CISA Adds Actively Exploited Vulnerabilities to the Known Exploited Vulnerabilities Catalog

Timeline

1. May 1, 2026

   CISA adds Linux Kernel flaw CVE-2026-31431 to KEV

   On 2026-05-01, CISA added CVE-2026-31431, an incorrect resource transfer between spheres vulnerability in the Linux Kernel, to its Known Exploited Vulnerabilities catalog after determining there was evidence of active exploitation. CISA said vulnerabilities of this type are frequently used by malicious cyber actors, pose significant risk to the federal enterprise, and should be prioritized for remediation under BOD 22-01.

2. Apr 24, 2026

   CISA adds four new vulnerabilities to KEV catalog

   On 2026-04-24, CISA added four vulnerabilities affecting Samsung MagicINFO 9 Server, SimpleHelp, and the D-Link DIR-823X to its Known Exploited Vulnerabilities catalog after determining there was evidence of active exploitation. CISA said the path traversal, missing authorization, and command injection flaws are common attack vectors that pose significant risk to the federal enterprise and urged timely remediation under BOD 22-01.

3. Apr 23, 2026

   CISA adds Marimo flaw CVE-2026-39987 to KEV

   On 2026-04-23, CISA added CVE-2026-39987, a remote code execution vulnerability affecting Marimo, to its Known Exploited Vulnerabilities catalog after determining there was evidence of active exploitation. CISA said the flaw poses significant risk to the federal enterprise and urged timely remediation under Binding Operational Directive 22-01.

4. Apr 22, 2026

   CISA adds Microsoft Defender flaw CVE-2026-33825 to KEV

   On 2026-04-22, CISA added CVE-2026-33825, an insufficient granularity of access control vulnerability affecting Microsoft Defender, to its Known Exploited Vulnerabilities catalog after determining there was evidence of active exploitation. CISA said the flaw poses significant risk to the federal enterprise and urged timely remediation under Binding Operational Directive 22-01.

5. Apr 20, 2026

   CISA adds eight new vulnerabilities to KEV catalog

   On 2026-04-20, CISA added eight vulnerabilities affecting PaperCut NG/MF, JetBrains TeamCity, Kentico Xperience, Quest KACE SMA, Synacor Zimbra Collaboration Suite, and Cisco Catalyst SD-WAN Manager to its Known Exploited Vulnerabilities catalog after determining there was evidence of active exploitation. CISA said the flaws are common attack vectors that pose significant risk to the federal enterprise and urged prioritized remediation under BOD 22-01.

6. Apr 16, 2026

   CISA adds Apache ActiveMQ flaw CVE-2026-34197 to KEV

   On 2026-04-16, CISA added CVE-2026-34197, an improper input validation vulnerability affecting Apache ActiveMQ, to its Known Exploited Vulnerabilities catalog after determining there was evidence of active exploitation. CISA said the flaw poses significant risk to the federal enterprise and urged timely remediation under BOD 22-01.

7. Apr 14, 2026

   CISA adds Microsoft Office and SharePoint flaws to KEV

   On 2026-04-14, CISA added two vulnerabilities to its Known Exploited Vulnerabilities catalog: CVE-2009-0238, a Microsoft Office remote code execution flaw, and CVE-2026-32201, an improper input validation vulnerability in Microsoft SharePoint Server. CISA said both were actively exploited and urged prioritized remediation under Binding Operational Directive 22-01.

8. Apr 13, 2026

   CISA adds seven new vulnerabilities to KEV catalog

   On 2026-04-13, CISA added seven vulnerabilities affecting Microsoft Visual Basic for Applications, Adobe Acrobat, Microsoft Exchange Server, Microsoft Windows, Fortinet products, and Adobe Acrobat and Reader to its Known Exploited Vulnerabilities catalog after determining there was evidence of active exploitation. CISA said the flaws are common attack vectors that pose significant risk to the federal enterprise and urged prioritized remediation under BOD 22-01.

9. Apr 8, 2026

   CISA adds Ivanti EPMM flaw CVE-2026-1340 to KEV

   On 2026-04-08, CISA added CVE-2026-1340, a code injection vulnerability affecting Ivanti Endpoint Manager Mobile (EPMM), to its Known Exploited Vulnerabilities catalog after determining there was evidence of active exploitation. CISA said the flaw presents significant risk to the federal enterprise and urged prioritized remediation under BOD 22-01.

10. Apr 6, 2026

    CISA adds Fortinet FortiClient EMS flaw CVE-2026-35616 to KEV

    On 2026-04-06, CISA added CVE-2026-35616, an improper access control vulnerability affecting Fortinet FortiClient EMS, to its Known Exploited Vulnerabilities catalog after determining there was evidence of active exploitation. CISA said the flaw presents significant risk to the federal enterprise and urged prioritized remediation under BOD 22-01.

