Loading story…
CISA updated its Known Exploited Vulnerabilities catalog to add three vulnerabilities now tracked as actively exploited: CVE-2026-39987 in Marimo, CVE-2024-1708 in ConnectWise ScreenConnect, and CVE-2026-32202 in Microsoft Windows. The Marimo issue was added in a catalog update that raised the total count to 1,579 entries, while a later update increased the catalog to 1,585 entries and included the ScreenConnect and Windows flaws.
CISA described CVE-2026-39987 as an unauthenticated remote code execution vulnerability that can provide shell access and allow arbitrary system command execution before authorization, mapped to CWE-306. CVE-2024-1708 was listed as a ScreenConnect path traversal flaw that could enable remote code execution or directly affect confidential data and critical systems, and CVE-2026-32202 was identified as a Windows Shell protection mechanism failure that allows network spoofing by an unauthorized attacker. CISA directed organizations to apply vendor mitigations, follow BOD 22-01 guidance for cloud services, or discontinue use if mitigations are unavailable; remediation deadlines were set for 2026-05-07 for Marimo and 2026-05-12 for the ScreenConnect and Windows entries.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
CISA published an updated Known Exploited Vulnerabilities catalog on 2026-05-04, increasing the total number of listed vulnerabilities to 1,587. The provided reference shows updated catalog metadata and release timestamp but does not identify the specific newly added CVEs.
CISA updated the KEV catalog on 2026-04-28, raising the total number of listed vulnerabilities from 1,583 to 1,585. The newly added entries were CVE-2024-1708 in ConnectWise ScreenConnect and CVE-2026-32202 in Microsoft Windows, both assigned a remediation due date of 2026-05-12.
CISA updated the Known Exploited Vulnerabilities catalog on 2026-04-23, increasing the total from 1,578 to 1,579 entries. The new entry was CVE-2026-39987, a Marimo remote code execution vulnerability allowing unauthenticated attackers to gain shell access and execute arbitrary commands before authorization, with a remediation due date of 2026-05-07.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISA expanded its Known Exploited Vulnerabilities catalog in a series of June updates, adding four newly exploited issues across enterprise and software platforms. The agency first listed **CVE-2026-45247** in Mirasvit Full Page Cache Warmer, a deserialization flaw that can enable unauthenticated remote code execution through a crafted serialized PHP object in the `CacheWarmer` cookie. It then added **CVE-2026-42271** in BerriAI LiteLLM, a command injection bug that can let any authenticated user, including low-privilege internal-user key holders, execute arbitrary commands on the host. CISA directed organizations to apply vendor mitigations, follow **BOD 22-01** guidance for cloud services, or discontinue use if mitigations are unavailable. CISA later added three more exploited vulnerabilities: a **Google Chromium V8** out-of-bounds read/write flaw that could allow sandboxed remote code execution via a crafted HTML page, an **Arista EOS** packet decapsulation vulnerability, and a **Cisco Catalyst SD-WAN Manager** flaw that could allow an authenticated local attacker to execute arbitrary commands as root. The KEV catalog count rose from **1,610** to **1,617** across the updates, and CISA assigned remediation deadlines ranging from **2026-06-06** to **2026-06-23**. Separate GitHub commits also showed Rack maintainers fixing multipart parsing denial-of-service issues tracked as **CVE-2025-61770**, **CVE-2025-61771**, and **CVE-2025-61772**, but those fixes were not part of the KEV additions described in the June catalog changes.
Jun 29, 2026
CISA added 14 vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog across two updates, citing evidence of active exploitation against widely used enterprise products from Fortinet, Microsoft, Adobe, Cisco, JetBrains, PaperCut, Kentico, Quest, and Zimbra. The newly listed flaws include issues in FortiClient EMS, Adobe Acrobat Reader, Microsoft Windows Common Log File System Driver, Microsoft Exchange Server, Host Process for Windows Tasks, Microsoft Visual Basic for Applications, JetBrains TeamCity, PaperCut NG/MF, Kentico Xperience, Quest KACE SMA, Zimbra Collaboration Suite, and Cisco Catalyst SD-WAN Manager, including privilege escalation, credential exposure, sensitive information disclosure, and cross-site scripting weaknesses. Reporting tied several of the vulnerabilities to real-world intrusion activity and ransomware operations. Microsoft said threat actor **Storm-1175** used `CVE-2023-21529` to deliver **Medusa ransomware**, while `CVE-2023-27351` has been linked to **Lace Tempest** deployments of **Cl0p** and **LockBit**. Defused Cyber also reported exploitation attempts against `CVE-2026-21643`, and CISA said federal civilian agencies must remediate the newly added flaws on deadlines running from late April into May 2026 under Binding Operational Directive requirements, while private-sector defenders were urged to prioritize the KEV entries for patching and exposure reduction.
Jun 29, 2026
CISA updated its Known Exploited Vulnerabilities catalog to add three newly listed flaws affecting **Microsoft Office Excel**, **Microsoft SharePoint Server**, and **Apache ActiveMQ**. The additions increased the catalog total from 1,566 to 1,569 entries across two updates, with CISA identifying **`CVE-2009-0238`** as a remote code execution vulnerability in Excel, **`CVE-2026-32201`** as an improper input validation spoofing issue in SharePoint Server, and **`CVE-2026-34197`** as an improper input validation flaw in ActiveMQ that can enable code injection. CISA assigned federal remediation deadlines of **2026-04-28** for the Excel and SharePoint entries and **2026-04-30** for the ActiveMQ entry. The catalog records indicate that known ransomware use is **unknown** for all three vulnerabilities, while the ActiveMQ listing references both an Apache security advisory and the NVD entry, underscoring active exploitation concerns for widely deployed enterprise software and messaging infrastructure.
Jun 29, 2026