Skip to content

CISA Known Exploited Vulnerabilities (KEV)

This section captures durable, actionable guidance triggered by noteworthy additions to CISA’s Known Exploited Vulnerabilities catalog.

How to use this

  • Treat KEV entries as “move now” signals.
  • Focus on:
  • internet-exposed assets
  • identity / edge products
  • unauthenticated RCE / auth bypass classes
  • For each alert page, follow the triage → mitigation → hunt flow.

Recent additions worth prioritizing

  • 2026-10-08 KEV: legacy-exploitation backfill batch — catalog 2026.10.08, 1739 entries, tracked, no new page. CISA added five long-dated entries on 10-08: CVE-2015-5477 (ISC BIND data-processing errors — TSIG/SIG(0) auth-bypass era bug: on engagements, old BIND in authoritative/recursive paths is KEV-validated interest for cache-poisoning-adjacent recon), CVE-2016-3081 (Apache Struts /devmode command injection — the dev-mode interceptor class: exposed /devmode.action + debugbypass header shapes remain fingerprintable on unpatched legacy Java apps), CVE-2023-22894 (Strapi cleartext secrets — JWT/secrets stored in plain config DB: Strapi admin-panel engagements should treat extracted app secrets as replayable session-mint material), CVE-2021-3199 (ONLYOFFICE Docs path traversal — document-server components embedded in collaboration suites share this file-fetch surface), CVE-2015-3306 (ProFTPD access control). All are historical CVEs newly KEV-listed, meaning CISA saw current exploitation telemetry on unpatched legacy estates — durable rule restated: legacy KEV additions are recon-priority signals for EOL/dark-asset discovery, not patch-advisory noise; fingerprint these build families during perimeter recon. NetScaler CVE-2026-88779 remains newest current-era entry (10-04); CVE-2026-84411 RouterOS still not KEV'd as of 2026.10.08 — ICSA-to-KEV head-start window still open.

  • 2026-10-04 KEV: Citrix NetScaler CVE-2026-88779 (SAML-gated pre-auth overflow) — fold on the Sept 15 wave page. CISA added the CTX697174 fast-follow (catalog 2026.10.04, 1734 entries, added 10-04, due 10-07, forensic triage required) less than 24h after Citrix published it as "no in-the-wild activity yet reported." Pattern note: a KEV addition on an availability-classified (DoS-labeled) CVE with forensic-triage requirements means the real exploitation chain exceeds the label — treat SAML SP/IdP-configured Gateways (samlAction/samlIdPProfile) as actively-targeted pre-auth surface, exact-build fingerprint (14.1-73.41 / 13.1-64.28 line) as the report item. Full operator detail on the October 4 follow-up section. CVE-2026-84411 RouterOS webfig underflow still not in KEV as of 2026.10.04 — ICSA-to-KEV head-start window still open.

  • 2026-10-01 KEV: Fortinet FortiMail IBE unauthenticated arbitrary file write — promoted. CVE-2026-104286 (CVSS 9.8, exploited in the wild, added 10-01, due 10-04): path traversal (CWE-22) + NULL-byte neutralization failure (CWE-158) in FortiMail 8.0.0–8.0.1 / 7.6.0–7.6.6 / 7.4.0–7.4.8 / 7.2.0–7.2.9; the vendor workaround (config system encryption ibe → disable) names the exploited feature gate — the write handler lives behind the IBE pre-auth enrollment/decrypt surface. Promoted as FortiMail IBE unauth file-write KEV: feature-toggle-as-attack-surface-map rule, NULL-byte+traversal writer-pair sweep, and the vendor IoC set as a mail-appliance persistence-pattern reference (ld.so.preload rootkit, rogue archive account exfil channel). Second Fortinet appliance KEV this quarter after FortiSandbox — Fortinet appliance feature-handler families stay a primary pre-auth audit axis.

