Threat Intel
CISA Expands KEV Catalog with Two New TrueConf Server Vulnerabilities
Two new CVEs—CVE‑2026‑72529 and CVE‑2026‑72530—have been added to CISA’s Known Exploited Vulnerabilities catalog. Both target the TrueConf Server platform, one bypassing authentication and the other enabling code injection. Federal agencies must prioritize patching under BOD 26‑04, while all organizations are urged to adopt risk‑based remediation and can submit additional KEVs via CISA’s nomination form.
New KEV Additions
CISA has just added two new CVEs to its Known Exploited Vulnerabilities catalog. Both target the TrueConf Server platform and have been actively abused in the wild.
- CVE-2026-72529 – Missing authentication on a critical function, allowing attackers to take full control of the server.
- CVE-2026-72530 – Code‑injection flaw that can execute arbitrary commands on the host.
Implications for Federal Agencies
Under Binding Operational Directive 26‑04, federal civilian executive branch agencies must prioritize remediation of high‑risk KEVs on publicly exposed assets that grant total control. The new TrueConf flaws fit that bill, so patching should be a top priority.
What You Should Do
All organizations, not just federal agencies, are encouraged to adopt risk‑based vulnerability management and prioritize remediation of KEV catalog entries. If you discover an exploited vulnerability not yet listed, submit it via CISA’s KEV Nomination Form.
Related vulnerabilities
CISA Expands KEV Catalog with Two New PaperCut Exploits
CISA has added CVE‑2026‑81578 and CVE‑2026‑82078 to its Known Exploited Vulnerabilities list. Both target PaperCut NG/MF, allowing attackers to bypass authentication or exploit unsafe reflection to gain full control. Federal agencies must now prioritize patching under BOD 26‑04, while all organizations are urged to adopt risk‑based remediation and submit new KEV candidates.
Read briefing
CISA Expands KEV Catalog with Two New MikroTik RouterOS Exploits
CISA has added two actively exploited vulnerabilities that target MikroTik RouterOS to its Known Exploited Vulnerabilities (KEV) catalog. CVE‑2026‑67277 allows attackers to bypass authentication for a critical function, while CVE‑2026‑86060 lets them inject malicious commands by exploiting improper argument neutralization. The update reinforces federal guidance under BOD 26‑04 to prioritize rapid patching of high‑risk flaws on publicly exposed assets, and invites all organizations to adopt a risk‑based approach to remediation.
Read briefing
CISA Expands KEV Catalog with Four Freshly Exploited CVEs
The Cybersecurity and Infrastructure Security Agency (CISA) has broadened its Known Exploited Vulnerabilities (KEV) list by adding four CVEs that are currently being abused in the wild. The new entries target Fortinet, Citrix NetScaler, Google Chromium V8, and Cisco Firewall Management Center, all of which can grant attackers full control over exposed systems. Federal agencies are urged to prioritize patching these high‑risk flaws under BOD 26‑04, while the broader community is encouraged to adopt a risk‑based remediation strategy and submit additional exploited CVEs for consideration.
Read briefing
CISA Expands KEV Catalog with Seven Fresh Exploited Vulnerabilities
CISA has just added seven new CVEs to its Known Exploited Vulnerabilities (KEV) catalog, all confirmed to be actively exploited in the wild. The list includes SQL injection in Sangoma Switchvox, HTTP smuggling in Kludex Starlette, OS command injection in Kestra OSS, and several high‑impact flaws in BerriAI LiteLLM, JFrog Artifactory, and SonicWall SMA1000 appliances. Under BOD 26‑04, federal agencies must prioritize patching these high‑risk items on publicly exposed assets, while the broader community is urged to adopt the same risk‑based approach and submit any missing exploited CVEs for incl
Read briefing