Topic

CISA KEV: news, advisories and analysis

27 articlesUpdated 30 Oct 2026

CISA's Known Exploited Vulnerabilities (KEV) catalog lists flaws with reliable evidence of exploitation in the wild. Under Binding Operational Directive 22-01, US federal civilian agencies must remediate each entry by its due date, and most enterprise patch programmes now treat a KEV listing as the signal to move a fix to the front of the queue.

This page tracks every vulnerability we have covered that appears in the catalog: the affected product and versions, the fixed release, the remediation deadline and what is known about the campaigns using it. For a table view with severity and fix status side by side, see the CISA KEV advisory hub.

CISA KEV advisory hub: severity, KEV status and fixes in one table

Latest coverage

ThreatsCloud & SaaSBreaking
Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Vulnerability Exploited in Wild Attacks
CVE-2026-76418 in Cisco Secure Firewall ASA Software and Cisco Secure FTD Software (Security Vulnerability) allows remote attackers to trigger active syste
CST Editorial Desk30 Oct 202610 min read
ThreatsCloud & SaaSBreaking
Broadcom VMware ESX Vulnerability Exploited in Wild Attacks
CVE-2026-41709 in Broadcom VMware ESX (Security Vulnerability) allows remote attackers to trigger active system exploitation. Patch: Vendor security patch
CST Editorial Desk29 Oct 202610 min read
ThreatsCloud & SaaSCritical
Google Brotli Vulnerability Exploited in Wild Attacks
CVE-2026-111497 in Google Brotli (Security Vulnerability) allows remote attackers to trigger active system exploitation. Patch: Version 1.2.0.
CST Editorial Desk28 Oct 202610 min read
ThreatsCloud & SaaSCritical
Adobe Commerce and Magento Unrestricted File Upload Flaw Exploited in Wild Attacks
CVE-2026-48356 in Adobe Commerce and Magento (Unrestricted File Upload) allows remote attackers to trigger active system exploitation. Patch: Vendor securi
CST Editorial Desk28 Oct 202610 min read
ThreatsCloud & SaaSCritical
Collabora Online – Built-in CODE Server OS Command Injection Flaw Exploited in Wild Attacks
CVE-2026-110447 in Collabora Online – Built-in CODE Server (OS Command Injection) allows remote attackers to trigger active system exploitation. Patch: Ver
CST Editorial Desk24 Oct 202610 min read
ThreatsCloud & SaaS
Siemens Software Center Vulnerability Exploited in Wild Attacks
CVE-2026-110936 in Siemens Software Center (Security Vulnerability) allows remote attackers to trigger active system exploitation. Patch: Vendor security p
CST Editorial Desk21 Oct 202610 min read
ThreatsCloud & SaaS
Plex Media Server Server-Side Request Forgery Flaw Exploited in Wild Attacks
CVE-2026-96655 in Plex Media Server (Server-Side Request Forgery) allows remote attackers to trigger active system exploitation. Patch: Version 1.43.3.1086
CST Editorial Desk21 Oct 202610 min read
ThreatsCloud & SaaSCritical
Plex Media Server Input Validation Flaw Exploited in Wild Attacks
CVE-2026-96654 in Plex Media Server (Input Validation) allows remote attackers to trigger active system exploitation. Patch: Vendor security patch release.
CST Editorial Desk21 Oct 202610 min read
ThreatsCloud & SaaSHigh
EG Secure Solutions SiteGuard Server Edition OS Command Injection Flaw Exploited in Wild Attacks
CVE-2026-106931 in EG Secure Solutions SiteGuard Server Edition (OS Command Injection) allows remote attackers to trigger active system exploitation. Patch
CST Editorial Desk21 Oct 202610 min read
ThreatsCloud & SaaSHigh
Plex Media Server Vulnerability Exploited in Wild Attacks
CVE-2026-96656 in Plex Media Server (Security Vulnerability) allows remote attackers to trigger active system exploitation. Patch: Version 1.43.3.10861 and
CST Editorial Desk21 Oct 202610 min read