11. Apr 1, 2026

    CISA adds Google Dawn flaw CVE-2026-5281 to KEV

    On 2026-04-01, CISA added CVE-2026-5281, a Google Dawn use-after-free vulnerability, to its Known Exploited Vulnerabilities catalog after determining there was evidence of active exploitation. CISA said the flaw poses significant risk to the federal enterprise and urged prioritized remediation under BOD 22-01.

12. Mar 27, 2026

    CISA adds F5 BIG-IP flaw CVE-2025-53521 to KEV

    On 2026-03-27, CISA added CVE-2025-53521, a remote code execution vulnerability affecting F5 BIG-IP, to its Known Exploited Vulnerabilities catalog after obtaining evidence of active exploitation. CISA warned the flaw poses significant risk to the federal enterprise and urged prioritized remediation under Binding Operational Directive 22-01.

13. Mar 26, 2026

    CISA adds Aqua Security Trivy flaw CVE-2026-33634 to KEV

    On 2026-03-26, CISA added CVE-2026-33634, an Aqua Security Trivy Embedded Malicious Code vulnerability, to its Known Exploited Vulnerabilities catalog after obtaining evidence of active exploitation. CISA said the flaw is a frequent attack vector that poses significant risk to the federal enterprise and urged prioritized remediation.

14. Mar 25, 2026

    CISA adds Langflow code injection flaw CVE-2026-33017 to KEV

    On 2026-03-25, CISA added CVE-2026-33017, a code injection vulnerability affecting Langflow, to its Known Exploited Vulnerabilities catalog after obtaining evidence of active exploitation. CISA said the flaw poses significant risk to the federal enterprise and urged prioritized remediation under BOD 22-01.

15. Mar 19, 2026

    CISA adds Cisco firewall management flaw CVE-2026-20131 to KEV

    On 2026-03-19, CISA added CVE-2026-20131, a deserialization of untrusted data vulnerability affecting Cisco Secure Firewall Management Center and Cisco Security Cloud Control Firewall Management, to the KEV catalog. CISA said the flaw was under active exploitation and posed significant risk to the federal enterprise.

16. Mar 18, 2026

    CISA adds Synacor Zimbra XSS flaw CVE-2025-66376 to KEV

    On 2026-03-18, CISA added CVE-2025-66376, a cross-site scripting vulnerability affecting Synacor Zimbra Collaboration Suite, to the KEV catalog. The agency said the flaw was actively exploited and should be prioritized for remediation.

17. Mar 16, 2026

    CISA adds Wing FTP Server vulnerability CVE-2025-47813 to KEV

    On 2026-03-16, CISA added CVE-2025-47813, an information disclosure vulnerability in Wing FTP Server, to the KEV catalog after evidence of active exploitation emerged. CISA warned that the issue presented significant risk to federal agencies and urged timely patching.

18. Mar 13, 2026

    CISA adds Google Skia and Chromium V8 flaws to KEV

    On 2026-03-13, CISA added CVE-2026-3909, a Google Skia out-of-bounds write vulnerability, and CVE-2026-3910, a Google Chromium V8 vulnerability, to the KEV catalog. The agency said both were being actively exploited and required prompt remediation.

19. Mar 11, 2026

    CISA adds n8n vulnerability CVE-2025-68613 to KEV

    On 2026-03-11, CISA added CVE-2025-68613, an improper control of dynamically managed code resources vulnerability affecting n8n, to the KEV catalog after evidence of active exploitation. CISA said the flaw posed significant risk to the federal enterprise and required remediation under BOD 22-01.

20. Mar 9, 2026

    CISA adds Ivanti, SolarWinds, and Omnissa flaws to KEV catalog

    By 2026-03-09, CISA had added three vulnerabilities to the KEV catalog based on active exploitation evidence: CVE-2026-1603 in Ivanti Endpoint Manager, CVE-2025-26399 in SolarWinds Web Help Desk, and CVE-2021-22054 in Omnissa Workspace ONE. The listed issues included authentication bypass, unauthenticated remote code execution, and SSRF risks.

21. Mar 5, 2026

    CISA adds three Apple vulnerabilities to KEV catalog

    On 2026-03-05, CISA added three actively exploited Apple vulnerabilities affecting macOS, iOS, iPadOS, Safari, and related platforms to its Known Exploited Vulnerabilities catalog. The flaws included two use-after-free issues and one integer overflow issue that could lead to memory corruption, arbitrary code execution, and in one case kernel-privileged code execution.