CISA adds 14 actively exploited vulnerabilities to KEV Catalog
Between September 8 and 11, CISA added 14 actively exploited vulnerabilities to its Known Exploited Vulnerabilities Catalog, spanning Adobe Commerce/Magento, Microsoft Windows, N-able N-central, Fortinet, Citrix NetScaler, Google Chromium V8, Cisco Firewall Management Center, MikroTik RouterOS, JFrog Artifactory, ConnectWise ScreenConnect, and GitLab. BOD 26-04 requires federal agencies to prioritize rapid remediation of KEV-listed CVEs.
Sources and evidence
Attributed quotes
“CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.”
“These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.”
“While BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities.”
Summary last validated Sep 12, 2026
Reader actions
Report an issue
Use this for an incorrect summary, wrong source, duplicate story, or wrong category. Submissions are private and do not change the story automatically.
Related coverage
- security
Microsoft urges early testing of post-quantum certificate ecosystems
Microsoft published guidance urging organizations to begin testing certificate ecosystems for post-quantum authentication now, highlighting its PQC TLS Pilot Program as a way to advance future readiness. The post appeared on the Microsoft Security Blog.
- security
CISA: Chinese Government-linked Hackers Target US Critical Infrastructure
CISA published an advisory stating Chinese government-linked cyber threat actors, enabled by China-based Integrity Technology Group, combine automated scanning, botnets, and hands-on exploitation to steal sensitive data from organizations worldwide, including US critical infrastructure. Tactics include cross-site scripting and password spraying on Microsoft Exchange servers, VPN persistence, and email and credential exfiltration via scripts.
- security
Cisco Talos Ties UAT-11985 to AI-Assisted Google AitM Phishing
Cisco Talos identified an APT spear-phishing campaign, tracked as UAT-11985, targeting individuals affiliated with Taiwan research organizations. The operation used legitimate public event themes and impersonated reputable academic and policy institutions, delivering real-time Google adversary-in-the-middle phishing.
- security
Cisco Talos details malware techniques for evading AI analysis
Cisco Talos published research on "AI-analysis evasion," describing real-world techniques malware authors use to obstruct or defeat automated AI analysis layers. The blog examines the current state of these evasion methods, which are designed to interfere with AI-driven malware detection and analysis pipelines.
- security
Anthropic launches Cyber Mission with Critical Infrastructure Defense Program and OSS Scanner
Anthropic announced the Anthropic Cyber Mission, a long-term effort to help defenders secure software and systems. It starts with two programs: the Critical Infrastructure Defense Program, providing frontier models, on-site engineers, and threat research for operational technology like power grids and water systems, and OSS Scanner, offering open-source projects free security scans from Anthropic's strongest models.