Quarantine exposed to the internet. Cisco has not released a patch. There is no workaround: compromised appliances must be rebuilt to eradicate the persistence mechanism Cisco found attackers planting on affected systems.
AUG 7
regulator
CISA adds Progress LoadMaster command injection to KEV catalog
BOD 26-04 makes the KEV catalog binding for federal agencies, not advisory, and the remediation clock starts now.
CISA added CVE-2026-8037, a command injection vulnerability in Progress LoadMaster, to its Known Exploited Vulnerabilities catalog on August 7. The vulnerability allows unauthenticated remote command execution on publicly exposed appliances. Federal civilian agencies now have a binding obligation under BOD 26-04 to prioritize patching it, the catalog has shifted from an advisory resource to a compliance framework with teeth. Contractors supporting federal networks should treat this as urgent: supply chain liability doesn't wait for a memo.
AUG 7
trade-press
CISA to Congress: don’t lock the CVE program in statute
The vulnerability-tracking backbone that 530 CNAs depend on needs formal recognition, but rigid legislative design rules could break what AI and international partners are already reshaping.
CISA’s vulnerability response branch chief told Black Hat that statutory recognition for the CVE Program is welcome, but legislation that dictates how the program operates could cripple its ability to adapt. The caution follows a June amendment from Reps. Ramirez and Whitesides that would codify CVE in DHS, establish a 15-member board, and require a NIST-CISA modernization plan. The amendment died in the House Rules Committee. CISA hasn’t opposed it, but Cerkovnik warned that overly prescriptive rules would collide with a program already absorbing AI-driven vulnerability discovery and pressure to bring international partners (ENISA among them) into formal governance roles.
AUG 7
trade-press
Russian Zero-Click Zimbra Exploit Steals Government Emails
Zimbra's smaller government footprint means fewer eyes on the logs, and this is the third zero-click nation-state email campaign in 18 months.
U.S. cyber agencies warned Thursday that Russian state-backed group Laundry Bear is exploiting a zero-click vulnerability in Zimbra Collaboration Suite that requires only that a victim open or preview a malicious email, no link click, no download. Active since July 2025, the campaign has hit more than 10 organizations across the defense industrial base, federal and local government, law enforcement, and other sectors. The exploit steals email archives up to 90 days, passwords, and two-factor authentication tokens. Zimbra's smaller government footprint compared with Exchange means these intrusions are less likely to be detected quickly.
JUL 23
regulator
CISA adds four KEV flaws under BOD 26-04
The directive turns KEV triage into an agency obligation, which contractors can no longer treat as advisory hygiene.
CISA added CVE-2021-27137 in DD-WRT, CVE-2026-0770 in Langflow, and two WordPress Core flaws, CVE-2026-63030 and CVE-2026-60137, to the Known Exploited Vulnerabilities Catalog based on active exploitation. Binding Operational Directive 26-04 requires Federal Civilian Executive Branch agencies to prioritize rapid remediation of KEV-listed CVEs on publicly exposed assets that grant total post-exploitation control. Government contractors, primes, subcontractors and C3PAOs now have a cleaner compliance baseline, even though CISA’s alert does not spell out the patch timeline or verification mechanics for these four entries.
JUL 21
regulator
CISA adds three Fortinet and SharePoint CVEs to KEV
BOD 26-04 turns these listings into federal patch priority, while the alert itself does not state a standalone remediation deadline.
CISA added CVE-2026-25089 and CVE-2026-39808, both Fortinet FortiSandbox OS command injection flaws, and CVE-2026-58644, a Microsoft SharePoint deserialization flaw, to the Known Exploited Vulnerabilities (KEV) Catalog. Binding Operational Directive (BOD) 26-04 requires Federal Civilian Executive Branch agencies to prioritize rapid remediation of KEV-listed CVEs on publicly exposed assets that grant total control after exploitation. Contractors and managed service providers inherit the urgency when they operate those federal environments.
JUL 16
trade-press
CISA adds exploited SonicWall SMA1000 zero-days to KEV
SMA1000 operators need to upgrade, check SonicWall’s indicators of compromise, and treat suspicious activity as a live intrusion.
