CISA Adds Seven Known Exploited Vulnerabilities to Catalog
2026-09-02T19:24:00Z•8251d4d292c505c2042641afdbb7d5057010796725365c2c9131ad3b55defeef
CVE-2015-3246CVE-2015-5287CVE-2019-1068CVE-2021-23758CVE-2022-0995CVE-2023-49105CVE-2026-21962CVE-2026-48710CVE-2026-49869CVE-2026-53362CVE-2026-59822CVE-2026-60004CVE-2026-66384CVE-2026-73570CVE-2026-81578CVE-2026-82078CVE-2026-82329CVE-2026-83548CVE-2026-83549CVE-2026-8452CVE-2026-9586CISACVEKEVOS-command-injectionSQL-injectionSSRFactive-exploitationcommand-injectiondeserializationfederal-enterpriseimproper-authenticationinternet-facing-systemsknown-exploited-vulnerabilitiesmemory-corruptionpath-traversalprivilege-escalationrapid-remediationremote-code-executionvulnerability-management
What happened
CISA alerts from August 24 through September 2, 2026 report 21 vulnerabilities added to the Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation. Affected products include Sangoma Switchvox, Starlette, Kestra, LiteLLM, JFrog Artifactory, SonicWall SMA1000, PaperCut, ownCloud, Linux, Microsoft SQL Server, Ajax.NET Professional, Citrix NetScaler, Gitea, Oracle WebLogic/HTTP Server, and Zimbra. Organizations should prioritize remediation, especially for internet-facing systems, and investigate potential compromise before patching.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- cisa_ncas_current_activity
- Record identifier
- 8251d4d292c505c2042641afdbb7d5057010796725365c2c9131ad3b55defeef
- Enrichment time
- 2026-09-02T19:24:00Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.