tag: Cisa-Kev · 59 items
- Engineer — Act: Ivanti Connect Secure is a common enterprise VPN appliance; CISA KEV listing plus active exploitation plus a public GitHub PoC makes this urgent — patch ICS immediately and audit appliance logs and filesystem integrity for signs of pre-patch compromise.
- SOC/IR — Act: Active exploitation of an edge VPN device means assume-breach posture is warranted — hunt for anomalous outbound connections and lateral movement from ICS appliance IPs since the KEV listing date, and check for Ivanti-specific persistence IOCs from prior campaigns (SPAWN/BUSHWALK malware families).
- Leader — Act: Ivanti Connect Secure has systemic enterprise reach; confirm with your network/infra team whether ICS is in use, obtain a patch-status attestation this week, and brief leadership — this class of Ivanti exploitation has previously generated board-level headlines.
- Signals: CVE-2026-111357 — CISA KEV: listed, EPSS 0.01, public PoC on GitHub
- Engineer — Act: Patch GitLab CE/EE immediately to the fixed version addressing CVE-2026-97229 (CVSS 10.0, KEV-listed, public PoC on GitHub); also apply the Cisco firewall DoS fix. KEV listing with public PoC confirms active exploitation pressure.
- SOC/IR — Act: Hunt for exploitation attempts against GitLab instances since KEV listing date — look for anomalous API calls or unauthenticated RCE indicators in web/application logs; write or enable detections for CVE-2026-97229 exploitation patterns given the public PoC and confirmed active exploitation.
- Leader — Plan: Confirm with engineering that GitLab and Cisco firewall patching is on an accelerated track given KEV status; no board-level event unless exploitation is confirmed in your environment, but verify remediation timelines are within CISA’s required window.
- Signals: CVE-2026-97229 — CISA KEV: listed, EPSS 0.27, public PoC on GitHub, reported by 2 collected sources
- Engineer — Act: CISA KEV listed, actively exploited by a nation-state actor, and a public PoC exists — patch VMware ESX to the fixed version addressing CVE-2026-41709 immediately, then audit ESX logs for gaps or tampering that could indicate prior access.
- SOC/IR — Act: Active exploitation specifically targets audit trail visibility, meaning logs on compromised ESX hosts may already be incomplete — treat any unpatched ESX as potentially breached, hunt for Warp Panda TTPs in hypervisor logs since at least the KEV listing date, and sweep for published IOCs from the CrowdStrike disclosure.
- Leader — Act: A Chinese state-linked actor is actively exploiting CISA KEV-listed VMware ESX to suppress forensic evidence, with confirmed targeting of the US legal sector — confirm patch status with engineering this week, and if your organization is in the legal sector, brief leadership before they see the headline.
- Signals: CVE-2026-41709 — CISA KEV: listed, EPSS 0.01, public PoC on GitHub
- Engineer — Act: CISA-confirmed active exploitation of a Brotli compression library flaw affecting Node.js and HTTP/2 stacks; audit all services for affected Brotli versions and apply vendor patches immediately, prioritizing internet-facing Node.js and HTTP/2 endpoints.
- SOC/IR — Act: Active exploitation confirmed by CISA warrants an assume-breach sweep; hunt for anomalous outbound connections and unusual process behavior on hosts running Node.js or Brotli-linked HTTP/2 services since the disclosure date.
- Leader — Plan: CISA confirmation of exploitation in a widely-used library could generate customer or board questions if exposure is significant; confirm engineering has inventoried affected systems and establish a patch-completion timeline to report upward.
- Engineer — Act: CISA KEV listing plus EPSS 1.00 and a public GitHub PoC confirm imminent exploitation risk. Audit all deployments for PHP2Shell and apply the vendor patch immediately; treat any unpatched instance as potentially compromised.
- SOC/IR — Act: Active exploitation is confirmed and a public PoC is available, meaning intrusions may already be in progress. Hunt for signs of unauthenticated RCE against PHP-based services since early October 2026 and tune WAF/EDR rules to flag PHP2Shell-related web-shell activity.
- Leader — Plan: CISA KEV classification signals an organization-wide exposure check is warranted. Confirm with engineering whether PHP2Shell is in use, and if so, verify emergency patching is tracked as a priority-one item this week.
- Signals: CVE-2026-109618 — CISA KEV: listed, EPSS 1.00, public PoC on GitHub, reported by 2 collected sources
- Engineer — Act: CISA KEV listing confirms active exploitation — audit whether PHP2Shell is present in any web application or server environment and patch immediately to meet the Thursday federal deadline or your own SLA for KEV-listed vulns.
- SOC/IR — Act: Active exploitation confirmed by CISA KEV; sweep web server and application logs for PHP2Shell exploitation indicators since at least the past 30 days and tune WAF/SIEM rules to detect post-compromise activity on PHP-based endpoints.
- Leader — Plan: Confirm with engineering whether PHP2Shell is in the application inventory and that patching is tracked against the CISA deadline; if the org is a federal agency or contractor, escalate to Act and verify compliance before Thursday.
- Engineer — Act: Both vulns are CISA KEV-listed with confirmed active exploitation; CVE-2026-110447 has a public PoC on GitHub. If you run Arista VeloCloud Orchestrator or Collabora Online Built-in CODE Server, patch immediately and check vendor advisories for fixed versions — VeloCloud is edge infrastructure where a compromise can precede full remediation.
- SOC/IR — Act: Arista VeloCloud Orchestrator is an SD-WAN edge appliance; active KEV-listed exploitation means assume-breach posture is warranted — hunt for anomalous lateral movement or credential use originating from VeloCloud IPs and check CISA KEV advisory for any published IOCs or ATT&CK TTPs associated with these campaigns.
- Leader — Act: Confirm whether your organization runs Arista VeloCloud or Collabora Online and verify engineering has this on a same-week remediation track; KEV-listed active exploitation on edge infrastructure can escalate to a material incident requiring disclosure, so brief your risk owner now rather than after an incident surfaces.
- Signals: CVE-2026-110447 — CISA KEV: listed, EPSS 0.01, public PoC on GitHub
- Engineer — Act: CISA confirmation of active exploitation chains across four Plex Media Server vulnerabilities makes this urgent for any team hosting Plex. Patch Plex Media Server to the latest available version immediately and audit exposed instances for signs of compromise.
