Cisa-Kev

vulnerabilities 2026-11-13
Barracuda ESG CVE-2026-116606 + CVE-2026-111560: Pre-Auth Root Chain Now Exploited, CISA KEV Deadline Today
Barracuda confirms exploitation of an ESG authorization bypass chained with a root command injection; CISA added both to KEV with a November 13 federal deadline.
active-exploitation cisa-kev authentication-bypass command-injection network-appliance email-security
vulnerabilities 2026-11-11
Cisco BroadWorks CVE-2026-20320 XXE Added to KEV After Jailbroken AI Agent Used It to Breach a European Telco
CISA lists Cisco BroadWorks CVE-2026-20320, a blind XXE in the OCI XML parser, as exploited after Malbear Labs tied it to an autonomous AI-driven intrusion at a European telecom provider.
active-exploitation cisa-kev cisco telecom ai-agents
vulnerabilities 2026-11-07
CVE-2026-19868: SonicWall SonicOS SSL-VPN SAML Bypass Exploited in the Wild, CISA Deadline November 20
SonicWall patched an actively exploited SonicOS SSL-VPN flaw that lets attackers with valid credentials sidestep SAML-enforced MFA; CISA added it to KEV on November 6.
active-exploitation cisa-kev authentication-bypass vpn network-appliance sonicwall
vulnerabilities 2026-11-05 Critical
Zyxel GS1900 Zero-Day CVE-2026-107441 Bypassed the CVE-2026-7273 Patch and Hit Nearly 1,000 Switches
Binarly found that attacks on ~1,000 Zyxel GS1900 switches used a separate CGI out-of-bounds write, CVE-2026-107441, that defeats the earlier CVE-2026-7273 fix; Zyxel's new firmware is out.
zero-day active-exploitation network-appliance cisa-kev rce memory-corruption
vulnerabilities 2026-11-04
WordPress Core CVE-2026-119977: Upgrade-Window Race Condition Gives Unauthenticated RCE, Added to CISA KEV
CISA added WordPress Core's CVE-2026-119977, a TOCTOU race in the full-package upgrade process affecting 4.7 through 7.1.3, to KEV on November 3; federal agencies must patch to 7.1.4 by November 6.
active-exploitation cisa-kev rce cms wordpress
vulnerabilities 2026-11-03 High
Ivanti Connect Secure CVE-2026-111357 and CVE-2026-118527: The Missing Privilege Escalation Zero-Days in the UTA0576 Root Chain Are Patched
Ivanti has patched the two remaining Connect Secure zero-days that UTA0576 chained with the CVE-2026-104935 auth bypass to reach root; both are in CISA KEV.
ivanti vpn zero-day privilege-escalation network-appliance active-exploitation cisa-kev
vulnerabilities 2026-10-25
SiteGuard WAF CVE-2026-106931: Exploited Command Injection Gives Root/SYSTEM, and Patching Can Erase the Evidence
EG Secure Solutions' SiteGuard Server Edition WAF has an exploited OS command injection in its default-on statistics feature; CISA added it to KEV and the vendor says to save diagnostics before patching.
active-exploitation cisa-kev command-injection waf network-appliance rce
vulnerabilities 2026-10-24
CVE-2026-114625: Arista VeloCloud Orchestrator SQL Injection Exploited in the Wild, Third VCO Zero-Day in Four Months
CISA added Arista VeloCloud Orchestrator SQL injection CVE-2026-114625 (CVSS 9.9) to KEV; any authenticated user can escalate to operator-level superuser on on-prem deployments.
zero-day active-exploitation cisa-kev network-appliance privilege-escalation sd-wan
deep-dives 2026-10-18
Patching Is Not Eviction: What Ivanti, BeyondTrust, and NetScaler Teach Us About Post-Patch Compromise
Three edge-appliance zero-days in six weeks, three different persistence models, and one shared lesson: the patch closes the door but doesn't remove whoever is already inside. A practical playbook for compromise assessment after you upgrade.
network-appliance zero-day incident-response detection-engineering cisa-kev infrastructure-hardening
vulnerabilities 2026-10-16 Critical
BeyondTrust Remote Support CVE-2026-102764: Unauthenticated File-Operation Zero-Day Exploited by China-Linked Armory Castle
A CVSS 4.0 9.3 unauthenticated flaw in self-hosted BeyondTrust Remote Support has been exploited since late August by a China-linked cluster Google tracks as Armory Castle; patch BT26-05-RS and assume compromise on exposed appliances.
