CISA adds eight known exploited vulnerabilities to catalog

CISA has added eight new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation:

CVE-2023-27351 PaperCut NG/MF Improper Authentication Vulnerability, CVE-2024-27199 JetBrains TeamCity Relative Path Traversal Vulnerability, CVE-2025-2749 Kentico Xperience Path Traversal Vulnerability, CVE-2025-32975 Quest KACE Systems Management Appliance (SMA) Improper Authentication Vulnerability, CVE-2025-48700 Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability, CVE-2026-20122 Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Vulnerability, CVE-2026-20128 Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format Vulnerability, and CVE-2026-20133 Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor Vulnerability.

These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.