CISA KEV updates and active exploitation alerts highlight shifting vulnerability risk

CISA’s Known Exploited Vulnerabilities (KEV) Catalog continued to expand with newly confirmed in-the-wild exploitation, including the addition of four CVEs: CVE-2019-19006 (Sangoma FreePBX improper authentication), CVE-2021-39935 (GitLab CE/EE SSRF), CVE-2025-40551 (SolarWinds Web Help Desk deserialization of untrusted data), and CVE-2025-64328 (Sangoma FreePBX OS command injection). Under BOD 22-01, U.S. Federal Civilian Executive Branch agencies are required to remediate KEV-listed vulnerabilities by CISA’s due dates, and CISA urged non-federal organizations to use KEV as a prioritization input because these flaws are common initial access vectors.

Separate reporting highlighted concerns about how CISA communicates changes to KEV metadata tied to ransomware risk: GreyNoise reported that across 59 instances in 2025, CISA updated KEV entries to reflect ransomware-associated exploitation without proactively notifying defenders when the “known ransomware use” flag changed from Unknown to Known, which can materially affect patch prioritization. In parallel, third-party coverage described a CISA high-priority alert for a critical KiloView Encoder Series issue, CVE-2026-1453 (CVSS 9.8), caused by missing authentication for critical functions that could allow unauthenticated attackers to create/delete administrator accounts and gain full administrative control—posing disruption and lateral-movement risk in broadcast/production networks.