CISA Adds Four Known Exploited Vulnerabilities to Catalog
2026-04-27T13:24:11Z•dbdc3702fe7406165527de990d59a3a9f064a8b14d8eb5ddc3d9f16461a8c914
BOD 22-01CI/CDCISAKEV Catalogaxioscommand-injectioncredential-rotationimproper-authenticationknown-exploited-vulnerabilitiesmalicious-dependencymissing-authorizationnpmpatchingpath-traversalremediationremote-access-trojansupply-chainvulnerability-management
What happened
CISA issued multiple KEV Catalog updates adding numerous actively exploited CVEs across vendors (Samsung MagicINFO, SimpleHelp, D‑Link, Marimo, Microsoft, Apache ActiveMQ, Cisco, PaperCut, JetBrains TeamCity, Kentico, Quest KACE, Synacor Zimbra, etc.) and published a separate supply‑chain alert for a compromise of axios npm packages (axios@1.14.1 and axios@0.30.4) that injected plain-crypto-js@4.2.1, which downloads multi‑stage payloads including a remote access trojan. CISA reiterates BOD 22‑01 requirements for FCEB agencies to remediate KEV entries and urges all organizations to prioritize:
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- cisa_ncas_current_activity
- Record identifier
- dbdc3702fe7406165527de990d59a3a9f064a8b14d8eb5ddc3d9f16461a8c914
- Enrichment time
- 2026-04-27T13:24:11Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.