SonicWall disclosed CVE-2026-15409 and CVE-2026-15410 for SMA1000 appliances Tuesday, and CISA added both to the Known Exploited Vulnerabilities catalog the same day. Rapid7 told CyberScoop exploitation began June 22 and likely aimed at ransomware. SonicWall says fewer than 5,000 SMA1000 units sit within its roughly one million monitored sensors, but also warned customers that patching alone is insufficient.
JUL 15
trade-press
ISACs weigh risk triage as AI swells CVE backlog
The feed-everything model cannot survive a vulnerability market where discovery accelerates faster than patch capacity.
Inside Cybersecurity reports that IT-ISAC, Health-ISAC and Retail and Hospitality-ISAC leaders are exploring risk-based triage for vulnerability intelligence as AI-driven discovery increases volume. The CVE program logged 48,244 records in 2025 and 35,872 in the first half of 2026. For members, the operative question is no longer whether to patch everything; it is which exposed, exploitable systems move first.
JUL 15
regulator
CISA adds CVE-2023-4346, CVE-2026-46817 to KEV catalog
BOD 26-04 makes high-risk KEV entries binding work on exposed federal assets, and contractors that run them inherit urgency.
CISA added CVE-2023-4346 in KNX Protocol and CVE-2026-46817 in Oracle E-Business Suite to the Known Exploited Vulnerabilities (KEV) Catalog after evidence of active exploitation. Federal Civilian Executive Branch agencies must prioritize high-risk KEV flaws on publicly exposed assets that grant total control after exploitation under Binding Operational Directive (BOD) 26-04. Contractors and managed service providers that administer those systems inherit the urgency, but CISA’s alert does not list specific due dates for these two CVEs.
JUL 15
regulator
CISA adds four SonicWall, AD FS, SharePoint CVEs to KEV
CISA's catalog entry matters because BOD 26-04 turns edge-device patching into a federal compliance clock.
CISA added CVE-2026-15409 and CVE-2026-15410 in SonicWall SMA1000 appliances, CVE-2026-56155 in Microsoft Active Directory Federation Services, and CVE-2026-56164 in Microsoft SharePoint Server to the Known Exploited Vulnerabilities Catalog. Federal Civilian Executive Branch agencies must prioritize rapid remediation under Binding Operational Directive 26-04 for KEV flaws on publicly exposed assets that grant total control after exploitation. Contractors, vendors, and managed service providers supporting those environments inherit the urgency, even where the CISA alert leaves the exact agency deadline unstated.
JUL 14
regulator
CISA links three SharePoint CVEs to active exploitation
This is now a coordinated SharePoint server problem, not three vulnerability tickets waiting for the next maintenance window.
CISA says CVE-2026-32201, CVE-2026-45659, and CVE-2026-56164 are being actively exploited against all supported on-premises SharePoint Server versions, enabling remote code execution, IIS machine-key theft, persistence, and malware deployment. Contractors, managed service providers, municipalities, and government operators running SharePoint Server 2016, 2019, or Subscription Edition should patch, enable AMSI in Full Mode where feasible, hunt for compromise before rotating keys, and treat positive detections as incident-response triggers.
JUL 14
regulator
CISA adds Cisco IOS CVE-2008-4128 to KEV
Federal agencies get a binding remediation priority, but CISA’s alert leaves the exact BOD 26-04 deadline unstated.
CISA added CVE-2008-4128, a Cisco IOS cross-site request forgery vulnerability, to the Known Exploited Vulnerabilities Catalog after evidence of active exploitation. Federal Civilian Executive Branch agencies must prioritize remediation under Binding Operational Directive 26-04 for qualifying publicly exposed assets. State CISOs and contractors servicing federal networks should treat the listing as a practical audit and remediation trigger.
JUL 13
regulator
CISA puts Adobe ColdFusion CVE-2026-48282 in KEV
The operational burden is asset discovery first, patching second, because KEV only matters where exposed ColdFusion can hand over control.
CISA added CVE-2026-48282, an actively exploited Adobe ColdFusion path traversal vulnerability, to the Known Exploited Vulnerabilities Catalog. Under Binding Operational Directive 26-04, Federal Civilian Executive Branch agencies must prioritize remediation for KEV-listed CVEs on publicly exposed assets that can grant total control after exploitation. Contractors supporting federal systems should expect the same urgency through prime flowdowns. CISA’s alert does not supply exploit code, detection signatures, or a specific deadline.
