Structured cabling
Certified voice and data cabling installed and tested to standard, indoors and out.
Business networks, built right from the cable up.
Enless Solutions Ltd designs, installs, and secures networks for businesses across Trinidad and Tobago: structured cabling, managed networking, cybersecurity, and backup and recovery.
A team of ICT consultants who also do the install.
We work with small offices, multi-site organisations, and remote teams, and we build every solution around the client's needs and budget.
An engagement can start with consulting and a network design on paper, then run through certified cabling, equipment supply, configuration, and ongoing management and security assessments. One team owns it end to end, so nothing gets lost between the designer and the installer.
- Multi-vendorFortinet, Sophos, Cisco, Ubiquiti, WatchGuard and more, chosen to fit the job rather than a quota.
- From SMB to multi-siteThe same standards whether it's one office or a network of branches.
- Local and on siteEngineers in Trinidad, available any day, any time.
Every layer, one team.
Each one stands on its own, and they're designed to work together, from the physical layer up.
Managed networking
We learn how your business runs, then design and manage the network infrastructure to match.
Managed cybersecurity
Round-the-clock access to security specialists who monitor and protect your systems against new and emerging threats.
Backup and disaster recovery
A backup and recovery plan built with your team, so you're back up within the timeline your business needs.
How a project runs
AssessSite visit, current network review, and your requirements and budget.
DesignA clear plan and quote covering cabling, equipment, and security.
InstallCabling, hardware, and configuration, tested and documented.
ManageMonitoring, updates, and support after go-live.
Connectivity, security and safety systems.
Physical security built by network engineers: every camera, reader and sensor sits on a properly designed, segmented network, so your security systems never become the weak point.
CCTV & video surveillance
Crisp IP cameras that see what matters, day and night, with footage you can pull up from your phone in seconds.
Access control
Decide who gets in, where and when. Lose a card, revoke it in a click instead of changing every lock.
Intrusion alarm systems
Layered sensors and a panel you arm from anywhere, so a break-in attempt is an alert, not a surprise.
Fire alarm systems
Early detection that buys the time that matters, designed for your building and kept inspection-ready.
Wi-Fi solutions
Surveyed, designed and tuned coverage with no dead zones, from a family home to a busy warehouse floor.
For homes and enterprises
Home
Discreet installs, one app for cameras, alarm and Wi-Fi, and a team you can call.
Enterprise
Multi-site rollouts, segmented security VLANs and documented handover your IT team can trust.
Threat watch.
Vulnerabilities confirmed as actively exploited, from CISA's Known Exploited Vulnerabilities catalog, filtered to the vendors we install and support. If you run any of these products, patch these first.
5new in 30 days, our vendors
154used by ransomware
632exploited, our vendors
30new in 30 days, all vendors
Severity
Vendor
CVE-2025-61624Fortinet Multiple ProductsFortinet Multiple Products Path Traversal VulnerabilityMedium 5.4
FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.
- Severity (CVSS)
- Medium 5.4
- Added to KEV
- 16 Oct 2026
- CISA due date
- 19 Oct 2026
- Ransomware use
- Not known
- Weakness
- CWE-22
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CVE-2026-76519Cisco Secure Email GatewayCisco Secure Email Gateway Relative Path Traversal VulnerabilityCritical 9.8
Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.
- Severity (CVSS)
- Critical 9.8
- Added to KEV
- 14 Oct 2026
- CISA due date
- 17 Oct 2026
- Ransomware use
- Not known
- Weakness
- CWE-23
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CVE-2026-96951Microsoft WindowsMicrosoft Windows Command Injection VulnerabilityHigh 8.8
Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network.
- Severity (CVSS)
- High 8.8
- Added to KEV
- 13 Oct 2026
- CISA due date
- 16 Oct 2026
- Ransomware use
- Not known
- Weakness
- CWE-77
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CVE-2026-104286Fortinet FortiMailFortinet FortiMail Path Traversal VulnerabilityCritical 9.8
Fortinet FortiMail contains a path traversal and an improper neutralization of NULL byte or NULL character vulnerability that may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.
- Severity (CVSS)
- Critical 9.8
- Added to KEV
- 1 Oct 2026
- CISA due date
- 4 Oct 2026
- Ransomware use
- Not known
- Weakness
- CWE-22, CWE-158
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CVE-2026-76504Cisco Catalyst SD-WAN ManagerCisco Catalyst SD-WAN Manager Hex Encoding VulnerabilityCritical 9.8
Cisco Catalyst SD-WAN Manager contains a hex encoding vulnerability that could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user due to improper handling of URI encoding in an HTTP request.
- Severity (CVSS)
- Critical 9.8
- Added to KEV
- 30 Sep 2026
- CISA due date
- 3 Oct 2026
- Ransomware use
- Not known
- Weakness
- CWE-177
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CVE-2026-65660Microsoft SharePointMicrosoft SharePoint Code Injection VulnerabilityHigh 8.8
Microsoft SharePoint contains a code injection vulnerability which could allow an authorized attacker to execute code over a network.