  • 2026-09-24→30 KEV: nine-entry perimeter/identity wave — tracked, one pattern note. CISA added (catalog 2026.09.30, 1730 entries): CVE-2026-88771 / CVE-2026-88772 (Citrix NetScaler ADC/Gateway improper input validation + memory-bounds violation, added 09-27, due 09-30 — matching the GHSA-h5xm-pf48-4c32 / GHSA-mx58-p288-86qp critical pair published 09-27; NetScaler appears in KEV again after the Sept 15 wave — perimeter rule stands: fingerprint build versions (/rns.js, redirect URL params) on every exposed Gateway and treat CI/Gateway memory-safety KEVs as pre-auth targets for reachability reporting only), CVE-2026-76504 (Cisco Catalyst SD-WAN Manager "hex encoding" vulnerability, added 09-30, due 10-03 — third SD-WAN-manager KEV this quarter after the 05-17 auth bypass and the tracked crafted-file items; on any engagement touching the SD-WAN control plane, version-fingerprint the Manager appliance and re-check the encoding/parsing surface of its data-migration/config APIs, which is where this vendor keeps landing), CVE-2026-87902 (WordPress Core remote file inclusion, added 09-25, due 09-28 — first core RFI KEV in this catalog era: for hosted/managed WP fleets the operator question is whether core patches roll automatically; for pentests, confirm core version on in-scope sites and note that template/theme include paths are KEV-validated interest), CVE-2026-65660 (Microsoft SharePoint code injection, 09-25), CVE-2026-67279 (MikroTik RouterOS improper enforcement of behavioral workflow, 09-25), CVE-2026-5430 (WSO2 multiple products path traversal, 09-24), CVE-2026-71362 (Adobe Commerce/Magento incorrect authorization, 09-24 — second Magento KEV this month after the Sept 8 template-engine RCE: storefront audit axis is authorization on APIs, not just template sinks), CVE-2026-86950 (Apple multiple products OOB write, 09-29 — presumed actively exploited zero/limited-detail; endpoint fleet note only). Technical detail landed Oct 3–4 (CTX697096 precondition config patterns + fast-follow CVE-2026-88779 SAML-gated pre-auth DoS via CTX697174/GHSA-56r3-m27m-8p62) — promoted as an October 4 follow-up section on the Sept 15 KEV wave page: per-CVE show config precondition mapping, SAML SP/IdP feature-gate fingerprint, and exact-build version evidence. Remainder tracked.

  • 2026-09-22 KEV: perimeter-vendor wave — F5 BIG-IP APM, Check Point pair, VeloCloud. CISA added four entries on 2026-09-22 (catalog 2026.09.22, 1721 entries): CVE-2026-94127 (F5 BIG-IP APM heap overflow — the APM-policy + OAuth-profile composite-config unauth RCE promoted today as its own page), CVE-2026-93616 (Check Point Multiple Products path traversal — the Management Server traversal→upload RCE still zero-detail in the GHSA, KEV listing confirms active exploitation; revisit the operator page when technical detail lands), CVE-2026-85102 (Check Point Quantum Security Gateway improper certificate validation during VPN negotiation → unauthenticated RCE, CVSS 9.8 per GHSA-3fvr-5gg9-225m, due 2026-09-25 — an IKE/TLS handshake validator that accepts untrusted certs turns every exposed gateway into a pre-auth target; perimeter-VPN audit rule: fingerprint gateway TLS behavior against its own CA chain expectations from an owned test peer, and treat cert-validation KEVs as "patch now, scan first" items), and CVE-2026-93952 (VMware Arista VeloCloud Orchestrator improper input validation — the detail-free VCO critical already tracked on the Sept 22 WP page; KEV status escalates it to active-exploitation priority for any engagement touching SD-WAN controllers: version-fingerprint VCO exposure and report reachability as the finding).

