CISA KEV · March 2026
In March 2026, CISA added 26 vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, down from 28 in February 2026. 2 entries are known to be used in ransomware campaigns. The most affected vendors were Apple (6), Google (2), Citrix (1). Every entry below has reliable evidence of exploitation in the wild, so if you run the product, patch or mitigate it first.
| Added | CVE | Vulnerability | Federal due |
|---|---|---|---|
| 30 Mar 2026 | CVE-2026-3055 | Citrix NetScaler Out-of-Bounds Read VulnerabilityCitrix · NetScaler | |
| 27 Mar 2026 | CVE-2025-53521 | F5 BIG-IP Stack-Based Buffer Overflow VulnerabilityF5 · BIG-IP | |
| 26 Mar 2026 | CVE-2026-33634 | Aquasecurity Trivy Embedded Malicious Code VulnerabilityAquasecurity · Trivy | |
| 25 Mar 2026 | CVE-2026-33017 | Langflow Code Injection VulnerabilityLangflow · Langflow | |
| 20 Mar 2026 | CVE-2025-54068 | Laravel Livewire Code Injection VulnerabilityLaravel · Livewire | |
| 20 Mar 2026 | CVE-2025-43520 | Apple Multiple Products Classic Buffer Overflow VulnerabilityApple · Multiple Products | |
| 20 Mar 2026 | CVE-2025-43510 | Apple Multiple Products Improper Locking VulnerabilityApple · Multiple Products | |
| 20 Mar 2026 | CVE-2025-32432 | Craft CMS Code Injection VulnerabilityCraft CMS · Craft CMS | |
| 20 Mar 2026 | CVE-2025-31277 | Apple Multiple Products Buffer Overflow VulnerabilityApple · Multiple Products | |
| 19 Mar 2026 | CVE-2026-20131 | Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data VulnerabilityRANSOMWARECisco · Secure Firewall Management Center (FMC) | |
| 18 Mar 2026 | CVE-2026-20963 | Microsoft SharePoint Deserialization of Untrusted Data VulnerabilityMicrosoft · SharePoint | |
| 18 Mar 2026 | CVE-2025-66376 | Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting VulnerabilitySynacor · Zimbra Collaboration Suite (ZCS) | |
| 16 Mar 2026 | CVE-2025-47813 | Wing FTP Server Information Disclosure VulnerabilityWing FTP Server · Wing FTP Server | |
| 13 Mar 2026 | CVE-2026-3910 | Google Chromium V8 Improper Restriction of Operations Within the Bounds of a Memory Buffer VulnerabilityGoogle · Chromium V8 | |
| 13 Mar 2026 | CVE-2026-3909 | Google Skia Out-of-Bounds Write VulnerabilityGoogle · Skia | |
| 11 Mar 2026 | CVE-2025-68613 | n8n Improper Control of Dynamically-Managed Code Resources Vulnerabilityn8n · n8n | |
| 9 Mar 2026 | CVE-2026-1603 | Ivanti Endpoint Manager (EPM) Authentication Bypass VulnerabilityIvanti · Endpoint Manager (EPM) | |
| 9 Mar 2026 | CVE-2025-26399 | SolarWinds Web Help Desk Deserialization of Untrusted Data VulnerabilityRANSOMWARESolarWinds · Web Help Desk | |
| 9 Mar 2026 | CVE-2021-22054 | Omnissa Workspace ONE Server-Side Request ForgeryOmnissa · Workspace One UEM | |
| 5 Mar 2026 | CVE-2023-43000 | Apple Multiple products Use-After-Free VulnerabilityApple · Multiple Products | |
| 5 Mar 2026 | CVE-2023-41974 | Apple iOS and iPadOS Use-After-Free VulnerabilityApple · iOS and iPadOS | |
| 5 Mar 2026 | CVE-2021-30952 | Apple Multiple Products Integer Overflow or Wraparound VulnerabilityApple · Multiple Products | |
| 5 Mar 2026 | CVE-2021-22681 | Rockwell Multiple Products Insufficient Protected Credentials VulnerabilityRockwell · Multiple Products | |
| 5 Mar 2026 | CVE-2017-7921 | Hikvision Multiple Products Improper Authentication VulnerabilityHikvision · Multiple Products | |
| 3 Mar 2026 | CVE-2026-22719 | Broadcom VMware Aria Operations Command Injection VulnerabilityBroadcom · VMware Aria Operations | |
| 3 Mar 2026 | CVE-2026-21385 | Qualcomm Multiple Chipsets Memory Corruption VulnerabilityQualcomm · Multiple Chipsets |
Run your vendors and products through stack check, pre-filled with this month's vendors; it also gives you an RSS feed for new additions. The long-run picture is on CVE Trends.
26 vulnerabilities. In February 2026 it added 28.
Apple, with 6 entries. Next were Google (2), Citrix (1), F5 (1).
It is the US Cybersecurity and Infrastructure Security Agency's list of vulnerabilities with reliable evidence of exploitation in the wild, currently 1,767 entries. US federal agencies must fix listed vulnerabilities by the due date; for everyone else it is the best public list of what to patch first.
How this is made: generated automatically from the CISA KEV catalog, grouped by the date CISA added each entry. Vulnerability names are CISA's. Federal due dates apply to US agencies under BOD 22-01; for everyone else they are a sensible upper bound.
We wire CISA KEV and EPSS into your scanner, SIEM and ticketing, so your team sees the few entries that match your estate, with deadlines an auditor accepts.
Get in touch →