- Severity (CVSS)
- High 8.8
- Added to KEV
- 25 Sep 2026
- CISA due date
- 28 Sep 2026
- Ransomware use
- Not known
- Weakness
- CWE-94
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CVE-2026-71362Adobe Commerce and MagentoAdobe Commerce and Magento Incorrect Authorization VulnerabilityCritical 9.1
Adobe Commerce and Magento contains an incorrect authorization vulnerability that could allow an attacker to leverage this vulnerability to gain elevated access to sensitive resources without any user interaction.
- Severity (CVSS)
- Critical 9.1
- Added to KEV
- 24 Sep 2026
- CISA due date
- 27 Sep 2026
- Ransomware use
- Not known
- Weakness
- CWE-863
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CVE-2026-93616Check Point Multiple ProductsCheck Point Multiple Products Path Traversal VulnerabilityCritical 9.8
Check Point Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent contain a path traversal vulnerability that allows an unauthenticated attacker to upload and execute arbitrary scripts.
- Severity (CVSS)
- Critical 9.8
- Added to KEV
- 22 Sep 2026
- CISA due date
- 25 Sep 2026
- Ransomware use
- Not known
- Weakness
- CWE-22
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CVE-2026-85102Check Point Multiple ProductsCheck Point Multiple Products Improper Certificate Validation VulnerabilityCritical 9.8
Check Point Security Gateway and Check Point Spark Firewall using Site to Site VPN or Remote Access VPN contain an improper certificate validation vulnerability which could allow an unauthenticated remote attacker to execute arbitrary code on the Gateway.
- Severity (CVSS)
- Critical 9.8
- Added to KEV
- 22 Sep 2026
- CISA due date
- 25 Sep 2026
- Ransomware use
- Not known
- Weakness
- CWE-295
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CVE-2026-87886Acronis BackupAcronis Backup Incorrect Default Permissions VulnerabilityHigh 7.8
Acronis Backup plugin for cPanel & WHM and extension for Plesk contains an incorrect default permissions vulnerability that could allow for privilege escalation.
- Severity (CVSS)
- High 7.8
- Added to KEV
- 16 Sep 2026
- CISA due date
- 19 Sep 2026
- Ransomware use
- Not known
- Weakness
- CWE-276
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
NVD detailsCISA KEV entrysecurity-advisory.acronis.comcisa.gov
CVE-2026-76460Cisco Identity Services EngineCisco Identity Services Engine Incorrect Use of Privileged APIs VulnerabilityCritical 10.0
Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) contain an incorrect use of privileged APIs vulnerability that could allow an unauthenticated, remote attacker to gain unauthorized access to the affected device by bypassing the web-based management interface.
- Severity (CVSS)
- Critical 10.0
- Added to KEV
- 16 Sep 2026
- CISA due date
- 19 Sep 2026
- Ransomware use
- Not known
- Weakness
- CWE-648
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CVE-2026-76461Cisco Secure Email GatewayCisco Secure Email Gateway SQL Injection VulnerabilityCritical 9.8
Cisco AsyncOS software for Cisco Secure Email Gateway (SEG) contains a SQL injection vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system.
- Severity (CVSS)
- Critical 9.8
- Added to KEV
- 14 Sep 2026
- CISA due date
- 17 Sep 2026
- Ransomware use
- Not known
- Weakness
- CWE-89
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CVE-2026-20079Cisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC)…Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel VulnerabilityCritical 10.0
Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain an authentication Bypass using an alternate path or channel vulnerability that could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system.
- Severity (CVSS)
- Critical 10.0
- Added to KEV
- 9 Sep 2026
- CISA due date
- 12 Sep 2026
- Ransomware use
- Not known
- Weakness
- CWE-288
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CVE-2025-25249Fortinet Multiple ProductsFortinet Multiple Products Heap-based Buffer Overflow VulnerabilityHigh 7.4
Fortinet FortiOS, FortiSwitchManager, and FortiSASE contain a heap-based buffer overflow vulnerability that allows an attacker to execute unauthorized code or commands via specially crafted packets.
- Severity (CVSS)
- High 7.4
- Added to KEV
- 9 Sep 2026
- CISA due date
- 12 Sep 2026
- Ransomware use
- Not known
- Weakness
- CWE-122, CWE-787
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CVE-2026-85880Microsoft WindowsMicrosoft Windows Heap-Based Buffer Overflow VulnerabilityHigh 7.8
Microsoft Windows Advanced Local Procedure Call contains a heap-based buffer overflow vulnerability that allows an attacker to elevate privileges locally.
- Severity (CVSS)
- High 7.8
- Added to KEV
- 8 Sep 2026
- CISA due date
- 22 Sep 2026
- Ransomware use
- Not known
- Weakness
- CWE-122, CWE-908
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CVE-2026-81963Microsoft WindowsMicrosoft Windows Link Following VulnerabilityHigh 7.8
Microsoft Windows Update Stack contains a link following vulnerability that allows a local attacker to escalate privileges locally up to SYSTEM.
