Tag: CISA KEV
All articles about CISA KEV.
Actively exploited
Exploited UnrealIRCd flaw CVE-2026-114713 lets any user run commands with server authority
On Friday 13 November 2026 CISA added CVE-2026-114713, a flaw in the UnrealIRCd IRC server, to its Known Exploited Vulnerabilities catalog and gave federal agencies just three days to fix it. The bug in the labeled-response module lets any user on a network with two or more linked servers inject server-to-server commands that are executed with server authority, such as KILL or GLINE. The project's maintainer called it the most critical UnrealIRCd issue in 15 years. The fix shipped on 7 November as version 6.2.7.1 and as a hot-patch that needs no restart.
Actively exploited
Openwave Webtop Media Transcoder: an old document converter flaw is now exploited
Run Openwave Webtop webmail for your customers? Media Transcoder versions before 1.1.22.0 ignore the file type restrictions the administrator has set. The vendor has confirmed attacks and CISA added the flaw to its exploited list on 10 November, even though the vendor says the fixed release shipped back in December 2021.
Actively exploited
IBM Aspera Faspex: an authorization flaw hands users full admin rights, and it is already exploited
Use IBM Aspera Faspex 5 to move large files? On 7 November 2026 IBM fixed CVE-2026-123218, which lets an ordinary signed-in user take full administrative control. Two days later CISA added it to its list of known exploited vulnerabilities and gave US federal agencies only until 12 November to fix it.
Actively exploited
AhsayCBS intrusion: attackers left webshells, a cryptominer and a Python implant on backup servers
On 9 November 2026 Huntress published a deep dive into an intrusion that hit three AhsayCBS backup servers through CVE-2026-105133 and CVE-2026-105134. The flaws have been public and patched since October 2026 and are listed in CISA's KEV catalog. What's new is what the attacker left behind: five webshell families, a cryptominer, a Python implant talking to an unidentified C2, tunneling tools and theft of Veeam credentials. Patching does not remove any of it.
Actively exploited
Cisco BroadWorks: an August XXE flaw is now exploited, and attackers are stealing server private keys
Run Cisco BroadWorks? CVE-2026-20320 has been fixed since 19 August 2026, but CISA added it to its exploited list on 10 November. Malbear Labs has described an intrusion at a European telecoms provider in which the attacker used it to steal the server's private keys and certificates.
Actively exploited
FreeSWITCH: one SIP MESSAGE is enough to run commands on your VoIP server
Run a PBX, contact centre or VoIP service built on FreeSWITCH? Check your version now. Attackers are already exploiting CVE-2026-116779, according to both the vendor and CISA, and the fix is in 1.11.3.
Actively exploited
GPUStack: behind a same-host reverse proxy, anyone on the internet is admin
Running GPUStack to serve your own AI models? Check your version. Attackers are using CVE-2026-102895 to run code on GPU servers, and CISA added it to its exploited list on 9 November 2026 – even though the fix in version 2.2.0 shipped back in June 2026.
Actively exploited
Ivanti Connect Secure: attackers chain three flaws to take over the VPN gateway
If your organisation uses Ivanti Connect Secure for remote access, check its version now. All three flaws in this chain are in CISA's catalog of exploited vulnerabilities, the attacks began on a gateway that was fully patched at the time, and Ivanti's own Integrity Checker missed them.
Actively exploited
Magento and Adobe Commerce: attackers exploit the PolyShell flaw
If you run an online store on Magento Open Source or Adobe Commerce, check that the July patch APSB26-73 is installed – and then check whether someone got in before you patched. CISA says CVE-2026-48356, nicknamed PolyShell, is being exploited to plant webshells and inject scripts into storefronts.
Actively exploited
OpenSSH on Alpine Linux: attackers can log in over SSH without knowing the password
Run servers, VMs or containers on Alpine Linux with an SSH server? Check your openssh package. Under certain conditions, CVE-2026-123158 lets anyone in who sends a long enough password. OpenSSH and Alpine shipped fixes on 5 November 2026, and attackers have been exploiting it since 7 November.
Actively exploited
SonicWall SSLVPN CVE-2026-19868: attackers bypass SAML login and MFA
If your organisation runs SSLVPN on a SonicWall firewall with SAML sign-in, check your SonicOS version today. CISA says CVE-2026-19868 is already being exploited, and it lets an attacker with a valid password skip the SAML step – and the MFA that comes with it.
Actively exploited
WordPress: attackers exploit a flaw in the core update process
Run a WordPress site? CVE-2026-119977 lets an attacker with no account run code on your server while WordPress is updating itself, and CISA says it is being exploited. WordPress fixed it on 28 October 2026 in version 7.1.4 and in security releases for older branches.