#CISA
All CosmicBytez Labs articles tagged #CISA, across news, security advisories, how-to guides, and projects.
- News
Ransomware Has a New Target: Is Your Backup Ready?
Ransomware gangs now destroy backups first to kill recovery options. Kaseya, CISA, and recent Veeam CVEs show why isolated, tested backups matter.
- Security
CVE-2026-95102: Critical Missing Authentication in Monta EV Charging Platform's WebSocket Endpoints
CVSS 9.4: Monta EV charging WebSocket endpoints lack authentication, allowing attackers to impersonate charging stations.
- News
CISA Warns of Critical Pre-Auth RCE Flaw in MikroTik RouterOS
CISA warns of CVE-2026-84411, a critical CVSS 9.8 pre-auth flaw in MikroTik RouterOS letting unauthenticated attackers gain root RCE or crash the device.
- News
US, UK, and Dutch Agencies Warn of Actively Exploited Citrix NetScaler Zero-Days
US, UK, and Dutch agencies warn Citrix NetScaler ADC and Gateway zero-days CVE-2026-88771 and CVE-2026-88772 are under active global exploitation.
- News
SharePoint RCE and MikroTik RouterOS Flaws Actively Exploited in the Wild
CISA added CVE-2026-65660 (SharePoint RCE, CVSS 8.8) and CVE-2026-67279 (MikroTik RouterOS, CVSS 6.9) to its KEV catalog citing active exploitation.
- News
Deception by Design: CISA's Guide to Tricking Cybercriminals
CISA's new deception guide helps resource-strapped orgs deploy honeypots and honeytokens to catch attackers using stolen credentials.
- News
After Water Attacks, Congress Pitches Its Own AI Cyber Defense Pilot
Gottheimer's $100M CISA bill would give water utilities free AI tools, rivaling the White House's Texas pilot.
- News
CISA Warns of Active Exploitation of Three Linux Kernel Flaws
CISA added three Linux kernel CVEs to its KEV catalog, ordering federal agencies to patch and forensically triage by end of day.
- News
House Democrats Push CISA Force Structure Assessment Act After ~1,000 Employee Exodus
New legislation would force a top-to-bottom review of CISA's staffing, training, and readiness after roughly 1,000 departures.
- Security
Digital Watchdog VMAX DVR/NVR Missing Authorization Enables Takeover
CVE-2026-66887 (CVSS 9.6) lets attackers bypass session checks on Digital Watchdog VMAX DVR/NVR state-changing CGIs for full admin control.
- Security
Digital Watchdog VMAX Root FTP Credentials Baked In
CVE-2026-66890 (CVSS 9.6) hard-codes root-level FTP credentials into Digital Watchdog VMAX DVR/NVR firmware, enabling remote root file access.
- News
CISA Calls for More Guidance, Less Spin, as Cyber Outages Escalate
CISA, FBI, and Five Eyes partners publish joint crisis-comms guidance urging providers to drop PR spin and disclose outage root causes transparently.
- News
Actively Exploited Oracle WebLogic Flaw Lets Unauthenticated Attackers Access Critical Data
CISA adds a maximum-severity Oracle WebLogic and HTTP Server flaw to the KEV catalog as active exploitation is confirmed in the wild.
- News
CISA Warns of Hackers Exploiting Critical MLflow Vulnerability
CVE-2026-64849 (CVSS 9.3): Active SSRF exploitation in MLflow lets attackers steal AWS cloud credentials via redirect bypass. Added to CISA KEV.
- News
CISA: Medusa Ransomware Hit Over 500 Critical Infrastructure Orgs
FBI and CISA warn that Medusa ransomware has breached 500+ US critical infrastructure organizations since 2021, demanding ransoms up to $15 million.
- News
CISA Flags Actively Exploited Ray Flaw That Can Trigger Browser-Based RCE
CISA added a critical Ray framework flaw to its KEV catalog. The vulnerability enables browser-based RCE in AI/ML distributed computing workloads.
- News
Gunra Ransomware Exploits Fortinet and Schneider Electric Flaws to Breach Networks
A CISA/FBI joint advisory warns that Gunra ransomware — a Conti-derived RaaS — has claimed 51+ victims by exploiting critical Fortinet FortiOS...