- Severity (CVSS)
- High 7.8
- Added to KEV
- 8 Sep 2026
- CISA due date
- 22 Sep 2026
- Ransomware use
- Not known
- Weakness
- CWE-59, CWE-284
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CVE-2026-75650Adobe Commerce and MagentoAdobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine VulnerabilityCritical 10.0
Adobe Commerce and Magento Open Source contain an improper neutralization of special elements used in a template engine vulnerability that could allow an attacker to execute arbitrary code.
- Severity (CVSS)
- Critical 10.0
- Added to KEV
- 8 Sep 2026
- CISA due date
- 11 Sep 2026
- Ransomware use
- Not known
- Weakness
- CWE-1336
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CVE-2019-1068Microsoft SQL ServerMicrosoft SQL Server Remote Code Execution VulnerabilityHigh 8.8
Microsoft SQL Server contains a remote code execution vulnerability that could allow an attacker to execute code in the context of the SQL Server Database Engine service account.
- Severity (CVSS)
- High 8.8
- Added to KEV
- 26 Aug 2026
- CISA due date
- 29 Aug 2026
- Ransomware use
- Not known
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CVE-2026-55040Microsoft SharePointMicrosoft SharePoint Weak Authentication VulnerabilityCritical 9.1
Microsoft SharePoint contains a weak authentication vulnerability which allows an unauthorized attacker to bypass a security feature over a network.
- Severity (CVSS)
- Critical 9.1
- Added to KEV
- 18 Aug 2026
- CISA due date
- 21 Aug 2026
- Ransomware use
- Not known
- Weakness
- CWE-1390
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CVE-2026-33824Microsoft Internet Key Exchange (IKE) Service ExtensionsMicrosoft Internet Key Exchange (IKE) Service Extensions Double Free VulnerabilityCritical 9.8
Microsoft Internet Key Exchange (IKE) Service Extensions contains a double free vulnerability that could enable remote code execution.
- Severity (CVSS)
- Critical 9.8
- Added to KEV
- 18 Aug 2026
- CISA due date
- 21 Aug 2026
- Ransomware use
- Not known
- Weakness
- CWE-415
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CVE-2026-68820Microsoft Windows Ancillary Function Driver for WinSockMicrosoft Windows Ancillary Function Driver for WinSock Use-After-Free VulnerabilityHigh 7.0
Microsoft Windows Ancillary Function Driver for WinSock contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.
- Severity (CVSS)
- High 7.0
- Added to KEV
- 11 Aug 2026
- CISA due date
- 25 Aug 2026
- Ransomware use
- Not known
- Weakness
- CWE-416
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CVE-2026-20349Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat…Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection VulnerabilityHigh 8.6
Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) contain a heap inspection vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.
- Severity (CVSS)
- High 8.6
- Added to KEV
- 11 Aug 2026
- CISA due date
- 14 Aug 2026
- Ransomware use
- Not known
- Weakness
- CWE-244
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CVE-2026-20316Cisco Secure Firewall Management Center (FMC)Cisco Secure Firewall Management Center Use of Hard-coded Password VulnerabilityMedium 5.3Ransomware
Cisco Secure Firewall Management Center (FMC) formerly known as Firepower Management Center contains a use of hard-coded password vulnerability that could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems.
- Severity (CVSS)
- Medium 5.3
- Added to KEV
- 29 Jul 2026
- CISA due date
- 1 Aug 2026
- Ransomware use
- Known
- Weakness
- CWE-259
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CVE-2025-68686Fortinet FortiOSFortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor VulnerabilityMedium 5.3
Fortinet FortiOS contains an exposure of sensitive information to an unauthorized actor vulnerability. This may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests. An attacker would need first to have compromised the product via another vulnerability, at filesystem level.
- Severity (CVSS)
- Medium 5.3
- Added to KEV
- 27 Jul 2026
- CISA due date
- 10 Aug 2026
- Ransomware use
- Not known
- Weakness
- CWE-200
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CVE-2026-50522Microsoft SharePointMicrosoft SharePoint Deserialization of Untrusted Data VulnerabilityCritical 9.8
Microsoft SharePoint contains a deserialization of untrusted data vulnerability which could allow an unauthorized attacker to execute code over a network.
- Severity (CVSS)
- Critical 9.8
- Added to KEV
- 22 Jul 2026
- CISA due date
- 25 Jul 2026
- Ransomware use
- Not known
- Weakness
- CWE-502
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CVE-2026-16232Check Point SmartConsoleCheck Point SmartConsole Improper Authentication VulnerabilityCritical 9.3
Check Point SmartConsole contains an improper authentication vulnerability which could allow an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges.
- Severity (CVSS)
- Critical 9.3
- Added to KEV
- 22 Jul 2026
- CISA due date
- 25 Jul 2026
- Ransomware use
- Not known
- Weakness
- CWE-287
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CVE-2026-58644Microsoft SharePointMicrosoft SharePoint Deserialization of Untrusted Data VulnerabilityCritical 9.8
Microsoft SharePoint contains a deserialization of untrusted data vulnerability that allows an unauthorized attacker to execute code over a network.
