CISA Adds Four Known Exploited Vulnerabilities to Catalog
2026-07-21T17:24:11Z•57e27ea02c51c9d0eb105d03bd24c499868fc9bca5eb7f84f445f6b26afea883
BOD 26-04CISACisco IOSDD-WRTFortinetKEV CatalogKNXLangflowOracle E-Business SuiteRCESQL injectionSSRFSharePointSonicWallWordPressactive exploitationcode injectioncommand injectiondeserializationfile uploadvulnerability managementweb application security
What happened
Between 13–21 July 2026 CISA issued multiple alerts adding numerous vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog and warning of active exploitation. Affected products include Microsoft SharePoint (deserialization, RCE, missing auth), SonicWall SMA1000 (SSRF, code injection), Fortinet FortiSandbox (command injection), WordPress (SQL injection, interpretation conflict), DD‑WRT (stack buffer overflow), Oracle E‑Business Suite (improper privilege management), KNX (account lockout issue), Cisco IOS (CSRF), Langflow (inclusion of untrusted functionality), and multiple web‑app
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- cisa_ncas_current_activity
- Record identifier
- 57e27ea02c51c9d0eb105d03bd24c499868fc9bca5eb7f84f445f6b26afea883
- Enrichment time
- 2026-07-21T17:24:11Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.