CISA Adds One Known Exploited Vulnerability to Catalog

CISA added multiple vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog (Mar 19–30, 2026) based on evidence of active exploitation. The additions include a range of high-impact defects — remote code execution, deserialization of untrusted data, code injection, out-of-bounds read, and embedded malicious code — affecting widely used products and vendors (Citrix NetScaler, F5 BIG‑IP, Cisco FMC/SCC, Microsoft SharePoint, Apple products, Craft CMS, Laravel Livewire, Aqua Trivy, Langflow, etc.). Federal Civilian Executive Branch agencies must remediate these per BOD 22‑01; CISA also