- Severity (CVSS)
- Critical 9.8
- Added to KEV
- 16 Jul 2026
- CISA due date
- 19 Jul 2026
- Ransomware use
- Not known
- Weakness
- CWE-502
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CVE-2026-39808Fortinet FortiSandboxFortinet FortiSandbox OS Command Injection VulnerabilityCritical 9.1
Fortinet FortiSandbox contains an OS command injection vulnerability that could allow an unauthenticated attacker to execute unauthorized code or commands via crafted HTTP requests.
- Severity (CVSS)
- Critical 9.1
- Added to KEV
- 16 Jul 2026
- CISA due date
- 19 Jul 2026
- Ransomware use
- Not known
- Weakness
- CWE-78
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CVE-2026-25089Fortinet FortiSandboxFortinet FortiSandbox OS Command Injection VulnerabilityCritical 9.1
Fortinet FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS contain an OS command injection vulnerability that allows an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests.
- Severity (CVSS)
- Critical 9.1
- Added to KEV
- 16 Jul 2026
- CISA due date
- 19 Jul 2026
- Ransomware use
- Not known
- Weakness
- CWE-78
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CVE-2026-56164Microsoft SharePoint ServerMicrosoft SharePoint Server Missing Authentication for Critical Function VulnerabilityMedium 5.3
Microsoft SharePoint contains a missing authentication for critical function vulnerability that allows an unauthorized attacker to elevate privileges over a network.
- Severity (CVSS)
- Medium 5.3
- Added to KEV
- 14 Jul 2026
- CISA due date
- 17 Jul 2026
- Ransomware use
- Not known
- Weakness
- CWE-306
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CVE-2026-56155Microsoft Active Directory Federation ServicesMicrosoft Active Directory Federation Services Insufficient Granularity of Access Control VulnerabilityHigh 7.8
Microsoft Active Directory Federation Services contains an insufficient granularity of access control vulnerability that allows an authorized attacker to elevate privileges locally.
- Severity (CVSS)
- High 7.8
- Added to KEV
- 14 Jul 2026
- CISA due date
- 28 Jul 2026
- Ransomware use
- Not known
- Weakness
- CWE-1220
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CVE-2008-4128Cisco IOSCisco IOS Cross-Site Request Forgery VulnerabilityHigh 8.1
Cisco IOS 12.4 contains multiple cross-site forgery vulnerabilities that allows remote attackers to execute arbitrary commands via (1) a certain "show privilege" command to the /level/15/exec/- URI, and (2) a certain "alias exec" command to the /level/15/exec/-/configure/http URI.
- Severity (CVSS)
- High 8.1
- Added to KEV
- 13 Jul 2026
- CISA due date
- 16 Jul 2026
- Ransomware use
- Not known
- Weakness
- CWE-352
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CVE-2026-48282Adobe ColdFusionAdobe ColdFusion Path Traversal VulnerabilityCritical 10.0
Adobe ColdFusion contains a path traversal vulnerability that could lead to arbitrary code execution in the context of the current user.
- Severity (CVSS)
- Critical 10.0
- Added to KEV
- 7 Jul 2026
- CISA due date
- 10 Jul 2026
- Ransomware use
- Not known
- Weakness
- CWE-22
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CVE-2026-45659Microsoft SharePoint ServerMicrosoft SharePoint Server Deserialization of Untrusted Data VulnerabilityHigh 8.8Ransomware
Microsoft SharePoint Server contains a deserialization of untrusted data vulnerability which allows an authorized attacker to execute code over a network.
- Severity (CVSS)
- High 8.8
- Added to KEV
- 1 Jul 2026
- CISA due date
- 4 Jul 2026
- Ransomware use
- Known
- Weakness
- CWE-502
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CVE-2026-20230Cisco Unified Communications ManagerCisco Unified Communications Manager Server-Side Request Forgery (SSRF) VulnerabilityHigh 8.6
Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) contain a server-side request forgery (SSRF) Vulnerability that could allow an unauthenticated, remote attacker to write files to the underlying operating system that could be used later to elevate to root.
- Severity (CVSS)
- High 8.6
- Added to KEV
- 25 Jun 2026
- CISA due date
- 28 Jun 2026
- Ransomware use
- Not known
- Weakness
- CWE-918
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CVE-2026-34910Ubiquiti UniFi OSUbiquiti UniFi OS Improper Input Validation VulnerabilityCritical 10.0
Ubiquiti UniFi OS contains an improper input validation vulnerability which could allow a malicious actor with access to the network to conduct command injection.
- Severity (CVSS)
- Critical 10.0
- Added to KEV
- 23 Jun 2026
- CISA due date
- 26 Jun 2026
- Ransomware use
- Not known
- Weakness
- CWE-20
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CVE-2026-34909Ubiquiti UniFi OSUbiquiti UniFi OS Path Traversal VulnerabilityCritical 10.0
Ubiquiti UniFi OS contains a path traversal vulnerability which could allow a malicious actor with access to the network to access files on the underlying system that could be manipulated to access an underlying account.
- Severity (CVSS)
- Critical 10.0
- Added to KEV
- 23 Jun 2026
- CISA due date
- 26 Jun 2026
- Ransomware use
- Not known
- Weakness
- CWE-22
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CVE-2026-34908Ubiquiti UniFi OSUbiquiti UniFi OS Improper Access Control VulnerabilityCritical 10.0
Ubiquiti UniFi OS contains an improper access control vulnerability which could allow a malicious actor with access to the network to make unauthorized changes to the system.
