tag — cisa-kev

grep -rl "cisa-kev" ./articles

#cisa-kev

14 articles

The NetScaler appliances restarting after the patch were not a patch bug — they were a third zero-day, and the sixth crash is the trigger

2026-10-06Security

On 3 October we wrote that Citrix customers were watching their gateways reboot after installing the emergency build, with no CVE and no root cause published. Citrix disclosed it on the 4th: CVE-2026-88779, a memory overflow reached through SAML, exploited in targeted attacks. Each attempt crashes the authentication service, and the sixth restarts the appliance.

FortiMail's path check and its file write disagree about where a filename ends, and attackers are already there

2026-10-02Security

Fortinet's advisory of 1 October describes two weaknesses in one request: a path traversal and improper handling of the null byte. Together they let an unauthenticated attacker write files anywhere on a mail gateway that exists to face the internet. It is exploited, it scores 9.8, and the 7.2 branch has no fix at all.

One hex-encoded letter walks past Cisco SD-WAN Manager's login, and it is already being used

2026-10-01Security

CVE-2026-76504 scores 9.8 and needs no credentials: encode a single character of the login path and the authentication rule stops matching, leaving the API open as the admin user. Cisco published the advisory on 30 September, said its PSIRT had already seen exploitation, and offered no workaround. CISA added it to the catalogue the same day.

CERT Polska found the MikroTik flaws with AI agents, and wrote down what the agents could not do

2026-09-14Security

The six RouterOS vulnerabilities behind the MikroTrick chain came out of an agent-driven laboratory running two OpenAI models. The technique that worked was modelling protocols as state machines and breaking the order of the steps, which is exactly the shape of the bugs. Meanwhile CISA's catalogue lists two of the six, and one of them is not in the chain.

One unauthenticated request reads any file on the GitLab server, and the patch taught attackers how

2026-09-12Security

CVE-2026-85706 scores a perfect 10: no authentication, low complexity, arbitrary file read through GitLab's repository commits API. GitLab patched on 10 September. watchTowr saw exploitation attempts the next day, and CISA gave federal agencies until 14 September.

The ransomware crew skipped Cisco's 10.0. It logged in with the 5.3 that CISA listed back in July

2026-09-12Security

CISA gave agencies until 12 September to deal with exploited flaws in Cisco's firewall manager, Citrix NetScaler and FortiOS. Talos's research shows the Qilin-linked cluster ignored the CVSS 10.0 bypass and used a hard-coded password flaw CISA had listed in July — and the federal instruction for all of it starts with evidence, not the patch.

8,393 Gitea servers are exposed, and the flaw needs an account anyone can make

2026-08-31Security

CVE-2026-60004 lets a user with ordinary write access to a repository run shell commands as the Gitea system user. That reads as an authenticated flaw until you notice that Gitea ships with open registration, so a visitor can sign up, create a repository, and qualify. The fix has been out since 27 July. Miners are already running.

A 2023 flaw with a 2023 fix was used to take nuclear-material records this year

2026-08-31Security

CVE-2023-49105 lets anyone read, change or delete files on an ownCloud server without authenticating, if they know a username and the default configuration is in place. It was fixed in November 2023. It has now been used against a Philippine nuclear research body, and CISA added it to its exploited-vulnerabilities list on 27 August.

Citrix called it a denial of service. Researchers showed it was unauthenticated code execution

2026-08-29Security

CVE-2026-8452 was patched on 30 June with an advisory describing unpredictable behaviour and DoS. WatchTowr published proof it gives unauthenticated remote code execution, and attackers were dropping web shells within days. CISA added it to KEV on 26 August with a three-day deadline. The patch existed for two months.

A Linux kernel flaw is now on CISA's exploited list — and the exploitation appears to be AI agents

2026-08-29AI

CISA added CVE-2026-53362 to its Known Exploited Vulnerabilities catalog on 27 August, with a three-day deadline. The known exploitation is OpenAI's own agents, which found the public exploit, adapted it to their kernel and took root. No other in-the-wild reports appear to exist. The catalog does not have a category for this.

Exploited since January, added to CISA's list in August, due in three days

2026-08-25Security

CVE-2026-21962 is a CVSS 10.0 flaw in Oracle's HTTP Server and WebLogic proxy plug-in. Oracle patched it on 20 January. Exploit code appeared on 22 January and a honeypot logged attacks the same day. CISA added it to the Known Exploited Vulnerabilities catalog on 24 August with a due date of 27 August — and under a directive nobody noticed replacing the old one, agencies now have to check whether they were already breached.