Loading story…
CISA added CVE-2008-4128 to its Known Exploited Vulnerabilities catalog after confirming in-the-wild exploitation of a cross-site request forgery flaw in Cisco IOS 12.4 on Cisco 871 Integrated Services Routers. The vulnerability affects the HTTP Administration interface and can let a remote attacker trick an authenticated administrator into executing arbitrary commands through crafted HTTP requests and specific URIs tied to functions such as show privilege and alias exec.
The KEV catalog update increased the total number of listed vulnerabilities from 1637 to 1638 and marked ransomware use as unknown for this Cisco issue. CISA directed organizations to apply vendor mitigations and said federal civilian executive branch agencies must remediate the flaw under applicable Binding Operational Directive requirements, with the catalog listing a remediation due date of 2026-07-16; private-sector defenders were also urged to review the KEV entry and address affected devices in their environments.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
On 2026-07-13, CISA added CVE-2008-4128, a Cisco IOS 12.4 cross-site request forgery vulnerability affecting Cisco 871 Integrated Services Routers, to its Known Exploited Vulnerabilities catalog. The entry states the flaw is known to be exploited in the wild and can allow remote attackers to execute arbitrary commands via specific HTTP administration interface URIs.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcescworld.com
Open sourcesecurityaffairs.com
Open sourcegithub.com
Open sourcecisa.gov
Open sourcecve.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISA expanded its Known Exploited Vulnerabilities catalog in a series of June updates, adding four newly exploited issues across enterprise and software platforms. The agency first listed **CVE-2026-45247** in Mirasvit Full Page Cache Warmer, a deserialization flaw that can enable unauthenticated remote code execution through a crafted serialized PHP object in the `CacheWarmer` cookie. It then added **CVE-2026-42271** in BerriAI LiteLLM, a command injection bug that can let any authenticated user, including low-privilege internal-user key holders, execute arbitrary commands on the host. CISA directed organizations to apply vendor mitigations, follow **BOD 22-01** guidance for cloud services, or discontinue use if mitigations are unavailable. CISA later added three more exploited vulnerabilities: a **Google Chromium V8** out-of-bounds read/write flaw that could allow sandboxed remote code execution via a crafted HTML page, an **Arista EOS** packet decapsulation vulnerability, and a **Cisco Catalyst SD-WAN Manager** flaw that could allow an authenticated local attacker to execute arbitrary commands as root. The KEV catalog count rose from **1,610** to **1,617** across the updates, and CISA assigned remediation deadlines ranging from **2026-06-06** to **2026-06-23**. Separate GitHub commits also showed Rack maintainers fixing multipart parsing denial-of-service issues tracked as **CVE-2025-61770**, **CVE-2025-61771**, and **CVE-2025-61772**, but those fixes were not part of the KEV additions described in the June catalog changes.
Jun 29, 2026
CISA added **five vulnerabilities** to its **Known Exploited Vulnerabilities (KEV) Catalog** based on evidence of **active exploitation**, urging organizations to prioritize remediation and reminding U.S. Federal Civilian Executive Branch (FCEB) agencies that **BOD 22-01** requires fixes by mandated due dates. The newly added KEVs are **CVE-2017-7921** (Hikvision improper authentication), **CVE-2021-22681** (Rockwell insufficiently protected credentials), and three Apple issues: **CVE-2021-30952** (integer overflow/wraparound), **CVE-2023-41974** (iOS/iPadOS use-after-free), and **CVE-2023-43000** (use-after-free affecting multiple Apple products). CISA emphasized that KEV-listed flaws are common attack vectors and represent elevated risk, even for non-federal organizations. CISA’s public *kev-data* repository reflects the same update, increasing the catalog count from **1531 to 1536** and recording a remediation **due date of 2026-03-26** for at least **CVE-2017-7921** (with required action to apply vendor mitigations or discontinue use if unavailable). Separately, Cisco Talos published a 2025 CVE retrospective that provides broader context on the growing volume of vulnerabilities and KEV additions, noting a year-over-year increase in KEVs and highlighting persistent exploitation of older CVEs; however, it does not add incident-specific details about the five newly listed KEVs beyond reinforcing the operational importance of patching and compensating controls for unpatchable systems.
Jun 29, 2026
CISA added 14 vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog across two updates, citing evidence of active exploitation against widely used enterprise products from Fortinet, Microsoft, Adobe, Cisco, JetBrains, PaperCut, Kentico, Quest, and Zimbra. The newly listed flaws include issues in FortiClient EMS, Adobe Acrobat Reader, Microsoft Windows Common Log File System Driver, Microsoft Exchange Server, Host Process for Windows Tasks, Microsoft Visual Basic for Applications, JetBrains TeamCity, PaperCut NG/MF, Kentico Xperience, Quest KACE SMA, Zimbra Collaboration Suite, and Cisco Catalyst SD-WAN Manager, including privilege escalation, credential exposure, sensitive information disclosure, and cross-site scripting weaknesses. Reporting tied several of the vulnerabilities to real-world intrusion activity and ransomware operations. Microsoft said threat actor **Storm-1175** used `CVE-2023-21529` to deliver **Medusa ransomware**, while `CVE-2023-27351` has been linked to **Lace Tempest** deployments of **Cl0p** and **LockBit**. Defused Cyber also reported exploitation attempts against `CVE-2026-21643`, and CISA said federal civilian agencies must remediate the newly added flaws on deadlines running from late April into May 2026 under Binding Operational Directive requirements, while private-sector defenders were urged to prioritize the KEV entries for patching and exposure reduction.
Jun 29, 2026