KEV 2026

Ahsay AhsayCBS - Unauthenticated RCE as SYSTEM via Replication Receiver API

Cisco Secure Email Gateway - Pre-Auth Root File Write via Crafted AMP Attachment

Zammad - Unauthenticated Session Fixation to RCE as the zammad User

Zammad - Local Privilege Escalation from the zammad Service User to root

Fortinet FortiMail - Pre-Auth Arbitrary File Write via IBE Path Traversal and NULL Byte Injection

WSO2 API Manager - Pre-Auth Admin Takeover via Unsupported-Algorithm JWT

Arista VeloCloud Orchestrator On-Prem - Unauthenticated Host Compromise via Edge Certificate Path

Cisco ISE - Unauthenticated Privileged-API Auth Bypass to Admin

GitLab CE/EE - Unauthenticated Path Traversal Arbitrary File Read via Commits API

Cisco Secure FMC - Unauthenticated Auth Bypass to Root via Orphaned Boot Session

Adobe Commerce / Magento StyleSmuggler - Unauthenticated Template Injection RCE

Kestra Workflow Orchestrator — Auth Bypass via '/configs' Suffix Match Yields Unauthenticated RCE

SonicWall SMA1000 — Pre-Auth SSRF Zero-Day, Chained with CVE-2026-83549 for Unauthenticated RCE

ConnectWise ScreenConnect - Unauthorized Session File Transfer and Execution (Worm-like)

Cisco Catalyst SD-WAN Manager - Pre-Auth Admin API Access via Hex-Encoded j_security_check

Citrix NetScaler ADC and Gateway - Pre-Auth Command Injection via Poisoned Log Parsing

Check Point Security Gateway and Spark - Pre-Auth RCE via VPN Certificate Validation

Check Point Security Management - Pre-Auth RCE via Path Traversal on TCP/19009

F5 BIG-IP APM - Unauthenticated RCE in TMM via OAuth Profile Traffic

Cisco Secure Email Gateway - Unauthenticated SQL Injection to Root via Crafted Email

MikroTik RouterOS MikroTrick - SSH Argument Injection Privilege Escalation

Citrix NetScaler ADC / Gateway - Unauthenticated Authentication Bypass

N-able N-central - Pre-Auth Static Code Injection RCE

JFrog Artifactory — 'Phantom' Join Key Lets Attackers Mint Admin Tokens on Default Configs

Sangoma Switchvox PBX — Unauthenticated SQLi-to-RCE via Spoofed Phone XML on /pa Endpoint

Adobe Commerce and Magento Open Source - Customer Account Takeover via Session Identity Overwrite

Oracle HTTP Server / WebLogic Proxy Plug-in — Unauthenticated Access-Control Bypass

Metabase — Pre-Auth SQL Injection in Password Reset via HoneySQL :raw Escape Hatch

PaperCut NG/MF — Unauthenticated Admin Config Access, Entry Point of the Zero-Day Chain

Citrix NetScaler ADC / Gateway — Pre-Auth SAML Memory Overflow (CTX696604)

Gitea — diffpatch Git Hook Injection Enabling Remote Code Execution

TrueConf Server — Unauthenticated Script Execution via TCP/4307

Microsoft Windows IKEEXT — Pre-Auth Remote Code Execution as SYSTEM via IKEv2 Fragment Reassembly Double Free

Broadcom VMware vCenter — Unauthenticated Path Traversal in the Syslog Service Leading to Remote Code Execution

Apple macOS Screen Sharing — Pre-Authentication SRP Bypass in screensharingd Yielding Root Access

JetBrains TeamCity — Pre-Auth XStream Deserialization RCE via the Agent Polling Protocol

IBM Langflow — Unauthenticated RCE by Chaining auto_login to the Code Validation exec() Sink

Progress Kemp LoadMaster — Pre-Auth Root RCE via Uninitialized Heap in escape_quotes()

MLflow — Unauthenticated SSRF via Webhook Test Endpoint Redirect Bypass Exposing Cloud Metadata Credentials

PaperCut NG/MF — Arbitrary Java Class Loading via DB Driver Config, RCE Half of the Zero-Day Chain

Microsoft SharePoint Server — Unauthenticated JWT Forgery Enabling Arbitrary User and Site Administrator Impersonation

TrueConf Server — Sandbox Escape to SYSTEM via Code Injection

Arista VeloCloud Orchestrator — Pre-Auth OS Command Injection to Host Takeover of the SD-WAN Control Plane

SonicWall SMA1000 — Unauthenticated Work Place SSRF Chained With Admin Code Injection in Zero-Day Attacks

Adobe ColdFusion — RDS FILEIO Path Traversal to RCE, Exploited Within Hours of Disclosure

Microsoft SharePoint — Deserialization RCE via SessionSecurityTokenHandler, Fourth in a Month-Long SharePoint Attack Wave

Langflow — Unauthenticated Root RCE via Unsandboxed exec() in the Code Validation Endpoint

WordPress Core — REST API Batch-Routing Confusion Chained with CVE-2026-60137 for Pre-Auth RCE ("wp2shell")

