CISA KEV · July 2026
In July 2026, CISA added 26 vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, up from 23 in June 2026. 4 entries are known to be used in ransomware campaigns. The most affected vendors were Microsoft (5), Fortinet (3), Cisco (2). Every entry below has reliable evidence of exploitation in the wild, so if you run the product, patch or mitigate it first.
| Added | CVE | Vulnerability | Federal due |
|---|---|---|---|
| 29 Jul 2026 | CVE-2026-20316 | Cisco Secure Firewall Management Center Use of Hard-coded Password VulnerabilityRANSOMWARECisco · Secure Firewall Management Center (FMC) | |
| 27 Jul 2026 | CVE-2026-16812 | Arista VeloCloud Orchestrator On-Prem OS Command Injection VulnerabilityArista · VeloCloud Orchestrator | |
| 27 Jul 2026 | CVE-2025-68686 | Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor VulnerabilityFortinet · FortiOS | |
| 22 Jul 2026 | CVE-2026-50522 | Microsoft SharePoint Deserialization of Untrusted Data Vulnerability Microsoft · SharePoint | |
| 22 Jul 2026 | CVE-2026-16232 | Check Point SmartConsole Improper Authentication VulnerabilityCheck Point · SmartConsole | |
| 21 Jul 2026 | CVE-2026-63030 | WordPress Core Interpretation Conflict VulnerabilityWordPress · Core | |
| 21 Jul 2026 | CVE-2026-60137 | WordPress Core SQL Injection VulnerabilityWordPress · Core | |
| 21 Jul 2026 | CVE-2026-0770 | Langflow Inclusion of Functionality from Untrusted Control Sphere VulnerabilityLangflow · Langflow | |
| 21 Jul 2026 | CVE-2021-27137 | DD-WRT Stack-Based Buffer Overflow VulnerabilityDD-WRT · DD-WRT | |
| 16 Jul 2026 | CVE-2026-58644 | Microsoft SharePoint Deserialization of Untrusted Data VulnerabilityMicrosoft · SharePoint | |
| 16 Jul 2026 | CVE-2026-39808 | Fortinet FortiSandbox OS Command Injection VulnerabilityFortinet · FortiSandbox | |
| 16 Jul 2026 | CVE-2026-25089 | Fortinet FortiSandbox OS Command Injection VulnerabilityFortinet · FortiSandbox | |
| 15 Jul 2026 | CVE-2026-46817 | Oracle E-Business Suite Improper Privilege Management VulnerabilityOracle · E-Business Suite | |
| 15 Jul 2026 | CVE-2023-4346 | KNX Association KNX Protocol Connection Authorization Option 1 Overly Restrictive Account Lockout Mechanism VulnerabilityKNX Association · KNX Protocol Connection Authorization Option 1 | |
| 14 Jul 2026 | CVE-2026-56164 | Microsoft SharePoint Server Missing Authentication for Critical Function VulnerabilityMicrosoft · SharePoint Server | |
| 14 Jul 2026 | CVE-2026-56155 | Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability Microsoft · Active Directory Federation Services | |
| 14 Jul 2026 | CVE-2026-15410 | SonicWall SMA1000 Appliances Code Injection VulnerabilityRANSOMWARESonicWall · SMA1000 Appliances | |
| 14 Jul 2026 | CVE-2026-15409 | SonicWall SMA1000 Appliances Server-Side Request Forgery VulnerabilityRANSOMWARESonicWall · SMA1000 Appliances | |
| 13 Jul 2026 | CVE-2008-4128 | Cisco IOS Cross-Site Request Forgery VulnerabilityCisco · IOS | |
| 10 Jul 2026 | CVE-2026-56291 | Balbooa Forms Unrestricted Upload of File with Dangerous Type VulnerabilityBalbooa · Forms | |
| 10 Jul 2026 | CVE-2026-48939 | iCagenda Unrestricted Upload of File with Dangerous Type VulnerabilityiCagenda · iCagenda | |
| 7 Jul 2026 | CVE-2026-56290 | Joomlack Page Builder Improper Access Control VulnerabilityJoomlack · Page Builder | |
| 7 Jul 2026 | CVE-2026-55255 | Langflow Authorization Bypass Through User-Controlled Key VulnerabilityLangflow · Langflow | |
| 7 Jul 2026 | CVE-2026-48908 | JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type VulnerabilityJoomShaper · SP Page Builder | |
| 7 Jul 2026 | CVE-2026-48282 | Adobe ColdFusion Path Traversal VulnerabilityAdobe · ColdFusion | |
| 1 Jul 2026 | CVE-2026-45659 | Microsoft SharePoint Server Deserialization of Untrusted Data VulnerabilityRANSOMWAREMicrosoft · SharePoint Server |
Run your vendors and products through stack check, pre-filled with this month's vendors; it also gives you an RSS feed for new additions. The long-run picture is on CVE Trends.
26 vulnerabilities. In June 2026 it added 23.
Microsoft, with 5 entries. Next were Fortinet (3), Cisco (2), WordPress (2).
It is the US Cybersecurity and Infrastructure Security Agency's list of vulnerabilities with reliable evidence of exploitation in the wild, currently 1,767 entries. US federal agencies must fix listed vulnerabilities by the due date; for everyone else it is the best public list of what to patch first.
How this is made: generated automatically from the CISA KEV catalog, grouped by the date CISA added each entry. Vulnerability names are CISA's. Federal due dates apply to US agencies under BOD 22-01; for everyone else they are a sensible upper bound.
We wire CISA KEV and EPSS into your scanner, SIEM and ticketing, so your team sees the few entries that match your estate, with deadlines an auditor accepts.
Get in touch →