- News
Senate Democrats Introduce Water Cyber Shield Act to Fund $300M Annual Water System Cybersecurity
Senators Schiff and Klobuchar introduce legislation directing $300 million per year to secure U.S. water and wastewater infrastructure following...
- News
Progress Kemp LoadMaster Flaw Hits CISA KEV After 792 Reported Exploit Attempts
A critical pre-auth RCE vulnerability in Progress Kemp LoadMaster has been added to CISA's Known Exploited Vulnerabilities catalog following 792...
- News
CISA Flags Langflow RCE, Tomcat, and N-central Flaws as Actively Exploited
CISA added three vulnerabilities to its Known Exploited Vulnerabilities catalog on August 5, 2026 — a critical Langflow RCE, an Apache Tomcat encryption...
- Security
CVE-2026-61884: Tycon Systems TPDIN-Monitor-WEB2 Authentication Bypass (CVSS 9.8)
A critical authentication bypass in the Tycon Systems TPDIN-Monitor-WEB2 web interface allows unauthenticated remote attackers to gain full administrative...
- News
Russian Laundry Bear Exploited Zimbra Zero-Day to Steal Mail and 2FA Codes
A Russian state-sponsored espionage group spent months silently reading Western mailboxes through a zero-click XSS flaw in Zimbra's webmail client —...
- News
CISA Orders Immediate Patching of Actively Exploited Fortinet FortiSandbox Flaws
CISA added two critical Fortinet FortiSandbox OS command injection vulnerabilities to its KEV catalog and gave federal agencies just three days to patch,...
- News
iCagenda and Balbooa Forms Joomla Flaws Exploited as Zero-Days
CISA has added two maximum-severity flaws in iCagenda and Balbooa Forms Joomla extensions to its KEV catalog following confirmed zero-day exploitation in...
- News
Lessons Learned from CISA's Recent GitHub Leak
CISA has published a postmortem on a data leak in which a contractor exposed dozens of internal credentials — including AWS GovCloud keys — in a public...
- News
CISA Orders Feds to Prioritize Patching Langflow Auth Bypass Flaw
CISA added CVE-2026-55255, a CVSS 9.9 IDOR authorization bypass in Langflow, to its Known Exploited Vulnerabilities catalog on July 7, ordering U.S....
- News
CISA: Microsoft SharePoint RCE Flaw Now Actively Exploited
CISA added CVE-2026-45659 to its Known Exploited Vulnerabilities catalog, confirming active in-the-wild exploitation of a high-severity SharePoint...
- News
CISA: Windows BlueHammer Flaw Now Exploited by Ransomware Gangs
CISA has confirmed that ransomware gangs are actively exploiting BlueHammer, a Microsoft Defender privilege escalation vulnerability previously used in...
- News
Langflow RCE Exploited to Deploy Monero Miner on Exposed AI App Endpoints
Threat actors are actively weaponizing CVE-2026-33017, a critical unauthenticated RCE flaw in Langflow, to deploy a Monero miner via the lambsys...
- News
CISA Sets Urgent Deadline to Fix Cisco Flaw Actively Exploited in Attacks
CISA has added a Cisco Unified Communications Manager Server vulnerability to its Known Exploited Vulnerabilities catalog and ordered federal agencies to...
- News
CISA Adds Exploited PTC Windchill RCE Flaw to KEV as Web Shell Attacks Continue
CISA has added CVE-2026-12569, a critical remote code execution vulnerability in PTC Windchill PDMlink and FlexPLM, to its Known Exploited Vulnerabilities...
- News
First-Ever Exploitation of PTC Windchill Vulnerability Discovered in the Wild
CISA has added CVE-2026-12569, a remote code execution flaw in PTC Windchill, to its Known Exploited Vulnerabilities catalog after confirming active...
- News
CISA Warns Fortinet Users to Secure Devices After FortiBleed Credential Leak
Nearly 74,000 Fortinet firewall and VPN credentials were exposed in the FortiBleed data leak, prompting CISA to urge immediate device hardening and...
- News
CISA Orders Feds to Patch Max Severity Joomla Plugin Flaw by Friday
CISA has issued an emergency directive ordering federal agencies to patch CVE-2026-48907, a maximum-severity improper access control flaw in the Widget...