- SOC/IR — Plan: Active exploitation is confirmed but the summary lacks published IOCs or ATT&CK-mapped TTPs to hunt with now. Inventory any Plex Media Server instances in your estate and plan a sweep for post-compromise indicators (unexpected outbound connections, new scheduled tasks) once public technical analysis emerges.
- Leader — Skip
- Engineer — Act: FortiSandbox unauthenticated command injection is CISA KEV-listed with EPSS 0.76 and a public PoC — patch to the vendor-issued fixed version immediately, or isolate the appliance from untrusted network access if patching cannot be done within your window.
- SOC/IR — Act: With a public PoC and active exploitation implied by KEV listing, hunt for anomalous outbound connections or unexpected process execution from FortiSandbox hosts; check for command injection attempts in appliance logs since the CVE disclosure date.
- Leader — Plan: This is a critical edge-appliance RCE at the active-exploitation threshold, but it is a routine patch-and-remediate event unless your org runs FortiSandbox — confirm with engineering whether it is in scope and verify remediation is on track.
- Signals: CVE-2026-25089 — CISA KEV: listed, EPSS 0.76, public PoC on GitHub
- Engineer — Act: CISA KEV listed plus a public PoC and confirmed active exploitation make this urgent — apply the PAN-OS patch immediately and restrict management interface access to trusted IP ranges only.
- SOC/IR — Act: Active exploitation of a perimeter security appliance warrants an assume-breach posture — hunt for anomalous management-plane activity and lateral movement from PAN-OS devices dating back to initial disclosure.
- Leader — Act: PAN-OS is perimeter infrastructure for many enterprises; confirm whether it is in use, verify engineering has an emergency patch window in progress, and be ready to respond to customer or board questions given the CISA KEV designation and confirmed active exploitation.
- Signals: CVE-2026-0322 — CISA KEV: listed, EPSS 0.01, public PoC on GitHub, reported by 2 collected sources
- Engineer — Act: Ivanti Connect Secure is a widely deployed VPN appliance now under active zero-day exploitation; patch immediately and audit device logs and downstream network activity for signs of pre-patch compromise going back to October 1.
- SOC/IR — Act: Active exploitation of an edge VPN appliance demands an assume-breach posture — hunt for lateral movement or credential harvesting originating from ICS appliances in your estate since at least October 1, and check for anomalous outbound sessions from those hosts.
- Leader — Act: A CISA emergency advisory on a widely used VPN product with confirmed zero-day exploitation since October 1 warrants a same-week check: confirm whether Ivanti Connect Secure is in your environment, verify patch status with your team, and be ready to brief leadership if a breach window is identified.
- Engineer — Act: CVE-2015-3306 (ProFTPD, CVSS 10.0) carries EPSS 0.98, a public GitHub PoC, and active exploitation by a Chinese nation-state actor — patch ProFTPD immediately and audit all five KEV-listed CVEs before the October 11 federal deadline.
- SOC/IR — Act: Flax Typhoon is conducting live exploitation of these edge-service flaws; initiate a threat hunt for Flax Typhoon TTPs and sweep logs for ProFTPD anomalies (suspicious anonymous access, lateral movement from FTP services) since at least early October.
- Leader — Act: A Chinese nation-state actor is actively exploiting these vulnerabilities under a binding CISA directive with an October 11 deadline — confirm whether ProFTPD or the other four affected products are present in your environment and brief leadership given the geopolitical attribution and imminent compliance requirement.
- Signals: CVE-2015-3306 — CISA KEV: listed, EPSS 0.98, public PoC on GitHub
- Engineer — Act: CISA KEV-listed, public PoC exists, and active exploitation confirmed — unauthenticated arbitrary file write on FortiMail (CVSS 9.8). Identify all FortiMail instances and apply Fortinet’s patch immediately; treat unpatched appliances as potentially compromised.
- SOC/IR — Act: Active exploitation of an internet-facing email gateway means assume-breach posture for any unpatched FortiMail appliance; hunt for anomalous file creation events and unexpected processes spawned from the FortiMail service since the KEV listing date.
- Leader — Plan: A KEV-listed critical on email gateway infrastructure warrants confirming with engineering this week that all FortiMail deployments are inventoried and on the emergency patch queue — not board-level systemic risk, but email compromise has compliance and data-exposure implications worth tracking.
- Signals: CVE-2026-104286 — CISA KEV: listed, EPSS 0.02, public PoC on GitHub, reported by 2 collected sources
- Engineer — Act: CISA KEV listing plus a public GitHub PoC confirms active exploitation of this unauthenticated RCE on Zimbra mail servers. Apply the available Zimbra patch immediately; if the instance is internet-facing and patching will be delayed, consider taking it offline or blocking external access as a temporary control.
- SOC/IR — Act: Microsoft’s analysis includes attack paths and detection opportunities for an actively exploited, unauthenticated command injection on a common enterprise mail platform. Run a targeted hunt across Zimbra hosts for compromise indicators using the TTPs outlined in the post, and tune SIEM/EDR detections against the described exploitation behavior — assume any unpatched internet-facing Zimbra instance may already be compromised.
- Leader — Plan: This is a KEV-listed RCE on internet-facing mail servers, meaning exploitation is confirmed in the wild; confirm whether Zimbra is in your inventory and verify the engineering team has an emergency patch timeline in place this week. Not yet at Log4Shell systemic scope, but email server compromise carries credential and data-exfiltration risk worth validating before it becomes an incident.
- Signals: CVE-2026-73570 — CISA KEV: listed, EPSS 0.12, public PoC on GitHub
- Engineer — Act: CISA KEV-listed pre-auth memory overflow in NetScaler ADC/Gateway (CVSS 9.5) with public PoC and confirmed active exploitation — patch all NetScaler ADC and Gateway appliances to the vendor-fixed version immediately, prioritizing internet-facing instances.
- SOC/IR — Act: Active exploitation of a pre-auth edge-device RCE means assume-breach posture is warranted — sweep NetScaler ADC/Gateway logs for anomalous DTLS traffic, unexpected shell processes, or lateral movement originating from the appliance since initial disclosure date.