JUL 7
regulator
CISA adds three CVEs to KEV Catalog
For exposed federal assets, the practical question is ownership speed, because CISA’s alert does not give the deadline.
CISA added CVE-2026-48908, CVE-2026-55255 and CVE-2026-56290 to the Known Exploited Vulnerabilities Catalog based on active exploitation evidence. Federal Civilian Executive Branch agencies must prioritize rapid remediation under Binding Operational Directive 26-04 for qualifying publicly exposed assets. Contractors, primes and assessors using affected JoomShaper, Langflow or Joomlack products should treat the listing as an immediate vulnerability-management input, though CISA’s alert does not state a specific deadline.
JUL 7
trade-press
AI vulnerability surge strains CVE and KEV programs
A record every seven minutes turns vulnerability disclosure from a cataloging problem into a triage failure for downstream patch teams.
Inside Cybersecurity reports that Common Vulnerabilities and Exposures (CVE) Board and CVE Consumer Working Group members used a July 1 Institute for Security and Technology webinar to warn that the Cybersecurity and Infrastructure Security Agency (CISA)-funded CVE program cannot scale on current process. Jay Jacobs said CVE is publishing about one record every seven minutes, and Tod Beardsley said CISA’s Known Exploited Vulnerabilities (KEV) catalog is similarly exposed. Jen Ellis flagged vendor pressure to bundle multiple flaws under one identifier, which would land hardest on patch teams.
JUL 2
regulator
CISA adds SharePoint flaw CVE-2026-45659 to KEV
For federal teams, the practical instruction is simple: find exposed SharePoint, patch fast, then check whether attackers got there first.
CISA added CVE-2026-45659, a Microsoft SharePoint Server deserialization of untrusted data vulnerability, to the Known Exploited Vulnerabilities Catalog based on active exploitation. Federal Civilian Executive Branch agencies must prioritize KEV vulnerabilities under Binding Operational Directive 26-04, especially on publicly exposed assets that allow total control after exploitation. Contractors, managed service providers, and C3PAOs supporting federal systems should treat the listing as immediate remediation pressure, even though BOD 26-04 applies only to FCEB agencies.
JUL 1
regulator
CISA adds PTC Windchill/FlexPLM, Cisco flaws to KEV
For Federal Civilian Executive Branch teams, catalog status turns vulnerability triage into a Binding Operational Directive 26-04 priority call.
CISA added CVE-2026-12569, an improper input validation vulnerability in PTC Windchill and FlexPLM, and CVE-2026-20230, a Cisco server-side request forgery vulnerability, to the Known Exploited Vulnerabilities (KEV) catalog based on confirmed active exploitation. Federal Civilian Executive Branch agencies must prioritize remediation under Binding Operational Directive 26-04. State CISOs and assessors get the same exploitation signal without the same mandatory federal workflow.
JUN 25
trade-press
CISA CVE-2026-50751 directive exposes six-week intrusion gap
A six-week head start turns remediation into incident response, especially when the perimeter appliance blessed the attacker as legitimate.
CyberScoop’s Brad LaPorte says CISA’s June 21 emergency directive for CVE-2026-50751, a CVSS 9.3 Check Point Remote Access VPN authentication bypass, followed exploitation that began in early May. Federal agencies get the formal patch order; contractors running the same perimeter stack get the same incident-response problem. Check Point disclosed the bug June 8, but a Qilin affiliate had already used it against a few dozen organizations. A green patch report still leaves the May-June access window unresolved.
JUN 25
regulator
CISA adds Lantronix EDS5000, UniFi OS CVEs to KEV
Three entries hit the same UniFi OS line, which makes this a platform exposure problem for federal networks.
CISA added CVE-2025-67038 in Lantronix EDS5000 and three Ubiquiti UniFi OS flaws, CVE-2026-34908, CVE-2026-34909 and CVE-2026-34910, to the Known Exploited Vulnerabilities (KEV) Catalog. Binding Operational Directive (BOD) 26-04 requires Federal Civilian Executive Branch (FCEB) agencies to prioritize rapid remediation of high-risk KEV items on publicly exposed assets; the alert gives no item-specific deadline. Contractors, managed service providers and Cybersecurity Maturity Model Certification (CMMC) third-party assessors supporting federal environments should triage UniFi OS first.
JUN 23
trade-press
NDAA amendment would codify CISA control of CVE
A program that assigns the identifiers behind patch queues should not depend on whether one support contract survives spring cleaning.
