CISA Known Exploited Vulnerabilities
KEV additions — January 2026
16 CVEs entered the KEV catalog in January 2026.
Added January 29, 20261
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2026-1281 | Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability | 9.8 | 82.1 % | February 1, 2026 |
Added January 27, 20261
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2026-24858 | Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability | 9.8 | 6.2 % | January 30, 2026 |
Added January 26, 20265
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2018-14634 | Linux Kernel Integer Overflow Vulnerability | 7.8 | 25.7 % | February 16, 2026 |
| CVE-2025-52691 | SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerability | 10 | 78.4 % | February 16, 2026 |
| CVE-2026-21509 | Microsoft Office Security Feature Bypass Vulnerability | 7.8 | 12.5 % | February 16, 2026 |
| CVE-2026-23760 | SmarterTools SmarterMail < Build 9511 Authentication Bypass via Password Reset API | 9.8 | 79.9 % | February 16, 2026 |
| CVE-2026-24061 | GNU InetUtils Argument Injection Vulnerability | 9.8 | 92.3 % | February 16, 2026 |
Added January 23, 20261
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2024-37079 | Broadcom VMware vCenter Server Out-of-bounds Write Vulnerability | 9.8 | 83.0 % | February 13, 2026 |
Added January 22, 20264
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2025-31125 | Vite Vitejs Improper Access Control Vulnerability | 7.5 | 62.4 % | February 12, 2026 |
| CVE-2025-34026 | Versa Concerto Actuator Authentication Bypass Information Leak | 7.5 | 71.1 % | February 12, 2026 |
| CVE-2025-54313 | Prettier eslint-config-prettier Embedded Malicious Code Vulnerability | 7.5 | 11.6 % | February 12, 2026 |
| CVE-2025-68645 | Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion Vulnerability | 8.8 | 22.9 % | February 12, 2026 |
Added January 21, 20261
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2026-20045 | Cisco Unified Communications Products Remote Code Execution Vulnerability | 8.2 | 4.1 % | February 11, 2026 |
Added January 13, 20261
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2026-20805 | Desktop Window Manager Information Disclosure Vulnerability | 5.5 | 3.3 % | February 3, 2026 |
Added January 12, 20261
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2025-8110 | Gogs Path Traversal Vulnerability | 8.8 | 26.5 % | February 2, 2026 |
Added January 7, 20261
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2025-37164 | Hewlett Packard Enterprise (HPE) OneView Code Injection Vulnerability | 9.8 | 86.4 % | January 28, 2026 |