Fortinet FortiSandbox — Unauthenticated Command Injection via Start VNC Feature

Fortinet FortiSandbox — Unauthenticated Root Command Injection via tracer-behavior API

Microsoft SharePoint Server — Unauthenticated Remote Code Execution via Deserialization of Untrusted Data

Oracle E-Business Suite (Oracle Payments) — Unauthenticated Privilege Escalation and File Read via ibytransmit Endpoint

iCagenda — Frontend Attachment Upload Zero-Day Exploited Hours Before Patch Release

Balbooa Forms — Attachment Upload Extension Re-Attached Verbatim, Exploited as Zero-Day Before a Patch Existed

JoomShaper SP Page Builder — Unauthenticated uploadCustomIcon Task Enables PHP Web Shell Upload

Joomlack Page Builder CK — CSRF-Token-Only Upload Check Bypassed via Public Token Harvesting

Check Point SmartConsole — Unauthenticated Login Token Theft Leads to Full Administrative Takeover

SimpleHelp RMM — Unauthenticated OIDC Token Forgery Bypassing Authentication and MFA

Ubiquiti UniFi OS — Authentication Bypass via URI Normalization Mismatch

Ubiquiti UniFi OS — Path Traversal Enabling Signing Key Exfiltration (3-CVE Root RCE Chain)

Ubiquiti UniFi OS — Command Injection at Package Update Endpoint (Unauthenticated Root RCE)

Ivanti Sentry — Pre-Auth OS Command Injection via Unauthenticated MICS Configuration Endpoint

PTC Windchill / FlexPLM — Unauthenticated Pre-Auth Remote Code Execution via Deserialization

Splunk Enterprise — Unauthenticated RCE via PostgreSQL Sidecar Service (First Splunk CVE in KEV)

Joomla Content Editor (JCE) — Unauthenticated PHP File Upload RCE via Missing Authorization on Profile Import

Oracle PeopleSoft Enterprise PeopleTools — Pre-Auth SSRF/RCE via Unauthenticated PSEMHUB Endpoint, Exploited by ShinyHunters

Mirasvit Full Page Cache Warmer for Magento — Unauthenticated RCE via PHP Object Injection in CacheWarmer Cookie

Check Point Security Gateway — IKEv1 Auth Bypass Allows Unauthenticated VPN Access; Actively Exploited by Qilin Ransomware

Cisco Catalyst SD-WAN — Unauthenticated Remote Auth Bypass via vdaemon DTLS vHub Device-Type Confusion

Nx Console VS Code Extension — Supply-Chain Credential Stealer via TanStack-Linked Developer Compromise

DAEMON Tools Lite — Trojanized Official Installer Delivers .NET Infostealer and Selective Backdoor via Compromised Build Infrastructure

LiteSpeed User-End cPanel Plugin — Any cPanel User Can Execute Arbitrary Scripts as Root via Unguarded lsws.redisAble API Endpoint

BerriAI LiteLLM — Pre-Auth SQL Injection via Unsanitized Bearer Token in Authentication Path

TanStack npm Packages — Self-Propagating Supply-Chain Worm via GitHub Actions Cache Poisoning and OIDC Token Extraction

Palo Alto Networks PAN-OS — Unauthenticated RCE via Out-of-bounds Write in Authentication Portal

Palo Alto Networks PAN-OS GlobalProtect — Pre-Auth VPN Bypass via Forged Authentication Override Cookie

WebPros cPanel & WHM — Pre-Auth CRLF Injection Grants Unauthenticated Root WHM Access

Marimo — Pre-Auth RCE via Unauthenticated Terminal WebSocket

Fortinet FortiClient EMS — Pre-Auth SQL Injection via Site HTTP Header

Ivanti Endpoint Manager Mobile (EPMM) — Pre-Auth Remote Code Execution via Android File Transfer URL Injection

Fortinet FortiClient EMS — Pre-Authentication Remote Code Execution

Cisco Secure Firewall Management Center (FMC) — Unauthenticated Remote Code Execution via Java Deserialization

Citrix NetScaler ADC & Gateway — Memory Overread via Insufficient Input Validation (SAML IDP)

Langflow — Unauthenticated Remote Code Execution via Public Flow Build Endpoint

Microsoft SharePoint Server — Remote Code Execution via Deserialization of Untrusted Data

Cisco Catalyst SD-WAN — CVSS 10.0 Peering Authentication Bypass Enabling Fabric-Wide NETCONF Access, Exploited by UAT-8616 Since 2023

Dell RP4VMs — Hard-coded Tomcat admin credentials allow unauthenticated root access; exploited by PRC-nexus UNC6201

BeyondTrust RS/PRA — Unauthenticated Remote Code Execution via WebSocket Bash Arithmetic Injection

SmarterMail — Unauthenticated ConnectToHub API enables OS command execution via malicious server redirect

Ivanti EPMM — Pre-Auth Remote Code Execution via App Store URL Bash Injection

Fortinet FortiCloud SSO — Cross-tenant authentication bypass lets attackers log into other customers' devices

SmarterMail — Unauthenticated admin password reset via IsSysAdmin bypass; exploited within 2 days of patch

GNU InetUtils telnetd — 11-year-old USER variable injection grants instant unauthenticated root shell