A planned fiscal 2027 National Defense Authorization Act amendment would formally place the Common Vulnerabilities and Exposures program under the Cybersecurity and Infrastructure Security Agency, Nextgov/FCW reports. The measure would create a 15-member CVE Board and require a CISA-NIST modernization plan. Primes, agencies, assessors and security teams that build vulnerability workflows around CVE would get statutory footing for a system that MITRE’s contracting scare showed was more fragile than its ubiquity suggested.
JUN 18
trade-press
Attackers exploit two FortiSandbox flaws before CISA lists them in KEV
The risk has moved faster than the mandate, leaving Fortinet customers to triage exposed sandboxes without the federal deadline signal.
CyberScoop reports researchers saw exploitation of FortiSandbox CVE-2026-39808 and CVE-2026-39813, plus attempts against CVE-2026-25089; Fortinet has not confirmed exploitation. Fortinet disclosed and patched the first two critical flaws in April and the third on June 9; Defused counted 49 events from 11 IPs over six days. The Cybersecurity and Infrastructure Security Agency had not added the defects to the Known Exploited Vulnerabilities (KEV) catalog as of Wednesday. For a trusted sandbox appliance, absence from KEV changes the federal calendar while leaving the exposure intact.
JUN 17
regulator
CISA adds Cisco, LiteSpeed CVEs to KEV catalog
For agencies and contractors, the practical job is patching exposed systems and checking whether attackers arrived first.
The Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-20262, a Cisco Catalyst SD-WAN Manager directory/path traversal flaw, and CVE-2026-54420, a LiteSpeed cPanel plugin UNIX symlink-following flaw, to the Known Exploited Vulnerabilities (KEV) catalog based on active exploitation. Binding Operational Directive (BOD) 26-04 requires Federal Civilian Executive Branch agencies to prioritize rapid remediation on qualifying publicly exposed assets and check for prior compromise. Contractors and managed service providers are not bound, but the de facto pressure follows the KEV list. CISA did not specify whether rapid remediation means emergency patching or accelerated standard cycles.
JUN 15
regulator
CISA adds Oracle PeopleSoft CVE-2026-35273 to KEV
BOD 26-04 turns this from a catalog update into a public-facing asset triage problem with two clocks to track.
CISA added CVE-2026-35273, an Oracle PeopleSoft Enterprise PeopleTools missing-authentication vulnerability, to the Known Exploited Vulnerabilities catalog based on active exploitation. Federal Civilian Executive Branch agencies must prioritize rapid remediation under Binding Operational Directive 26-04 when KEV flaws sit on publicly exposed assets that grant total control after exploitation. Contractors and primes supporting federal systems should track that narrower regime separately; the alert does not state the CVE-specific deadline, penalties, or extension criteria.
JUN 12
regulator
CISA adds Ivanti Sentry flaw to KEV catalog
The listing turns an Ivanti patch decision into a federal priority item, with the exact remediation date left to the catalog.
CISA added CVE-2026-10520, an Ivanti Sentry OS command injection vulnerability, to the Known Exploited Vulnerabilities catalog based on evidence of active exploitation. Federal Civilian Executive Branch agencies must prioritize remediation under Binding Operational Directive 26-04 for covered publicly exposed assets. Contractors and C3PAOs supporting federal environments should verify patch status and whether pre-patch compromise checks are required.
JUN 11
trade-press
CISA ties BOD 26-04 patch deadlines to exploitability
CISA is turning attacker tempo, including automated exploitation, into the priority signal federal patch queues must reflect.
CyberScoop reports the Cybersecurity and Infrastructure Security Agency (CISA) issued Binding Operational Directive (BOD) 26-04, requiring federal agencies to rank vulnerabilities by public exposure, automated exploitability, system-control impact and active exploitation. Vulnerabilities meeting all four criteria get a three-day fix window and forensic triage. Contractors, primes and managed service providers are not directly bound, but agency customers now have 3-to-180-day timelines to meet against a reported 43-day median full-resolution time for known exploited vulnerabilities (KEVs).
JUN 10
trade-press
CISA issues BOD 24-02 for four-factor patch triage
The relief is real only if agencies can classify exposure, automation and impact faster than attackers can industrialize the exploit.
