cisa.govotherKnown Exploited Vulnerabilities Catalog | CISA
CISA's Known Exploited Vulnerabilities (KEV) catalog is the authoritative list of CVEs with confirmed in-the-wild exploitation. It shows 1739 entries, each with vendor, product, description, CWE, ransomware-use flag, date added, due date, and a new BOD 26-04 forensic-triage flag. The latest entries cover Citrix NetScaler, Zammad (chained session fixation and root privilege escalation), Fortinet FortiMail, Cisco Catalyst SD-WAN Manager, WordPress Core, SharePoint, MikroTik RouterOS, Adobe Commerce, WSO2 and Check Point, plus old CVEs such as ProFTPD CVE-2015-3306 and Struts CVE-2016-3081. Feeds are available as CSV and JSON for vulnerability-management prioritisation.
TL;DR CISA's KEV catalog of actively exploited CVEs, with BOD 26-04 due dates and forensic-triage flags, available as CSV/JSON feeds.
Document
What it is
The 20 newest entries in CISA's KEV catalog (1,739 total), added 2026-09-22 to 2026-10-08. The summary names the vendors, but not the CVE IDs, the deadlines, or which entries need forensic triage. This is the actionable part for anyone running these products.
Affected
| Product | CVE | Impact | Triage (BOD 26-04) |
|---|---|---|---|
| ProFTPD | CVE-2015-3306 | Read/write arbitrary files via site cpfr / site cpto | Yes |
| Apache Struts | CVE-2016-3081 | RCE via method: prefix when Dynamic Method Invocation is enabled | not shown |
| ISC BIND | CVE-2015-5477 | DoS via TKEY queries | No |
| ONLYOFFICE Docs | CVE-2021-3199 | Path traversal (/.. in image upload parameter) when JWT is used, leading to RCE | not shown |
| Strapi | CVE-2023-22894 | Cleartext sensitive data via query filter; chains with CVE-2023-22621 to RCE | not shown |
| Citrix NetScaler | CVE-2026-88772 | Unauthenticated command execution (input validation) | Yes |
| Citrix NetScaler | CVE-2026-88779 | Buffer overflow, DoS | No |
| Zammad | CVE-2026-102489 + CVE-2026-102490 | Session fixation gives RCE as the zammad user; local escalation to root | Yes |
| Fortinet FortiMail | CVE-2026-104286 | Unauthenticated arbitrary file write (path traversal and NULL byte) | Yes |
| Cisco Catalyst SD-WAN Manager | CVE-2026-76504 | Unauthenticated admin access via URI hex-encoding handling | Yes |
| WordPress Core | CVE-2026-87902 | Unauthenticated remote file inclusion of a local .php file via page-template resolution, leading to RCE | Yes |
| MikroTik RouterOS | CVE-2026-67279 | Unauthenticated session channel and exec request; chains to CVE-2026-86060 | No |
| Adobe Commerce / Magento | CVE-2026-71362 | Incorrect authorization, elevated access with no user interaction (APSB26-92) | Yes |
| Check Point gateways (Site-to-Site or Remote Access VPN) | CVE-2026-85102 | Unauthenticated RCE on the gateway via certificate validation | Yes |
| Check Point management and log servers, SmartEvent | CVE-2026-93616 | Unauthenticated script upload and execution | not shown |
| Apple iOS, macOS, iPadOS | CVE-2026-86950 | CoreGraphics out-of-bounds write, code execution | No |
| Microsoft SharePoint | CVE-2026-65660 | Code injection by an authorized attacker | not shown |
| WSO2 API Manager, Control Plane, Traffic Manager, Universal Gateway | CVE-2026-5430 | Path traversal / unrestricted upload, RCE | not shown |
For Citrix, the advisory covers CVE-2026-88771 through CVE-2026-88778. CISA also lists a separate NetScaler buffer-overflow entry (RCE or DoS) with no CVE visible in the fetched text.
What to do
- Check deadlines first. Most entries have a 3-day due date (added 09-22 to 10-08, due 09-25 to 10-11), so nearly all are already past due. The Apple entry has a 14-day window and is due 2026-10-13, today.
- Forensic triage is a separate obligation from patching. For entries flagged "Yes", CISA's action text requires compliance with BOD 26-04 and its "Forensics Triage Requirements". Patching alone does not satisfy it, so treat the affected systems as possibly compromised.
- Citrix NetScaler (CVE-2026-88772): CISA says running the provided IOCs in the NetScaler console may help identify exploitation. Vendor steps are in Citrix CTX694799 (suspected compromise) and CTX697096.
- Zammad: patch both CVEs together. The session fixation gets an attacker in as the
zammaduser, and the second bug takes them to root. - Strapi: CISA notes the product may be EoL/EoS and advises moving to a supported version. Also check for CVE-2023-22621 as part of the same chain.
- Struts: the exposure depends on Dynamic Method Invocation being enabled (S2-032).
- Where no mitigation exists: CISA says to follow BOD 26-04 guidance for cloud services, or stop using the product.
- Assess exposure per asset: CISA says stakeholders must evaluate each asset's internet exposure.
Caveats
- Every entry visible here shows the ransomware-use flag as "Unknown".
- The fetched text did not show the triage flag, the CWE, or the dates for several entries, so those fields are marked "not shown" above and not guessed.
- This is a snapshot of one page of 1,739 results. Use the CSV or JSON feed for programmatic matching against your inventory.
Organisations named here
- BOD 26-04
- CISA
- CWE-284
CVEs named here
- CVE-2015-3306
- CVE-2021-3199
- CVE-2023-22894
- CVE-2023-22621
- CVE-2016-3081
- CVE-2015-5477
- CVE-2026-88779
- CVE-2026-102489
- CVE-2026-102490
- CVE-2026-104286
- CVE-2026-76504
- CVE-2026-86950
- CVE-2026-88772
- CVE-2026-87902
- CVE-2026-65660
- CVE-2026-67279
- CVE-2026-86060
- CVE-2026-71362
- CVE-2026-5430
- CVE-2026-85102
- CVE-2026-93616
- CVE-2026-88771
- CVE-2026-88778
Technologies named here
- ProFTPD
- ONLYOFFICE Docs Server
- NVD vulnerability detail pages
- Strapi
- Apache Struts
- ISC BIND
- Citrix NetScaler ADC and NetScaler Gateway
- Zammad GmbH Zammad
- Fortinet FortiMail
- Cisco Catalyst SD-WAN Manager
- Apple iOS, macOS, iPadOS
- WordPress Core
- Microsoft SharePoint
- MikroTik RouterOS
- Adobe Commerce and Magento
- Check Point Security Gateway and Spark Firewall
- Citrix NetScaler
- WordPress
- FortiMail
- CISA KEV
- Zammad
Techniques named here
- Cleartext storage of sensitive information via query filter
- Denial of service via TKEY queries
- Hex/URI encoding handling flaw giving admin access
- Out-of-bounds write in CoreGraphics
- Code injection
- Improper enforcement of behavioral workflow
- Incorrect authorization
- Path traversal enabling unrestricted file upload and RCE
- Improper certificate validation enabling unauthenticated RCE
- Vulnerability chaining
- Path traversal
Related in Threat Intel
huntress.comwriteupReverse Engineering the Six Stages of MacSync Stealer and RAT
huntress.comwriteupAI-Coded Malware | Analyzing Vibe-Coded AD Enumeration | Huntress
blog.talosintelligence.comtoolIntroducing CAIRN: Frontier tracking for AI-integrated malware (Cisco Talos)
huntress.comwriteup