KEV 2026

Ivanti Sentry — Pre-Auth OS Command Injection via Unauthenticated MICS Configuration Endpoint

Oracle PeopleSoft Enterprise PeopleTools — Pre-Auth SSRF/RCE via Unauthenticated PSEMHUB Endpoint, Exploited by ShinyHunters

Mirasvit Full Page Cache Warmer for Magento — Unauthenticated RCE via PHP Object Injection in CacheWarmer Cookie

Check Point Security Gateway — IKEv1 Auth Bypass Allows Unauthenticated VPN Access; Actively Exploited by Qilin Ransomware

Cisco Catalyst SD-WAN — Unauthenticated Remote Auth Bypass via vdaemon DTLS vHub Device-Type Confusion

Nx Console VS Code Extension — Supply-Chain Credential Stealer via TanStack-Linked Developer Compromise

DAEMON Tools Lite — Trojanized Official Installer Delivers .NET Infostealer and Selective Backdoor via Compromised Build Infrastructure

LiteSpeed User-End cPanel Plugin — Any cPanel User Can Execute Arbitrary Scripts as Root via Unguarded lsws.redisAble API Endpoint

BerriAI LiteLLM — Pre-Auth SQL Injection via Unsanitized Bearer Token in Authentication Path

TanStack npm Packages — Self-Propagating Supply-Chain Worm via GitHub Actions Cache Poisoning and OIDC Token Extraction

Palo Alto Networks PAN-OS — Unauthenticated RCE via Out-of-bounds Write in Authentication Portal

Palo Alto Networks PAN-OS GlobalProtect — Pre-Auth VPN Bypass via Forged Authentication Override Cookie

WebPros cPanel & WHM — Pre-Auth CRLF Injection Grants Unauthenticated Root WHM Access

Marimo — Pre-Auth RCE via Unauthenticated Terminal WebSocket

Fortinet FortiClient EMS — Pre-Auth SQL Injection via Site HTTP Header

Ivanti Endpoint Manager Mobile (EPMM) — Pre-Auth Remote Code Execution via Android File Transfer URL Injection

Fortinet FortiClient EMS — Pre-Authentication Remote Code Execution

Cisco Secure Firewall Management Center (FMC) — Unauthenticated Remote Code Execution via Java Deserialization

Citrix NetScaler ADC & Gateway — Memory Overread via Insufficient Input Validation (SAML IDP)

Langflow — Unauthenticated Remote Code Execution via Public Flow Build Endpoint

Microsoft SharePoint Server — Remote Code Execution via Deserialization of Untrusted Data

Cisco Catalyst SD-WAN — CVSS 10.0 Peering Authentication Bypass Enabling Fabric-Wide NETCONF Access, Exploited by UAT-8616 Since 2023

Dell RP4VMs — Hard-coded Tomcat admin credentials allow unauthenticated root access; exploited by PRC-nexus UNC6201

BeyondTrust RS/PRA — Unauthenticated Remote Code Execution via WebSocket Bash Arithmetic Injection

SmarterMail — Unauthenticated ConnectToHub API enables OS command execution via malicious server redirect

Ivanti EPMM — Pre-Auth Remote Code Execution via App Store URL Bash Injection

Fortinet FortiCloud SSO — Cross-tenant authentication bypass lets attackers log into other customers' devices

SmarterMail — Unauthenticated admin password reset via IsSysAdmin bypass; exploited within 2 days of patch

GNU InetUtils telnetd — 11-year-old USER variable injection grants instant unauthenticated root shell