- News
CISA Warns of Actively Exploited Joomla JCE Flaw Allowing PHP Code Execution
CISA has added a maximum-severity vulnerability in the Joomla Content Editor (JCE) plugin to its Known Exploited Vulnerabilities catalog, warning that the...
- Newsletter
June 17 Digest: Teams C2 Evasion, Copilot Data Theft, iRhythm Breach, cPanel KEV
DragonForce hides C2 inside Microsoft Teams relay traffic; a SearchLeak attack weaponizes M365 Copilot for one-click data exfiltration; iRhythm confirms...
- News
CISA Warns of Another Actively Exploited cPanel Plugin Flaw
CISA has added CVE-2026-54420, an actively exploited vulnerability in the LiteSpeed cPanel user-end plugin, to its Known Exploited Vulnerabilities catalog...
- News
CISA Gives Feds 3 Days to Patch Check Point VPN Bug Exploited as Zero-Day
CISA ordered federal agencies to patch a critical Check Point Remote Access VPN flaw within 3 days after Qilin ransomware affiliates were confirmed...
- News
CISA: Hackers Now Exploit SolarWinds Serv-U Flaw to Crash Servers
CISA added a high-severity SolarWinds Serv-U flaw to its KEV catalog after confirming attackers are actively exploiting it to crash file transfer servers.
- News
In Other News: Anthropic Maps AI Threats, Unpatched Comodo Flaw, Palantir Chief Eyed for CISA
This week's cybersecurity roundup covers Anthropic's new AI threat taxonomy, an unpatched Comodo security flaw, Palantir's Alex Karp reportedly under…
- News
CISA Adds Exploited Magento RCE Flaw CVE-2026-45247 to KEV Catalog
CISA has added a critical remote code execution vulnerability in the Mirasvit Cache Warmer Magento extension to its Known Exploited Vulnerabilities catalog…
- News
Trump Considers Palantir CTO Shyam Sankar to Lead CISA
Shyam Sankar, the chief technology officer at Palantir Technologies, has emerged as the leading contender for the long-vacant CISA director role under the…
- News
Federal Audit Reveals NIST's NVD Is Plagued by Poor Planning and Duplication
A Commerce Inspector General report exposes how mismanagement allowed a backlog of more than 27,000 unprocessed security flaws to grow unchecked in the...
- News
In Other News: Trump Mobile Data Breach, FIFA World Cup Phishing, CISA Responds to Supply Chain Attacks
Noteworthy cybersecurity stories from the week: Trump Mobile exposes customer data, phishers target 2026 FIFA World Cup fans, and CISA responds to recent...
- News
CISA Gives Feds 4 Days to Patch Actively Exploited cPanel Plugin Flaw
CISA's emergency directive gives federal agencies four days to patch the actively exploited LiteSpeed cPanel plugin flaw being weaponized in the wild.
- News
CISA Urges Immediate Patching of Exploited LiteSpeed cPanel
CISA has added a LiteSpeed cPanel plugin zero-day to its Known Exploited Vulnerabilities catalog after active exploitation allowed attackers to execute scripts.
- News
Drupal Core SQL Injection Bug Actively Exploited, Added to CISA KEV
CISA has added CVE-2026-9082, a SQL injection vulnerability in Drupal Core, to its Known Exploited Vulnerabilities catalog following confirmed in-the-wild...
- News
Lawmakers Demand Answers as CISA Tries to Contain Data Leak
Members of Congress are demanding answers from CISA after a contractor intentionally published AWS GovCloud access keys and a trove of agency secrets on a...
- News
CISA Gives Federal Agencies Four Days to Patch Actively
CISA has added a high-severity Ivanti Endpoint Manager Mobile vulnerability to the Known Exploited Vulnerabilities catalog and issued an emergency...
- News
CISA Adds Actively Exploited Linux Root Access Bug
The U.S. Cybersecurity and Infrastructure Security Agency has added CVE-2026-31431, a Linux kernel privilege escalation flaw enabling root access, to its...
- News
Over 10,000 Zimbra Servers Vulnerable to Ongoing XSS Attacks
CISA has confirmed that a cross-site scripting vulnerability in Zimbra Collaboration Suite is being actively exploited in the wild, with over 10,000...
- News
CISA Adds 4 Exploited Flaws to KEV, Sets May 2026 Federal
CISA has added four actively exploited vulnerabilities affecting SimpleHelp, Samsung MagicINFO 9 Server, and D-Link DIR-823X routers to its Known...
