The CISA KEV Catalogue, Searchable
Every flaw attackers are known to be using: what it is, how bad, and what fixes it.
- Flaws on the list
- 1,779
- Added in 30 days
- 40
- Used in ransomware
- 361
- In web & server software
- 181
29 Sep 2026 Apple Multiple Products Memory corruption
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.11 and iPadOS 18.7.11, iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1, macOS Tahoe 26.7.1. Processing a maliciously crafted file may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- apple ipados 26.7.1, apple iphone os 26.7.1, apple macos 26.7.1, apple ipados 18.7.11, apple iphone os 18.7.11 and 1 older
- CISA due date
- 13 Oct 2026
- Weakness
- CWE-787
27 Sep 2026 Citrix NetScaler Memory corruption
Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to Remote Code Execution or Denial of Service
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- citrix netscaler application delivery controller 14.1-73.37, citrix netscaler gateway 14.1-73.37, citrix netscaler application delivery controller 13.1-64.23, citrix netscaler gateway 13.1-64.23, citrix netscaler application delivery controller 13.1.37.279
- CISA due date
- 30 Sep 2026
- Weakness
- CWE-119
27 Sep 2026 Citrix NetScaler Input validation flaw
Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to an unauthenticated attacker to execute arbitrary commands.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- citrix netscaler application delivery controller 14.1-73.37, citrix netscaler gateway 14.1-73.37, citrix netscaler application delivery controller 13.1-64.23, citrix netscaler gateway 13.1-64.23, citrix netscaler application delivery controller 13.1.37.279
- CISA due date
- 30 Sep 2026
- Weakness
- CWE-119
25 Sep 2026 WordPress Core Security flaw
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- wordpress 5.8.17, wordpress 5.7.19, wordpress 5.6.21, wordpress 5.5.22, wordpress 5.4.23 and 7 older
- CISA due date
- 28 Sep 2026
- Weakness
- CWE-98
25 Sep 2026 MikroTik RouterOS Security flaw
RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send an exec request. On affected builds the server dispatches the command, enabling unauthenticated creation, overwrite, and reconstruction of files in the RouterOS managed file namespace, including support files containing configuration and diagnostic data.This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- mikrotik routeros 7.24.2, mikrotik routeros 7.23.4, mikrotik routeros 6.49.21
- CISA due date
- 28 Sep 2026
- Weakness
- CWE-841
25 Sep 2026 Microsoft SharePoint Remote code execution
Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft sharepoint server 16.0.19725.20522
- CISA due date
- 28 Sep 2026
- Weakness
- CWE-94
24 Sep 2026 Adobe Commerce and Magento Access control flaw
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to sensitive resources. Exploitation of this issue does not require user interaction.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- adobe commerce 2.4.4, adobe commerce b2b 1.3.3
- CISA due date
- 27 Sep 2026
- Weakness
- CWE-863
24 Sep 2026 WSO2 Multiple Products Weak cryptography
The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which is then incorrectly validated, leading to unauthorized access. Successful exploitation of this vulnerability may result in unauthorized access to the system, including the potential compromise of administrative accounts and full account takeover. The CVSS score is adjusted to 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) in single-tenant deployments, reflecting that the impact is contained within a single security authority boundary.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- wso2 api control plane 4.6.0.22, wso2 api control plane 4.5.0.58, wso2 api manager 4.6.0.21, wso2 traffic manager 4.6.0.21, wso2 universal gateway 4.6.0.21 and 7 older
- CISA due date
- 27 Sep 2026
- Weakness
- CWE-347
22 Sep 2026 F5 BIG-IP APM Memory corruption
When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE). This vulnerability is only present when BIG-IP APM is configured as an OAuth Authorization Server. Deployments using APM strictly as an OAuth Client / Resource Server (without OAuth authorization server profiles configured) are not affected by this vulnerability. Impact: This vulnerability allows an unauthenticated attacker to perform remote code execution. The BIG-IP system in Appliance mode is also vulnerable. This is a data plane issue; there is no control plane exposure. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 25 Sep 2026