- Severity (CVSS)
- Critical 10.0
- Added to KEV
- 23 Jun 2026
- CISA due date
- 26 Jun 2026
- Ransomware use
- Not known
- Weakness
- CWE-284
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CVE-2026-20262Cisco Catalyst SD-WAN ManagerCisco Catalyst SD-WAN Manager Directory or Path Traversal VulnerabilityMedium 6.5
Cisco Catalyst SD-WAN Manager contains a directory or path traversal vulnerability that could allow an authenticated, remote attacker to create a file or overwrite any file on the filesystem of an affected system.
- Severity (CVSS)
- Medium 6.5
- Added to KEV
- 15 Jun 2026
- CISA due date
- 29 Jun 2026
- Ransomware use
- Not known
- Weakness
- CWE-22
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CVE-2026-20245Cisco Catalyst SD-WAN ManagerCisco Catalyst SD-WAN Manager Improper Encoding or Escaping of Output VulnerabilityHigh 7.8
Cisco Catalyst SD-WAN Manager formerly SD-WAN vManage contains an improper encoding or escaping of output vulnerability. This vulnerability could allow an authenticated, local attacker to execute arbitrary commands as root by supplying a crafted file to the affected system.
- Severity (CVSS)
- High 7.8
- Added to KEV
- 9 Jun 2026
- CISA due date
- 23 Jun 2026
- Ransomware use
- Not known
- Weakness
- CWE-116
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2026-50751Check Point Security GatewayCheck Point Security Gateway Improper Authentication VulnerabilityCritical 9.3Ransomware
Check Point Security Gateway contains an improper authentication vulnerability in IKEv1 key exchange that could allow an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password.
- Severity (CVSS)
- Critical 9.3
- Added to KEV
- 8 Jun 2026
- CISA due date
- 11 Jun 2026
- Ransomware use
- Known
- Weakness
- CWE-287
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
NVD detailsCISA KEV entryblog.checkpoint.comsupport.checkpoint.com
CVE-2009-3459Adobe Acrobat and ReaderAdobe Acrobat and Reader Heap-Based Buffer Overflow VulnerabilityHigh 8.8
Adobe Acrobat and Reader contain a heap-based buffer overflow vulnerability which could allow remote attackers to execute arbitrary code via a crafted PDF file that triggers memory corruption.
- Severity (CVSS)
- High 8.8
- Added to KEV
- 20 May 2026
- CISA due date
- 3 Jun 2026
- Ransomware use
- Not known
- Weakness
- CWE-119
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2026-34621Adobe Acrobat and ReaderAdobe Acrobat and Reader Prototype Pollution VulnerabilityHigh 8.6
Adobe Acrobat and Reader contain a prototype pollution vulnerability that allows for arbitrary code execution.
- Severity (CVSS)
- High 8.6
- Added to KEV
- 13 Apr 2026
- CISA due date
- 27 Apr 2026
- Ransomware use
- Not known
- Weakness
- CWE-1321
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2026-21643Fortinet FortiClient EMSFortinet FortiClient EMS SQL Injection VulnerabilityCritical 9.1
Fortinet FortiClient EMS contains a SQL injection vulnerability that may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests.
- Severity (CVSS)
- Critical 9.1
- Added to KEV
- 13 Apr 2026
- CISA due date
- 16 Apr 2026
- Ransomware use
- Not known
- Weakness
- CWE-89
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2020-9715Adobe AcrobatAdobe Acrobat Use-After-Free VulnerabilityHigh 7.8
Adobe Acrobat contains a use-after-free vulnerability that allows for code execution
- Severity (CVSS)
- High 7.8
- Added to KEV
- 13 Apr 2026
- CISA due date
- 27 Apr 2026
- Ransomware use
- Not known
- Weakness
- CWE-416
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2026-35616Fortinet FortiClient EMSFortinet FortiClient EMS Improper Access Control VulnerabilityCritical 9.1
Fortinet FortiClient EMS contains an improper access control vulnerability that may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests.
- Severity (CVSS)
- Critical 9.1
- Added to KEV
- 6 Apr 2026
- CISA due date
- 9 Apr 2026
- Ransomware use
- Not known
- Weakness
- CWE-284
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2017-7921Hikvision Multiple ProductsHikvision Multiple Products Improper Authentication VulnerabilityCritical 9.8
Multiple Hikvision products contain an improper authentication vulnerability that could allow a malicious user to escalate privileges on the system and gain access to sensitive information.
- Severity (CVSS)
- Critical 9.8
- Added to KEV
- 5 Mar 2026
- CISA due date
- 26 Mar 2026
- Ransomware use
- Not known
- Weakness
- CWE-287
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2026-22769Dell RecoverPoint for Virtual Machines (RP4VMs)Dell RecoverPoint for Virtual Machines (RP4VMs) Use of Hard-coded Credentials VulnerabilityCritical 10.0
Dell RecoverPoint for Virtual Machines (RP4VMs) contains an use of hard-coded credentials vulnerability that could allow an unauthenticated remote attacker to gain unauthorized access to the underlying operating system and root-level persistence.
