CISA Adds 8 Exploited Flaws to KEV, Sets April-May 2026 Federal Deadlines

CISA has added eight new vulnerabilities to its Known Exploited Vulnerabilities catalog, with three affecting Cisco Catalyst SD-WAN Manager, setting federal agency remediation deadlines.

• •CVE-2025-32975 in Quest KACE Systems Management Appliance has a critical CVSS score of 10.0 allowing attackers to impersonate legitimate users without credentials
• •Three Cisco Catalyst SD-WAN Manager flaws enable file upload/overwriting, password recovery, and sensitive information disclosure
• •Active exploitation has been observed including usage by threat actors for ransomware delivery and targeting unpatched systems
• •Federal agencies must remediate the three Cisco vulnerabilities by April 23, 2026, and address the remaining five vulnerabilities by May 4, 2026
• •