CISA KEV · January 2026
In January 2026, CISA added 17 vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, down from 20 in December 2025. 2 entries are known to be used in ransomware campaigns. The most affected vendors were Microsoft (3), SmarterTools (2), Ivanti (1). Every entry below has reliable evidence of exploitation in the wild, so if you run the product, patch or mitigate it first.
| Added | CVE | Vulnerability | Federal due |
|---|---|---|---|
| 29 Jan 2026 | CVE-2026-1281 | Ivanti Endpoint Manager Mobile (EPMM) Code Injection VulnerabilityIvanti · Endpoint Manager Mobile (EPMM) | |
| 27 Jan 2026 | CVE-2026-24858 | Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel VulnerabilityFortinet · Multiple Products | |
| 26 Jan 2026 | CVE-2026-24061 | GNU InetUtils Argument Injection VulnerabilityGNU · InetUtils | |
| 26 Jan 2026 | CVE-2026-23760 | SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel VulnerabilityRANSOMWARESmarterTools · SmarterMail | |
| 26 Jan 2026 | CVE-2026-21509 | Microsoft Office Security Feature Bypass VulnerabilityMicrosoft · Office | |
| 26 Jan 2026 | CVE-2025-52691 | SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type VulnerabilityRANSOMWARESmarterTools · SmarterMail | |
| 26 Jan 2026 | CVE-2018-14634 | Linux Kernel Integer Overflow VulnerabilityLinux · Kernel | |
| 23 Jan 2026 | CVE-2024-37079 | Broadcom VMware vCenter Server Out-of-bounds Write VulnerabilityBroadcom · VMware vCenter Server | |
| 22 Jan 2026 | CVE-2025-68645 | Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion VulnerabilitySynacor · Zimbra Collaboration Suite (ZCS) | |
| 22 Jan 2026 | CVE-2025-54313 | Prettier eslint-config-prettier Embedded Malicious Code VulnerabilityPrettier · eslint-config-prettier | |
| 22 Jan 2026 | CVE-2025-34026 | Versa Concerto Improper Authentication VulnerabilityVersa · Concerto | |
| 22 Jan 2026 | CVE-2025-31125 | Vite Vitejs Improper Access Control VulnerabilityVite · Vitejs | |
| 21 Jan 2026 | CVE-2026-20045 | Cisco Unified Communications Products Code Injection VulnerabilityCisco · Unified Communications Manager | |
| 13 Jan 2026 | CVE-2026-20805 | Microsoft Windows Information Disclosure VulnerabilityMicrosoft · Windows | |
| 12 Jan 2026 | CVE-2025-8110 | Gogs Path Traversal VulnerabilityGogs · Gogs | |
| 7 Jan 2026 | CVE-2025-37164 | Hewlett Packard Enterprise (HPE) OneView Code Injection VulnerabilityHewlett Packard Enterprise (HPE) · OneView | |
| 7 Jan 2026 | CVE-2009-0556 | Microsoft Office PowerPoint Code Injection VulnerabilityMicrosoft · Office |
Run your vendors and products through stack check, pre-filled with this month's vendors; it also gives you an RSS feed for new additions. The long-run picture is on CVE Trends.
17 vulnerabilities. In December 2025 it added 20.
Microsoft, with 3 entries. Next were SmarterTools (2), Ivanti (1), Fortinet (1).
It is the US Cybersecurity and Infrastructure Security Agency's list of vulnerabilities with reliable evidence of exploitation in the wild, currently 1,767 entries. US federal agencies must fix listed vulnerabilities by the due date; for everyone else it is the best public list of what to patch first.
How this is made: generated automatically from the CISA KEV catalog, grouped by the date CISA added each entry. Vulnerability names are CISA's. Federal due dates apply to US agencies under BOD 22-01; for everyone else they are a sensible upper bound.
We wire CISA KEV and EPSS into your scanner, SIEM and ticketing, so your team sees the few entries that match your estate, with deadlines an auditor accepts.
Get in touch →