- Weakness
- CWE-122
22 Sep 2026 Arista VeloCloud Orchestrator Input validation flaw
VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. Hosted, including Dedicated, versions of VCO were impacted and have already been patched.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- arista velocloud orchestrator 6.4.2.8, arista velocloud orchestrator 5.2.3.16
- CISA due date
- 25 Sep 2026
- Weakness
- CWE-20
22 Sep 2026 Check Point Multiple Products Path traversal
A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- checkpoint multi-domain security management r81.10, checkpoint quantum security management r81.10
- CISA due date
- 25 Sep 2026
- Weakness
- CWE-22
22 Sep 2026 Check Point Multiple Products Weak cryptography
Improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an unauthenticated remote attacker to execute arbitrary code on the Gateway.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- checkpoint gaia embedded r82.00.10, checkpoint gaia embedded r81.10.17, checkpoint gaia os r81.10
- CISA due date
- 25 Sep 2026
- Weakness
- CWE-295
21 Sep 2026 Zyxel GS1900 Series Switches Memory corruption
A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0 could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- zyxel gs1900-48 firmware 2.90\(aahn.2\)c0, zyxel gs1900-48hpv2 firmware 2.90\(abtq.2\)c0, zyxel gs1900-24 firmware 2.90\(aahl.2\)c0, zyxel gs1900-24hpv2 firmware 2.90\(abtp.2\)c0, zyxel gs1900-24e firmware 2.90\(aahk.2\)c0 and 5 older
- CISA due date
- 24 Sep 2026
- Weakness
- CWE-121
18 Sep 2026 Linux Kernel Memory corruption
In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: make ebt_snat ARP rewrite writable The ebtables SNAT target keeps the Ethernet source address rewrite behind skb_ensure_writable(skb, 0). This is intentional: at the bridge ebtables hooks the Ethernet header is addressed through skb_mac_header()/eth_hdr(), while skb->data points at the Ethernet payload. Asking skb_ensure_writable() for ETH_HLEN bytes would check the payload, not the Ethernet header, and would reintroduce the small packet regression fixed by commit 63137bc5882a. However, the optional ARP sender hardware address rewrite is different. It writes through skb_store_bits() at an offset relative to skb->data: skb_store_bits(skb, sizeof(struct arphdr), info->mac, ETH_ALEN) skb_header_pointer() only safely reads the ARP header; it does not make the later sender hardware address range writable. If that range is still held in a nonlinear skb fragment backed by a splice-imported file page, skb_store_bits() maps the frag page and copies the new MAC address directly into it. Ensure the ARP SHA range is writable before reading the ARP header and before calling skb_store_bits().
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- linux kernel 7.0.13, linux kernel 6.18.36, linux kernel 6.12.94, linux kernel 6.6.143, linux kernel 6.1.176 and 4 older
- CISA due date
- 21 Sep 2026
- Weakness
- CWE-787
18 Sep 2026 Linux Kernel Race condition
In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg Issuing two writes to the same af_alg socket is bogus as the data will be interleaved in an unpredictable fashion. Furthermore, concurrent writes may create inconsistencies in the internal socket state. Disallow this by adding a new ctx->write field that indiciates exclusive ownership for writing.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- linux kernel 6.16.9, linux kernel 6.12.49, linux kernel 6.6.108, linux kernel 6.1.154, linux kernel 5.15.194 and 1 older
- CISA due date
- 21 Sep 2026
- Weakness
- CWE-362
18 Sep 2026 Linux Kernel Security flaw
In the Linux kernel, the following vulnerability has been resolved: tls: fix handling of zero-length records on the rx_list Each recvmsg() call must process either - only contiguous DATA records (any number of them) - one non-DATA record If the next record has different type than what has already been processed we break out of the main processing loop. If the record has already been decrypted (which may be the case for TLS 1.3 where we don't know type until decryption) we queue the pending record to the rx_list. Next recvmsg() will pick it up from there. Queuing the skb to rx_list after zero-copy decrypt is not possible, since in that case we decrypted directly to the user space buffer, and we don't have an skb to queue (darg.skb points to the ciphertext skb for access to metadata like length). Only data records are allowed zero-copy, and we break the processing loop after each non-data record. So we should never zero-copy and then find out that the record type has changed. The corner case we missed is when the initial record comes from rx_list, and it's zero length.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- siemens simatic cn 4100 firmware 5.0, linux kernel 6.16.4, linux kernel 6.12.44, linux kernel 6.6.103, linux kernel 6.1.149
