KEV 2026

GitLab CE/EE - Unauthenticated RCE via Onigmo Integer Overflow in the CI/CD Regex Compiler

Ahsay AhsayCBS - Unauthenticated RCE as SYSTEM via Replication Receiver API

Arista VeloCloud Orchestrator On-Prem - Authenticated SQL Injection Turns a Read-Only Tenant Login into Superuser Operator

Google Brotli - Broccoli2Shell, Out-of-Bounds Write in the Block-Switch Decoder

PHP - php2shell, Pre-Auth RCE via Out-of-Memory Corruption During Request Parsing

Nextcloud richdocumentscode - Unauthenticated Command Injection in proxy.php While the CODE Server Is Down

BeyondTrust Remote Support - Pre-Auth File Write via Unvalidated Internal Message Origin

Cisco Secure Email Gateway - Pre-Auth Root File Write via Crafted AMP Attachment

Zammad - Unauthenticated Session Fixation to RCE as the zammad User

Zammad - Local Privilege Escalation from the zammad Service User to root

Fortinet FortiMail - Pre-Auth Arbitrary File Write via IBE Path Traversal and NULL Byte Injection

Adobe Commerce and Magento - PolyShell, Unauthenticated File Upload via Guest Cart Custom Options

WSO2 API Manager - Pre-Auth Admin Takeover via Unsupported-Algorithm JWT

Arista VeloCloud Orchestrator On-Prem - Unauthenticated Host Compromise via Edge Certificate Path

Cisco ISE - Unauthenticated Privileged-API Auth Bypass to Admin

GitLab CE/EE - Unauthenticated Path Traversal Arbitrary File Read via Commits API

Cisco Secure FMC - Unauthenticated Auth Bypass to Root via Orphaned Boot Session

Adobe Commerce / Magento StyleSmuggler - Unauthenticated Template Injection RCE

Kestra Workflow Orchestrator - Auth Bypass via '/configs' Suffix Match Yields Unauthenticated RCE

SonicWall SMA1000 - Pre-Auth SSRF Zero-Day, Chained with CVE-2026-83549 for Unauthenticated RCE

ConnectWise ScreenConnect - Unauthorized Session File Transfer and Execution (Worm-like)

Cisco Catalyst SD-WAN Manager - Pre-Auth Admin API Access via Hex-Encoded j_security_check

Citrix NetScaler ADC and Gateway - Pre-Auth Command Injection via Poisoned Log Parsing

Check Point Security Gateway and Spark - Pre-Auth RCE via VPN Certificate Validation

Check Point Security Management - Pre-Auth RCE via Path Traversal on TCP/19009

F5 BIG-IP APM - Unauthenticated RCE in TMM via OAuth Profile Traffic

Cisco Secure Email Gateway - Unauthenticated SQL Injection to Root via Crafted Email

MikroTik RouterOS MikroTrick - SSH Argument Injection Privilege Escalation

Citrix NetScaler ADC / Gateway - Unauthenticated Authentication Bypass

N-able N-central - Pre-Auth Static Code Injection RCE

JFrog Artifactory - 'Phantom' Join Key Lets Attackers Mint Admin Tokens on Default Configs

Sangoma Switchvox PBX - Unauthenticated SQLi-to-RCE via Spoofed Phone XML on /pa Endpoint

Adobe Commerce and Magento Open Source - Customer Account Takeover via Session Identity Overwrite

Oracle HTTP Server / WebLogic Proxy Plug-in - Unauthenticated Access-Control Bypass

Metabase - Pre-Auth SQL Injection in Password Reset via HoneySQL :raw Escape Hatch

PaperCut NG/MF - Unauthenticated Admin Config Access, Entry Point of the Zero-Day Chain

Citrix NetScaler ADC / Gateway - Pre-Auth SAML Memory Overflow (CTX696604)

Gitea - diffpatch Git Hook Injection Enabling Remote Code Execution

TrueConf Server - Unauthenticated Script Execution via TCP/4307

Microsoft Windows IKEEXT - Pre-Auth Remote Code Execution as SYSTEM via IKEv2 Fragment Reassembly Double Free

Broadcom VMware vCenter - Unauthenticated Path Traversal in the Syslog Service Leading to Remote Code Execution

Apple macOS Screen Sharing - Pre-Authentication SRP Bypass in screensharingd Yielding Root Access

JetBrains TeamCity - Pre-Auth XStream Deserialization RCE via the Agent Polling Protocol

IBM Langflow - Unauthenticated RCE by Chaining auto_login to the Code Validation exec() Sink

Progress Kemp LoadMaster - Pre-Auth Root RCE via Uninitialized Heap in escape_quotes()

MLflow - Unauthenticated SSRF via Webhook Test Endpoint Redirect Bypass Exposing Cloud Metadata Credentials

PaperCut NG/MF - Arbitrary Java Class Loading via DB Driver Config, RCE Half of the Zero-Day Chain

Microsoft SharePoint Server - Unauthenticated JWT Forgery Enabling Arbitrary User and Site Administrator Impersonation

TrueConf Server - Sandbox Escape to SYSTEM via Code Injection

Arista VeloCloud Orchestrator - Pre-Auth OS Command Injection to Host Takeover of the SD-WAN Control Plane

SonicWall SMA1000 - Unauthenticated Work Place SSRF Chained With Admin Code Injection in Zero-Day Attacks

Adobe ColdFusion - RDS FILEIO Path Traversal to RCE, Exploited Within Hours of Disclosure