- Leader — Act: Citrix NetScaler is pervasive in enterprise environments and this actively exploited critical RCE is CISA KEV-listed — confirm whether NetScaler ADC/Gateway is deployed, direct immediate patching, and brief leadership if it is internet-facing or handles sensitive authentication flows.
- Signals: CVE-2026-88772 — CISA KEV: listed, EPSS 0.01, public PoC on GitHub, reported by 3 collected sources
- Engineer — Act: CVE-2026-86950 is CISA KEV-listed with active exploitation and a public PoC; update all iOS 26 and macOS 26/15 devices to Apple’s latest patched release immediately — iOS/macOS 27 branches are unaffected.
- SOC/IR — Act: Active exploitation of a CISA KEV-listed Apple vulnerability means you should assume some corporate macOS/iOS devices may already be compromised; hunt for anomalous activity on unpatched macOS 15/26 and iOS 26 endpoints since at least the patch release date of 2026-09-28.
- Leader — Act: Active exploitation of corporate Apple devices (macOS 15/26, iOS 26) with a CISA KEV listing warrants confirming this week that MDM-managed endpoints are receiving the emergency update and verifying coverage for any unmanaged devices.
- Signals: CVE-2026-86950 — CISA KEV: listed, EPSS 0.01, public PoC on GitHub, reported by 2 collected sources
- Engineer — Act: CISA emergency directive implies KEV listing with active exploitation of these NetScaler flaws — patch Citrix NetScaler to the vendor-specified remediated version immediately; Wednesday federal deadline signals urgency applicable beyond government.
- SOC/IR — Act: Active exploitation of NetScaler edge appliances warrants an assume-breach sweep — hunt for post-exploitation activity (credential harvesting, lateral movement) originating from NetScaler nodes and check for anomalous sessions since the vulnerability window opened.
- Leader — Act: Confirm whether the organization runs Citrix NetScaler and verify the engineering team has patching underway; CISA emergency directives on widely-deployed edge appliances frequently generate customer and board inquiries, so brief leadership proactively.
- Engineer — Act: Both CVEs are CISA KEV-listed with a public GitHub PoC and confirmed active exploitation — patch Citrix NetScaler ADC and Gateway to Citrix’s remediated versions immediately; treat any internet-exposed NetScaler appliance as potentially compromised pending verification.
- SOC/IR — Act: Active exploitation of perimeter appliances warrants an assume-breach posture — sweep for NetScaler-related IOCs and hunt for lateral movement or persistence artifacts on any NetScaler host going back to initial disclosure; check for anomalous management-plane access.
- Leader — Act: CISA-confirmed global exploitation of a critical edge appliance will generate board and customer questions — confirm whether your environment runs Citrix NetScaler ADC or Gateway, verify your engineering team has initiated emergency patching, and prepare a brief on exposure status before it surfaces externally.
- Signals: CVE-2026-88771 — CISA KEV: listed, EPSS n/a, public PoC on GitHub, reported by 3 collected sources
- Engineer — Act: SharePoint (CVE-2026-65660, CVSS 8.8) is CISA KEV-listed, has a public PoC, and is seeing active exploitation — patch immediately per Microsoft’s advisory. Also audit MikroTik RouterOS firmware versions and apply vendor patches for the co-listed flaw.
- SOC/IR — Act: Active exploitation of both SharePoint and MikroTik RouterOS means assume-breach posture for those surfaces: hunt SharePoint access logs for code-injection patterns and sweep network edge devices running RouterOS for anomalous outbound connections or config changes since the KEV listing date.
- Leader — Plan: Confirm whether SharePoint and MikroTik RouterOS appear in your asset inventory and verify engineering teams are tracking CISA BOD remediation timelines; no board-level communication required unless your sector has seen confirmed targeting or you are under federal compliance obligations.
- Signals: CVE-2026-65660 — CISA KEV: listed, EPSS 0.02, public PoC on GitHub
- Engineer — Act: CISA KEV listing plus public GitHub PoC confirm active exploitation of CVE-2026-5430 (WSO2 auth bypass); patch all affected WSO2 products immediately and audit authentication logs for anomalous bypass activity since PoC is publicly available.
- SOC/IR — Act: Active exploitation confirmed via CISA KEV across WSO2, SharePoint, and Adobe Commerce; hunt for authentication bypass patterns in logs for these platforms and sweep for any anomalous sessions or privilege escalations tied to these products since the PoC went public.
- Leader — Act: CISA-confirmed active exploitation of multiple widely-deployed enterprise platforms (SharePoint, WSO2, Adobe Commerce) warrants an immediate internal exposure check; confirm which products are in the estate and ensure patching teams treat these as P1 this week.
- Signals: CVE-2026-5430 — CISA KEV: listed, EPSS 0.01, public PoC on GitHub, reported by 2 collected sources
- Engineer — Act: Both flaws are CISA KEV-listed with confirmed active exploitation; patch WSO2 API Control Plane (CVE-2026-5430, CVSS 9.8) and Adobe Commerce/Magento immediately — a public PoC is on GitHub, lowering the bar for opportunistic exploitation.
- SOC/IR — Act: KEV listing confirms in-the-wild exploitation of both products; sweep web and API gateway logs for path traversal patterns targeting WSO2 API Control Plane and audit Adobe Commerce instances for webshell drops or unauthorized file access since the PoC became public.
- Leader — Plan: Confirm whether WSO2 API Control Plane or Adobe Commerce is in your environment and direct engineering to treat these as this-week patches; Adobe Commerce’s payment-processing role adds PCI DSS urgency if applicable.
- Signals: CVE-2026-5430 — CISA KEV: listed, EPSS 0.01, public PoC on GitHub
- Engineer — Act: Pre-auth RCE on a widely deployed VPN gateway with CISA KEV listing, active exploitation, and a public PoC demands immediate action: apply Check Point’s patch for CVE-2026-85102, then audit gateway logs for signs of pre-patch compromise.
- SOC/IR — Act: Active exploitation of an edge VPN device requires an assume-breach posture: hunt for unusual outbound connections or lateral movement originating from or through Check Point Security Gateway hosts since the earliest known exploitation date, and check threat intel feeds for published IOCs tied to this campaign.