- CISA due date
- 21 Sep 2026
- Weakness
- CWE-754
16 Sep 2026 Acronis Backup Security flaw
Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.3.1021, Acronis Backup extension for Plesk (Linux) before build 1.8.11.638, Acronis Backup plugin for DirectAdmin (Linux) before build 1.2.3.238.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- acronis backup 1.9.3, acronis backup 1.8.11, acronis backup 1.2.3
- CISA due date
- 19 Sep 2026
- Weakness
- CWE-276
16 Sep 2026 Cisco Identity Services Engine Security flaw
A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication. This vulnerability is due to insufficient authentication control on an API endpoint. An attacker could exploit this vulnerability by sending a crafted request to an affected API endpoint. A successful exploit could allow the attacker to gain unauthorized access to the affected device by bypassing the web-based management interface.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 19 Sep 2026
- Weakness
- CWE-648
16 Sep 2026 Google Pixel Access control flaw
In Cellular Modem, there is a possible permission bypass due to a logic error in the code. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 19 Sep 2026
- Weakness
- CWE-693
14 Sep 2026 Cisco Secure Email Gateway SQL injection
A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system. This vulnerability is due to insufficient validation in the email parsing logic. An attacker could exploit this vulnerability by sending a crafted email message that contains malicious SQL statements through an affected device. A successful exploit could allow the attacker to execute arbitrary SQL statements, leading to command execution with root privileges on the underlying operating system.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- cisco asyncos 16.5.0-780, cisco asyncos 16.0.4-302, cisco asyncos 15.5.5-014
- CISA due date
- 17 Sep 2026
- Weakness
- CWE-89
11 Sep 2026 GitLab Community Edition and Enterprise Edition Path traversal
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an unauthenticated user could have read arbitrary files from the GitLab server due to improper path confinement and missing authentication enforcement in the repository commits API.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- gitlab 19.3.2, gitlab 19.2.6, gitlab 19.1.8, gitlab 19.0.9, gitlab 18.11.12
- CISA due date
- 14 Sep 2026
- Weakness
- CWE-35
11 Sep 2026 ConnectWise ScreenConnect Access control flaw
A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- connectwise screenconnect 26.6.5.9742
- CISA due date
- 14 Sep 2026
- Weakness
- CWE-269, CWE-862
11 Sep 2026 JFrog Artifactory Authentication bypass
JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- jfrog artifactory 7.146.8, jfrog artifactory 7.133.28, jfrog artifactory 7.125.19, jfrog artifactory 7.117.27, jfrog artifactory 7.111.20
- CISA due date
- 25 Sep 2026
- Weakness
- CWE-287
11 Sep 2026 JFrog Artifactory Access control flaw
JFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- jfrog artifactory 7.133.11
- CISA due date
- 25 Sep 2026
- Weakness
- CWE-863
10 Sep 2026 MikroTik RouterOS Command injection
RouterOS contains an argument-handling flaw in the SSH login path involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed, leading to privilege escalation. Exploitation requires an unauthenticated SSH session to reach the RouterOS login helper.This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- mikrotik routeros 7.24.2, mikrotik routeros 7.23.4, mikrotik routeros 6.49.21
- CISA due date
- 13 Sep 2026
- Weakness
- CWE-88
10 Sep 2026 MikroTik RouterOS Authentication bypass
RouterOS accepts a "related" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this state to start an IPv4 UDP test. With "random-data=false", the sender transmits an uninitialized tail from a kernel packet buffer. A separate unchecked, inverted packet-size interval causes unsigned integer underflow, anomalously large fragmented output, and can restart the RouterOS kernel. This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- mikrotik routeros 7.24.2, mikrotik routeros 7.23.4, mikrotik routeros 6.49.21
