CISA Flags Actively Exploited Vulnerabilities as KEV Adds Expand to BeyondTrust and Roundcube
Active Exploitation · 2 sources · Updated 4mo ago · First seen Feb 21, 2026
CISA updated its Known Exploited Vulnerabilities (KEV) Catalog to reflect active exploitation of a previously patched BeyondTrust remote code execution flaw, CVE-2026-1731 (CVSS 9.9), which has now been tied to ransomware activity. Reporting also cited third-party telemetry indicating an increase in exploitation attempts, and emphasized that because BeyondTrust commonly sits in identity/privileged access paths, successful RCE can rapidly translate into broad enterprise compromise; recommended mitigations included immediate patching and, if patching is not immediately possible, taking the affected portal offline or tightly restricting access.
Separately, CISA also announced the addition of two Roundcube Webmail vulnerabilities to the KEV Catalog based on evidence of active exploitation: CVE-2025-49113 (deserialization of untrusted data) and CVE-2025-68461 (cross-site scripting). CISA reiterated that under BOD 22-01, U.S. Federal Civilian Executive Branch agencies must remediate KEV-listed issues by mandated deadlines, and urged all organizations to prioritize remediation of KEV entries as a high-signal indicator of real-world exploitation risk.