ThreatsCloud & SaaSHigh
Palo Alto Networks PAN-OS Management Interface RCE Exploited in Attacks
A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated attacker with…
CST Editorial Desk16 Oct 20267 min read
ThreatsCloud & SaaS
AhsayCBS Authentication Bypass Exploited Against Backup Servers
A vulnerability was detected in Ahsay AhsayCBS up to 10.3.2.
CST Editorial Desk16 Oct 20267 min read
ThreatsCloud & SaaSCritical
Atlassian Data Center Flaw Spanning Jira, Confluence and Bitbucket Exploited
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data…
CST Editorial Desk16 Oct 20267 min read
ThreatsCloud & SaaSCritical
Cisco Secure Email Gateway AMP Flaw Exploited for Unauthenticated File Writes
A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write…
CST Editorial Desk15 Oct 20267 min read
ThreatsCloud & SaaSCritical
AhsayCBS Backup Server Command Injection Exploited in Attacks
A flaw has been found in Ahsay AhsayCBS up to 10.3.2.
CST Editorial Desk15 Oct 20267 min read
ThreatsCloud & SaaSCritical
ProFTPD mod_copy Flaw Weaponized to Copy Server Files and Execute Code
ProFTPD resolves a critical access control flaw in mod_copy (CVE-2015-3306) where unauthenticated attackers copy arbitrary server files and execute remote code.
CST Editorial Desk14 Oct 20268 min read
ThreatsCloud & SaaSCritical
ISC BIND 9 TKEY Flaw Exploited to Crash Authoritative DNS Servers
ISC resolves a critical assertion failure defect in BIND 9 nameservers (CVE-2015-5477) where a single malformed TKEY query crashes DNS daemons remotely.
CST Editorial Desk13 Oct 20268 min read
ThreatsCloud & SaaSCritical
Apache Struts 2 Dynamic Method Invocation Flaw Weaponized for Remote Code Execution
Apache Struts resolves critical vulnerability S2-032 (CVE-2016-3081) where dynamic method invocation enables arbitrary remote command execution via OGNL payloads.
CST Editorial Desk13 Oct 20269 min read
ThreatsCloud & SaaSCritical
Zammad Helpdesk Exploit Chain Pairs Session Fixation With Root Escalation for Takeover
Attackers are weaponizing an exploit chain in Zammad helpdesk combining session fixation (CVE-2026-102489) with root privilege escalation (CVE-2026-102490).
Daniel Okafor5 Oct 20268 min read
ThreatsCloud & SaaSCritical
Cisco Catalyst SD-WAN Manager Hex Encoding Flaw Exploited to Hijack Enterprise Routing (CVE-2026-76504)
A critical URL hex-encoding vulnerability in Cisco Catalyst SD-WAN Manager allows unauthenticated remote attackers to bypass authentication and hijack fabrics.
CST Editorial Desk29 Sep 20269 min read
ThreatsCloud & SaaS
MikroTik RouterOS SSH Rekey Flaw Weaponized in MikroTrick Chain to Hijack Routers
Threat actors weaponize MikroTik RouterOS flaw CVE-2026-67279 in the "MikroTrick" chain, bypassing SSH authentication to hijack core routing infrastructure.
Daniel Okafor26 Sep 202618 min read
ThreatsCloud & SaaSCritical
Adobe Commerce and Magento Authorization Flaw Exploited to Hijack Checkout Workflows
Adobe and CISA warn of active exploitation targeting CVE-2026-71362 in Adobe Commerce and Magento, enabling unauthenticated manipulation of checkout orders and customer data.
Daniel Okafor25 Sep 202617 min read
ThreatsCloud & SaaSCritical
Check Point Security Management Server Path Traversal Exploited to Gain Root Access
Check Point and CISA confirm active in-the-wild exploitation of CVSS 9.8 flaw CVE-2026-93616 allowing unauthenticated attackers to write arbitrary files as root.
CST Editorial Desk23 Sep 202616 min read
ThreatsCloud & SaaSCritical
Arista VeloCloud Orchestrator Zero-Day Exploited to Hijack SD-WAN Edge Gateways
Arista confirms active in-the-wild exploitation of CVSS 10.0 CVE-2026-93952, allowing unauthenticated attackers to hijack on-prem VeloCloud Orchestrators.
CST Editorial Desk23 Sep 202617 min read