CISA Adds Five Actively Exploited Vulnerabilities to the KEV Catalog

Timeline

1. Mar 26, 2026

   Nuclei adds detection templates for five KEV flaws in Fortinet, SonicWall, and Qlik

   A ProjectDiscovery pull request added Nuclei detection templates for five CISA KEV-listed vulnerabilities affecting Fortinet FortiOS, SonicWall SonicOS, SonicWall SMA 1000, and Qlik Sense Enterprise. The reference says the flaws are actively exploited, including by ransomware groups such as Akira, Fog, and Cactus, and that the templates are detection-only without exploit payloads.

2. Mar 20, 2026

   Researchers link March 20 Apple KEV flaws to DarkSword exploit kit

   Researchers from Google Threat Intelligence Group, iVerify, and Lookout reported that the three Apple vulnerabilities added by CISA to KEV on March 20, 2026 were linked to the DarkSword iOS exploit kit used to deliver malware. The same reporting also tied the Craft CMS flaw to in-the-wild exploitation documented by Orange Cyberdefense and associated the Laravel Livewire flaw with attacks by the Iran-linked MuddyWater APT group.

3. Mar 20, 2026

   CISA sets April 3 deadline for federal remediation of March 20 KEV additions

   Following the March 20, 2026 addition of five Apple, Craft CMS, and Laravel Livewire vulnerabilities to the KEV catalog, CISA required Federal Civilian Executive Branch agencies to remediate them by April 3, 2026 under BOD 22-01. The action formalized the federal response to the newly listed actively exploited flaws.

4. Mar 20, 2026

   CISA adds five more exploited flaws affecting Apple, Craft CMS, and Laravel

   On March 20, 2026, CISA announced another KEV catalog expansion, adding five newly exploited vulnerabilities affecting Apple multiple products, Craft CMS, and Laravel Livewire. The listed issues included buffer overflow, improper locking, and code injection flaws.

5. Mar 6, 2026

   Google links Apple iOS flaws to Coruna exploit kit activity

   Google Threat Intelligence Group attributed exploitation of some Apple vulnerabilities later added to CISA's KEV catalog to the Coruna (aka CryptoWaters) iOS exploit kit. GTIG said the kit targeted iPhones running iOS 13.0 through 17.2.1 and was used first in targeted campaigns and later more broadly by multiple tracked clusters.

6. Mar 5, 2026

   CISA sets March 26 deadline for federal remediation of March 5 KEV additions

   Under Binding Operational Directive 22-01, CISA required Federal Civilian Executive Branch agencies to remediate the five vulnerabilities added on March 5 by March 26, 2026. CISA also urged non-federal organizations to prioritize remediation of the newly listed KEV items.

7. Mar 5, 2026

   CISA KEV catalog update raises total listed vulnerabilities to 1,536

   CISA's KEV data repository was updated from catalog version 2026.03.04 to 2026.03.05, increasing the total number of listed vulnerabilities from 1,531 to 1,536. The update reflected the five newly added Apple, Hikvision, and Rockwell entries.

8. Mar 5, 2026

   CISA adds five Apple, Hikvision, and Rockwell flaws to KEV

   On March 5, 2026, CISA added five actively exploited vulnerabilities affecting Apple products, Hikvision IP cameras, and Rockwell Automation products to its Known Exploited Vulnerabilities catalog. The additions included improper authentication, insufficiently protected credentials, integer overflow, and use-after-free issues.