- Leader — Act: CISA KEV listing and confirmed active exploitation of a perimeter VPN appliance are board-question-level conditions: confirm whether Check Point Security Gateway is in your environment, verify your team has an emergency patch plan, and be ready to brief leadership on exposure before this surfaces in the news.
- Signals: CVE-2026-85102 — CISA KEV: listed, EPSS 0.01, public PoC on GitHub
- Engineer — Act: CVE-2026-7273 is CISA KEV-listed with a public PoC on GitHub; patch Zyxel GS1900 series switch firmware immediately and audit Veeam deployments for associated flaws granting SYSTEM-level access.
- SOC/IR — Act: Active exploitation of an edge network device warrants an assume-breach posture; sweep for Zyxel GS1900 switches in the estate and hunt for anomalous lateral movement or command execution sourced from switch management interfaces since the disclosure date.
- Leader — Plan: CISA KEV confirmation of active exploitation in network switches and backup software (Veeam) is a concrete risk item; confirm with engineering this week that Zyxel GS1900 and Veeam instances in your environment are patched and request a status update before month-end.
- Signals: CVE-2026-7273 — CISA KEV: listed, EPSS 0.02, public PoC on GitHub
- Engineer — Act: CISA KEV listing confirms active exploitation of Zyxel GS1900 series switches; if any are in your environment, patch immediately and audit management-plane access logs for signs of unauthorized access.
- SOC/IR — Act: Active exploitation for data theft means assume-compromise posture on any Zyxel GS1900 devices; hunt for anomalous traffic or config changes originating from or through these switches since KEV listing date.
- Leader — Plan: Confirm whether Zyxel GS1900 switches appear in network inventory and verify patching is prioritized this week; federal agencies face a hard CISA deadline, but private-sector organizations should treat this as elevated-urgency given confirmed exploitation.
- Engineer — Act: CISA confirmation of active exploitation is effectively a KEV signal — pull the advisory for CVE IDs and patch Linux kernels on all cloud hosts, container nodes, and CI runners to fixed versions immediately; one flaw is rated critical.
- SOC/IR — Act: Active exploitation confirmed by CISA warrants an assume-breach posture on Linux servers — sweep for anomalous kernel-level activity and privilege escalation events since the advisory date, and tune EDR/auditd rules for kernel exploit post-exploitation behavior while patching proceeds.
- Leader — Plan: Confirm your engineering team has triaged and prioritized the CISA-flagged CVEs; organizations under FedRAMP or federal contracts face mandatory KEV remediation deadlines and should verify compliance timelines are met.
- Engineer — Act: All three CVEs are CISA KEV-listed with confirmed active exploitation; CVE-2025-39682 carries CVSS 9.8 with a public GitHub PoC. Apply available Linux kernel patches immediately across all hosts, prioritizing internet-facing or TLS-terminating systems.
- SOC/IR — Act: Active exploitation is confirmed by CISA KEV for kernel-level flaws — assume-breach posture is warranted on Linux hosts. Run an EDR sweep for unusual kernel module loads, privilege escalations, or post-exploitation behavior on Linux systems since the date of first exploitation disclosure.
- Leader — Plan: Three actively exploited Linux kernel CVEs including a CVSS 9.8 flaw warrant confirming your team’s patch response this week; direct engineering to validate patch status across Linux infrastructure and report back before the next leadership sync.
- Signals: CVE-2025-39682 — CISA KEV: listed, EPSS 0.01, public PoC on GitHub
- Engineer — Plan: CISA KEV listing and public PoC elevate urgency beyond routine patching; if your organization issues corporate Pixel devices, verify your MDM is enforcing the September 2026 security update to CVE-2026-58704’s fixed build level.
- SOC/IR — Plan: Limited targeted exploitation means a sophisticated actor is actively using this; if corporate Pixel devices are in scope, confirm MDM patch compliance and add coverage for post-exploitation behaviors (unexpected privilege changes on Android endpoints) since modem-level compromise offers minimal traditional SIEM visibility.
- Leader — Plan: CISA KEV designation confirms real-world targeted use; verify the corporate mobile fleet’s MDM enrollment and patch push status for September 2026 Android security updates, and note this aligns with elevated nation-state mobile targeting trends worth tracking on the risk register.
- Signals: CVE-2026-58704 — CISA KEV: listed, EPSS 0.00, public PoC on GitHub
- Engineer — Act: CISA KEV-listed, public PoC live, and actively exploited — patch AsyncOS for Cisco Secure Email Gateway to Cisco’s fixed release immediately; if patching is delayed, apply any available workaround and isolate the appliance from untrusted networks.
- SOC/IR — Act: Active exploitation of an edge mail appliance means assume-breach posture is warranted — sweep email gateway logs for anomalous process execution or unexpected outbound connections since the vulnerability was disclosed, and tune EDR/SIEM for unauthenticated root-level process spawns from the AsyncOS process tree.
- Leader — Act: Cisco Secure Email Gateway is a widely deployed enterprise appliance; active exploitation with a CVSS 9.8 and KEV listing warrants confirming whether your environment uses it this week and verifying your team has applied Cisco’s patch — brief leadership if the appliance handles regulated data or sits on a compliance boundary.
- Signals: CVE-2026-76461 — CISA KEV: listed, EPSS 0.02, public PoC on GitHub
- Engineer — Act: All five CVEs are KEV-listed with confirmed active exploitation; a public PoC exists for CVE-2026-42016 (CVSS 8.1). Audit your estate for JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS and apply vendor patches immediately — these are common CI/CD, remote-access, and network infrastructure components.
- SOC/IR — Act: Active exploitation of ScreenConnect (remote access) and Artifactory (build pipeline) creates high-value footholds; initiate assume-breach sweeps by reviewing ScreenConnect session logs and Artifactory access logs for unauthorized activity since the KEV listing date, and tune detections for anomalous authentication or file-access patterns on these systems.
- Leader — Plan: Confirm with engineering this week whether Artifactory, ScreenConnect, or RouterOS are deployed and verify an expedited patch cycle is underway; KEV listing raises the risk register for these assets but does not yet constitute a systemic breach event requiring board or customer notification.
