Threat Intel
CISA Expands KEV Catalog with Four New Exploited CVEs, Urges Rapid Patch Deployment
CISA has added four actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) list, covering SonicWall SMA1000 appliances and Microsoft AD FS and SharePoint. The update reinforces BOD 26‑04’s mandate for federal agencies to prioritize patching high‑risk flaws and encourages all organizations to adopt risk‑based remediation and submit additional KEV candidates.
In a move to tighten federal cyber defenses, the Cybersecurity and Infrastructure Security Agency (CISA) has broadened its Known Exploited Vulnerabilities (KEV) catalog by adding four CVEs that have been confirmed as actively exploited in the wild.
New KEV Additions
- CVE‑2026‑15409 – Server‑Side Request Forgery in SonicWall SMA1000 appliances.
- CVE‑2026‑15410 – Code injection flaw in SonicWall SMA1000 appliances.
- CVE‑2026‑56155 – Insufficient granularity of access control in Microsoft Active Directory Federation Services.
- CVE‑2026‑56164 – Missing authentication for a critical function in Microsoft SharePoint Server.
These vulnerabilities are particularly dangerous because they can grant attackers full control over the affected systems when left unpatched. CISA’s inclusion of these CVEs signals that they meet the agency’s criteria of “active exploitation” and “high‑risk impact.”
Implications for Federal Agencies
BOD 26‑04, “Prioritizing Security Updates Based on Risk,” requires Federal Civilian Executive Branch (FCEB) agencies to focus patching efforts on KEV-listed CVEs that expose publicly reachable assets. The directive also sets expectations for agencies to verify whether a system has been compromised before a patch is applied. While the directive is aimed at FCEB entities, CISA recommends that all organizations adopt a similar risk‑based approach and treat KEV vulnerabilities as top‑priority.
How to Keep Your Systems Safe
- Review the KEV catalog regularly and ensure your patch management process addresses listed CVEs immediately.
- Use automated scanning tools to detect unpatched SonicWall and Microsoft components.
- Verify system integrity after patching to confirm that no exploitation has occurred.
- Submit any newly discovered exploited vulnerabilities through CISA’s KEV Nomination Form, providing a CVE ID, exploitation evidence, and mitigation guidance.
“CISA will continue to add vulnerabilities that meet the active‑exploitation criteria,” said a CISA spokesperson. “We encourage organizations to stay vigilant and report potential KEV candidates.”
Related vulnerabilities
CISA Expands KEV Catalog with Four New Exploited Vulnerabilities
CISA has added four new CVEs to its Known Exploited Vulnerabilities catalog, covering critical flaws in Adobe Commerce, Microsoft Windows, and N‑central. The update highlights the agency’s push for rapid remediation of high‑risk flaws and reinforces BOD 26‑04’s prioritization rules for federal agencies.
Read briefing
CISA Expands KEV Catalog with Four Fresh Exploited Vulnerabilities
CISA has added four newly confirmed, actively exploited CVEs to its Known Exploited Vulnerabilities (KEV) list, underscoring the urgency of patching exposed assets. The additions cover a Fortinet heap overflow, a Citrix NetScaler auth bypass, a Chromium V8 out‑of‑bounds write, and a Cisco Firewall Management Center auth bypass. Federal agencies are now required to prioritize rapid remediation of these high‑risk flaws, while all organizations are urged to follow a risk‑based approach to vulnerability management.
Read briefing
CISA Expands KEV Catalog with Four Fresh Exploited Vulnerabilities
The Cybersecurity and Infrastructure Security Agency has added four new CVEs to its Known Exploited Vulnerabilities catalog, covering a critical Adobe Commerce flaw, two Microsoft Windows weaknesses, and a N‑able N‑central code injection. The update reinforces BOD 26‑04’s risk‑based patching mandate for federal agencies and urges all organizations to prioritize these high‑risk fixes and submit any other exploited CVEs for consideration.
Read briefing
CISA Expands KEV Catalog with Three New Exploited Vulnerabilities
CISA has added CVE‑2026‑42016, CVE‑2026‑42018, and CVE‑2026‑84869 to its Known Exploited Vulnerabilities catalog after confirmed active exploitation. The flaws affect JFrog Artifactory’s authorization and authentication controls and ConnectWise ScreenConnect’s privilege management, enabling attackers to gain full control of exposed assets. Federal agencies must now prioritize patching these high‑risk CVEs under BOD 26‑04, while the agency urges all organizations to adopt risk‑based remediation and report any other exploited CVEs via the KEV Nomination Form.
Read briefing