CISA Adds One Known Exploited Vulnerability to Catalog
2026-09-18T21:24:02Z•cc662eae54bb68b3c24d0f61d0656120e638e14b3fcd1d3363d3fb854caa48be
CVE-2025-39682CVE-2025-39964CVE-2026-42016CVE-2026-42018CVE-2026-53266CVE-2026-58704CVE-2026-76460CVE-2026-76461CVE-2026-84869CVE-2026-85706CVE-2026-87886Acronis BackupCISA KEVCiscoConnectWise ScreenConnectGitLabGoogle PixelJFrog ArtifactoryLinux KernelSQL injectionactive exploitationimproper authenticationimproper authorizationknown exploited vulnerabilitiesout-of-bounds writepath traversalprivilege managementrace conditionvulnerability management
What happened
CISA reports active exploitation of multiple vulnerabilities newly added to its Known Exploited Vulnerabilities (KEV) Catalog between September 11 and 18, 2026. Affected products include Linux Kernel, Cisco Identity Services Engine and Secure Email Gateway, Acronis Backup, Google Pixel, GitLab, JFrog Artifactory, and ConnectWise ScreenConnect. Organizations should prioritize urgent remediation, assess internet-facing exposure, and investigate systems for possible compromise before patching.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- cisa_ncas_current_activity
- Record identifier
- cc662eae54bb68b3c24d0f61d0656120e638e14b3fcd1d3363d3fb854caa48be
- Enrichment time
- 2026-09-18T21:24:02Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.