- CISA due date
- 13 Sep 2026
- Weakness
- CWE-306
9 Sep 2026 Google Chromium V8 Memory corruption
Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- google chrome 153.0.8010.36
- CISA due date
- 23 Sep 2026
- Weakness
- CWE-787
9 Sep 2026 Cisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management Authentication bypass
A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system. This vulnerability is due to an improper system process that is created at boot time. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute a variety of scripts and commands that allow root access to the device.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 12 Sep 2026
- Weakness
- CWE-288
9 Sep 2026 Citrix NetScaler Authentication bypass
Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: from 14.1 through 73.32 and from 13.1 through 63.21; Gateway: from 14.1 through 73.32 and from 13.1 through 63.21.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- citrix netscaler application delivery controller 14.1-73.32, citrix netscaler gateway 14.1-73.32, citrix netscaler application delivery controller 13.1-63.21, citrix netscaler gateway 13.1-63.21, citrix netscaler application delivery controller 13.1-37.277
- CISA due date
- 12 Sep 2026
- Weakness
- CWE-288
On Hacker News
Detecting and Weaponizing NetScaler9 Sep 2026 Fortinet Multiple Products Memory corruption
A heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiOS 6.4 all versions, FortiSwitchManager 7.2.0 through 7.2.6, FortiSwitchManager 7.0.0 through 7.0.5 allows attacker to execute unauthorized code or commands via specially crafted packets
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- fortinet fortios 7.6.4, fortinet fortios 7.4.9, fortinet fortios 7.2.12, fortinet fortiswitchmanager 7.2.7, fortinet fortios 7.0.18 and 1 older
- CISA due date
- 12 Sep 2026
- Weakness
- CWE-122, CWE-787
8 Sep 2026 N-able N-central Remote code execution
N-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- n-able n-central 2026.3
- CISA due date
- 11 Sep 2026
- Weakness
- CWE-96
8 Sep 2026 Microsoft Windows Memory corruption
Heap-based buffer overflow in Windows ALPC allows an authorized attacker to elevate privileges locally.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft windows server 2022 10.0.20348.5622, microsoft windows server 2019 10.0.17763.9245, microsoft windows server 2016 10.0.14393.9512, microsoft windows 10 1809 10.0.17763.9245, microsoft windows 10 1607 10.0.14393.9512 and 2 older
- CISA due date
- 22 Sep 2026
- Weakness
- CWE-122, CWE-908
8 Sep 2026 Microsoft Windows Access control flaw
Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft windows server 2025 10.0.26100.33438, microsoft windows 11 26h1 10.0.28000.2954, microsoft windows 11 25h2 10.0.26200.9445, microsoft windows 11 24h2 10.0.26100.9445, microsoft windows 11 23h2 10.0.22631.7582
- CISA due date
- 22 Sep 2026
- Weakness
- CWE-59, CWE-284
8 Sep 2026 Adobe Commerce and Magento Remote code execution
Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- adobe magento 2.4.6, adobe commerce 2.4.4, adobe commerce b2b 1.3.3
- CISA due date
- 11 Sep 2026
- Weakness
- CWE-1336
4 Sep 2026 Google Chromium V8 Memory corruption
Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- google chrome 152.0.7977.82, google v8 15.3.48
- CISA due date
- 18 Sep 2026
- Weakness
- CWE-843
2 Sep 2026 Sangoma Switchvox SQL injection
An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The /pa endpoint processes XML content beginning with <PolycomIPPhone> and directly concatenates the user-controlled PhoneIP value into PostgreSQL queries without sanitization or parameterization. An unauthenticated remote attacker can execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- sangoma switchvox 8.4.0.2
- CISA due date
- 5 Sep 2026
- Weakness
- CWE-89
2 Sep 2026 SonicWall SMA1000 Appliances Command injection
Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- sonicwall sma8200v 12.5.0-02952, sonicwall sma8200v 12.4.3-03526, sonicwall sma7210 firmware 12.5.0-02952, sonicwall sma7210 firmware 12.4.3-03526, sonicwall sma6210 firmware 12.5.0-02952 and 1 older
- CISA due date
- 5 Sep 2026
- Weakness
- CWE-78
2 Sep 2026 SonicWall SMA1000 Appliances Server-side request forgery
