cisa kev

7 articles · newest first

Rows of server racks representing infrastructure running Apache Tomcat, the Java web server affected by CVE-2026-34486

CISA gave you until tomorrow to patch this Tomcat bug — an AI is already hunting for it

A Chinese hacker wired DeepSeek into an autonomous attack framework and pointed it at unpatched Apache Tomcat servers, and CISA wants federal systems fixed by Friday — everyone else should move just as fast.

Priya Nair · Aug 6 · 7 min

Rows of servers in a data center, the kind of infrastructure that runs self-hosted AI tools like Langflow

that AI agent builder you self-hosted? attackers don't even need a password to take it over

CVE-2026-9198 lets anyone run code on a default Langflow install with zero credentials — CISA gave federal agencies two days to patch it.

Lena Fischer · Aug 6 · 6 min

Networking and firewall equipment mounted in a server rack

Software

Cisco's firewall management tool shipped with a hidden login — and attackers found it first

CVE-2026-20316 is a static-credential bug in Secure FMC that's already on CISA's Known Exploited Vulnerabilities list, with a federal patch deadline of August 1.

Priya Nair · Aug 5 · 6 min

Software

n-able's remote-management tool has a hole attackers are already walking through — patch now

CVE-2026-18577 lets an attacker skip the login screen entirely and pivot straight into every endpoint N-central manages — CISA added it to its must-patch list within 24 hours.

Priya Nair · Aug 4 · 6 min

Networking equipment and cables in a server rack, representing the Cisco Secure Firewall Management Center affected by CVE-2026-20316

Software

Cisco's firewall management tool had a hardcoded password. attackers found it before Cisco did

CVE-2026-20316 gives anyone the login to a low-privilege account baked into Cisco Secure FMC — and Cisco's own team says it was already being used in the wild before a patch existed.

Priya Nair · Jul 31 · 7 min

NVD detail for CVE-2026-25089 showing a 9.8 FortiSandbox command injection

Software

a 9.8 in Fortinet's FortiSandbox lets anyone run commands with one crafted request — and it's being exploited

CVE-2026-25089 is an unauthenticated command-injection flaw in FortiSandbox, the security appliance meant to catch malware. It's on CISA's exploited list. The tool that inspects threats has become one.

Priya Nair · Jul 28 · 9 min

NVD detail for CVE-2026-58644 showing a 9.8 SharePoint deserialization RCE

Software

the other SharePoint bug: a 9.8 that runs code with no login, already exploited and on CISA's list

Everyone focused on the SharePoint privilege-escalation zero-day. CVE-2026-58644 is worse: an unauthenticated deserialization flaw that runs code on the server, actively exploited, with a CISA deadline that's already passed.

Priya Nair · Jul 28 · 9 min