KEV - Malwlab

Ivanti

The Patched Box

A fully patched Ivanti Connect Secure appliance got hit by a zero-day chain that ran entirely in memory and left no trace the vendor's own integrity tool could find.

Abstract cybersecurity illustration of a broken authentication lock with red data streams slipping past it into a ring of elevated admin privilege.

cisco

Unauthenticated admin access in Cisco Catalyst SD-WAN Manager is under active exploitation

A URI-encoding flaw (CVE-2026-76504, CVSS 9.8) lets an unauthenticated remote attacker reach the Catalyst SD-WAN Manager API with admin privileges. CISA added it to KEV on 2026-09-30; Cisco confirms active exploitation. Upgrade to a fixed release, or keep the system off the internet.

Abstract cybersecurity illustration of a cracked shield with data streams and a key escalating through privilege rings.

zammad

Zammad session-hijack RCE and root escalation are under active exploitation

Two critical Zammad CVEs (9.4 CVSS 4.0) are in the CISA KEV catalog, and one was used to breach a Dutch government agency on 21 Sep 2026. Upgrade to the fixed release or take the instance offline.