[CLSTR]
< Back to situations

Monitor this situation.

[SITUATION] · [ACTIVE] · [TECHNOLOGY]

12 clusters · 48 sources · 65 days · First seen · Last updated

CISA vulnerability exploitation and patching directives

Overview

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has continued issuing directives to federal agencies regarding multiple actively exploited software vulnerabilities. Following the September 9, 2026, addition of the ‘StyleSmuggler’ flaw in Adobe Commerce (CVE-2026-75650), CISA also added a static code injection vulnerability in N-able N-central (CVE-2026-86218) and a Microsoft Windows link-following vulnerability (CVE-2026-81963) to its Known Exploited Vulnerabilities (KEV) catalog. On September 22, CISA added three high-severity Linux kernel vulnerabilities: CVE-2025-39682, affecting the TLS receive path; CVE-2026-53266, an out-of-bounds write in the ebtables SNAT ARP rewrite path; and CVE-2025-39964, a long-standing race condition in the AF_ALG cryptographic interface. On the same day, CISA ordered agencies to patch a stack-based buffer overflow in Zyxel GS1900 series switches (CVE-2026-7273). By September 25, CISA added further critical flaws, including a code injection vulnerability in Microsoft SharePoint Server (CVE-2026-65660), an SSH protocol flaw in MikroTik RouterOS (CVE-2026-67279), a path traversal flaw in WSO2 (CVE-2026-5430), and an authorization flaw in Adobe Commerce (CVE-2026-71362). On September 30, CISA added a critical authentication bypass in Cisco Catalyst SD-WAN Manager (CVE-2026-76504). In October, Fortinet confirmed a critical zero-day path traversal vulnerability (CVE-2026-104286) in its FortiMail gateway. For the week of October 12–18, CISA added nine new vulnerabilities, including a path traversal flaw in Fortinet products (CVE-2025-61624) used by PEERSTITCH malware to exploit FortiManager, and an authentication bypass in BeyondTrust Remote Support (CVE-2026-102764). Other additions included flaws in Atlassian, Cisco, AhsayCBS, Palo Alto Networks, Microsoft, and Ivanti products. During the same period, CISA added five entries for the week of October 5–11, including flaws in Strapi, ONLYOFFICE Docs Server, Apache Struts, ISC BIND, and ProFTPD. Cisco reported active exploitation of a zero-day in its Secure Email Gateway (CVE-2026-76519), while Ivanti Connect Secure faced a chain of three zero-day vulnerabilities, including CVE-2026-104935, used by threat actor UTA0576.

Entities

CISA · Fortinet · Microsoft · Google · Cisco

Claims

What the coverage asserts, and how many sources carry each claim.

Coverage disagrees

Sources make claims that cannot both be true. CLSTR reports the disagreement; it does not decide who is right.

  • "CISA set a federal remediation deadline of September 21, 2026, for these vulnerabilities."

    vs

    "U.S. federal agencies were mandated to remediate the Cisco SD-WAN vulnerability by October 3, 2026."

    The claims provide two different federal remediation deadlines: September 21, 2026, and October 3, 2026.

Timeline

  1. [TECHNOLOGY] 7 sources
    Cybersecurity vulnerabilities identified in Microsoft, Apple, and network appliances

    Major security flaws have been reported in Microsoft updates, Apple's macOS Screen Sharing, and Fortinet/Palo Alto Networks appliances, leading to active exploitation and credential theft.

  2. [TECHNOLOGY] 4 sources
    Fortinet products face critical security vulnerabilities

    INCIBE-CERT has issued a critical alert for Fortinet products, including FortiOS and FortiManager, urging immediate security updates to protect internet-exposed devices.

  3. [TECHNOLOGY] 4 sources
    CISA adds Fortinet, BeyondTrust, and Atlassian flaws to KEV catalog

    CISA added nine new vulnerabilities to its Known Exploited Vulnerabilities catalog, including critical flaws in Fortinet, BeyondTrust, Atlassian, and Cisco products being actively used by attackers.

