CISA Adds Four Actively Exploited Vulnerabilities to KEV Catalog (CVE‑2026‑75650, CVE‑2026‑81963, CVE‑2026‑85880, CVE‑2026‑86218)
What It Is – The Cybersecurity and Infrastructure Security Agency (CISA) announced that four CVEs have been added to its Known Exploited Vulnerabilities (KEV) Catalog after confirming active exploitation in the wild.
Exploitability – All four flaws are confirmed to be weaponized by threat actors; no public proof‑of‑concept is required for the catalog entry. CISA’s Binding Operational Directive 26‑04 treats them as high‑risk, demanding rapid remediation on any publicly exposed asset.
Affected Products –
- CVE‑2026‑75650 – Adobe Commerce and Magento (template engine injection)
- CVE‑2026‑81963 – Microsoft Windows (link‑following vulnerability)
- CVE‑2026‑85880 – Microsoft Windows (heap‑based buffer overflow)
- CVE‑2026‑86218 – N‑able N‑central (static code injection)
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous vulnerability‑management controls that generate auditable evidence of timely patching.
- Aligns with the control objective of maintaining a documented, risk‑based remediation process, which satisfies multiple frameworks (e.g., NIST CSF 2.0, ISO 27001).
- Provides a concrete trigger for control‑mapping activities: each CVE maps to the “Patch Management” and “Secure Configuration” objectives, enabling organizations to prove due‑diligence to auditors and federal partners.
Recommended Actions
- Identify any public‑facing assets running the listed products and verify exposure.
- Prioritize patch deployment per CISA BOD 26‑04, capturing remediation tickets and patch‑install logs as evidence.
- Run a post‑remediation scan to confirm the vulnerability is closed and record the results in your control‑evidence repository.
- Update your vulnerability‑risk register and map each CVE to the relevant control objectives in your framework of record.
Source: CISA Advisory – Four Known Exploited Vulnerabilities Added to KEV Catalog