zero-day active-exploitation cisa-kev remote-access apt network-appliance
vulnerabilities 2026-10-16
October Patch Tuesday Hits a Record ~1,400 CVEs; Windows Shell Mark-of-the-Web Zero-Day Exploited
Microsoft's largest Patch Tuesday yet fixes roughly 1,400 CVEs, including an actively exploited Windows Shell Mark-of-the-Web bypass and two publicly disclosed .NET-related zero-days.
microsoft patch-tuesday zero-day active-exploitation cisa-kev windows
vulnerabilities 2026-10-15
Cisco Secure Email Gateway CVE-2026-76519: Unauthenticated Root File Write via AMP Exploited in the Wild
Cisco confirms in-the-wild exploitation of CVE-2026-76519, a CVSS 9.8 path traversal in Secure Email Gateway's AMP File Reputation that lets unauthenticated attackers write files and run commands as root.
active-exploitation cisa-kev rce path-traversal network-appliance email-security cisco
vulnerabilities 2026-10-15
Palo Alto PAN-OS CVE-2026-0322: Management Interface Code Injection Gives Root on Firewalls, Exploited as Zero-Day
Palo Alto Networks patched CVE-2026-0322, a code injection flaw in the PAN-OS management interface that lets an authenticated attacker run code as root; limited exploitation observed and CISA has added it to KEV.
palo-alto pan-os zero-day active-exploitation cisa-kev rce network-appliance
vulnerabilities 2026-10-14 High
Ivanti Connect Secure CVE-2026-104935: Auth-Bypass Zero-Day Chained to Root by UTA0576, Added to CISA KEV
Ivanti patched an authentication-bypass-by-spoofing zero-day in Connect Secure that Volexity saw chained with a still-unpatched privilege escalation for root access. CISA added it to KEV with an October 16 deadline.
ivanti vpn zero-day authentication-bypass network-appliance active-exploitation cisa-kev
vulnerabilities 2026-10-05
CVE-2026-88779: NetScaler SAML Memory Overflow Zero-Day Crashes Auth, Hits Freshly Patched Appliances
Citrix confirms exploitation of a NetScaler ADC/Gateway SAML memory overflow (CVSS 8.7) that crashes authentication services; honeypot data suggests appliances patched for the previous batch are also being hit.
active-exploitation cisa-kev zero-day network-appliance authentication-bypass vpn
vulnerabilities 2026-10-04
Zammad CVE-2026-102489 and CVE-2026-102490: Session Hijack to Root Chain Exploited in DIVD Breach
Two Zammad zero-days chain a session hijack into RCE and local root; DIVD says an autonomous AI agent used them to breach its network, CISA added both to KEV, and the root flaw reportedly has no patch.
zero-day active-exploitation cisa-kev rce privilege-escalation authentication-bypass
vulnerabilities 2026-10-01
FortiMail CVE-2026-104286: Unauthenticated Path Traversal Exploited as Zero-Day
Fortinet confirms in-the-wild exploitation of CVE-2026-104286, a CVSS 9.8 path traversal in FortiMail that lets unauthenticated attackers write arbitrary files. Patches are not yet released; CISA set a October 4 deadline.
fortinet zero-day active-exploitation cisa-kev rce network-appliance
vulnerabilities 2026-09-30
Cisco Catalyst SD-WAN Manager CVE-2026-76504: Unauthenticated Admin API Access Exploited
Cisco confirms in-the-wild exploitation of CVE-2026-76504, a CVSS 9.8 URL-encoding auth bypass that hands unauthenticated attackers admin API access on Catalyst SD-WAN Manager. No workaround; CISA added it to KEV.
cisco sd-wan zero-day active-exploitation cisa-kev authentication-bypass network-appliance
vulnerabilities 2026-09-27
CVE-2026-88771 & CVE-2026-88772: Unauthenticated RCE Zero-Days Hit Every NetScaler Deployment
Citrix confirms two NetScaler ADC/Gateway zero-days under active exploitation — one an unauthenticated command-execution bug present in every default configuration, the other a DTLS memory overflow enabled by default on VPN virtual servers.
active-exploitation cisa-kev network-appliance rce vpn zero-day
vulnerabilities 2026-09-26
CISA Adds SharePoint CVE-2026-65660 to KEV: SafeControls Bypass Enables Authenticated RCE
CISA confirmed active exploitation of CVE-2026-65660, a SharePoint code-injection bug that bypasses the SafeControls allowlist, letting a low-privilege authenticated user register arbitrary .NET classes and run code as the farm service account.
active-exploitation cisa-kev rce microsoft privilege-escalation