- Signals: CVE-2026-42016 — CISA KEV: listed, EPSS 0.01, public PoC on GitHub
- Engineer — Act: CVSS 10.0 pre-auth RCE on N-central is CISA KEV-listed with active exploitation and a public GitHub PoC — patch N-central immediately and audit your N-central server logs for signs of compromise before the patch is applied.
- SOC/IR — Act: Active exploitation of an RMM platform is a high-priority assume-breach scenario; hunt for anomalous commands or lateral movement originating from N-central agents across managed endpoints since exploitation requires no credentials and leaves a narrow pre-auth detection window.
- Leader — Act: Compromised RMM tools give attackers keys to every managed endpoint — confirm whether your organization or any MSP you rely on runs N-central, and request written patch confirmation or an attestation of remediation given the September 11 CISA deadline.
- Signals: CVE-2026-86218 — CISA KEV: listed, EPSS 0.01, public PoC on GitHub
- Engineer — Act: CVE-2026-20079 carries a CVSS 10.0, is KEV-listed, has a public PoC, and EPSS 0.75 — all three signal immediate exploitation pressure on Cisco, Citrix, and Fortinet devices common in enterprise perimeters; patch all three affected products to vendor-specified fixed versions before September 12.
- SOC/IR — Act: Active exploitation of edge appliances from all three vendors means assume-breach posture is warranted — hunt for anomalous authentication events and lateral movement originating from Cisco, Citrix, and Fortinet devices since before today’s disclosure, and sweep for any available IOCs tied to these CVEs.
- Leader — Act: Three critical-severity, actively exploited flaws across widely deployed network vendors represent a systemic perimeter risk; confirm your team has prioritized patching all affected Cisco, Citrix, and Fortinet products before the Sept 12 deadline, and verify no prior compromise occurred on exposed appliances.
- Signals: CVE-2026-20079 — CISA KEV: listed, EPSS 0.75, public PoC on GitHub, reported by 2 collected sources
- Engineer — Act: CVE-2026-83548 is a CVSS 10.0 unauthenticated SSRF in SonicWall SMA 1000 — KEV-listed with a public GitHub PoC and confirmed active exploitation. Patch SonicWall SMA 1000 to the vendor-fixed version immediately and audit outbound connections from the appliance for reverse-shell traffic or unauthorized processes.
- SOC/IR — Act: Attackers exploiting these flaws are deploying reverse shells and crypto miners, giving clear post-compromise detection surface. Hunt for anomalous outbound connections and miner processes originating from SonicWall SMA 1000 appliances since the KEV listing date, and tune EDR/SIEM rules for reverse-shell execution patterns on edge devices.
- Leader — Act: A CVSS 10.0 unauthenticated flaw in a widely deployed enterprise VPN appliance is now KEV-confirmed exploited — this warrants same-week action. Confirm with your engineering team whether SonicWall SMA 1000 is in your estate and verify patch status; VPN compromise is a common lateral-movement entry point that may require disclosure if exploitation is found.
- Signals: CVE-2026-83548 — CISA KEV: listed, EPSS 0.01, public PoC on GitHub
- Engineer — Act: CISA KEV listing with active exploitation across NetScaler ADC/Gateway, Linux, and SQL Server — all plausible in enterprise environments; patch affected NetScaler and SQL Server instances immediately and verify Linux kernel versions against the KEV entries.
- SOC/IR — Act: NetScaler edge devices are a prime assume-breach target when exploitation precedes patching; hunt for post-exploitation activity on NetScaler appliances and any lateral movement from SQL Server hosts since these vulnerabilities entered active exploitation.
- Leader — Plan: Six KEV additions spanning widely-deployed infrastructure signal a broad active-exploitation wave; confirm your engineering teams are tracking patch timelines for NetScaler, Linux, and SQL Server against CISA’s binding operational directive deadlines.
- Signals: CVE-2019-1068 — CISA KEV: listed, EPSS 0.53, public PoC on GitHub
- Engineer — Act: Citrix NetScaler is a common edge appliance; active exploitation of an RCE with a CISA KEV order makes this immediate. Identify all NetScaler instances in your environment and apply the vendor patch now — Saturday deadline applies to federal agencies but exploitation is not sector-limited.
- SOC/IR — Act: Active exploitation of an edge RCE means attackers may already be inside before patching occurs; initiate an assume-breach sweep on NetScaler appliances, reviewing management-plane logs and lateral movement indicators since the vulnerability became public.
- Leader — Act: CISA’s mandatory patch order with a Saturday deadline signals systemic exploitation — confirm whether your organization runs Citrix NetScaler, verify remediation is in progress, and brief leadership if you operate federal systems or customer-facing NetScaler infrastructure.
- Engineer — Act: CISA KEV listed, CVSS 10.0, public PoC on GitHub, and active exploitation confirmed — all signals align for emergency patching. Apply Oracle’s patch for CVE-2026-21962 on all Oracle HTTP Server and WebLogic Server instances immediately; treat as an out-of-cycle emergency change.
- SOC/IR — Act: Active exploitation is confirmed via CISA KEV; the unauthenticated HTTP attack vector means exploit attempts are visible at the network layer. Hunt for anomalous unauthenticated HTTP requests to WebLogic management and listener ports since the KEV listing date, and tune SIEM/WAF rules for CVE-2026-21962 exploitation patterns.
- Leader — Act: A maximum-severity, actively-exploited Oracle middleware flaw in CISA KEV warrants same-week leadership attention for any org running WebLogic in regulated or customer-facing environments. Confirm whether Oracle WebLogic or Oracle HTTP Server is in your environment, verify emergency patching is in motion, and prepare a brief for leadership if these systems support critical workloads.
- Signals: CVE-2026-21962 — CISA KEV: listed, EPSS 0.43, public PoC on GitHub
- Engineer — Act: CISA KEV listing with active exploitation means immediate action: patch Zimbra Collaboration Suite to the vendor-recommended version within the 3-day federal window, or sooner if possible.
- SOC/IR — Act: Active exploitation is confirmed; hunt for anomalous Zimbra activity (unusual logins, webshell artifacts, outbound connections from ZCS hosts) dating back at least 30 days and tune detections for ZCS-specific abuse patterns.