  4. [TECHNOLOGY] 8 sources
    Cisco and Ivanti face active zero-day exploits in security infrastructure

    Cisco and Ivanti face active zero-day exploits. Cisco's Secure Email Gateway flaw (CVE-2026-76519) allows root access, while Ivanti Connect Secure is being targeted by a three-vulnerability chain.

  5. [TECHNOLOGY] 2 sources
    Cybersecurity report highlights non-CVE vulnerabilities and new CISA KEV entries

    Cybersecurity reports highlight the prevalence of non-CVE vulnerabilities and list five new CISA KEV entries actively exploited by attackers, alongside several major recent data breaches.

  6. [TECHNOLOGY] 10 sources
    Fortinet and Cisco report active exploitation of critical zero-day vulnerabilities

    Fortinet and Cisco report active exploitation of critical zero-day vulnerabilities in FortiMail and Catalyst SD-WAN Manager, both rated 9.8 CVSS. CISA has mandated federal remediation.

  7. [TECHNOLOGY] 6 sources
    CISA adds Microsoft, MikroTik, Adobe, and WSO2 flaws to KEV catalog

    CISA has added multiple critical vulnerabilities affecting Microsoft SharePoint, MikroTik RouterOS, WSO2, and Adobe Commerce to its Known Exploited Vulnerabilities catalog due to active real-world exploitation.

  8. [TECHNOLOGY] 3 sources
    CISA orders federal agencies to patch exploited Zyxel switch flaw

    CISA has ordered federal agencies to patch a high-severity Zyxel GS1900 switch vulnerability (CVE-2026-7273) that is being actively exploited to execute unauthorized commands on local networks.

  9. [TECHNOLOGY] 9 sources
    Linux kernel vulnerabilities added to CISA KEV catalog

    CISA has added three actively exploited Linux kernel vulnerabilities to its KEV catalog, including a 15-year-old flaw (CVE-2025-39964), prompting urgent patching advisories for administrators.

  10. [TECHNOLOGY] 2 sources
    CISA adds Microsoft, Adobe, and N-able flaws to exploited vulnerabilities catalog

    CISA has added critical vulnerabilities in Microsoft Windows, Adobe Commerce, and N-able N-central to its Known Exploited Vulnerabilities catalog due to active real-world exploitation.

  11. [TECHNOLOGY] 10 sources
    CISA flags multiple actively exploited vulnerabilities in Linux, Citrix, and Microsoft software

    CISA has added multiple actively exploited vulnerabilities to its KEV catalog, including flaws in the Linux kernel, Citrix NetScaler, Microsoft SharePoint, VMware vCenter, and Apple macOS.

  12. [TECHNOLOGY] 5 sources
    CISA orders patching of exploited TrueConf vulnerabilities

    CISA has ordered U.S. federal agencies to patch two exploited vulnerabilities in TrueConf video conferencing software used by attackers to execute scripts and gain server control.

Sources

algeriatech.news · bitnewsbot.com · blogspan.net · borncity.com · bruun.co · businesstechweekly.com · cert.ug · cyberinsider.com · cybernoz.com · cybersecurity-news.de · dev.to · doj.state.or.us · drweb.de · elespectador.com · emarketerz.fr · flagthis.com · forkast.news · gcn.com · gipfeli.ch · horizon3.ai · incibe.es · invitehealth.substack.com · it-boltwise.de · it-daily.net · linuxsecurity.com · moncloa.com · nhmlac.org · obsidian.md · paraonline.com.br · pcgameshardware.de · perfil.com · planningassociates.com.au · redes-sociales.com · securityaffairs.co · securityaffairs.com · sempreupdate.com.br · socprime.com · thehackernews.com · theNEXTweb.com · therecord.media · theregister.co.uk · theregister.com · vandragt.com · venceremos.it · viakoo.com · vital.com · world-today-journal.com · world-today-news.com

This summary has been updated 9 times: see revision history