Threat Intel
CISA Expands KEV Catalog with Four Fresh Exploited Vulnerabilities
CISA has added four newly confirmed, actively exploited CVEs to its Known Exploited Vulnerabilities (KEV) list, underscoring the urgency of patching exposed assets. The additions cover a Fortinet heap overflow, a Citrix NetScaler auth bypass, a Chromium V8 out‑of‑bounds write, and a Cisco Firewall Management Center auth bypass. Federal agencies are now required to prioritize rapid remediation of these high‑risk flaws, while all organizations are urged to follow a risk‑based approach to vulnerability management.
In a swift update to its KEV catalog, the Cybersecurity and Infrastructure Security Agency (CISA) has announced four new CVEs that are currently being exploited in the wild. These vulnerabilities span a range of high‑profile platforms and pose a direct threat to any exposed systems.
New KEV Additions
- CVE‑2025‑25249 – Heap‑based buffer overflow in multiple Fortinet products.
- CVE‑2026‑19490 – Authentication bypass in Citrix NetScaler via an alternate path or channel.
- CVE‑2026‑87491 – Out‑of‑bounds write in Google Chromium’s V8 engine.
- CVE‑2026‑20079 – Authentication bypass in Cisco Firewall Management Center through an alternate path or channel.
These flaws are not just theoretical; attackers are actively exploiting them to gain full control over vulnerable systems. The inclusion of these CVEs in the KEV catalog signals that they meet CISA’s strict criteria: evidence of active exploitation, a publicly available CVE ID, and clear mitigation guidance.
BOD 26‑04: Federal Prioritization Rules
Under Binding Operational Directive 26‑04, Federal Civilian Executive Branch agencies must prioritize patching of KEV‑listed vulnerabilities on publicly exposed assets that could grant an attacker total control. The directive also mandates that agencies verify whether a system has already been compromised before applying a patch.
While BOD 26‑04 applies only to FCEB agencies, CISA strongly encourages all organizations—public and private—to adopt a risk‑based approach and focus remediation on KEV catalog entries.
What to Do Next
- Check your inventory for any of the four new CVEs and apply the vendor‑provided patches immediately.
- Validate that no compromise has occurred prior to patch deployment.
- If you encounter an exploited vulnerability not yet in the KEV catalog, submit it via CISA’s KEV Nomination Form.
By staying on top of these newly catalogued threats, organizations can reduce the window of exposure and protect critical assets from active exploitation.
Related vulnerabilities
CISA Expands KEV Catalog with Four New Exploited Vulnerabilities
CISA has added four new CVEs to its Known Exploited Vulnerabilities catalog, covering critical flaws in Adobe Commerce, Microsoft Windows, and N‑central. The update highlights the agency’s push for rapid remediation of high‑risk flaws and reinforces BOD 26‑04’s prioritization rules for federal agencies.
Read briefing
CISA Expands KEV Catalog with Four Freshly Exploited CVEs
The Cybersecurity and Infrastructure Security Agency (CISA) has broadened its Known Exploited Vulnerabilities (KEV) list by adding four CVEs that are currently being abused in the wild. The new entries target Fortinet, Citrix NetScaler, Google Chromium V8, and Cisco Firewall Management Center, all of which can grant attackers full control over exposed systems. Federal agencies are urged to prioritize patching these high‑risk flaws under BOD 26‑04, while the broader community is encouraged to adopt a risk‑based remediation strategy and submit additional exploited CVEs for consideration.
Read briefing
CISA Expands KEV Catalog with Four New Exploited CVEs, Urges Rapid Patch Deployment
CISA has added four actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) list, covering SonicWall SMA1000 appliances and Microsoft AD FS and SharePoint. The update reinforces BOD 26‑04’s mandate for federal agencies to prioritize patching high‑risk flaws and encourages all organizations to adopt risk‑based remediation and submit additional KEV candidates.
Read briefing
CISA Expands KEV Catalog with Seven Fresh Exploited Vulnerabilities
CISA has just added seven new CVEs to its Known Exploited Vulnerabilities (KEV) catalog, all confirmed to be actively exploited in the wild. The list includes SQL injection in Sangoma Switchvox, HTTP smuggling in Kludex Starlette, OS command injection in Kestra OSS, and several high‑impact flaws in BerriAI LiteLLM, JFrog Artifactory, and SonicWall SMA1000 appliances. Under BOD 26‑04, federal agencies must prioritize patching these high‑risk items on publicly exposed assets, while the broader community is urged to adopt the same risk‑based approach and submit any missing exploited CVEs for incl
Read briefing