CISA Known Exploited Vulnerabilities Catalog
cisa-kev · A · active
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
Authoritative for actively-exploited vulns with federal remediation deadlines. WebFetch is reliably HTTP 403 on this host (transport-side block on the routine UA, ongoing since 2026-05-06; re-confirmed 2026-05-08). REQUIRED FETCH METHOD for both main agent AND every sub-agent: `python3 tools/fetch_source.py cisa-kev` returns the full KEV JSON catalog. Do NOT call WebFetch on cisa.gov; treat the 403 as a transport block, it never demotes the source. | 2026-06-20 full audit (v2.62): live=Y, drill=Y. FETCH → api: python3 tools/fetch_source.py cisa-kev (full KEV JSON catalog, each entry is a drillable CVE record). AVOID: Do NOT WebFetch cisa.gov, reliably 403s the routine UA. The api subcommand is the only supported path.. | 2026-07-05 admiralty audit: A (primary-authority), CISA KEV, authoritative exploited-vuln catalog; api fetch clean and current. Status stays active. | 2026-08-19: KEV JSON feed carried catalogue version 2026.08.18 and the four 2026-08-18 additions; the feed path works when every cisa.gov HTML path 403s. | 2026-09-30 (v4.18): KEV stays on `cisa-kev`, which reads in-container with no reader. CLAUDE.md now allows WebFetch on cisa.gov pages that have no structured recipe (news, alerts, directives), so the older 'Do NOT call WebFetch on cisa.gov' line applies to the KEV feed only. (2026-09-30T0634Z-audit)
Cited in 152 entries
Citation cadence
Citation days per ISO week (27 weeks of coverage span, total 91).
- Sekoia: an APT29-linked watering hole serves n-day iOS and Android exploit chains through compromised sites, clone domains and a one-week compromise of the Plerdy tracker; CISA lists the Apple WebKit pointer-authentication bypass CVE-2024-27834 as exploited on 2026-11-042026-11-05
- CVE-2026-109618 / CVE-2026-109619, Xerox AltaLink, EC81xx, VersaLink and WorkCentre printers and Fiery print controllers: Xerox lists them as affected by the PHP2Shell flaws, with fixes expected on 2026-11-06 and Fiery patches between 2026-11-09 and 2026-11-232026-11-02
- CVE-2026-84295, Progress WS_FTP Server: an unauthenticated remote authentication flaw can expose administrative credentials (CVSS 10.0), with two more unauthenticated flaws, fixed in 2025.0.4 and 2024.0.7; no exploitation found2026-10-31
- CVE-2026-109618 / CVE-2026-109619, Broadcom Symantec Endpoint Protection Manager, Carbon Black App Control Server, CloudSOC SpanVA and Content Analysis and Malware Analysis: PHP2Shell reaches the endpoint-security management servers; App Control Server 8.12.2 and 8.13.2 are the fixes Broadcom names2026-10-31
- WordPress core 4.7 to 7.1.3: an unauthenticated race in the core update process can lead to remote code execution, fixed in 7.1.4 and backported to every supported branch, listed by CISA as exploited; Wordfence assigned CVE-2026-1199772026-10-30
- CVE-2026-76418, Cisco Secure Firewall ASA and Secure FTD: a crafted request to the remote access SSL VPN reloads the device when a tunnel group uses secondary authentication; Cisco reports active exploitation and CISA lists it (CVSS 3.1 8.6)2026-10-30
- CVE-2026-109618 / CVE-2026-109619, PHP2Shell in management servers and storage: Trend Micro Apex Central and Apex One server have no released fix, with patches expected on 2026-11-11, Quest KACE SMA and SDA have fixes and should block ports 80, 443 and 52230 until patched, and NetApp ONTAP 9 is affected by CVE-2026-109618 only, inside the PHP jail2026-10-29
- MDaemon mail server below 26.0.4 and Windows ClamAV 0.101.0 to 1.5.3: a crafted RAR emailed to any address runs code on the server through the bundled UnRAR flaw CVE-2025-8088, and ESET saw Russia-aligned attackers use it in Ukraine to deploy the HELLAGE and HELLTAG backdoors2026-10-29
