CISA Adds Four Known Exploited Vulnerabilities to Catalog
2026-09-08T19:24:01Z•db9fae270d0a79e05fc6c7528efc34ad383a9b533aeade005fd10fe247730289
CVE-2015-3246CVE-2015-5287CVE-2019-1068CVE-2021-23758CVE-2022-0995CVE-2023-49105CVE-2026-48710CVE-2026-49869CVE-2026-53362CVE-2026-59822CVE-2026-60004CVE-2026-66384CVE-2026-75650CVE-2026-81578CVE-2026-81963CVE-2026-82078CVE-2026-82329CVE-2026-83548CVE-2026-83549CVE-2026-8452CVE-2026-85046CVE-2026-85880CVE-2026-86218CVE-2026-9586BOD 26-04CISA KEVSQL injectionactive exploitationbrowser securitycloud and developer platformscode injectioncommand injectionenterprise securityimproper authenticationknown exploited vulnerabilitymemory corruptionnetwork appliancespath traversalprivilege escalationremote code executionserver-side request forgeryvulnerability remediation
What happened
CISA reports multiple additions to its Known Exploited Vulnerabilities (KEV) Catalog from August 26 through September 8, 2026, covering 24 vulnerabilities across Adobe Commerce/Magento, Microsoft Windows, Chromium, enterprise appliances, developer platforms, Linux, and other products. The vulnerabilities include command injection, code injection, SQL injection, authentication bypass, path traversal, SSRF, deserialization, memory corruption, privilege escalation, and browser type confusion issues. CISA states that all are being actively exploited and urges rapid, risk-based remediation, with F-
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- cisa_ncas_current_activity
- Record identifier
- db9fae270d0a79e05fc6c7528efc34ad383a9b533aeade005fd10fe247730289
- Enrichment time
- 2026-09-08T19:24:01Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.