Cisa-Current-Activity-Cisa-Adds-Three-Kn

Published Monday, June 29, 2026 at 07:09 AM PT BLUF: CISA has added three vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, confirming active exploitation in the wild. Federal Civilian Executive Branch (FCEB) agencies face mandatory remediation deadlines under BOD 22-01. All organizations should treat these as priority patching targets immediately. DETAILS CISA has added three vulnerabilities to the KEV Catalog, indicating confirmed active exploitation — not theoretical risk. Under Binding Operational Directive (BOD) 22-01, FCEB agencies are legally required to remediate KEV-listed vulnerabilities by CISA-assigned deadlines. Specific CVE identifiers, affected vendors/products, and remediation due dates are not confirmed in the source data provided — organizations should consult the CISA KEV Catalog directly for authoritative details. This update follows a pattern of frequent KEV additions in recent weeks, including prior single, two, and seven-vulnerability additions — indicating sustained, broad exploitation activity across multiple product categories. CISA’s guidance explicitly extends urgency beyond federal agencies to all organizations, public and private sector. IMPACT Directly mandated: All U.S. FCEB agencies — compliance deadlines apply. Strongly urged: All private sector, state/local government, and critical infrastructure operators. Scope of affected products: Unknown pending full catalog review — verify at cisa.gov/known-exploited-vulnerabilities-catalog. RECOMMENDED ACTIONS Immediately review the CISA KEV Catalog for the three newly added CVEs and identify whether affected products exist in your environment. Apply vendor-supplied patches or mitigations per CISA-specified deadlines — FCEB agencies treat this as mandatory. If patches are unavailable, implement compensating controls and isolate affected systems where operationally feasible. Review BOD 22-01 Fact Sheet for federal compliance obligations. Enroll in CISA KEV notifications to receive future updates without delay. ⚠️ UNCERTAINTY FLAGS Specific CVEs, affected vendors, and due dates are not confirmed in available source data. Do not assume scope until catalog is reviewed directly. Exploitation methods and threat actor attribution are unknown at this time. SOURCES CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog BOD 22-01 Fact Sheet: https://www.cisa.gov/sites/default/files/publications/Reducing_the_Significant_Risk_of_Known_Exploited_Vulnerabilities_211103.pdf CISA Current Activity Feed (direct trigger for this alert)

BLUF: CISA has added three known exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog. Federal Civilian Executive Branch (FCEB) agencies face mandatory remediation deadlines. All organizations are urged to treat these as priority patches immediately. DETAILS CISA has officially catalogued three additional vulnerabilities confirmed to be actively exploited in the wild — specific CVE identifiers were not included in the source data provided; treat all three as high-priority until full details are confirmed via CISA’s KEV catalog at cisa.gov. Under Binding Operational Directive (BOD) 22-01, FCEB agencies are legally required to remediate KEV-listed vulnerabilities by assigned due dates or face compliance risk. CISA explicitly extended its guidance beyond federal agencies, strongly urging all public and private sector organizations to prioritize remediation of KEV-listed vulnerabilities to reduce attack surface exposure. Active exploitation is confirmed — these are not theoretical or proof-of-concept threats. Threat actors are leveraging these vulnerabilities in live operations. ⚠️ UNCERTAINTY FLAG: Specific CVE numbers, affected vendors/products, and CVSS scores were not available in the triggering data. Verify full details directly at the CISA KEV Catalog before prioritizing remediation queues. IMPACT Directly mandated: All U.S. Federal Civilian Executive Branch agencies — remediation is not optional. Strongly advised: All private sector organizations, critical infrastructure operators, state/local governments, and managed service providers. Scope: Unknown until CVE details are confirmed; given the current threat landscape, context suggests potential overlap with ongoing WordPress plugin exploitation, FortiClient EMS abuse, and SolarWinds Serv-U activity observed in parallel reporting. RECOMMENDED ACTIONS Immediately access the CISA KEV Catalog at cisa.gov/known-exploited-vulnerabilities-catalog to identify the three newly added CVEs. Cross-reference your asset inventory against affected products and versions. FCEB agencies: Confirm remediation deadlines per BOD 22-01 and initiate patching workflows now. All organizations: Prioritize these vulnerabilities above routine patch cycles — active exploitation is confirmed. Review the BOD 22-01 Fact Sheet for compliance obligations and remediation guidance. Monitor threat intelligence feeds for indicators of compromise linked to these CVEs as details emerge. SOURCES Primary: CISA Current Activity — CISA Adds Three Known Exploited Vulnerabilities to Catalog (CISA.gov) Reference: CISA Binding Operational Directive 22-01 Fact Sheet Context: The Hacker News — concurrent reporting on active exploitation of SolarWinds Serv-U, FortiClient EMS, and WordPress plugin vulnerabilities