- Leader — Plan: If your org runs Zimbra, confirm patching is underway and verify no compromise occurred; if Zimbra is a vendor dependency, request their remediation attestation this week.
- Engineer — Plan: TrueConf Server is niche self-hosted comms software, so most teams won’t be exposed, but CISA KEV confirms active exploitation — audit your inventory and if you run TrueConf Server, elevate to Act and apply vendor patches immediately.
- SOC/IR — Learn: CISA KEV confirms active exploitation but the item provides no IOCs, TTPs, or attack patterns to hunt or detect against; monitor for follow-on threat intel with TrueConf-specific indicators before building detections.
- Leader — Skip
- Engineer — Act: CISA’s active-exploitation warning effectively signals KEV listing; teams running MLflow in AI/ML pipelines should patch to the fixed version immediately and audit pipeline access logs for signs of prior compromise.
- SOC/IR — Plan: The item confirms active exploitation but provides no IOCs or TTPs to hunt on; pull the full CISA advisory for indicators, then build detection rules targeting anomalous MLflow API or model-registry access patterns.
- Leader — Plan: Confirm whether data science or engineering teams operate MLflow, then verify patching is tracked to completion — CISA exploitation warnings on AI/ML tooling are increasingly likely to surface in customer security questionnaires.
- Engineer — Act: Four KEV-listed critical vulns across platforms you likely run — patch macOS (CVE-2026-65400, CVSS 9.8), SharePoint, vCenter, and Microsoft IKE immediately; a public PoC exists for the macOS flaw, making exploitation trivial.
- SOC/IR — Act: Active exploitation of vCenter and SharePoint warrants an assume-breach sweep — hunt for post-exploitation activity (credential dumping, lateral movement) on these systems dating back at least 30 days, and tune detections for anomalous SharePoint API calls and vCenter admin actions.
- Leader — Act: KEV-listed active exploitation across macOS endpoints, SharePoint, and vCenter is a systemic risk event — confirm patch status and exposure scope with engineering this week, and be prepared to brief leadership if any of these systems host sensitive data or are business-critical.
- Signals: CVE-2026-65400 — CISA KEV: listed, EPSS 0.00, public PoC on GitHub
- Engineer — Act: CISA-confirmed active exploitation by ransomware operators means patch immediately — apply the Microsoft Windows Task Host security update to all Windows endpoints and servers; prioritize internet-facing and domain-joined systems.
- SOC/IR — Act: Assume ransomware precursor activity may already be present — hunt for anomalous Task Host (taskhostw.exe) process behavior and lateral movement since April when exploitation was first flagged; tune EDR detections for suspicious task scheduler abuse.
- Leader — Act: Ransomware exploitation of a CISA-flagged Windows flaw is a board-question-level event — confirm patching status with your engineering team this week and brief leadership on exposure and remediation timeline before an incident forces the conversation.
- Engineer — Act: CISA KEV listing confirms active exploitation of a critical RCE in Ray, a widely-used Python distributed computing framework for AI/ML workloads; patch Ray immediately and, if patching is delayed, restrict external access to Ray dashboard and cluster endpoints.
- SOC/IR — Act: Active exploitation confirmed via KEV; hunt for unauthorized code execution originating from Ray cluster nodes and sweep for internet-exposed Ray dashboards in your environment, prioritizing ML infrastructure that may not be covered by standard EDR.
- Leader — Plan: If your organization runs AI/ML workloads, ask engineering to confirm whether Ray is deployed and to report patch status; KEV listing makes this likely to surface in auditor or customer questionnaires about your ML infrastructure security posture.
- Engineer — Act: SonicWall SMA1000 is a common enterprise remote-access appliance; CISA confirmation of active ransomware exploitation effectively means KEV-listed. Patch SMA1000 to the vendor-released fixed version immediately and audit device logs for signs of pre-patch compromise.
- SOC/IR — Act: Edge-device exploitation by ransomware gangs requires an assume-breach posture: sweep SMA1000 logs for exploitation indicators, hunt for anomalous outbound SSRF traffic or lateral movement originating from the appliance segment since the vulnerability window opened, and tune EDR/SIEM alerts on hosts reachable from those devices.
- Leader — Act: Maximum-severity flaw on a remote-access appliance with confirmed ransomware exploitation is a board-question-level event; confirm whether SonicWall SMA1000 is in your estate and demand an immediate patch status report from engineering — delay creates material incident exposure under SEC disclosure timelines.
- Engineer — Act: CISA has flagged active exploitation of this critical command injection flaw in Progress Kemp LoadMaster; patch to the latest fixed version immediately and audit LoadMaster logs for signs of prior compromise.
- SOC/IR — Act: Edge device under active exploitation warrants an assume-breach posture — sweep LoadMaster access logs for anomalous commands or unexpected outbound connections since the vulnerability was disclosed, and tune detections on traffic originating from load balancer management interfaces.
- Leader — Plan: Confirm whether LoadMaster is deployed anywhere in the environment and verify your engineering team has prioritized patching; this is not yet a board-level systemic event but CISA active-exploitation designation means it should be on the remediation radar this week.
- Engineer — Act: Patch on-premise JetBrains TeamCity to the fixed version immediately — CISA KEV listing confirms active exploitation, a public PoC is on GitHub, and the unauthenticated deserialization flaw carries a 9.8 CVSS score. Also audit TeamCity for unauthorized admin accounts or altered build configurations.
- SOC/IR — Act: TeamCity servers are pre-authentication targets; assume-breach sweep is warranted — hunt for anomalous build jobs, new admin accounts, or outbound connections from CI/CD hosts since patch disclosure. Map exploitation behavior to ATT&CK T1190 (Exploit Public-Facing Application) and tune EDR/SIEM rules for post-exploitation on build agents.
- Leader — Act: On-premise TeamCity RCE under active exploitation carries supply-chain risk comparable to prior CI/CD incidents — confirm this quarter whether your organization runs on-premise TeamCity instances and verify patch status with engineering before end of week.
- Signals: CVE-2026-63077 — CISA KEV: listed, EPSS 0.01, public PoC on GitHub
- Engineer — Act: All three products are KEV-listed with confirmed active exploitation and a 72-hour federal patch deadline — check your inventory for Langflow, N-able N-central, and Apache Tomcat instances and apply vendor patches immediately, prioritizing any internet-exposed deployments.
