CISA Adds Fortinet CVE-2025-61624 to Actively Exploited Vulnerabilities List
CISA added CVE-2025-61624 in Fortinet products to the KEV catalog. The flaw allows a privileged account to write or delete arbitrary files.
Tag KEV
CVE-2026-102764 BeyondTrust: Critical Flaw Exploited as a Zero-Day
According to Mandiant, a critical vulnerability in BeyondTrust Remote Support was exploited before a fix was disclosed. Administrators of self-hosted appliances should deploy the update and check for possible signs of compromise.
CISA Adds Old Apache Struts Vulnerability to Exploited Vulnerabilities Catalog
CISA added CVE-2016-3081 in Apache Struts to the KEV catalog. The flaw enables remote code execution when Dynamic Method Invocation is enabled.
U.S. Seizes Domains of Microscan and FishHub Tools Linked to Flax Typhoon
The U.S. Department of Justice and FBI, acting under court authorization, seized seven domains used by the Microscan and FishHub tools. According to officials, they were used to scan for vulnerabilities, conduct spear-phishing and gain subsequent access to networks.
CISA Lists Zammad Vulnerability as Actively Exploited; Chaining Could Lead to Root Access
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the Zammad vulnerability CVE-2026-102489 to its catalog of actively exploited vulnerabilities. Combined with a second flaw, it could allow an attacker to gain root privileges.
CISA Adds CVE-2026-65660 in SharePoint to Actively Exploited Vulnerabilities
CISA added the CVE-2026-65660 vulnerability in on-premises Microsoft SharePoint servers to its KEV catalog. Microsoft has released fixes for three supported editions.
CISA Adds MikroTik RouterOS Vulnerability CVE-2026-67279 to Actively Exploited Vulnerabilities
CISA added MikroTik RouterOS vulnerability CVE-2026-67279 to the KEV catalog. Administrators are advised to update and restrict SSH access.
CISA Adds CVE-2026-5430 in WSO2 to Actively Exploited Vulnerabilities; Description Differs from Vendor
CISA added the CVE-2026-5430 vulnerability in WSO2 products to the KEV catalog. The vendor describes it as a JWT authentication bypass, while the CISA entry uses a different characterization of the flaw.
CISA Adds Three Linux Kernel Flaws to Actively Exploited Vulnerabilities
CISA has recorded active exploitation of three Linux kernel flaws. U.S. federal civilian agencies have until September 21, 2026, to remediate and conduct forensic triage of affected assets.
CISA Adds Linux CVE-2026-53266 to Actively Exploited Vulnerabilities List
CISA added an ebtables SNAT vulnerability in the Linux kernel to its KEV catalog. Organizations should review affected configurations and deploy fixes from vendors.