CISA Adds One Known Exploited Vulnerability to Catalog
2026-08-25T19:24:01Z•4627f30146a852cb9fa4bf866ed3cf877c830dc8a32ed97f118f2c7a2bf6e425
CVE-2025-62593CVE-2026-21962CVE-2026-33824CVE-2026-55040CVE-2026-59310CVE-2026-60004CVE-2026-64849CVE-2026-65400CVE-2026-72529CVE-2026-72530CVE-2026-73570Apple macOSCISAGiteaKEVMLflowMicrosoft SharePointOracle HTTP ServerOracle WebLogicRay ProjectSSRFTrueConf ServerVMware vCenterZimbraaccess-controlactive-exploitationauthenticationcode-injectioncommand-injectionknown-exploited-vulnerabilitypatchingpath-traversalvulnerability-management
What happened
CISA’s August 18–25, 2026 updates add 11 vulnerabilities to the Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation. The affected products include Gitea, Oracle HTTP Server/WebLogic Server Proxy Plug-in, Zimbra Collaboration Suite, TrueConf Server, MLflow, Microsoft IKE Service Extensions, Microsoft SharePoint, VMware vCenter, Apple macOS, and Ray Project. Organizations should prioritize rapid remediation, exposure reduction, and compromise assessment, consistent with CISA risk-based vulnerability management guidance and BOD 26-04 requirements for U.S. FCEB16
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- cisa_ncas_current_activity
- Record identifier
- 4627f30146a852cb9fa4bf866ed3cf877c830dc8a32ed97f118f2c7a2bf6e425
- Enrichment time
- 2026-08-25T19:24:01Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.