- KeyDrift: Talos reports UAT-11473 exploiting CVE-2026-20127 in Cisco Catalyst SD-WAN controllers to run an implant inside the control-plane daemon that collects data-plane keys, with infrastructure overlapping Volt Typhoon's Silent Train network2026-10-29
- CVE-2026-109618 / CVE-2026-109619, F5 BIG-IP: the PHP2Shell flaws reach the Configuration utility of every module and the APM and SSL Orchestrator access profiles on 17.1.0 to 17.1.3, 17.5.0 to 17.5.1 and 21.1.0, and F5's cumulative critical releases 17.1.3.7, 17.5.1.11 and 21.1.0.4 carry the fix2026-10-29
- CVE-2026-109618 / CVE-2026-109619, Check Point Force, Spark and Cloud firewalls: the PHP2Shell flaws reach the web interfaces of gateways that run Mobile Access, SSL Network Extender, SAML-realm VPN, the Identity Awareness captive portal, UserCheck or Zero Phishing; hotfixes since 2026-10-23, the R81.20 package reissued on 2026-10-28 (CVSS 9.2)2026-10-29
- CVE-2026-109618 / CVE-2026-109619, HPE Networking ClearPass Policy Manager: bulletin HPESBNW05171 lists the 6.14, 6.12 and 6.11 trains as affected by the PHP2Shell flaws and names a hotfix patch for each (CVSS 3.1 9.8)2026-10-28
- CVE-2026-48356 (PolyShell), Adobe Commerce and Magento Open Source: an unauthenticated file upload attacked since March 2026, fixed for supported lines in July, and listed by CISA as exploited on 2026-10-272026-10-28
- CVE-2026-109618 / CVE-2026-109619, Cisco Expressway, Ultra-Reliable Wireless Backhaul, Duo Access Gateway and ISE Portal Builder: Cisco's final PHP2Shell advisory names Expressway 15.5.21 and Duo Access Gateway 3.2.0 as the fixes and knows of no malicious use against its products2026-10-28
- CVE-2026-109618 / CVE-2026-109619, PHP2Shell in industrial, building and network-access products: Belden NetModule NRSW is fixed in 5.0.0.105 and macmon 6.x must move to 7.x, with notices from Schneider Electric, B&R, HMS Networks, Wibu-Systems, Johnson Controls and Oracle2026-10-27
- Camping.Care booking system (TCS Camping): customer and booking data stolen in connection with the PHP flaws, with real reservation numbers already used in WhatsApp fraud and 15,000 guests warned as a precaution2026-10-27
- CVE-2026-111497 / CVE-2026-70197, Microsoft .NET: an out-of-band release fixes a Brotli decoder flaw and delivers the Windows sockets fix that the 13 October update did not contain, in 8.0.33, 9.0.22 and 10.0.14 (CVSS 3.1 8.1)2026-10-26
- CVE-2026-109618 / CVE-2026-109619, QNAP QTS, QuTS hero and QuTScloud: the PHP2Shell flaws reach the NAS web components before authentication; fixed builds of 2026-10-23, QVR Surveillance, TVR OS and Notes Station 3 now fixed, QNE (ADRA) still unfixed2026-10-25
- CVE-2026-111497, Node.js and Google Brotli (Node2Shell): an out-of-bounds write in the Brotli decoder lets crafted compressed data run code, reached through fetch() and Express 5 or body-parser 2 request bodies; fixed in Node.js 22.23.4, 24.22.1 and 26.12.1 and in the PyPI packages Brotli 1.2.1 and brotlicffi 1.2.1.0 (CVSS 4.0 9.2)2026-10-24
- CVE-2026-109618 / CVE-2026-109619, NetScaler ADC and Gateway: the PHP2Shell flaws reach the management GUI on the NSIP, management-enabled SNIPs and the cluster IP of every supported version; fixed in 14.1-73.49, 13.1-64.32 and the FIPS and NDcPP builds2026-10-23
- CVE-2026-109618 / CVE-2026-109619, Palo Alto Networks PAN-OS and Panorama: the PHP2Shell flaws affect every release below its train's hotfix through the management web interface, and Palo Alto reports active exploitation against internet-exposed management interfaces; all twenty hotfixes are out2026-10-22
- k0t: Group-IB and NyxLab describe a probable access broker that mass-exploits FortiWeb and PAN-OS GlobalProtect, brute-forces FortiGate and decrypts stolen FortiGate configurations offline with the default key, with victims later listed by Qilin and The Gentlemen2026-10-22
