Topic · 4 articles

CISA KEV catalog additions, explained

The CISA KEV catalog lists vulnerabilities with evidence of active exploitation, and US federal agencies must fix them by a set due date. These articles explain notable KEV additions and the patch and hunt steps for each.

Put it into practice

Ivanti Connect Secure CVE-2026-111357 in KEV: What to Do

CISA added two more Ivanti Connect Secure flaws to KEV on 30 Oct 2026, completing a zero-day chain that gives root. Versions, deadlines and checks.

October 30, 2026

CVE-2026-76460: Cisco ISE CVSS 10.0 Auth Bypass

CVE-2026-76460 is a CVSS 10.0 authentication bypass in Cisco ISE, under active exploitation with no workaround. Affected versions, patches, and detection.

September 17, 2026

CVSS 10.0 Vendor Ranking 2026: Who Ships the Most Criticals

A ranked table of 12 major enterprise infrastructure vendors by CVSS 10.0 vulnerability count and confirmed exploitability through September 2026, with Cisco's record advisory cluster and board-ready framing for CISOs.

September 17, 2026

LiteLLM CVE-2026-59822 on CISA KEV: Forged MCP Sessions

CISA added LiteLLM CVE-2026-59822 (CVSS 8.8) to its Known Exploited Vulnerabilities catalog on Sep 3, 2026 — an unauthenticated attacker can establish an authenticated MCP session against the popular AI gateway. Why the gateway is the prize, and how to respond.

September 3, 2026