CISA Adds 4 Exploited Flaws to KEV, Sets May 2026 Federal Deadline

CISA added four exploited vulnerabilities to its Known Exploited Vulnerabilities catalog, with a May 2026 federal deadline for mitigation.

• •CVE-2024-57726 (CVSS 9.9): Missing authorization in SimpleHelp allowing privilege escalation to admin role
• •CVE-2024-57728 (CVSS 7.2): Zip slip vulnerability in SimpleHelp enabling arbitrary code execution
• •CVE-2024-7399 (CVSS 8.8): Path traversal in Samsung MagicINFO 9 Server for arbitrary file writing
• •CVE-2025-29635 (CVSS 7.5): Command injection in D-Link DIR-823X routers exploitable via POST request
• •Active exploitation confirmed, with links to Mirai botnet and ransomware campaigns

This summary was automatically generated by AI based on the original article and may not be fully accurate.