- News
FIRESTARTER Backdoor Hit Federal Cisco Firepower Device
CISA and the UK's NCSC have revealed that a US federal civilian agency's Cisco Firepower device running ASA software was compromised in September 2025...
- News
Fortinet FortiClient EMS Zero-Day CVE-2026-35616 Actively
A critical zero-day in FortiClient EMS with a CVSS score of 9.8 is being actively exploited in the wild while Fortinet has released only an emergency...
- News
Trump Budget Proposal Would Cut Hundreds of Millions More
The Trump administration's latest federal budget proposal includes hundreds of millions of dollars in additional cuts to CISA, the nation's primary...
- News
CISA Orders Feds to Patch Actively Exploited Citrix Flaw by Thursday
CISA has issued a mandatory patching directive ordering all U.S. federal agencies to apply Citrix NetScaler security updates by Thursday, March 5, 2026,...
- News
F5 BIG-IP Vulnerability Reclassified from DoS to RCE Under
CVE-2025-53521, initially disclosed as a high-severity denial-of-service flaw in F5 BIG-IP APM, has been reclassified as a remote code execution...
- News
CISA: New Langflow Flaw Actively Exploited to Hijack AI
CISA has added CVE-2026-33017, a critical unauthenticated remote code execution vulnerability in the Langflow AI framework, to its Known Exploited...
- News
CISA Adds CVE-2025-53521 to KEV After Active F5 BIG-IP APM
CISA has added CVE-2025-53521, a critical vulnerability in F5 BIG-IP Access Policy Manager, to its Known Exploited Vulnerabilities catalog after...
- News
FBI Warns Russian Intelligence Targeting Signal and WhatsApp in Mass Phishing Campaign
FBI and CISA alert warns Russian state actors have compromised thousands of messaging accounts belonging to US government officials, military personnel,...
- News
CISA Adds Zimbra XSS and SharePoint RCE to KEV; Cisco FMC
CISA added actively exploited Zimbra Collaboration Suite and Microsoft SharePoint vulnerabilities to its Known Exploited Vulnerabilities catalog on March...
- News
CISA Orders Federal Agencies to Patch n8n RCE Flaw
CISA mandated all federal civilian agencies patch CVE-2025-68613, a CVSS 9.9 remote code execution flaw in the n8n workflow automation platform, after...
- Security
CISA Issues Emergency Directive as Cisco SD-WAN Zero-Day
A maximum-severity authentication bypass in Cisco Catalyst SD-WAN (CVE-2026-20127, CVSS 10.0) has been actively exploited by threat actor UAT-8616 since...
- Security
CISA Adds Actively Exploited VMware Aria Operations RCE
CISA has added CVE-2026-22719, a high-severity command injection vulnerability in VMware Aria Operations allowing unauthenticated remote code execution,...
- Security
Cisco SD-WAN Zero-Day CVE-2026-20127 Triggers Five Eyes
A CVSS 10.0 authentication bypass in Cisco Catalyst SD-WAN has been exploited since at least 2023. CISA issues Emergency Directive ED 26-03 as all Five...
- Security
CISA Adds Two Actively Exploited Roundcube Webmail Flaws to KEV
CISA has added two Roundcube Webmail vulnerabilities to the Known Exploited Vulnerabilities catalog — CVE-2025-49113 (CVSS 9.9, deserialization RCE) and...
- News
CISA Loses 62% of Workforce as DHS Shutdown Guts America's
A partial DHS shutdown since February 14 has furloughed 1,453 of CISA's 2,341 employees, halting vulnerability scanning, threat advisories, and critical...
- News
CISA Mandates Full Zero Trust Architecture for Federal
New CISA directive requires all federal civilian agencies to implement comprehensive zero trust security architecture by September 2027, setting a...
- Security
CISA Adds Four Critical Vulnerabilities to KEV Catalog
CISA has updated the Known Exploited Vulnerabilities catalog with four actively exploited flaws including Microsoft Office and SmarterMail vulnerabilities.
- News
Ivanti Connect Secure Under Active Attack - CISA Issues
CISA has issued an emergency directive requiring federal agencies to mitigate Ivanti Connect Secure vulnerabilities within 48 hours as active exploitation...