Microsoft SharePoint - Deserialization RCE via SessionSecurityTokenHandler, Fourth in a Month-Long SharePoint Attack Wave

Langflow - Unauthenticated Root RCE via Unsandboxed exec() in the Code Validation Endpoint

WordPress Core - REST API Batch-Routing Confusion Chained with CVE-2026-60137 for Pre-Auth RCE ("wp2shell")

Fortinet FortiSandbox - Unauthenticated Command Injection via Start VNC Feature

Fortinet FortiSandbox - Unauthenticated Root Command Injection via tracer-behavior API

Microsoft SharePoint Server - Unauthenticated Remote Code Execution via Deserialization of Untrusted Data

Oracle E-Business Suite (Oracle Payments) - Unauthenticated Privilege Escalation and File Read via ibytransmit Endpoint

iCagenda - Frontend Attachment Upload Zero-Day Exploited Hours Before Patch Release

Balbooa Forms - Attachment Upload Extension Re-Attached Verbatim, Exploited as Zero-Day Before a Patch Existed

JoomShaper SP Page Builder - Unauthenticated uploadCustomIcon Task Enables PHP Web Shell Upload

Joomlack Page Builder CK - CSRF-Token-Only Upload Check Bypassed via Public Token Harvesting

Check Point SmartConsole - Unauthenticated Login Token Theft Leads to Full Administrative Takeover

SimpleHelp RMM - Unauthenticated OIDC Token Forgery Bypassing Authentication and MFA

Ubiquiti UniFi OS - Authentication Bypass via URI Normalization Mismatch

Ubiquiti UniFi OS - Path Traversal Enabling Signing Key Exfiltration (3-CVE Root RCE Chain)

Ubiquiti UniFi OS - Command Injection at Package Update Endpoint (Unauthenticated Root RCE)

Ivanti Sentry - Pre-Auth OS Command Injection via Unauthenticated MICS Configuration Endpoint

PTC Windchill / FlexPLM - Unauthenticated Pre-Auth Remote Code Execution via Deserialization

Splunk Enterprise - Unauthenticated RCE via PostgreSQL Sidecar Service (First Splunk CVE in KEV)

Joomla Content Editor (JCE) - Unauthenticated PHP File Upload RCE via Missing Authorization on Profile Import

Oracle PeopleSoft Enterprise PeopleTools - Pre-Auth SSRF/RCE via Unauthenticated PSEMHUB Endpoint, Exploited by ShinyHunters

Mirasvit Full Page Cache Warmer for Magento - Unauthenticated RCE via PHP Object Injection in CacheWarmer Cookie

Check Point Security Gateway - IKEv1 Auth Bypass Allows Unauthenticated VPN Access; Actively Exploited by Qilin Ransomware

Cisco Catalyst SD-WAN - Unauthenticated Remote Auth Bypass via vdaemon DTLS vHub Device-Type Confusion

Nx Console VS Code Extension - Supply-Chain Credential Stealer via TanStack-Linked Developer Compromise

DAEMON Tools Lite - Trojanized Official Installer Delivers .NET Infostealer and Selective Backdoor via Compromised Build Infrastructure

LiteSpeed User-End cPanel Plugin - Any cPanel User Can Execute Arbitrary Scripts as Root via Unguarded lsws.redisAble API Endpoint

BerriAI LiteLLM - Pre-Auth SQL Injection via Unsanitized Bearer Token in Authentication Path

TanStack npm Packages - Self-Propagating Supply-Chain Worm via GitHub Actions Cache Poisoning and OIDC Token Extraction

Palo Alto Networks PAN-OS - Unauthenticated RCE via Out-of-bounds Write in Authentication Portal

Palo Alto Networks PAN-OS GlobalProtect - Pre-Auth VPN Bypass via Forged Authentication Override Cookie

WebPros cPanel & WHM - Pre-Auth CRLF Injection Grants Unauthenticated Root WHM Access

Marimo - Pre-Auth RCE via Unauthenticated Terminal WebSocket

Fortinet FortiClient EMS - Pre-Auth SQL Injection via Site HTTP Header

Ivanti Endpoint Manager Mobile (EPMM) - Pre-Auth Remote Code Execution via Android File Transfer URL Injection

Fortinet FortiClient EMS - Pre-Authentication Remote Code Execution

Cisco Secure Firewall Management Center (FMC) - Unauthenticated Remote Code Execution via Java Deserialization

Citrix NetScaler ADC & Gateway - Memory Overread via Insufficient Input Validation (SAML IDP)

Langflow - Unauthenticated Remote Code Execution via Public Flow Build Endpoint

Microsoft SharePoint Server - Remote Code Execution via Deserialization of Untrusted Data

Cisco Catalyst SD-WAN - CVSS 10.0 Peering Authentication Bypass Enabling Fabric-Wide NETCONF Access, Exploited by UAT-8616 Since 2023

Dell RP4VMs - Hard-coded Tomcat admin credentials allow unauthenticated root access; exploited by PRC-nexus UNC6201

BeyondTrust RS/PRA - Unauthenticated Remote Code Execution via WebSocket Bash Arithmetic Injection

SmarterMail - Unauthenticated ConnectToHub API enables OS command execution via malicious server redirect

Ivanti EPMM - Pre-Auth Remote Code Execution via App Store URL Bash Injection

Fortinet FortiCloud SSO - Cross-tenant authentication bypass lets attackers log into other customers' devices

SmarterMail - Unauthenticated admin password reset via IsSysAdmin bypass; exploited within 2 days of patch

GNU InetUtils telnetd - 11-year-old USER variable injection grants instant unauthenticated root shell