- Severity (CVSS)
- Critical 10.0
- Added to KEV
- 18 Feb 2026
- CISA due date
- 21 Feb 2026
- Ransomware use
- Not known
- Weakness
- CWE-798
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2026-24858Fortinet Multiple ProductsFortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel VulnerabilityCritical 9.4
Fortinet FortiAnalyzer, FortiManager, FortiOS, and FortiProxy contain an authentication bypass using an alternate path or channel that could allow an attacker with a FortiCloud account and a registered device to log into other devices registered to other accounts, if FortiCloud SSO authentication is enabled on those devices.
- Severity (CVSS)
- Critical 9.4
- Added to KEV
- 27 Jan 2026
- CISA due date
- 30 Jan 2026
- Ransomware use
- Not known
- Weakness
- CWE-288
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
NVD detailsCISA KEV entryfortiguard.fortinet.comfortinet.com
CVE-2025-14733WatchGuard FireboxWatchGuard Firebox Out of Bounds Write VulnerabilityCritical 9.3Ransomware
WatchGuard Fireware OS iked process contains an out of bounds write vulnerability in the OS iked process. This vulnerability may allow a remote unauthenticated attacker to execute arbitrary code and affects both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when configured with a dynamic gateway peer.
- Severity (CVSS)
- Critical 9.3
- Added to KEV
- 19 Dec 2025
- CISA due date
- 26 Dec 2025
- Ransomware use
- Known
- Weakness
- CWE-787
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2025-59718Fortinet Multiple ProductsFortinet Multiple Products Improper Verification of Cryptographic Signature VulnerabilityCritical 9.1
Fortinet FortiOS, FortiSwitchMaster, FortiProxy, and FortiWeb contain an improper verification of cryptographic signature vulnerability that may allow an unauthenticated attacker to bypass the FortiCloud SSO login authentication via a crafted SAML message. Please be aware that CVE-2025-59719 pertains to the same problem and is mentioned in the same vendor advisory. Ensure to apply all patches mentioned in the advisory.
- Severity (CVSS)
- Critical 9.1
- Added to KEV
- 16 Dec 2025
- CISA due date
- 23 Dec 2025
- Ransomware use
- Not known
- Weakness
- CWE-347
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
NVD detailsCISA KEV entryfortiguard.fortinet.comdocs.fortinet.com
CVE-2025-9242WatchGuard FireboxWatchGuard Firebox Out-of-Bounds Write VulnerabilityCritical 9.3
WatchGuard Firebox contains an out-of-bounds write vulnerability in the OS iked process that may allow a remote unauthenticated attacker to execute arbitrary code.
- Severity (CVSS)
- Critical 9.3
- Added to KEV
- 12 Nov 2025
- CISA due date
- 3 Dec 2025
- Ransomware use
- Not known
- Weakness
- CWE-787
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2025-54236Adobe Commerce and MagentoAdobe Commerce and Magento Improper Input Validation VulnerabilityCritical 9.1
Adobe Commerce and Magento Open Source contain an improper input validation vulnerability that could allow an attacker to take over customer accounts through the Commerce REST API.
- Severity (CVSS)
- Critical 9.1
- Added to KEV
- 24 Oct 2025
- CISA due date
- 14 Nov 2025
- Ransomware use
- Not known
- Weakness
- CWE-20
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2025-54253Adobe Experience Manager (AEM) FormsAdobe Experience Manager Forms Code Execution VulnerabilityCritical 10.0
Adobe Experience Manager Forms in JEE contains an unspecified vulnerability that allows for arbitrary code execution.
- Severity (CVSS)
- Critical 10.0
- Added to KEV
- 15 Oct 2025
- CISA due date
- 5 Nov 2025
- Ransomware use
- Not known
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2017-3066Adobe ColdFusionAdobe ColdFusion Deserialization VulnerabilityCritical 9.8
Adobe ColdFusion contains a deserialization vulnerability in the Apache BlazeDS library that allows for arbitrary code execution.
- Severity (CVSS)
- Critical 9.8
- Added to KEV
- 24 Feb 2025
- CISA due date
- 17 Mar 2025
- Ransomware use
- Not known
- Weakness
- CWE-502
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2020-29574Sophos CyberoamOSCyberoamOS (CROS) SQL Injection VulnerabilityCritical 9.8Ransomware
CyberoamOS (CROS) contains a SQL injection vulnerability in the WebAdmin that allows an unauthenticated attacker to execute arbitrary SQL statements remotely.
- Severity (CVSS)
- Critical 9.8
- Added to KEV
- 6 Feb 2025
- CISA due date
- 27 Feb 2025
- Ransomware use
- Known
- Weakness
- CWE-89
Required action: The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.
CVE-2020-15069Sophos XG FirewallSophos XG Firewall Buffer Overflow VulnerabilityCritical 9.8
Sophos XG Firewall contains a buffer overflow vulnerability that allows for remote code execution via the "HTTP/S bookmark" feature.
