We’re Tracking the Future of Security

Tag: CISA KEV

  • CISA Adds Actively Exploited WordPress Core File-Inclusion Flaw to KEV

    CISA Adds Actively Exploited WordPress Core File-Inclusion Flaw to KEV

    CISA has added CVE-2026-87902, a WordPress core file-inclusion vulnerability, to its Known Exploited Vulnerabilities catalog after confirming active exploitation. The issue affects WordPress versions before 7.1.2, with fixes also backported to maintained older branches.

    Specific conditions can turn local inclusion into code execution

    The flaw involves page-template resolution in get_page_template(). An unauthenticated attacker can cause WordPress to include a chosen readable local PHP file outside the active theme directories. Exploitation requires additional server and theme preconditions, but a successful chain can lead to remote code execution. The CVE record assigns a high-severity score and notes that no user interaction or prior privileges are required.

    WordPress released version 7.1.2 on September 22 and recommended immediate updates. CISA added the vulnerability to KEV on September 25, while public reporting documented probing shortly after the patch became available.

    Inventory and verification matter after patching

    Operators should confirm the actual WordPress core version on every site, apply the relevant security release, review web and file-change telemetry, and verify that unsupported instances are not exposed. Patching does not by itself prove that an already-exposed site was not accessed. SectechMedia follows related operational risks in its cybersecurity coverage.

    Sources

  • CISA Adds Exploited WSO2 and Adobe Commerce Flaws to KEV Catalog

    CISA Adds Exploited WSO2 and Adobe Commerce Flaws to KEV Catalog

    The U.S. Cybersecurity and Infrastructure Security Agency has added two enterprise-software vulnerabilities to its Known Exploited Vulnerabilities catalog. The additions cover CVE-2026-5430 in WSO2 products and CVE-2026-71362 in Adobe Commerce and Magento.

    Two different attack paths

    The WSO2 issue is a path-traversal weakness that can enable unrestricted file upload and potentially remote code execution in affected API-management components. Security researchers reported exploitation attempts before the catalog update. The Adobe Commerce issue is an authorization flaw that can allow an attacker to reach another customer’s account context and sensitive information under vulnerable conditions.

    KEV inclusion means CISA has evidence that the vulnerabilities are being exploited, not merely that public proof-of-concept material exists. Federal civilian agencies received a remediation deadline, while private organizations can use the catalog as a prioritization signal alongside asset exposure, business impact and compensating controls.

    Prioritization for defenders

    Teams should inventory affected WSO2, Adobe Commerce and Magento deployments, compare versions against vendor advisories, apply fixes, and inspect logs for file-upload anomalies, forged tokens or unusual account switching. Internet-facing systems and identity-connected APIs deserve immediate attention. SectechMedia follows similar operational risk in its cyber-physical security channel.

    Sources

  • Cisco Secure Email Gateway Zero-Day Added to CISA Exploited Vulnerabilities Catalog

    Cisco Secure Email Gateway Zero-Day Added to CISA Exploited Vulnerabilities Catalog

    Cisco has disclosed CVE-2026-76461, a vulnerability affecting Secure Email Gateway and Secure Email and Web Manager software that can allow an unauthenticated attacker to execute commands with root privileges under vulnerable conditions. Cisco’s advisory provides the affected-version and remediation details.

    The U.S. Cybersecurity and Infrastructure Security Agency added the flaw to its Known Exploited Vulnerabilities catalog on September 14, confirming evidence of exploitation in the wild. That designation does not identify every victim or attacker, but it materially changes patch priority.

    Email gateways are high-value perimeter systems because they inspect untrusted content and often hold privileged network positions. Defenders should follow Cisco’s exact guidance, review appliance logs and avoid relying on exposure assumptions that have not been tested.

    Why it matters

    An exploited edge-device vulnerability can bypass controls deeper inside the network. Asset owners need authoritative version checks, rapid remediation and post-compromise review, because installing a fix does not by itself remove persistence created before patching.

    For wider context, see SectechMedia’s related technical coverage.

    Sources

  • CISA Deadline Passes for Federal Agencies to Patch Actively Exploited Zimbra Flaw

    CISA Deadline Passes for Federal Agencies to Patch Actively Exploited Zimbra Flaw

    August 24, 2026, was the deadline for US federal civilian executive branch agencies to mitigate or discontinue use of Zimbra Collaboration Suite (ZCS) systems affected by CVE-2026-73570, a critical, actively exploited remote-code-execution flaw, after the US Cybersecurity and Infrastructure Security Agency (CISA) added it to its Known Exploited Vulnerabilities (KEV) catalog on August 21, according to reporting from Dark Reading and The Hacker News.

    Background on the flaw

    Zimbra disclosed CVE-2026-73570, a command-injection vulnerability in the optional zimbra-snmp component that can allow unauthenticated remote code execution when SNMP notifications are enabled, and released a patched version, ZCS 10.1.20, on July 20, 2026. Poland’s CERT Polska warned on August 16–17 that the flaw was being actively exploited in the wild, and BleepingComputer reported on the active exploitation campaign on August 20. CISA added the vulnerability to its KEV catalog on August 21 and required federal civilian agencies to remediate by August 24.

    Why it matters

    Zimbra Collaboration Suite is widely used email and collaboration software across businesses and government agencies. An unauthenticated remote-code-execution flaw in internet-facing collaboration infrastructure, already confirmed as being actively exploited before a patch was applied everywhere, is exactly the scenario CISA’s KEV deadlines are designed to force organizations to act on quickly. Security teams running Zimbra Collaboration Suite that have not yet applied version 10.1.20 or later, or disabled the affected SNMP component, should treat this as an active, ongoing exploitation risk rather than a theoretical one.

    Sources

    More coverage like this is available on Technology News.