  • 2026-09-21 KEV: Zyxel GS1900 series switch CGI stack overflow (CVE-2026-7273) — tracked, no standalone page. CISA added CVE-2026-7273 on 2026-09-21 (catalog 2026.09.21, 1717 entries, due 2026-09-24, forensic-triage flag set): stack-based buffer overflow (CWE-121) in the management CGI program of Zyxel GS1900-48HPv2 firmware through 2.90(ABTQ.1)C0 (GHSA-rrv4-8jq5-8j78, published with the June 16, 2026 vendor advisory), letting a LAN-based, unauthenticated attacker reach potential OS-command execution via a crafted HTTP request. No public exploit detail, so per the Totolink/Netcore/D-Link CGI-overflow precedent this is tracked rather than turned into an operator page. Operator-relevant axes it still feeds: access-layer switch management planes are routinely unpatched and LAN-based does not mean low-value once you have any internal foothold — version-fingerprint 2.90(ABTQ.1)C0-era firmware on GS1900-class devices during internal recon, treat the switch web-CGI admin interface as an unauthenticated post-access pivot target, and sweep sibling Zyxel managed-switch lines for the same CGI surface.
  • 2026-09-18 KEV: Linux kernel trio — tracked, no operator page. CISA added CVE-2025-39964 (crypto: af_alg concurrent-write socket-state inconsistency), CVE-2026-53266 (netfilter: bridge ebt SNAT ARP sender-HW-address rewrite past a non-writable header region, OOB write), and CVE-2025-39682 (tls: rx zero-length record retrieved from rx_list bypasses recvmsg() record-type handling, so subsequent records are processed under wrong zero-copy/queuing assumptions) on 2026-09-18 (catalog 2026.09.18, 1716 entries). All are local kernel primitives with no documented public exploit path or remote attack surface; the TLS item adds parser-state-drift interest for kernels with kTLS enabled; relevant to post-exploitation planning on compromised Linux hosts (which kernel build still has a local-write primitive) rather than a standalone operator page. af_alg remains a durable container-escape/local-attack interest area; the netfilter item matters only where bridge-netfilter is loaded in the target's kernel.
  • 2026-09-08 KEV: Adobe Commerce / Magento template-engine RCE (CVE-2026-75650) — operator guidance
  • CISA added CVE-2026-75650 on 2026-09-08: Adobe Commerce / Magento Open Source "Improper Neutralization of Special Elements Used in a Template Engine" (CWE-1336) allowing arbitrary code execution in the current-user context, CVSS 10.0 (AV:N/AC:L/PR:N/UI:N/S:C), exploitation does not require user interaction, CISA SSVC active/automatable/total, forensic-triage flag set, due 2026-09-11 (BOD 26-04). Affected lines: Commerce/Magento ≤ 2.4.9-2026-aug, B2B ≤ 1.5.3-2026-aug; fixed by the vendor "Hotfix for CVE-2026-7565" (APSB26-146). Prioritize internet-exposed storefronts; the audit axis is which unauthenticated fields reach server-side template/render evaluation in core and third-party extensions, not just the core sink.
  • Same-day tracked without publication: CVE-2026-85880 (Windows ALPC heap-based buffer overflow, local privilege escalation, due 2026-09-22) and CVE-2026-81963 (Windows Update Stack link following, local privilege escalation, due 2026-09-22). Both are post-auth local-privilege-escalation primitives with no public exploit path documented; use in post-exploitation planning (which build of a compromised Windows host can still LPE) rather than as standalone operator pages.
  • 2026-09-08 KEV: N-able N-Central pre-auth RCE (CVE-2026-86218) — operator guidance
  • CISA added CVE-2026-86218 on 2026-09-08: "static code injection" (CWE-96) allowing pre-authentication remote code execution on the N-Central server, critical CVSS, forensic-triage flag set, due 2026-09-11 (BOD 26-04). Vendor fixed in 2026.3 HF4 (build 2026.3.1.14). Second N-Central KEV this quarter after the 2026-08-03 incomplete-auth-fix entry — prioritize internet-exposed N-Central instances and re-test the full auth route family on the new hotfix, not just the named entry.
  • 2026-09-05 KEV unauth RCE/admin wave — Kestra, JFrog Artifactory, Sangoma Switchvox — operator guidance
  • CISA added three actively-exploited, unauthenticated entries on 2026-09-02/04, all with forensic-triage flags and 2026-09-05 due dates: CVE-2026-49869 (Kestra OSS, CWE-78/287 — endsWith("/configs") suffix-match auth bypass → unauth workflow creation → RCE with default script plugins, fixed 1.0.45/1.3.21), CVE-2026-82329 (JFrog Artifactory, CWE-287 — default-config unauth admin), and CVE-2026-9586 (Sangoma Switchvox SMB 8.3, CWE-89 CVSSv4 9.3 — unauth /pa PhoneIP → PostgreSQL SQLi → COPY … TO PROGRAM RCE, patched 8.4.0.2, in-the-wild exploitation observed). Prioritize internet-exposed orchestration/registry/PBX assets; Chromium V8 type-confusion (CVE-2026-85046, same day) is a browser memory-safety entry with no public exploit path and is tracked, not turned into an operator page.
  • 2026-05-20 KEV legacy client and Defender batch — guidance
  • CISA added exploited legacy Microsoft/Adobe client-side RCE surfaces and Microsoft Defender endpoint boundary issues: CVE-2008-4250, CVE-2009-1537, CVE-2009-3459, CVE-2010-0249, CVE-2010-0806, CVE-2026-41091, and CVE-2026-45498.

  • Prioritize EOL removal/isolation, Defender platform health, SMB/RPC exposure reduction, and post-exploitation hunting by the 2026-06-03 due date.

  • CVE-2026-42897 — Microsoft Exchange Server OWA cross-site scripting

  • KEV-tracked Exchange web-render exposure with a CISA due date of 2026-05-29.

  • Patch or apply vendor mitigations, verify Exchange Emergency Mitigation Service health, restrict OWA exposure where possible, and hunt for suspicious OWA/session/mailbox-rule activity.

  • CVE-2026-20182 — Cisco Catalyst SD-WAN Controller authentication bypass

  • Emergency-priority SD-WAN control-plane exposure with known exploitation and a CISA due date of 2026-05-17.

  • Restrict controller/manager exposure, apply ED 26-03 mitigation and hunt guidance, and rotate controller/admin secrets after compromise assessment.

  • CVE-2026-41940 — WebPros cPanel & WHM / WP2 authentication bypass

  • Emergency-priority hosting control-panel exposure with reported exploitation.

  • Patch branch-specific fixed builds immediately and restrict WHM/cPanel management ports while validating compromise indicators.

  • CVE-2024-1708 — ConnectWise ScreenConnect path traversal

  • High-priority remote-management exposure.

  • Triage every internet-facing ScreenConnect deployment and isolate anything you cannot patch immediately.

  • CVE-2026-32202 — Microsoft Windows protection mechanism failure

  • Track where Windows shell / spoofing exposure could affect trust decisions.

  • Prioritize managed endpoints that handle sensitive auth or admin workflows.

  • CVE-2026-39987 — Marimo remote code execution

  • Treat exposed notebook services as direct code-execution paths.
  • Remove public access or isolate the service until patched.

Feed