A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. A remote unauthenticated attacker could potentially exploit this vulnerability to gain unauthorized access to sensitive functionality and perform unauthorized operations.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- sonicwall sma8200v 12.5.0-02952, sonicwall sma8200v 12.4.3-03526, sonicwall sma7210 firmware 12.5.0-02952, sonicwall sma7210 firmware 12.4.3-03526, sonicwall sma6210 firmware 12.5.0-02952 and 1 older
- CISA due date
- 5 Sep 2026
- Weakness
- CWE-918, CWE-441
2 Sep 2026 JFrog Artifactory Authentication bypass
JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- jfrog artifactory 7.161.20, jfrog artifactory 7.146.38, jfrog artifactory 7.133.29, jfrog artifactory 7.125.20, jfrog artifactory 7.117.28 and 1 older
- CISA due date
- 5 Sep 2026
- Weakness
- CWE-287
On Hacker News
Critical CVE: JFrog Artifactory Authentication Bypass2 Sep 2026 BerriAI LiteLLM Authentication bypass
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, LiteLLM's MCP Streamable HTTP endpoint allowed an unauthenticated attacker to use a fabricated Authorization header to trigger an OAuth2 passthrough fallback path that replaced failed LiteLLM key validation with an empty UserAPIKeyAuth() object, allowing requests to reach MCP tooling without a valid LiteLLM key. This issue is fixed in version 1.84.0.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- litellm 1.84.0
- CISA due date
- 16 Sep 2026
- Weakness
- CWE-287, CWE-306
2 Sep 2026 Kestra OSS Command injection
Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, AuthenticationFilter in Kestra OSS uses request.getPath().endsWith("/configs") to whitelist the public configuration endpoint from Basic Auth. Because the check is a suffix match rather than an exact path match, any API path whose last segment is configs bypasses authentication entirely. An unauthenticated remote attacker can exploit this to create and execute arbitrary workflows without credentials. Because Kestra ships with script execution plugins (plugin-script-shell, plugin-script-python, etc.) enabled by default, this directly results in unauthenticated Remote Code Execution as root inside the Kestra worker container. This vulnerability is fixed in 1.0.45 and 1.3.21.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- kestra 1.3.21, kestra 1.0.45
- CISA due date
- 5 Sep 2026
- Weakness
- CWE-78, CWE-184, CWE-287, CWE-918
2 Sep 2026 Kludex Starlette Input validation flaw
Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) could therefore be bypassed. Users should upgrade to a version greater than or equal to version 1.0.1, which validates the `Host` header against the grammar of RFC 9112 §3.2 / RFC 3986 §3.2.2 when constructing `request.url` and falls back to `scope["server"]` for malformed values.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- redhat migration toolkit for applications 8.2.0, redhat openshift ai 3.4.2, redhat openshift ai 3.3.5, encode starlette 1.0.1
- CISA due date
- 16 Sep 2026
- Weakness
- CWE-444
31 Aug 2026 PaperCut NG/MF Security flaw
An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers. If an attacker can manipulate system configuration parameters, this enables the execution of arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- papercut mf 26.0.4, papercut ng 26.0.4, papercut mf 25.0.12, papercut ng 25.0.12, papercut mf 24.1.9 and 1 older
- CISA due date
- 14 Sep 2026
- Weakness
- CWE-470
31 Aug 2026 PaperCut NG/MF Authentication bypass
An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions prior to the completion of access validation checks. This allows an unauthenticated remote attacker to modify certain system configurations.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- papercut mf 26.0.4, papercut ng 26.0.4, papercut mf 25.0.12, papercut ng 25.0.12, papercut mf 24.1.9 and 1 older
- CISA due date
- 14 Sep 2026
- Weakness
- CWE-306
27 Aug 2026 JFrog Artifactory Path traversal
An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- jfrog artifactory 7.161.16, jfrog artifactory 7.146.35
- CISA due date
- 10 Sep 2026
- Weakness
- CWE-22
27 Aug 2026 Linux Kernel Memory corruption
