cisa kev

13 articles · newest first

Rows of server racks in a data center, representative of the self-hosted infrastructure Gitea instances typically run on

a Gitea admin's hosting bill flagged 70% CPU usage. that's how he found the hackers

A bug that lets anyone with a free account plant a git hook is now CISA's problem — and it started with a cryptominer, not a headline.

Aliteq Team · Aug 26 · 6 min

Rows of rack-mounted network appliances in a data center, similar to load balancer hardware

Software

This load balancer bug got patched in June. Hackers had a five-week head start before CISA said a word

CVE-2026-8037 lets anyone run root commands on Kemp LoadMaster appliances with zero credentials — and 792 attack attempts from 65 IP addresses landed before it made the federal watch list.

Aliteq Team · Aug 23 · 6 min

Cisco networking and firewall hardware mounted in a server rack

Software

Cisco's firewall has a bug that lets anyone crash it — no password, no login, just one request

CVE-2026-20349 doesn't steal your data. It just reboots your VPN gateway on command, and Cisco's already watching it happen in the wild.

Aliteq Team · Aug 23 · 6 min

Rows of server racks in a data center representing an email server infrastructure

Software

zimbra patched this bug in july. hackers are breaking into inboxes with it right now

CERT Polska is warning that attackers are actively exploiting an unauthenticated command-injection bug in Zimbra's SNMP monitoring component — one Zimbra quietly fixed five weeks ago, in version 10.1.20.

Aliteq Team · Aug 22 · 6 min

Close-up of an NVIDIA GPU used for AI computing workloads

CISA gave federal agencies 3 days to fix this AI bug. Hackers got a 9-month head start

The flaw needs zero login to trigger — just a malicious webpage and a DNS trick — and it's already turning GPU clusters into crypto miners.

Aliteq Team · Aug 20 · 7 min

Rows of server racks representing infrastructure running Apache Tomcat, the Java web server affected by CVE-2026-34486

Software

CISA gave you until tomorrow to patch this Tomcat bug — an AI is already hunting for it

A Chinese hacker wired DeepSeek into an autonomous attack framework and pointed it at unpatched Apache Tomcat servers, and CISA wants federal systems fixed by Friday — everyone else should move just as fast.

Aliteq Team · Aug 6 · 7 min

Rows of servers in a data center, the kind of infrastructure that runs self-hosted AI tools like Langflow

that AI agent builder you self-hosted? attackers don't even need a password to take it over

CVE-2026-9198 lets anyone run code on a default Langflow install with zero credentials — CISA gave federal agencies two days to patch it.

Aliteq Team · Aug 6 · 6 min

Networking and firewall equipment mounted in a server rack

Software

Cisco's firewall management tool shipped with a hidden login — and attackers found it first

CVE-2026-20316 is a static-credential bug in Secure FMC that's already on CISA's Known Exploited Vulnerabilities list, with a federal patch deadline of August 1.

Aliteq Team · Aug 5 · 6 min

Software

n-able's remote-management tool has a hole attackers are already walking through — patch now

CVE-2026-18577 lets an attacker skip the login screen entirely and pivot straight into every endpoint N-central manages — CISA added it to its must-patch list within 24 hours.

Aliteq Team · Aug 4 · 6 min

Networking equipment and cables in a server rack, representing the Cisco Secure Firewall Management Center affected by CVE-2026-20316

Software

Cisco's firewall management tool had a hardcoded password. attackers found it before Cisco did

CVE-2026-20316 gives anyone the login to a low-privilege account baked into Cisco Secure FMC — and Cisco's own team says it was already being used in the wild before a patch existed.

Aliteq Team · Jul 31 · 7 min

NVD detail for CVE-2026-25089 showing a 9.8 FortiSandbox command injection

Software

a 9.8 in Fortinet's FortiSandbox lets anyone run commands with one crafted request — and it's being exploited

CVE-2026-25089 is an unauthenticated command-injection flaw in FortiSandbox, the security appliance meant to catch malware. It's on CISA's exploited list. The tool that inspects threats has become one.

Aliteq Team · Jul 28 · 9 min

NVD detail for CVE-2026-58644 showing a 9.8 SharePoint deserialization RCE

Software

the other SharePoint bug: a 9.8 that runs code with no login, already exploited and on CISA's list

Everyone focused on the SharePoint privilege-escalation zero-day. CVE-2026-58644 is worse: an unauthenticated deserialization flaw that runs code on the server, actively exploited, with a CISA deadline that's already passed.

Aliteq Team · Jul 28 · 9 min

A dark network security concept image representing an exploited appliance

Software

a perfect 10: the Ivanti Sentry bug that hands an anonymous attacker root, and it's already being backdoored

CVE-2026-10520 scores a maximum 10.0 — the rarest severity rating there is. No login, one network request, and an attacker owns the box as root. It's on CISA's exploited list, with public exploit code and confirmed backdoors.

Aliteq Team · Jul 28 · 7 min