- CVE-2026-109618 / CVE-2026-109619, PHP (PHP2Shell): two unauthenticated remote-code-execution flaws in the runtime, fixed on 2026-10-21 in 8.5.12, 8.4.27, 8.3.36 and 8.2.35, with attack traffic already observed and no upstream release for 8.1 and older (CVSS 4.0 9.2)2026-10-21
- AA26-293A: FBI, CISA and German and UK law enforcement describe SafePay ransomware, which enters through VPN credentials and five edge-device and backup-server flaws and factory-resets backup NAS devices before encrypting2026-10-21
- CVE-2026-76519, Cisco Secure Email Gateway: one crafted email attachment writes files and runs commands as root, exploited in the wild and listed in CISA KEV (CVSS 9.8)2026-10-15
- CVE-2026-0322, Palo Alto Networks PAN-OS: code injection in the management interface gives an authenticated attacker root, exploited in very limited attacks and listed in CISA KEV (CVSS-B 8.6)2026-10-15
- CVE-2026-96951, Windows Shell: a Mark of the Web bypass exploited as a zero-day, fixed in the 2026-10-13 cumulative updates and listed in CISA KEV (CVSS 8.8)2026-10-14
- CVE-2026-104935, Ivanti Connect Secure: an authentication bypass chained to code execution is exploited as a zero-day, the root-escalation step was patched on 2026-10-29 and CISA lists all three chain flaws (CVSS 8.6)2026-10-14
- CVE-2026-97229, GitLab CE/EE: an integer overflow in the CI/CD regular-expression compiler allows code execution on self-managed servers; exploited, fixed in 19.4.2, 19.3.5 and 19.2.8 (CVSS 10.0)2026-10-13
- CVE-2026-84411, MikroTik RouterOS: one unauthenticated request to the web management service can run code as root; fixed in 7.24 (v7 stable), 7.23.8 (v7 long-term) and 6.49.23 (v6 long-term) (CVSS 3.1 9.8)2026-10-10
- CVE-2026-105133 / CVE-2026-105134, AhsayCBS backup management console: an unauthenticated authentication-bypass and code-execution chain exploited since 7 October to drop webshells and a cryptominer; Ahsay says its earlier patches were incomplete and ships hotfixes 10.3.4.45 and 9.15.2.70 through its partner portal2026-10-10
- AA26-281A: China-linked actors enabled by Integrity Technology Group scan with MicroScan, spray Exchange and Microsoft 365 passwords and steal mail, and five old flaws from the scanner's scripts enter CISA KEV2026-10-09
- CVE-2026-21589, Atlassian Data Center: unauthenticated arbitrary file access in every version of eight self-managed products, patch or take them off the internet (CVSS 4.0 9.3)2026-10-06
- CVE-2026-88779, Citrix NetScaler ADC and Gateway: a SAML-triggered memory overflow still hits appliances on the September fixed builds, and Citrix confirms targeted attacks (CVSS 4.0 8.7)2026-10-04
- CVE-2026-102489 / CVE-2026-102490, Zammad helpdesk: a session-hijack remote code execution and a zammad-to-root escalation, both reported exploited since 21 September; 7.2.2 fixes the root flaw on DEB and RPM installs2026-10-02
- CVE-2026-76504, Cisco Catalyst SD-WAN Manager: one percent-encoded character in the login path skips the password check and mints an admin API session, exploited in the wild (CVSS 9.8)2026-10-02
- CVE-2026-104286, Fortinet FortiMail: unauthenticated path traversal file write exploited as a zero-day, fixed in 8.0.2, 7.6.7 and 7.4.9 (CVSS 9.8)2026-10-02
- Adobe Campaign Classic: eight unauthenticated CVSS 10.0 flaws in APSB26-142 and three more in APSB26-134, with build 9403 as the fix after APSB26-1622026-10-02
- CVE-2026-86950, Apple iOS, iPadOS and macOS CoreGraphics: out-of-bounds write exploited in an extremely sophisticated attack on targeted iOS users, CISA KEV-listed (CVSS 8.8)2026-09-30
- CVE-2026-88771 / CVE-2026-88772, Citrix NetScaler ADC and Gateway: unauthenticated pre-auth RCE zero-days exploited before a patch existed (CVSS 4.0 9.5)2026-09-28
- CVE-2019-18935, Progress Telerik UI for ASP.NET AJAX: a patched-since-2020 deserialization RCE still exploited, now via an in-memory Godzilla web shell registered on ASP.NET's VirtualPathProvider2026-09-28
