CISA Adds Four Known Exploited Vulnerabilities to Catalog
2026-06-23T19:24:09Z•0d3b5a0361ede4f2ea484a5103831e8776bbaa46e8908ef408c1ce4b236e438f
BOD-26-04CISACiscoFortiBleedFortinetIvantiJoomlaKEV CatalogLantronixLiteSpeedMFAOracle-PeopleSoftPBKDF2SplunkUbiquiticredential-exposureknown-exploited-vulnerabilitypatchingremediationvulnerability-management
What happened
CISA added multiple vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog and issued guidance urging rapid remediation and hardening. New KEV entries include Lantronix (code injection), three Ubiquiti UniFi OS flaws (improper access control, path traversal, input validation), Splunk (missing authentication for critical function), Joomla Widget Factory (improper access control), Cisco Catalyst SD‑WAN Manager (directory/path traversal), LiteSpeed cPanel plugin (symlink following), Oracle PeopleSoft PeopleTools (missing authentication), and Ivanti Sentry (command injection). Separ‑
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- cisa_ncas_current_activity
- Record identifier
- 0d3b5a0361ede4f2ea484a5103831e8776bbaa46e8908ef408c1ce4b236e438f
- Enrichment time
- 2026-06-23T19:24:09Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.