- SOC/IR — Act: Actively exploited RMM (N-central) and Java servlet (Tomcat) instances are high-value footholds; hunt for web shells on Tomcat endpoints and audit N-central for unauthorized agent activity or lateral-movement artifacts since the CISA advisory date.
- Leader — Plan: Confirm with engineering whether the organization runs Langflow, N-able N-central, or Apache Tomcat and ensure the patch sprint is underway; the federal 3-day deadline signals regulator attention and may surface in upcoming audit or customer questionnaire conversations.
- Engineer — Act: All three CVEs are CISA KEV-listed with confirmed active exploitation; CVE-2026-9198 in Langflow is a CVSS 9.8 unauthenticated RCE with a public PoC — patch Langflow, Apache Tomcat, and N-central to current vendor-recommended versions immediately, prioritizing any internet-exposed instances.
- SOC/IR — Act: Active exploitation of Langflow (unauthenticated RCE) and Tomcat creates immediate hunt obligations — sweep logs for exploitation attempts against these services since August 5, check for post-exploitation indicators (new processes, outbound connections) on hosts running any of the three products.
- Leader — Plan: Three simultaneous KEV additions including a critical AI-workflow tool (Langflow) warrant confirming your team’s KEV remediation SLA is on track and verifying whether N-central (an RMM platform) is in scope — RMM compromise can enable broad lateral movement across managed endpoints.
- Signals: CVE-2026-9198 — CISA KEV: listed, EPSS 0.02, public PoC on GitHub
- Engineer — Act: CVE-2026-18577 is CISA KEV-listed with a public PoC and confirmed in-the-wild exploitation; if you run N-able N-central, apply the latest patch immediately and treat any N-central host as potentially compromised pending verification.
- SOC/IR — Act: Confirmed customer compromises via an RMM platform mean privileged agent access may already be weaponized; hunt for anomalous lateral movement or command execution originating from N-central agents since the disclosure date and sweep admin audit logs for unauthorized access.
- Leader — Act: RMM platforms have privileged access across entire client estates — if your organization uses an MSP that runs N-able N-central, this week confirm whether they are patched and request a written attestation, as confirmed customer compromises indicate active supply-chain risk through managed-service relationships.
- Signals: CVE-2026-18556 — CISA KEV: not listed, EPSS 0.00, public PoC on GitHub · CVE-2026-18577 — CISA KEV: listed, EPSS 0.01, public PoC on GitHub, reported by 2 collected sources
- Engineer — Act: CVE-2026-16232 (CVSS 9.3) is CISA KEV-listed and actively exploited with a public Rapid7 PoC now amplifying risk; patch Check Point Security Management Server and MDS to the vendor-supplied fixed release immediately, and verify no unauthorized SmartConsole logins occurred before the patch window.
- SOC/IR — Act: Active exploitation of a management-plane authentication bypass means compromise may precede patching in affected environments; hunt for anomalous SmartConsole login events and unusual policy-change activity since the vulnerability’s disclosure date, and establish a detection baseline on SmartConsole auth logs.
- Leader — Plan: Confirm with engineering that any Check Point Security Management Server instances are on the immediate patch list given active exploitation and KEV listing; while not yet a Log4Shell-scale systemic event, a compromised firewall management plane represents catastrophic policy-control risk worth a brief escalation check this week.
- Signals: CVE-2026-16232 — CISA KEV: listed, EPSS 0.13, public PoC on GitHub
- Engineer — Act: CVE-2026-16812 (CVSS 10.0) is CISA KEV-listed with a public PoC and confirmed active exploitation — patch on-premises VeloCloud Orchestrator to the vendor-fixed version immediately and treat any unpatched instance as potentially compromised.
- SOC/IR — Act: Active exploitation of this RCE means on-prem VCO hosts should be treated as assume-breach candidates; hunt for anomalous process execution or outbound connections originating from VeloCloud Orchestrator nodes and sweep for IOCs since the date public PoC became available.
- Leader — Act: Confirm whether the organization runs on-premises VeloCloud Orchestrator and if so escalate to an emergency patch cycle this week; a CVSS 10.0 SD-WAN orchestration flaw on the CISA KEV list under active exploitation is a board-question-level event for enterprises relying on it for network management.
- Signals: CVE-2026-16812 — CISA KEV: listed, EPSS n/a, public PoC on GitHub
- Engineer — Act: CVE-2026-16232 is CISA KEV-listed, CVSS 9.3, with a public PoC and confirmed active exploitation — patch Check Point Security Management and MDSM to the vendor-released fixed version immediately, then audit SmartConsole admin access logs for unauthorized sessions.
- SOC/IR — Act: Active exploitation of a full admin bypass on security management infrastructure is an assume-breach trigger — sweep SmartConsole audit logs for anomalous admin logins and unauthorized policy changes since the disclosure date, and hunt for lateral movement from compromised management hosts.
- Leader — Act: A KEV-listed authentication bypass granting full admin control over Check Point firewall management is a systemic risk event — confirm with your engineering team whether Check Point SmartConsole or MDSM is in use and verify patching status before board or customer inquiries arrive.
- Signals: CVE-2026-16232 — CISA KEV: listed, EPSS n/a, public PoC on GitHub
- Engineer — Act: Both CVEs are CISA KEV-listed with public PoCs and confirmed active exploitation deploying persistent webshells and rogue plugins. Patch WordPress Core immediately, then audit web root directories for unexpected PHP files and review installed plugins for unauthorized additions.
- SOC/IR — Act: Active webshell deployment creates a concrete detection surface — sweep web server access logs for unusual POST requests to new PHP files in WordPress directories since public PoC release, hunt for unexpected process spawning from web server processes, and add rules for plugin installation events outside change-window hours.
- Leader — Plan: WordPress is pervasive; CISA KEV listing on both CVEs signals confirmed active exploitation at scale. Confirm this week that engineering has inventoried all WordPress instances and is treating these as priority patches — a successful webshell compromise could trigger breach notification obligations if customer data is exposed.
