CISA adds four exploited vulnerabilities to Known Exploited Vulnerabilities Catalog

CISA said it added four vulnerabilities to its Known Exploited Vulnerabilities Catalog after finding evidence of active exploitation. The agency said the issues are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.

The new entries are CVE-2021-27137, described as a DD-WRT stack-based buffer overflow; CVE-2026-0770, described as a Langflow inclusion of functionality from untrusted control sphere issue; CVE-2026-63030, described as a WordPress Core interpretation conflict; and CVE-2026-60137, described as a WordPress Core SQL injection vulnerability.

Federal agencies use the catalog to prioritize patching for weaknesses already being used in the wild. CISA said Binding Operational Directive 26-04, titled Prioritizing Security Updates Based on Risk, sets vulnerability management requirements for Federal Civilian Executive Branch agencies.

According to the alert, BOD 26-04 directs agencies to move quickly on high-risk vulnerabilities listed in the KEV Catalog, especially on publicly exposed assets that could grant total control after exploitation. It also says agencies should determine whether threat actors compromised a system before a patch was applied. CISA said the directive applies only to FCEB agencies, but it encourages all organizations to use risk-based vulnerability management and focus on KEV remediation.

CISA said KEV additions must have a CVE ID, evidence of exploitation and clear mitigation guidance. The agency also said it will keep adding vulnerabilities that meet those criteria and accepts submissions through its KEV Nomination Form.

Sources

• CISA alert: “CISA Adds Four Known Exploited Vulnerabilities to Catalog”

Editorial note: This article was prepared with AI assistance and includes source attribution for reader review.