Loading story…
CISA updated its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation, adding CVE-2024-37079, an out-of-bounds write vulnerability affecting Broadcom VMware vCenter Server. CISA emphasized that KEV-listed issues represent frequent attack vectors and material risk to the federal enterprise, and reiterated that BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate KEV vulnerabilities by mandated due dates; CISA also urged non-federal organizations to prioritize KEV remediation as part of vulnerability management.
Separately, LevelBlue SpiderLabs highlighted renewed operational relevance of CVE-2009-0556, a legacy Microsoft PowerPoint memory-corruption/code-injection issue enabling arbitrary code execution via a crafted PowerPoint file (e.g., malformed OutlineTextRefAtom index). The post notes the vulnerability’s resurfacing after being added to the KEV Catalog (per the article, on 2026-01-07), using it as an example of how long-fixed flaws can re-emerge when legacy Office versions, backward-compatible components, or poor patch hygiene persist in enterprise environments.
See which actors are running it and whether you're in range.
3 events from the most recent confirmed update back to the earliest known activity.
CISA added CVE-2024-37079, an out-of-bounds write vulnerability affecting Broadcom VMware vCenter Server, to the Known Exploited Vulnerabilities Catalog based on evidence of active exploitation.
CISA added CVE-2009-0556 to its Known Exploited Vulnerabilities Catalog, indicating evidence of active exploitation and renewed operational relevance for the long-known PowerPoint flaw.
In 2009, Ziv Mador and Cristian Craioveanu of the Microsoft Malware Team documented CVE-2009-0556, a memory-corruption/code-injection vulnerability in legacy Microsoft PowerPoint versions that could allow remote code execution via a crafted PowerPoint file.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISA added **five vulnerabilities** to its **Known Exploited Vulnerabilities (KEV) Catalog** based on evidence of **active exploitation**, reinforcing that these issues are being used as real-world attack vectors and should be prioritized for remediation. The newly listed CVEs are **CVE-2018-14634** (Linux kernel integer overflow / local privilege escalation), **CVE-2025-52691** (SmarterTools *SmarterMail* unrestricted file upload enabling RCE), **CVE-2026-21509** (Microsoft Office security feature bypass), **CVE-2026-23760** (SmarterTools *SmarterMail* authentication bypass via alternate path/channel), and **CVE-2026-24061** (GNU *InetUtils* argument injection). CISA reiterated that these vulnerability classes are frequently leveraged by threat actors and pose material risk to enterprise environments. Under **BOD 22-01**, U.S. Federal Civilian Executive Branch (FCEB) agencies are required to remediate KEV-listed vulnerabilities by CISA-specified due dates, and CISA urged all organizations to treat KEV entries as high-priority items in vulnerability management. Additional technical context highlighted that **CVE-2025-52691** can enable unauthenticated arbitrary file upload leading to **remote code execution** (noted as **CVSS 10.0** in the reporting) and that **CVE-2018-14634**, while older, remains relevant where legacy Linux kernels persist—underscoring that KEV additions can include long-standing flaws when exploitation is observed in the wild.
Jun 29, 2026
CISA’s **Known Exploited Vulnerabilities (KEV)** program continues to be used as an operational prioritization mechanism for vulnerabilities with confirmed exploitation, but recent analysis cautions it is often misunderstood as a definitive list of the “worst” vulnerabilities. A paper by former CISA KEV section chief Tod Beardsley describes how enrichment signals (e.g., **CVSS**, **EPSS**, **SSVC**, public exploit availability in *Metasploit*/*Nuclei*, and **MITRE ATT&CK** mappings) can be combined to better triage KEV entries, and introduces *KEV Collider*, a free web app/dataset intended to help teams explore and validate enriched KEV data; one highlighted finding is that only **~32%** of KEV-listed vulnerabilities are “immediately exploitable for initial access.” CISA also added two vulnerabilities to the KEV catalog due to **active exploitation**: **CVE-2026-24423** (SmarterTools *SmarterMail*) and **CVE-2025-11953** (*React Native Community CLI*). CVE-2026-24423 is described as an unauthenticated **RCE** tied to a missing authentication check in the `ConnectToHub` API method in SmarterMail builds prior to **9511**, enabling command execution by coercing the server to connect to a malicious HTTP endpoint; build **9511** was released to remediate, and ransomware activity has reportedly targeted exposed instances. CVE-2025-11953 is described as unauthenticated OS command injection via the Metro dev server (notably when bound to external interfaces), with reporting of exploitation activity involving PowerShell-based loaders and defense evasion; U.S. federal agencies are directed under **BOD 22-01** to remediate by the stated KEV deadline, and other organizations are advised to patch/upgrade and reduce exposure (e.g., bind Metro to localhost) while monitoring for suspicious PowerShell and related post-exploitation behavior.
Jun 29, 2026
**CISA added CVE-2024-37079, a critical VMware vCenter Server vulnerability, to its Known Exploited Vulnerabilities (KEV) Catalog after Broadcom indicated it has evidence of in-the-wild exploitation.** The flaw is a **9.8 CVSS** out-of-bounds write/heap-overflow issue in vCenter Server’s **DCERPC** implementation; an attacker with network access can send specially crafted packets that may result in **remote code execution (RCE)**. CISA’s KEV entry does not attribute exploitation to a specific threat actor and lists ransomware use as **unknown**, but the KEV addition triggers mandatory remediation timelines for US federal agencies. Reporting also noted CISA added multiple other enterprise software issues to KEV in a short span (including vulnerabilities affecting **Versa Concerto** and **Zimbra**, plus developer tools), but the vCenter Server item drew specific attention because it was **patched by Broadcom in 2024** and is still being exploited. Broadcom has not publicly provided details on the scope, victims, or exploitation chain beyond acknowledging observed exploitation, reinforcing the need for organizations running vCenter Server to validate exposure and ensure the relevant updates are deployed.
Jun 29, 2026