cisa kev

9 articles · newest first

Rows of server racks in a data center, representative of the self-hosted infrastructure Gitea instances typically run on

a Gitea admin's hosting bill flagged 70% CPU usage. that's how he found the hackers

A bug that lets anyone with a free account plant a git hook is now CISA's problem — and it started with a cryptominer, not a headline.

Priya Nair · Aug 26 · 6 min

Rows of rack-mounted network appliances in a data center, similar to load balancer hardware

Software

This load balancer bug got patched in June. Hackers had a five-week head start before CISA said a word

CVE-2026-8037 lets anyone run root commands on Kemp LoadMaster appliances with zero credentials — and 792 attack attempts from 65 IP addresses landed before it made the federal watch list.

Priya Nair · Aug 23 · 6 min

Cisco networking and firewall hardware mounted in a server rack

Software

Cisco's firewall has a bug that lets anyone crash it — no password, no login, just one request

CVE-2026-20349 doesn't steal your data. It just reboots your VPN gateway on command, and Cisco's already watching it happen in the wild.

Priya Nair · Aug 23 · 6 min

Rows of server racks in a data center representing an email server infrastructure

Software

zimbra patched this bug in july. hackers are breaking into inboxes with it right now

CERT Polska is warning that attackers are actively exploiting an unauthenticated command-injection bug in Zimbra's SNMP monitoring component — one Zimbra quietly fixed five weeks ago, in version 10.1.20.

Priya Nair · Aug 22 · 6 min

Close-up of an NVIDIA GPU used for AI computing workloads

CISA gave federal agencies 3 days to fix this AI bug. Hackers got a 9-month head start

The flaw needs zero login to trigger — just a malicious webpage and a DNS trick — and it's already turning GPU clusters into crypto miners.

Lena Fischer · Aug 20 · 7 min

Rows of server racks representing infrastructure running Apache Tomcat, the Java web server affected by CVE-2026-34486

Software

CISA gave you until tomorrow to patch this Tomcat bug — an AI is already hunting for it

A Chinese hacker wired DeepSeek into an autonomous attack framework and pointed it at unpatched Apache Tomcat servers, and CISA wants federal systems fixed by Friday — everyone else should move just as fast.

Priya Nair · Aug 6 · 7 min

Rows of servers in a data center, the kind of infrastructure that runs self-hosted AI tools like Langflow

that AI agent builder you self-hosted? attackers don't even need a password to take it over

CVE-2026-9198 lets anyone run code on a default Langflow install with zero credentials — CISA gave federal agencies two days to patch it.

Lena Fischer · Aug 6 · 6 min

Networking and firewall equipment mounted in a server rack

Software

Cisco's firewall management tool shipped with a hidden login — and attackers found it first

CVE-2026-20316 is a static-credential bug in Secure FMC that's already on CISA's Known Exploited Vulnerabilities list, with a federal patch deadline of August 1.

Priya Nair · Aug 5 · 6 min

Software

n-able's remote-management tool has a hole attackers are already walking through — patch now

CVE-2026-18577 lets an attacker skip the login screen entirely and pivot straight into every endpoint N-central manages — CISA added it to its must-patch list within 24 hours.

Priya Nair · Aug 4 · 6 min