60
60
60
45
60
60
60
60
U.S. CISA adds Ivanti CSA and Fortinet bugs to its Known Exploited Vulnerabilities catalog
60
U.S. CISA adds Dahua IP Camera, Linux Kernel and Microsoft Exchange Server bugs to its Known Exploited Vulnerabilities catalog
60
57
60
60
60
60
U.S. CISA adds SonicWall and Microsoft flaws to its Known Exploited Vulnerabilities catalog
60
U.S. CISA adds Adobe, Fortinet, Microsoft Windows, Microsoft Exchange Server flaws to its Known Exploited Vulnerabilities catalog
60
U.S. CISA adds Apple, Laravel Livewire and Craft CMS flaws to its Known Exploited Vulnerabilities catalog
60
U.S. CISA adds SolarWinds Web Help Desk, Sangoma FreePBX, and GitLab flaws to its Known Exploited Vulnerabilities catalog
60
U.S. CISA adds Cisco, SonicWall, and ASUS flaws to its Known Exploited Vulnerabilities catalog
60
60
U.S. CISA adds Oracle, Windows, Kentico, Apple flaws to its Known Exploited Vulnerabilities catalog
60
U.S. CISA adds Ivanti EPMM, MDaemon Email Server, Srimax Output Messenger, Zimbra Collaboration, and ZKTeco BioTime flaws to its Known Exploited Vulnerabilities catalog
60
60
60
60
60
U.S. CISA adds Microsoft Windows, Zyxel device flaws to its Known Exploited Vulnerabilities catalog
60
60
60
U.S. CISA adds Microsoft Windows and Rejetto HTTP File Server bugs to its Known Exploited Vulnerabilities catalog
60
CISA adds 10 flaws to its Known Exploited Vulnerabilities Catalog
60
60
60
CISA Adds Four Known Exploited Vulnerabilities to Catalog
CISA added four actively exploited vulnerabilities—Fortinet buffer overflow, Citrix NetScaler and Cisco auth bypasses, and a Chromium V8 write—to the KEV Catalog.
CISA added CVE-2025-25249 (Fortinet heap-based buffer overflow), CVE-2026-19490 (Citrix NetScaler authentication bypass), CVE-2026-87491 (Google Chromium V8 out-of-bounds write), and CVE-2026-20079 (Cisco Firewall Management Center authentication bypass) to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. Under Binding Operational Directive 26-04, Federal Civilian Executive Branch agencies must prioritize rapid remediation of these high-risk vulnerabilities on exposed assets and verify whether systems were compromised before patching. CISA encourages all organizations to adopt risk-based vulnerability management and prioritize KEV Catalog remediation.
75
CISA Adds Four Known Exploited Vulnerabilities to Catalog
CISA added four actively exploited vulnerabilities to its KEV catalog, covering Adobe Commerce/Magento, Microsoft Windows, and N-able N-central.
CISA added CVE-2026-75650 (Adobe Commerce and Magento, improper neutralization in a template engine), CVE-2026-81963 (Microsoft Windows link following), CVE-2026-85880 (Microsoft Windows heap-based buffer overflow), and CVE-2026-86218 (N-able N-central static code injection) to the Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. Under Binding Operational Directive 26-04, federal civilian agencies must prioritize rapid remediation of KEV-listed vulnerabilities on exposed assets that grant total control post-exploitation and check for pre-patch compromise. All organizations are encouraged to prioritize these flaws in risk-based patching.
72
CVE-2026-81578 + CVE-2026-82078 | PaperCut NG/MF Authentication Bypass and Unsafe Dynamic Class Loading Vulnerabilities
Two chained PaperCut NG/MF flaws, CVE-2026-81578 and CVE-2026-82078, enable pre-auth RCE, with active exploitation confirmed in customer environments.
PaperCut NG/MF is affected by CVE-2026-81578, an improper access control flaw (CVSS 4.0 8.8) allowing unauthenticated configuration changes, and CVE-2026-82078, an unsafe dynamic class loading flaw (CVSS 4.0 9.4) enabling arbitrary Java bytecode execution. Chained, they yield pre-authentication remote code execution on the PaperCut Application Server. PaperCut confirmed active exploitation and customer incidents, and Huntress observed exploitation starting August 26, 2026. Emergency Patch Release 2 is available for NG/MF v24-v26, with IOCs including suspicious pc-app.exe child processes, truncated server.log files, and AnyDesk installs.
88
U.S. CISA adds Red Hat, Linux Kernel, Ajax.NET Professional, Microsoft SQL Server, and Citrix NetScaler flaws to its Known Exploited Vulnerabilities catalog
CISA added six flaws, including actively exploited CVE-2026-8452 in Citrix NetScaler, to its Known Exploited Vulnerabilities catalog with federal patch deadlines.
CISA added six vulnerabilities to its KEV catalog: CVE-2015-3246 and CVE-2015-5287 (Red Hat libuser race condition and ABRT privilege escalation), CVE-2019-1068 (Microsoft SQL Server RCE), CVE-2021-23758 (Ajax.NET Professional deserialization), CVE-2022-0995 (Linux Kernel out-of-bounds write) and CVE-2026-8452 (Citrix NetScaler ADC/Gateway memory buffer flaw). CVE-2026-8452 has been observed under active exploitation in the wild and can cause denial-of-service. Under BOD 22-01, federal civilian agencies must patch CVE-2019-1068 and CVE-2026-8452 by August 29, 2026, and the rest by September 9, 2026.
68
60
U.S. CISA adds Ubiquiti UniFi OS and Lantronix EDS5000 plugin flaws to its Known Exploited Vulnerabilities catalog
60