cyber.hendryadrian.com
Security News · helpnetsecurity.com

CISA Adds Eight Vulnerabilities to Exploited Catalog, Including Cisco SD-WAN Flaws

· Original article ↗

Summary

CISA added eight vulnerabilities to its KEV catalog. Cisco confirmed exploitation of two Catalyst SD-WAN Manager flaws; exploitation of a third is unconfirmed. US federal civilian agencies must remediate all eight by April 20, 2026.

Key points

  • CISA added eight vulnerabilities to its Known Exploited Vulnerabilities catalog.
  • Three additions affect Cisco Catalyst SD-WAN Manager: CVE-2026-20133, CVE-2026-20128, and CVE-2026-20122.
  • Cisco confirmed CVE-2026-20128 and CVE-2026-20122 were actively exploited in early March 2026.
  • VulnCheck assessed CVE-2026-20133 as high risk and likely exploited, but public confirmation of exploitation is absent.
  • Other additions affect PaperCut NG/MF, JetBrains TeamCity, Kentico Xperience, Quest KACE appliances, and Synacor Zimbra; exploitation reporting varies by flaw.
  • US federal civilian agencies must remediate all eight vulnerabilities by April 20, 2026.

Article Details

Event Type
CISA added eight vulnerabilities to its Known Exploited Vulnerabilities catalog.
Impact
Cisco confirmed active exploitation of CVE-2026-20128 and CVE-2026-20122 in early March 2026. VulnCheck assessed CVE-2026-20133 as high risk and likely to be exploited, but exploitation has not been publicly confirmed; it is unclear whether it was used in the same attacks. The article also reports exploitation of vulnerabilities affecting PaperCut NG/MF, JetBrains TeamCity, and Synacor Zimbra, and malicious activity potentially linked to exploitation of Quest KACE. There were no public exploitation reports for the Kentico Xperience vulnerability. US federal civilian agencies were required to remediate all eight vulnerabilities by April 20, 2026.

CVE

CVE-2023-27351Papercut · Papercut mf; Papercut · Papercut ngCVE-2023-27351, a PaperCut NG/MF vulnerability that has been exploited since early 2023 by Lace Tempest, a Clop ransomware affiliateCVE-2024-27199Jetbrains · TeamcityCVE-2024-27199, a JetBrains TeamCity flaw leveraged by attackers since early 2024CVE-2025-2749Kentico · XperienceCVE-2025-2749, a Kentico Xperience bug with no public reports of exploitationCVE-2025-32975Quest · Kace systems management applianceCVE-2025-32975, a vulnerability affecting Quest KACE Systems Management Appliances.CVE-2025-48700Synacor · Zimbra collaboration suiteCVE-2025-48700, a zero-click cross-site scripting vulnerability in Synacor’s Zimbra Collaboration Suite that, according to the State Special Communications Service of Ukraine, has been exploited since late SeptemberCVE-2026-20122Cisco · Catalyst sd-wan managercatalog, including three affecting Cisco Catalyst SD-WAN Manager (CVE-2026-20133, CVE-2026-20128, CVE-2026-20122), with Cisco confirming active exploitation of two of those in March 2026.CVE-2026-20128Cisco · Catalyst sd-wan managerVulnerabilities catalog, including three affecting Cisco Catalyst SD-WAN Manager (CVE-2026-20133, CVE-2026-20128, CVE-2026-20122), with Cisco confirming active exploitation of two of those in March 2026.CVE-2026-20133Cisco · Catalyst sd-wan managerits Known Exploited Vulnerabilities catalog, including three affecting Cisco Catalyst SD-WAN Manager (CVE-2026-20133, CVE-2026-20128, CVE-2026-20122), with Cisco confirming active exploitation of two of those in March

Threat Actors

TA505The article reports that Lace Tempest exploited the PaperCut NG/MF vulnerability CVE-2023-27351 beginning in early 2023, and describes Lace Tempest as a Clop ransomware affiliate.

Vendors

CiscoCISA added eight vulnerabilities to its Known Exploited Vulnerabilities catalog, including three affecting Cisco Catalyst SD-WAN Manager (CVE-2026-20133, CVE-2026-20128, CVE-2026-20122), with Cisco confirming activeJetBrains20, 2026, while other listed issues include exploited bugs in PaperCut NG/MF linked to Lace Tempest, JetBrains TeamCity, Quest KACE appliances, and Synacor Zimbra.KenticoCVE-2025-2749, a Kentico Xperience bug with no public reports of exploitationPaperCutmust remediate all eight flaws by April 20, 2026, while other listed issues include exploited bugs in PaperCut NG/MF linked to Lace Tempest, JetBrains TeamCity, Quest KACE appliances, and Synacor Zimbra.Questother listed issues include exploited bugs in PaperCut NG/MF linked to Lace Tempest, JetBrains TeamCity, Quest KACE appliances, and Synacor Zimbra.Synacorexploited bugs in PaperCut NG/MF linked to Lace Tempest, JetBrains TeamCity, Quest KACE appliances, and Synacor Zimbra.

Products

Cisco Catalyst SD-WAN Managervulnerabilities to its Known Exploited Vulnerabilities catalog, including three affecting Cisco Catalyst SD-WAN Manager (CVE-2026-20133, CVE-2026-20128, CVE-2026-20122), with Cisco confirming active exploitation ofJetBrains TeamCity2026, while other listed issues include exploited bugs in PaperCut NG/MF linked to Lace Tempest, JetBrains TeamCity, Quest KACE appliances, and Synacor Zimbra.Kentico XperienceCVE-2025-2749, a Kentico Xperience bug with no public reports of exploitationPaperCut NG/MFmust remediate all eight flaws by April 20, 2026, while other listed issues include exploited bugs in PaperCut NG/MF linked to Lace Tempest, JetBrains TeamCity, Quest KACE appliances, and Synacor Zimbra.Quest KACE Systems Management AppliancesCVE-2025-32975, a vulnerability affecting Quest KACE Systems Management Appliances.Zimbra Collaboration SuiteCVE-2025-48700, a zero-click cross-site scripting vulnerability in Synacor’s Zimbra Collaboration Suite that, according to the State Special Communications Service of Ukraine, has been exploited since late September

Countries

United StatesUS federal civilian agencies must remediate all eight flaws by April 20, 2026, while other listed issues include exploited bugs in PaperCut NG/MF linked to Lace Tempest, JetBrains TeamCity, Quest KACE appliances, and

Related Articles