In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path In __ip6_append_data(), when the paged-allocation branch is taken (MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are computed as alloclen = fragheaderlen + transhdrlen; pagedlen = datalen - transhdrlen; datalen already includes fraggap (datalen = length + fraggap). When fraggap is non-zero, this is not the first skb and transhdrlen is zero. The fraggap bytes carried over from the previous skb are copied just past the fragment headers in the new skb's linear area. The linear area is therefore undersized by fraggap bytes while pagedlen is overstated by the same amount, and the copy writes past skb->end into the trailing skb_shared_info. An unprivileged user can trigger this via a UDPv6 socket using MSG_MORE together with MSG_SPLICE_PAGES. The bad accounting was introduced by commit 773ba4fe9104 ("ipv6: avoid partial copy for zc"). Before commit ce650a166335 ("udp6: Fix __ip6_append_data()'s handling of MSG_SPLICE_PAGES"), the negative copy value caused -EINVAL to be returned. That later commit allowed MSG_SPLICE_PAGES to proceed in this case, making the corruption triggerable. The non-paged branch sets alloclen to fraglen, which already accounts for fraggap because datalen does. Bring the paged branch in line by adding fraggap to alloclen and subtracting it from pagedlen. After this adjustment, copy no longer collapses to -fraggap on the paged path, so remove the stale comment describing that old arithmetic. Since a negative copy is no longer expected for a valid MSG_SPLICE_PAGES case, remove the MSG_SPLICE_PAGES exception from the negative copy check.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- linux kernel 7.1.3, linux kernel 6.18.38, linux kernel 6.12.95, linux kernel 6.6.144, linux kernel 6.1.177
- CISA due date
- 30 Aug 2026
- Weakness
- CWE-787, CWE-122
27 Aug 2026 ownCloud Authentication bypass
An issue was discovered in ownCloud owncloud/core before 10.13.1. An attacker can access, modify, or delete any file without authentication if the username of a victim is known, and the victim has no signing-key configured. This occurs because pre-signed URLs can be accepted even when no signing-key is configured for the owner of the files. The earliest affected version is 10.6.0.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- owncloud server 10.13.1
- CISA due date
- 30 Aug 2026
- Weakness
- CWE-287
26 Aug 2026 Citrix NetScaler ADC and NetScaler Gateway Memory corruption
Memory overflow vulnerability NetScaler ADC and NetScaler Gateway leading to unpredictable or erroneous behavior and Denial of Service if the appliance is configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- citrix netscaler application delivery controller 14.1-72.61, citrix netscaler gateway 14.1-72.61, citrix netscaler application delivery controller 13.1-63.18, citrix netscaler gateway 13.1-63.18, citrix netscaler application delivery controller 13.1-37.272
- CISA due date
- 29 Aug 2026
- Weakness
- CWE-119
26 Aug 2026 Linux Kernel Memory corruption
An out-of-bounds (OOB) memory write flaw was found in the Linux kernel’s watch_queue event notification subsystem. This flaw can overwrite parts of the kernel state, potentially allowing a local user to gain privileged access or cause a denial of service on the system.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- linux kernel 5.16.5, linux kernel 5.15.29, linux kernel 5.10.106
- CISA due date
- 29 Aug 2026
- Weakness
- CWE-787
26 Aug 2026 Ajax.NET Professional Remote code execution
All versions of package ajaxpro.2 are vulnerable to Deserialization of Untrusted Data due to the possibility of deserialization of arbitrary .NET classes, which can be abused to gain remote code execution.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- michaelschwarz ajax.net professional 21.10.30.1
- CISA due date
- 9 Sep 2026
- Weakness
- CWE-502
Know when it's your software
Get an email within half an hour when a flaw in your software is added. Free.
About the KEV Catalogue
What is the CISA KEV catalogue?
CISA's list of flaws attackers are known to be using. A flaw is added only with reliable evidence of attacks and a known fix.
Why does it matter more than the CVSS score?
Few CVEs are ever used in attacks. These are, so fix them first, whatever their score.
What is the due date?
The deadline for US federal agencies to fix it (BOD 26-04, which replaced BOD 22-01): as little as three days for recent entries. A sensible deadline for anyone.
Does it apply outside the US?
The deadlines don't, but the flaws are in software used everywhere. If you run it, it applies to you.
What does "used in ransomware" mean?
CISA knows ransomware groups have used the flaw.
How often is it updated?
CISA adds flaws several times a week. CVE Hawk checks hourly and alerts you within half an hour if it's your software.