- CVE-2026-65660, Microsoft SharePoint: a SafeControls parser-desync lets an authenticated attacker forge a second Register directive and reach RCE via in-memory XAML deserialization, now confirmed exploited (CVSS 8.8)2026-09-26
- CVE-2026-5430, WSO2 API Manager, API Control Plane, Traffic Manager, Universal Gateway: a JWT algorithm-confusion bypass reaches full administrative control of the API gateway, exploited since 13 September (CVSS 10.0/9.8)2026-09-25
- The FBI says the incident at its recruitment portal resulted from a contractor failing to apply an issued security patch on a third-party-managed platform; sources name PeopleSoft, and ShinyHunters claimed the breach2026-09-24
- CVE-2026-94127, F5 BIG-IP APM: unauthenticated heap overflow in OAuth-profile processing reaches RCE on the TMM data plane (CVSS 9.8)2026-09-23
- CVE-2026-93952, Arista VeloCloud Orchestrator: actively exploited, two release trains still have no fix2026-09-23
- CVE-2026-93616, Check Point Security Management: pre-authentication path traversal to arbitrary script execution, exploited as a zero-day, with attacks observed on 2026-07-23 (CVSS 9.8)2026-09-23
- CVE-2026-7273 and CVE-2026-107441, Zyxel GS1900 switches: GreyNoise caught a Red Heron-linked actor exfiltrating configurations and hashed root credentials from 996 switches in 48 countries, and Binarly shows its exploit targets a separate flaw that the June fix leaves open; only the .3C0 builds close it2026-09-22
- NightEagle (APT-Q-95) pivots to Russian targets, tunnels RDP through Microsoft's own legitimate dev-tunnels service, and attempts DCSync against Active Directory2026-09-21
- Oracle's September 2026 Critical Security Patch Update carries fifty unauthenticated CVSS 9.8+ flaws, concentrated in Fusion Middleware's identity, forms, directory and portal components, plus E-Business Suite, Hyperion, Analytics, Enterprise Manager, Communications and Supply Chain products2026-09-20
- CISA KEV adds three unrelated Linux kernel flaws in one day: kTLS receive-path logic error, AF_ALG race condition, netfilter ebtables SNAT out-of-bounds write2026-09-19
- CVE-2026-87886, Acronis Backup plugins for cPanel/WHM and DirectAdmin and extension for Plesk: local privilege escalation via insecure default permissions, CISA KEV-listed (CVSS 7.8)2026-09-18
- CVE-2026-76460 (+ CVE-2026-76423), Cisco Identity Services Engine: unauthenticated API authentication bypass to root, found during a Cisco TAC support case, no workaround beyond ACLs (CVSS 10.0)2026-09-17
- CVE-2026-58704: Google Pixel zero-click privilege escalation out of the cellular modem sandbox, listed in CISA KEV as exploited2026-09-17
- CVE-2026-76461: Cisco Secure Email Gateway unauthenticated SQL injection in email parsing reaches root command execution, exploited before disclosure (CVSS 9.8)2026-09-15
- CVE-2026-42016 + CVE-2026-42018, JFrog Artifactory: chaining two previously-patched token flaws turns an unauthenticated request into full administrative control in two API calls, confirmed exploited since mid-August2026-09-12
- CVE-2026-85706, GitLab CE/EE: unauthenticated path traversal in the repository commits API reads arbitrary server files, and honeypots recorded probes by the day after the patch (CVSS 10.0)2026-09-12
- CVE-2026-84869, ConnectWise ScreenConnect: a missing file-transfer authorization check lets an active remote session push and auto-run files on the Host, and Huntress traced worm-like exploitation back to 20 August, weeks before any patch existed (CVSS 9.9)2026-09-12
- CVE-2026-87491, Google Chrome: V8 out-of-bounds write exploited in the wild, patched in Chrome 153 (seventh exploited Chrome zero-day of 2026)2026-09-10
- CVE-2025-25249, Fortinet FortiOS/FortiSwitchManager: unauthenticated CAPWAP heap overflow added to CISA KEV, actively exploited since July via the PivotC2 RAT2026-09-10
- + 92 earlier entries