On November 9, 2026, CISA added four actively exploited flaws to its KEV catalog, including a CVSS 9.8 authentication flaw in GPUStack that hands administration of a GPU cluster to an unauthenticated attacker. Teams running this manager should move to 2.3.0 and then revoke every exposed secret, because the patch does not invalidate keys already stolen.
On October 28, 2026, CISA added CVE-2026-46300 to its Known Exploited Vulnerabilities catalog: an uninitialized variable in the Linux kernel’s ESP-in-TCP path that chains with the two PHP2Shell flaws to plant webshells and run commands as root. The remediation deadline is October 31: patch the kernel and hunt for webshells on exposed PHP servers.
On 15 October 2026, Check Point confirms that CVE-2026-85102, a pre-authentication remote code execution flaw in its Security Gateway VPN fixed on 9 September, is now being exploited at scale against Spark firewalls, and ships a fix for a zero-day in its management server. Apply both hotfixes, starting with your management servers, which are watched less closely than the gateways.
On September 24, 2026, CISA added the path traversal flaw CVE-2026-5430 in WSO2 and the broken authorization flaw CVE-2026-71362 in Adobe Commerce and Magento to its Known Exploited Vulnerabilities catalog, both of them already exploited in the wild. U.S. federal agencies must patch by September 27, and any organization exposing these products should do the same without waiting.
On September 16, 2026, CISA added a local privilege escalation (CVE-2026-87886) caused by overly permissive default permissions in the Acronis Backup plugins for cPanel & WHM, Plesk and DirectAdmin to its KEV catalog. Update to the fixed builds — the September 19 federal deadline has already passed.
On September 22, 2026, CISA added a CVSS 10 input-validation flaw in Arista’s on-prem VeloCloud Orchestrator to its KEV catalog, exploitable with no credentials. Restrict network access to the VCO web interface and apply the fix before September 25.
On September 21, 2026, CISA added CVE-2026-7273, a stack-based buffer overflow in the CGI of Zyxel GS1900 switches, to its KEV catalog after confirming active exploitation. Lock down the management interface, apply Zyxel’s fix before September 24, and hunt for signs of compromise on exposed devices.
On September 18, 2026, CISA added three Linux kernel vulnerabilities to the KEV catalog: a race in AF_ALG, an out-of-bounds write in ebtables SNAT, and mishandled zero-length TLS records. Patch before September 21 and confirm your distribution has backported all three commits.
On September 2, 2026, CISA added CVE-2026-49869 to its KEV catalog: a CVSS 10 command injection in the open-source orchestrator Kestra, caused by a path comparison that lets any endpoint ending in ’configs’ through. Move to 1.0.45 or 1.3.21 before the September 5 federal deadline, then check whether the instance was already used as an entry point.
Ray’s anti-browser defense was a User-Agent header check that Firefox and Safari let you forge through the fetch API. Combined with DNS rebinding, it becomes a remote code execution triggered by a single page visit — added to CISA’s KEV catalog on August 17, 2026 with a fix deadline of August 20.
CISA updated its KEV catalog to flag the Windows Task Host privilege-escalation flaw CVE-2025-60710, patched in November 2025, as now being exploited by ransomware gangs. Organizations must treat privilege-escalation patches with the same urgency as RCEs: this is the link that turns limited access into full control.
CISA added **CVE-2026-8037** to the KEV catalog on **August 7, 2026** — the command injection flaw in Progress Kemp LoadMaster is under active exploitation by ransomware gangs. Patch now before your load balancer becomes your infrastructure's front door for attackers.