- Signals: CVE-2026-60137 — CISA KEV: listed, EPSS 0.04, public PoC on GitHub, reported by 2 collected sources · CVE-2026-63030 — CISA KEV: listed, EPSS 0.09, public PoC on GitHub, reported by 3 collected sources
- Engineer — Act: CISA KEV listing confirms active exploitation of this RCE in Langflow, a framework increasingly adopted by AI development teams. Audit all environments for Langflow deployments and patch to the fixed version immediately — days-level urgency, not weeks.
- SOC/IR — Act: Active exploitation of a Langflow RCE means any instance in your estate should be treated as potentially compromised; initiate an assume-breach sweep of Langflow hosts for post-exploitation artifacts (new processes, outbound connections, credential access) and hunt for inbound exploitation attempts in web/proxy logs since the vulnerability became public.
- Leader — Plan: Langflow is niche enough that board escalation is unlikely unless your AI engineering teams are actively using it — confirm with engineering whether Langflow is deployed anywhere in the environment and ensure it lands in the emergency patch queue this week.
- Engineer — Act: FortiSandbox is actively exploited per CISA KEV listing with a public PoC on GitHub; patch to the fixed version immediately and check for signs of compromise on any internet-facing FortiSandbox appliances.
- SOC/IR — Act: KEV listing plus public PoC means exploitation is likely underway; hunt for anomalous outbound connections or new processes spawned from FortiSandbox hosts since the PoC publication date, and check edge appliance logs for unauthenticated command-injection attempts.
- Leader — Plan: KEV-listed Fortinet RCE warrants confirming whether FortiSandbox is in the environment and requesting patch status from the infrastructure team; brief on remediation timeline if deployed, given the active exploitation signal.
- Signals: CVE-2026-25089 — CISA KEV: listed, EPSS 0.36, public PoC on GitHub
- Engineer — Act: CISA KEV listing with active exploitation means patch FortiSandbox to the vendor-fixed version immediately — treat this as a critical-priority change with a days-level window, not weeks.
- SOC/IR — Act: Active exploitation of FortiSandbox warrants an assume-breach sweep on any FortiSandbox instances in the estate; hunt for anomalous outbound connections or config changes on those appliances since the vulnerability window opened.
- Leader — Act: Confirm whether FortiSandbox is deployed anywhere in your environment, verify the patching timeline with your engineering team, and be prepared to brief leadership if you are a federal agency facing CISA’s Sunday deadline.
- Engineer — Act: SharePoint Server CVE-2026-58644 (CVSS 9.8) is KEV-listed with active exploitation and a public GitHub PoC — patch immediately; federal deadline is July 19, 2026, so treat this as emergency priority regardless of your organization type.
- SOC/IR — Act: With active exploitation confirmed and a public PoC live, treat any on-prem SharePoint Server as potentially compromised — sweep SharePoint ULS/IIS logs for deserialization anomalies and unusual POST requests to SharePoint endpoints since the vulnerability was disclosed.
- Leader — Act: A CVSS 9.8 SharePoint RCE is actively exploited and KEV-listed with a two-day federal remediation deadline — confirm this week whether your environment runs SharePoint Server on-prem and verify the engineering team has emergency patching underway before the July 19 deadline.
- Signals: CVE-2026-58644 — CISA KEV: listed, EPSS 0.01, public PoC on GitHub
- Engineer — Act: CISA KEV listing with confirmed active exploitation and an imminent Saturday deadline; audit your environment for Oracle E-Business Suite deployments and apply Oracle’s patch immediately.
- SOC/IR — Act: Active exploitation is underway against Oracle EBS financial systems; initiate a hunt for anomalous EBS access patterns and monitor threat intel feeds for IOCs to sweep across relevant log sources.
- Leader — Act: A CISA-mandated Saturday deadline on actively exploited financial software warrants same-week confirmation from your engineering team that Oracle E-Business Suite is either patched or absent from your environment.
- Engineer — Act: Both CVEs are CISA KEV-listed with public PoCs and confirmed active exploitation — patch SMA1000 appliances to the latest firmware immediately and audit access logs for signs of pre-patch compromise.
- SOC/IR — Act: Edge appliance exploitation means assume-breach posture is warranted — sweep for lateral movement or credential harvesting activity originating from SMA1000 IPs since the zero-day window, and hunt for post-exploitation behavior in downstream systems.
- Leader — Act: Actively exploited VPN appliances are a board-level exposure; confirm whether your organization runs SMA1000, verify patching status with the engineering team, and prepare a brief in case the incident becomes public.
- Signals: CVE-2026-15409 — CISA KEV: listed, EPSS n/a, public PoC on GitHub, reported by 2 collected sources · CVE-2026-15410 — CISA KEV: listed, EPSS n/a, public PoC on GitHub
- Engineer — Act: CISA warning indicates KEV-level active exploitation against internet-exposed on-premises SharePoint Server. Apply Microsoft’s patches immediately and verify no externally reachable SharePoint instances remain unpatched.
- SOC/IR — Act: Active exploitation of internet-facing SharePoint means assume-breach posture is warranted; hunt for post-exploitation activity (lateral movement, credential access) on SharePoint hosts since the earliest known exploitation date and review IIS/ULS logs for anomalous request patterns.
- Leader — Act: Confirm whether the organization runs on-premises SharePoint Server exposed to the internet, and get a patching status update from engineering this week — active exploitation with a CISA advisory is the kind of event that surfaces in board or customer security reviews.
- Engineer — Act: CISA KEV-listed, CVSS 10.0, actively exploited as zero-days with a public PoC on GitHub — patch iCagenda and Balbooa Forms Joomla extensions to the latest fixed versions immediately if these are in your stack.
- SOC/IR — Act: In-the-wild zero-day exploitation of web-facing Joomla components means you should assume compromise may predate patching — sweep web access logs for anomalous requests targeting these extension endpoints and confirm whether any estate assets run Joomla with either plugin.
- Leader — Plan: CISA KEV listing at CVSS 10.0 warrants a same-week inventory check of web properties for Joomla usage with these extensions; if confirmed in use, escalate to engineering for urgent remediation before this surfaces in a customer questionnaire or audit.
- Signals: CVE-2026-48939 — CISA KEV: listed, EPSS 0.02, public PoC on GitHub