CISA issued Binding Operational Directive (BOD) 24-02, requiring federal civilian agencies to rank remediation by asset exposure, Known Exploited Vulnerabilities (KEV) status, exploit automation and technical impact, replacing BOD 22-01’s KEV-only trigger. Agencies must revise policies immediately, update processes within 60 days and finish broader asset/reporting work within 180 days. State CISOs get a benchmark rather than a mandate. The unresolved question is whether the table buys relief or turns bad risk scoring into compliance evidence.
JUN 10
regulator
CISA adds three Arista, Chrome V8, Cisco flaws to KEV
The binding clock now matters more than the alert text, because the specific remediation due dates were not included here.
CISA added CVE-2026-7473 in Arista Extensible Operating System, CVE-2026-11645 in Google Chromium V8 and CVE-2026-20245 in Cisco Catalyst SD-WAN Manager to the Known Exploited Vulnerabilities Catalog after evidence of active exploitation. Binding Operational Directive 22-01 requires Federal Civilian Executive Branch agencies to remediate KEV entries by their due dates, though this alert does not state those dates. Contractors, primes and managed service providers supporting FCEB networks should treat the catalog entry, not the press alert, as the operational source.
JUN 9
trade-press
CISA BOD shifts agencies from patch speed to risk triage
Federal patch metrics are finally meeting the asset inventory problem most dashboards have been politely avoiding.
CyberScoop reports CISA will publish a binding operational directive (BOD) Wednesday moving federal vulnerability management away from uniform patch speed and toward risk scored by asset exposure, Known Exploited Vulnerabilities (KEV) status, exploitability and criticality. Federal agencies are first in line; state CISOs and contractors supporting federal systems should expect the same vocabulary in oversight and performance conversations. The missing piece is whether the BOD gives agencies a scoring method and implementation deadlines.
JUN 9
trade-press
Researchers fault Trump AI EO on vulnerability management
A new clearinghouse does little for defenders if the real failure point is remediation speed at the network edge.
Security researchers told an IST webinar that President Trump’s June 2 artificial intelligence executive order relies on older vulnerability-management assumptions while exploit timelines compress from months or years to days, hours or minutes. The order tasks Treasury with a voluntary AI cybersecurity clearinghouse and directs the Cybersecurity and Infrastructure Security Agency to issue binding operational directives. The critique lands on a familiar asymmetry: attackers do not need a Common Vulnerabilities and Exposures record; defenders often do.
JUN 9
regulator
CISA adds LiteLLM and Check Point flaws to KEV
For federal networks, KEV placement turns active exploitation into a remediation clock, even when version scope still needs vendor confirmation.
CISA added CVE-2026-42271, a BerriAI LiteLLM command injection flaw, and CVE-2026-50751, a Check Point Security Gateway improper authentication flaw, to the Known Exploited Vulnerabilities Catalog based on active exploitation. Federal Civilian Executive Branch agencies must remediate KEV-listed vulnerabilities under Binding Operational Directive 22-01; contractors supporting federal systems should treat the entries as contract-driven patch priorities.
JUN 8
regulator
CISA adds SolarWinds Serv-U CVE-2026-28318 to KEV
For federal civilian agencies, the listing turns an exploited Serv-U flaw into a BOD 22-01 remediation clock.
CISA added CVE-2026-28318, a SolarWinds Serv-U uncontrolled resource consumption vulnerability, to the Known Exploited Vulnerabilities Catalog after evidence of active exploitation. Federal Civilian Executive Branch agencies covered by Binding Operational Directive 22-01 must remediate KEV-listed flaws by CISA’s due date. The supplied alert text does not state the deadline or whether SolarWinds had issued a patch as of publication.
JUN 5
regulator
CISA adds Mirasvit deserialization flaw to KEV Catalog
For FCEB agencies, the catalog entry turns a patch priority into a BOD 22-01 compliance deadline.
CISA added CVE-2026-45247, a Mirasvit Full Page Cache Warmer deserialization of untrusted data flaw, to the Known Exploited Vulnerabilities Catalog based on active exploitation. Binding Operational Directive 22-01 requires Federal Civilian Executive Branch agencies to remediate KEV-listed vulnerabilities by the applicable due date. Contractors and vendors supporting FCEB systems should coordinate patching, but CISA’s alert does not state a specific due date or workaround.
