CISA Adds 4 Exploited Flaws to KEV, Sets May 2026 Federal Deadline

A cluster of high-impact incidents and active exploitations was reported across federal and commercial environments. CISA added four actively exploited flaws to its KEV list (notably CVE-2024-57726, CVSS 9.9) and set a May 2026 federal mitigation deadline. Multiple supply‑chain compromises and rapid post‑disclosure exploits were observed — including the Bitwarden CLI compromise (malicious bw1.js) tied to a Checkmarx campaign, malicious Checkmarx/KICS Docker tags, the CanisterSprawl npm worm, and LMDeploy’s SSRF (CVE-2026-33626) which was exploited within 13 hours. Severe product flaws and intr