KEV
CISA's Known Exploited Vulnerabilities catalog. A listed CVE is being used in real attacks: patch it first.
Further reading: www.cisa.gov
Advisories that mention this term
Opening a crafted message file makes Outlook skip the external-content warning and leak NTLMv2 hashes; zero-day CVE-2026-124194 exploited and added to KEV
Microsoft’s November Patch Tuesday fixes Outlook spoofing flaw CVE-2026-124194: if a user opens a crafted message file, Outlook connects to an attacker-controlled location without the usual external-content warning and leaks an NTLMv2 hash that can be used to impersonate the user .
IBM Aspera Faspex 5 authorization flaw CVE-2026-123218 exploited and added to KEV, allows escalation to full admin
IBM published a bulletin on Nov 7 saying Aspera Faspex 5.
Exploited SonicOS SSLVPN flaw CVE-2026-19868 lets attackers sidestep SAML and MFA, now on KEV
CVE-2026-19868 in SonicWall SonicOS SSLVPN can let a user holding valid credentials for another authentication method bypass SAML authentication, and possibly the MFA that SAML enforces .
Exploited Barracuda ESG auth bypass and root command injection flaws land on CISA KEV with Nov 13 deadline
Barracuda updated its advisory on November 9 to confirm that the authorization bypass CVE-2026-116606 and the command injection CVE-2026-111560 in Email Security Gateway have been exploited against a small number of organizations; chained, they give root on the device when the attacker can reach the admin interface .
A crafted SIP MESSAGE lets attackers run commands on FreeSWITCH; CVE-2026-116779 exploited and added to KEV
In FreeSWITCH 1.