KEV 2026

Oracle HTTP Server / WebLogic Proxy Plug-in — Unauthenticated Access-Control Bypass

Metabase — Pre-Auth SQL Injection in Password Reset via HoneySQL :raw Escape Hatch

Citrix NetScaler ADC / Gateway — Pre-Auth SAML Memory Overflow (CTX696604)

Gitea — diffpatch Git Hook Injection Enabling Remote Code Execution

TrueConf Server — Unauthenticated Script Execution via TCP/4307

Microsoft Windows IKEEXT — Pre-Auth Remote Code Execution as SYSTEM via IKEv2 Fragment Reassembly Double Free

Broadcom VMware vCenter — Unauthenticated Path Traversal in the Syslog Service Leading to Remote Code Execution

Apple macOS Screen Sharing — Pre-Authentication SRP Bypass in screensharingd Yielding Root Access

JetBrains TeamCity — Pre-Auth XStream Deserialization RCE via the Agent Polling Protocol

IBM Langflow — Unauthenticated RCE by Chaining auto_login to the Code Validation exec() Sink

Progress Kemp LoadMaster — Pre-Auth Root RCE via Uninitialized Heap in escape_quotes()

MLflow — Unauthenticated SSRF via Webhook Test Endpoint Redirect Bypass Exposing Cloud Metadata Credentials

Microsoft SharePoint Server — Unauthenticated JWT Forgery Enabling Arbitrary User and Site Administrator Impersonation

TrueConf Server — Sandbox Escape to SYSTEM via Code Injection

Arista VeloCloud Orchestrator — Pre-Auth OS Command Injection to Host Takeover of the SD-WAN Control Plane

SonicWall SMA1000 — Unauthenticated Work Place SSRF Chained With Admin Code Injection in Zero-Day Attacks

Adobe ColdFusion — RDS FILEIO Path Traversal to RCE, Exploited Within Hours of Disclosure

Microsoft SharePoint — Deserialization RCE via SessionSecurityTokenHandler, Fourth in a Month-Long SharePoint Attack Wave

Langflow — Unauthenticated Root RCE via Unsandboxed exec() in the Code Validation Endpoint

WordPress Core — REST API Batch-Routing Confusion Chained with CVE-2026-60137 for Pre-Auth RCE ("wp2shell")

Fortinet FortiSandbox — Unauthenticated Command Injection via Start VNC Feature

Fortinet FortiSandbox — Unauthenticated Root Command Injection via tracer-behavior API

Microsoft SharePoint Server — Unauthenticated Remote Code Execution via Deserialization of Untrusted Data

Oracle E-Business Suite (Oracle Payments) — Unauthenticated Privilege Escalation and File Read via ibytransmit Endpoint

iCagenda — Frontend Attachment Upload Zero-Day Exploited Hours Before Patch Release

Balbooa Forms — Attachment Upload Extension Re-Attached Verbatim, Exploited as Zero-Day Before a Patch Existed

JoomShaper SP Page Builder — Unauthenticated uploadCustomIcon Task Enables PHP Web Shell Upload

Joomlack Page Builder CK — CSRF-Token-Only Upload Check Bypassed via Public Token Harvesting

Check Point SmartConsole — Unauthenticated Login Token Theft Leads to Full Administrative Takeover

SimpleHelp RMM — Unauthenticated OIDC Token Forgery Bypassing Authentication and MFA

Ubiquiti UniFi OS — Authentication Bypass via URI Normalization Mismatch

Ubiquiti UniFi OS — Path Traversal Enabling Signing Key Exfiltration (3-CVE Root RCE Chain)

Ubiquiti UniFi OS — Command Injection at Package Update Endpoint (Unauthenticated Root RCE)

Ivanti Sentry — Pre-Auth OS Command Injection via Unauthenticated MICS Configuration Endpoint

PTC Windchill / FlexPLM — Unauthenticated Pre-Auth Remote Code Execution via Deserialization

Splunk Enterprise — Unauthenticated RCE via PostgreSQL Sidecar Service (First Splunk CVE in KEV)

Joomla Content Editor (JCE) — Unauthenticated PHP File Upload RCE via Missing Authorization on Profile Import

Oracle PeopleSoft Enterprise PeopleTools — Pre-Auth SSRF/RCE via Unauthenticated PSEMHUB Endpoint, Exploited by ShinyHunters

Mirasvit Full Page Cache Warmer for Magento — Unauthenticated RCE via PHP Object Injection in CacheWarmer Cookie

Check Point Security Gateway — IKEv1 Auth Bypass Allows Unauthenticated VPN Access; Actively Exploited by Qilin Ransomware

Cisco Catalyst SD-WAN — Unauthenticated Remote Auth Bypass via vdaemon DTLS vHub Device-Type Confusion

Nx Console VS Code Extension — Supply-Chain Credential Stealer via TanStack-Linked Developer Compromise

DAEMON Tools Lite — Trojanized Official Installer Delivers .NET Infostealer and Selective Backdoor via Compromised Build Infrastructure

LiteSpeed User-End cPanel Plugin — Any cPanel User Can Execute Arbitrary Scripts as Root via Unguarded lsws.redisAble API Endpoint

BerriAI LiteLLM — Pre-Auth SQL Injection via Unsanitized Bearer Token in Authentication Path

TanStack npm Packages — Self-Propagating Supply-Chain Worm via GitHub Actions Cache Poisoning and OIDC Token Extraction

Palo Alto Networks PAN-OS — Unauthenticated RCE via Out-of-bounds Write in Authentication Portal

Palo Alto Networks PAN-OS GlobalProtect — Pre-Auth VPN Bypass via Forged Authentication Override Cookie

WebPros cPanel & WHM — Pre-Auth CRLF Injection Grants Unauthenticated Root WHM Access

Marimo — Pre-Auth RCE via Unauthenticated Terminal WebSocket

Fortinet FortiClient EMS — Pre-Auth SQL Injection via Site HTTP Header

Ivanti Endpoint Manager Mobile (EPMM) — Pre-Auth Remote Code Execution via Android File Transfer URL Injection

Fortinet FortiClient EMS — Pre-Authentication Remote Code Execution

Cisco Secure Firewall Management Center (FMC) — Unauthenticated Remote Code Execution via Java Deserialization

Citrix NetScaler ADC & Gateway — Memory Overread via Insufficient Input Validation (SAML IDP)

Langflow — Unauthenticated Remote Code Execution via Public Flow Build Endpoint

Microsoft SharePoint Server — Remote Code Execution via Deserialization of Untrusted Data

Cisco Catalyst SD-WAN — CVSS 10.0 Peering Authentication Bypass Enabling Fabric-Wide NETCONF Access, Exploited by UAT-8616 Since 2023

Dell RP4VMs — Hard-coded Tomcat admin credentials allow unauthenticated root access; exploited by PRC-nexus UNC6201

BeyondTrust RS/PRA — Unauthenticated Remote Code Execution via WebSocket Bash Arithmetic Injection

SmarterMail — Unauthenticated ConnectToHub API enables OS command execution via malicious server redirect

Ivanti EPMM — Pre-Auth Remote Code Execution via App Store URL Bash Injection

Fortinet FortiCloud SSO — Cross-tenant authentication bypass lets attackers log into other customers' devices

SmarterMail — Unauthenticated admin password reset via IsSysAdmin bypass; exploited within 2 days of patch

GNU InetUtils telnetd — 11-year-old USER variable injection grants instant unauthenticated root shell