- Severity (CVSS)
- Critical 9.8
- Added to KEV
- 6 Feb 2025
- CISA due date
- 27 Feb 2025
- Ransomware use
- Not known
- Weakness
- CWE-120
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2024-20767Adobe ColdFusionAdobe ColdFusion Improper Access Control VulnerabilityHigh 7.4
Adobe ColdFusion contains an improper access control vulnerability that could allow an attacker to access or modify restricted files via an internet-exposed admin panel.
- Severity (CVSS)
- High 7.4
- Added to KEV
- 16 Dec 2024
- CISA due date
- 6 Jan 2025
- Ransomware use
- Not known
- Weakness
- CWE-284
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2023-45249Acronis Cyber Infrastructure (ACI)Acronis Cyber Infrastructure (ACI) Insecure Default Password VulnerabilityCritical 9.8
Acronis Cyber Infrastructure (ACI) allows an unauthenticated user to execute commands remotely due to the use of default passwords.
- Severity (CVSS)
- Critical 9.8
- Added to KEV
- 29 Jul 2024
- CISA due date
- 19 Aug 2024
- Ransomware use
- Not known
- Weakness
- CWE-1393
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2024-24919Check Point Quantum Security GatewaysCheck Point Quantum Security Gateways Information Disclosure VulnerabilityHigh 8.6Ransomware
Check Point Quantum Security Gateways contain an unspecified information disclosure vulnerability. The vulnerability potentially allows an attacker to access information on Gateways connected to the internet, with IPSec VPN, Remote Access VPN or Mobile Access enabled. This issue affects several product lines from Check Point, including CloudGuard Network, Quantum Scalable Chassis, Quantum Security Gateways, and Quantum Spark Appliances.
- Severity (CVSS)
- High 8.6
- Added to KEV
- 30 May 2024
- CISA due date
- 20 Jun 2024
- Ransomware use
- Known
- Weakness
- CWE-200
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2023-1671Sophos Web ApplianceSophos Web Appliance Command Injection VulnerabilityCritical 9.8
Sophos Web Appliance contains a command injection vulnerability in the warn-proceed handler that allows for remote code execution.
- Severity (CVSS)
- Critical 9.8
- Added to KEV
- 16 Nov 2023
- CISA due date
- 7 Dec 2023
- Ransomware use
- Not known
- Weakness
- CWE-77
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2022-3236Sophos FirewallSophos Firewall Code Injection VulnerabilityCritical 9.8
A code injection vulnerability in the User Portal and Webadmin of Sophos Firewall allows for remote code execution.
- Severity (CVSS)
- Critical 9.8
- Added to KEV
- 23 Sep 2022
- CISA due date
- 14 Oct 2022
- Ransomware use
- Not known
- Weakness
- CWE-94
Required action: Apply updates per vendor instructions.
CVE-2018-7841Schneider Electric U.motion BuilderSchneider Electric U.motion Builder SQL Injection VulnerabilityCritical 9.8
A SQL Injection vulnerability exists in U.motion Builder software which could cause unwanted code execution when an improper set of characters is entered.
- Severity (CVSS)
- Critical 9.8
- Added to KEV
- 15 Apr 2022
- CISA due date
- 6 May 2022
- Ransomware use
- Not known
- Weakness
- CWE-89
Required action: The impacted product is end-of-life and should be disconnected if still in use.
CVE-2010-5330Ubiquiti AirOSUbiquiti AirOS Command Injection VulnerabilityCritical 9.8
Certain Ubiquiti devices contain a command injection vulnerability via a GET request to stainfo.cgi.
- Severity (CVSS)
- Critical 9.8
- Added to KEV
- 15 Apr 2022
- CISA due date
- 6 May 2022
- Ransomware use
- Not known
- Weakness
- CWE-77
Required action: Apply updates per vendor instructions.
CVE-2022-23176WatchGuard Firebox and XTMWatchGuard Firebox and XTM Privilege Escalation VulnerabilityHigh 8.8
WatchGuard Firebox and XTM appliances allow a remote attacker with unprivileged credentials to access the system with a privileged management session via exposed management access.
- Severity (CVSS)
- High 8.8
- Added to KEV
- 11 Apr 2022
- CISA due date
- 2 May 2022
- Ransomware use
- Not known
Required action: Apply updates per vendor instructions.
CVE-2022-1040Sophos FirewallSophos Firewall Authentication Bypass VulnerabilityCritical 9.8
An authentication bypass vulnerability in User Portal and Webadmin of Sophos Firewall allows for remote code execution.
- Severity (CVSS)
- Critical 9.8
- Added to KEV
- 31 Mar 2022
- CISA due date
- 21 Apr 2022
- Ransomware use
- Not known
- Weakness
- CWE-158
Required action: Apply updates per vendor instructions.
CVE-2021-21551Dell dbutil DriverDell dbutil Driver Insufficient Access Control VulnerabilityHigh 8.8
Dell dbutil driver contains an insufficient access control vulnerability which may lead to escalation of privileges, denial-of-service (DoS), or information disclosure.
