CISA's Known Exploited Vulnerabilities catalog picked up twelve new entries this week. Nine have confirmed active exploitation, and the affected products read like an inventory of the average enterprise perimeter: Citrix NetScaler, Cisco Firepower Management Center, Fortinet FortiOS, Adobe Commerce, N-able N-central, Google Chrome and Microsoft Windows.

If you only have budget for one prioritisation feed, KEV is still the best free signal available. It is not a list of theoretically dangerous bugs. It is a list of bugs someone is using right now.

The edge appliance problem, again

Three of this week's additions — NetScaler, FMC and FortiOS — are network edge devices. This is not a coincidence, and it is not new. Attackers have concentrated on this class of product for several years for a set of very practical reasons:

  • They are internet-facing by definition. No phishing required, no user interaction, no initial access broker to pay.
  • They rarely run EDR. Most are appliances with locked-down operating systems. Your detection stack has no visibility inside them.
  • They terminate credentials and sessions. A compromised VPN concentrator or management console is a credential harvesting position, not just a foothold.
  • They are patched slowly. Updating a firewall means a maintenance window, a change ticket and someone willing to own the outage risk.

That last point is the one defenders can actually change. The organisations that patch edge devices fast are the ones that treat those devices as tier-zero infrastructure with a standing emergency change path, not as network plumbing.

N-able N-central deserves separate attention

Of the twelve, the N-able N-central entry has the widest blast radius relative to its install base. N-central is a remote monitoring and management platform used heavily by managed service providers. Compromise the platform and you inherit privileged agent access to every downstream customer environment it manages.

RMM platforms are the highest-leverage target in the mid-market. One vulnerability, hundreds of victim organisations, and the malicious activity arrives through a channel every endpoint is configured to trust.

If you are an MSP, this is a same-day patch. If you are a customer of an MSP, this is a reasonable week to ask your provider — in writing — what their N-central patch status is and whether they have reviewed agent activity logs for the exposure window.

Beyond the network gear

Adobe Commerce exploitation typically means card skimming. If you run a Commerce or Magento storefront, patching is necessary but not sufficient — check for injected JavaScript in checkout templates, review admin accounts created in the last 60 days, and diff your storefront's client-side assets against a known-good build.

Google Chrome in KEV is usually a browser-exploitation chain, often paired with a sandbox escape. Chrome updates itself, but only if the browser actually restarts. In enterprise fleets, the median uptime of a Chrome process is long enough for this to matter. Force a relaunch rather than assuming the update landed.

Other notable entries this cycle

Alongside the confirmed-exploited set, several high-severity vulnerabilities are worth adding to the same triage pass:

  • CVE-2026-35273 — Oracle PeopleSoft Enterprise PeopleTools
  • CVE-2026-41940 — WebPros cPanel & WHM
  • CVE-2026-9586 — Sangoma Switchvox, SQL injection
  • CVE-2026-82329 — JFrog Artifactory
  • CVE-2026-0257 — Palo Alto Networks PAN-OS, authentication bypass

The Artifactory entry is quietly the most interesting of that group. Artifactory holds build artefacts and package caches. An attacker with write access there does not need to compromise your developers — they can poison what your build pipeline pulls and let CI do the rest.

A usable process for KEV

  1. Subscribe to the KEV feed and route it into whatever your team actually reads. An RSS feed nobody opens is not a control.
  2. Maintain a mapping from KEV product names to your asset inventory. The bottleneck in KEV response is almost never patching — it is working out whether you run the thing.
  3. Pre-authorise emergency change for the edge device class specifically. The approval delay is usually longer than the patch.
  4. After patching an edge appliance, assume it may already have been compromised: rotate credentials it held, invalidate sessions, and review configuration for unauthorised changes.

That last step gets skipped constantly. Patching a device that was exploited three weeks ago closes the door behind the attacker.