JUN 3
regulator
CISA adds Linux and Android flaws to KEV
For federal teams, the important fact is not novelty, but active exploitation and the BOD 22-01 remediation clock.
CISA added CVE-2022-0492, a Linux kernel improper authentication flaw, and CVE-2025-48595, an Android Framework integer overflow, to the Known Exploited Vulnerabilities Catalog based on active exploitation. Binding Operational Directive 22-01 requires Federal Civilian Executive Branch agencies to remediate KEV-listed vulnerabilities by their due dates. Contractors supporting those agencies should treat the listings as access-risk items, not ordinary backlog work.
JUN 2
regulator
CISA adds CVE-2024-21182 to KEV Catalog
For agencies, KEV is less advisory than clock: remediation is mandatory even when the public alert leaves implementation details thin.
CISA added CVE-2024-21182, an Oracle WebLogic Server unspecified vulnerability, to the Known Exploited Vulnerabilities Catalog based on active exploitation. Binding Operational Directive 22-01 requires Federal Civilian Executive Branch agencies to remediate KEV entries by CISA’s due date. Contractors and primes supporting federal systems should expect the same pressure through contract terms and access controls, though the alert does not state the specific deadline or workaround status.
JUN 1
regulator
CISA adds PAN-OS auth bypass CVE-2026-0257 to KEV Catalog
BOD 22-01 requires Federal Civilian Executive Branch agencies to remediate; the specific deadline for this CVE is not stated in the advisory.
CISA added CVE-2026-0257, a Palo Alto Networks PAN-OS authentication bypass vulnerability, to the Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. Federal Civilian Executive Branch agencies must remediate by the BOD 22-01 due date assigned to this entry; that date is not specified in the advisory. Contractors and integrators supporting FCEB systems should treat this as an inherited obligation and check the KEV Catalog directly for the deadline.
MAY 29
trade-press
NIST adds CISA SSVC data to NVD starting June 17
With full enrichment capped at 15, 20 percent of new CVEs, the exploitation-status data landing June 17 covers a fraction of what assessors actually need to triage.
NIST will surface Stakeholder-Specific Vulnerability Categorization data from CISA in the National Vulnerability Database on June 17, adding exploitation status and safety-impact signals alongside existing CVSS scores. The addition follows NIST's April 15 decision to limit full enrichment to CVEs in the Known Exploited Vulnerabilities catalog, federal software, and "critical software" under a Biden-era executive order (roughly 15) 20 percent of new CVEs. Assessors and patch managers at contractors, MSPs, and state agencies relying on NVD for remediation decisions will still face gaps on the remaining 80, 85 percent and will need external intelligence platforms to cover them.
MAY 29
regulator
CISA adds CVE-2026-48027 to KEV as Nx Console, GitHub CI/CD attacks widen
The malicious Nx Console extension v18.95.0 deployed silently via auto-update, meaning developers never had to click anything, and every secret their pipeline could touch is now exposed.
CISA added CVE-2026-48027, assigned to the poisoned Nx Console VS Code extension version 18.95.0, to the Known Exploited Vulnerabilities (KEV) Catalog and flagged two linked campaigns: the Nx-to-GitHub pivot that exfiltrated internal GitHub repositories, and "Megalodon," which injected malicious GitHub Actions workflows to harvest CI/CD secrets, cloud credentials, and tokens across public repositories. The extension spread through VS Code's automatic update mechanism, requiring no manual action from developers or pipeline agents. CISA's mandatory remediation: rotate every credential, token, API key, and cloud provider secret that any CI/CD pipeline could access, and treat any organization using Nx Console or GitHub Actions as potentially compromised until forensics say otherwise.
MAY 28
regulator
CISA adds LiteSpeed cPanel privilege escalation CVE to KEV catalog
Federal civilian agencies must patch CVE-2026-48172 by CISA's BOD 22-01 deadline; the specific due date is not published in the advisory.
CISA added CVE-2026-48172, a privilege escalation flaw in the LiteSpeed cPanel plugin, to the Known Exploited Vulnerabilities catalog based on evidence of active exploitation. Federal Civilian Executive Branch agencies must remediate by the catalog-listed due date under Binding Operational Directive 22-01. The advisory does not state the specific deadline. All organizations running LiteSpeed cPanel should treat this as priority patching regardless of BOD 22-01 applicability.
MAY 26