- Severity (CVSS)
- High 8.8
- Added to KEV
- 31 Mar 2022
- CISA due date
- 21 Apr 2022
- Ransomware use
- Not known
- Weakness
- CWE-782
Required action: Apply updates per vendor instructions.
CVE-2022-26318WatchGuard Firebox and XTM AppliancesWatchGuard Firebox and XTM Appliances Arbitrary Code ExecutionCritical 9.8
On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary code.
- Severity (CVSS)
- Critical 9.8
- Added to KEV
- 25 Mar 2022
- CISA due date
- 15 Apr 2022
- Ransomware use
- Not known
- Weakness
- CWE-122
Required action: Apply updates per vendor instructions.
CVE-2020-25223Sophos SG UTMSophos SG UTM Remote Code Execution VulnerabilityCritical 9.8
A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM.
- Severity (CVSS)
- Critical 9.8
- Added to KEV
- 25 Mar 2022
- CISA due date
- 15 Apr 2022
- Ransomware use
- Not known
- Weakness
- CWE-78
Required action: Apply updates per vendor instructions.
CVE-2021-36260Hikvision Security cameras web serverHikvision Improper Input ValidationCritical 9.8
A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation.
- Severity (CVSS)
- Critical 9.8
- Added to KEV
- 10 Jan 2022
- CISA due date
- 24 Jan 2022
- Ransomware use
- Not known
- Weakness
- CWE-78
Required action: Apply updates per vendor instructions.
CVE-2020-12271Sophos SFOSSophos SFOS SQL Injection VulnerabilityCritical 10.0Ransomware
Sophos Firewall operating system (SFOS) firmware contains a SQL injection vulnerability when configured with either the administration (HTTPS) service or the User Portal is exposed on the WAN zone. Successful exploitation may cause remote code execution to exfiltrate usernames and hashed passwords for the local device admin(s), portal admins, and user accounts used for remote access (but not external Active Directory or LDAP passwords).
- Severity (CVSS)
- Critical 10.0
- Added to KEV
- 3 Nov 2021
- CISA due date
- 3 May 2022
- Ransomware use
- Known
- Weakness
- CWE-89
Required action: Apply updates per vendor instructions.
No exploited vulnerabilities match this filter.
Top 10 most recent for the selected filters. Select a row for details, required action and advisories.
Not sure whether you're exposed? Ask us for a security assessment.
Security news.
The three biggest breach, cyberattack and ransomware stories worldwide from the last 24 hours, refreshed hourly.
Partners and suppliers.
Long-term vendor partnerships let us supply modern, supported equipment at a fair cost, and we source other leading brands through reliable channels when a job calls for it.
Partners
Products we work with every day.
Also supplied
Recommended and sourced to fit your needs and budget.
What's new from our partners
Mar 2026FortiOS 8.0
The new FortiGate operating system adds visibility and policy controls for staff use of AI tools, expanded SASE options, simpler SD-WAN and quantum-safe encryption.
Read on fortinet.com
Jun 2026Cisco Cloud Control
One console across Cisco networking, security and observability with AI-assisted operations, plus expanded Live Protect to shield more Cisco products from new flaws without reboots.
Read on newsroom.cisco.com
Mar 2026WatchGuard NDR for Firebox
Network detection and response built into existing Firebox firewalls, with no extra sensors. Can also push IP blocks to Fortinet and Check Point firewalls.
Read on watchguard.com
Sep 2026UniFi Enterprise Campus Switch Core
A 100G Layer 3 core switch with 3.2 Tbps capacity and MC-LAG for high availability, aimed at larger UniFi campus networks.
Read on ui.com
May 2026Dell PowerProtect One
Brings PowerProtect Data Manager and Data Domain backup storage under one control plane, to simplify protection and recovery from ransomware.
Read on dell.com
May 20262026 ThinkPad line-up
New ThinkPad X13 Gen 7 and L-series business laptops complete the 2026 range, with iFixit repairability scores of up to 9 out of 10.
Read on news.lenovo.com
Jan 2026Sophos Firewall v22
A hardened kernel, real-time integrity monitoring of the firewall itself through the Sophos XDR Linux sensor, and a new Health Check, as part of Secure by Design.
Read on docs.sophos.com
2026AcuSeek NVR
A recorder with on-device AI models that finds footage from a plain-language description in seconds, instead of reviewing video frame by frame.
Read on hikvision.com
Aug 2026Multi-chemistry Smart-UPS
The new Smart-UPS SRTD runs on lead-acid or lithium-ion batteries, so you can change battery type without replacing the UPS. Up to 3x base runtime.
Read on se.com
Jul 2026Cyber Protect v17 2026 Q2
Adds Microsoft Entra ID backup and Windows on ARM support, extending backup, security and remote management from one platform.
Read on acronis.com
Jul 2026Intune Suite in Microsoft 365 E5
Intune Suite capabilities are now included in Microsoft 365 E5, with selected ones in E3: less standing admin access, cloud certificate management and remote help.
Read on microsoft.com
May 2026Acrobat productivity agent
A conversational agent in Acrobat that answers questions about your PDFs and turns long documents into summaries, slides and audio.
Read on news.adobe.comTell us what you need.
Send a few details about your site or project and we'll get back to you.