Ten CVEs Added to CISA KEV, Four with a Three-day Mitigation Window
NEOSEC enrichment — no mirror of the original source
On Monday, April 20, 2026, the US Cybersecurity and Infrastructure Security Agency (CISA) added three vulnerabilities in Cisco Catalyst SD-WAN Manager (formerly known as vManage) to the Known Exploited Vulnerabilities (KEV) catalog, each wi
Source: SANS NewsBites. For licensing reasons NEOSEC Intel does not mirror the full text verbatim. The full text and expert commentary are available at the original source.
Read the issue at SANS NewsBitesLinked advisories
- CVE-2026-20122Cisco Catalyst SD-WAN Manger — Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Vulnerability
- CVE-2026-39987Marimo: Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass
- CVE-2023-27351PaperCut NG/MF — PaperCut NG/MF Improper Authentication Vulnerability
- CVE-2025-2749Kentico Kentico Xperience — Kentico Xperience Path Traversal Vulnerability
- CVE-2024-27199JetBrains TeamCity — JetBrains TeamCity Relative Path Traversal Vulnerability
- CVE-2026-39987Marimo Marimo — Marimo Remote Code Execution Vulnerability
- CVE-2025-32975Quest KACE Systems Management Appliance (SMA) — Quest KACE Systems Management Appliance (SMA) Improper Authentication Vulnerability
- CVE-2025-48700Synacor Zimbra Collaboration Suite (ZCS) — Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability
- CVE-2026-20133Cisco Catalyst SD-WAN Manager — Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor Vulnerability
- CVE-2026-20128Cisco Catalyst SD-WAN Manager — Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format Vulnerability
Affected vendors and products
More on Mitigation
Other advisories
- HighCVE-2026-115570Electron: Mitigation for compromised eMudhra intermediate certificates
- HighCVE-2026-115570Electron: Mitigation for compromised eMudhra intermediate certificates
- Not ratedosv:CVE-2026-115570Electron: Mitigation for compromised eMudhra intermediate certificates
- CriticalCVE-2026-39797Data443 Risk Mitigation GDPR Framework By Data443: Deserialisierung nicht vertrauenswürdiger Daten
- CriticalCVE-2026-39797Data443 Risk Mitigation GDPR Framework By Data443: Deserialisierung nicht vertrauenswürdiger Daten
- Not ratedosv:CLEANSTART-2026-RX54054As mitigation for CVE-2020-1945 Apache Ant 1
- Not ratedosv:CLEANSTART-2025-TN67221As mitigation for CVE-2020-1945 Apache Ant 1
- HighCVE-2026-86043Skipper has OPA body-authz bypass: truncated_body mitigation fails open on chunked/HTTP-2 (incomplete fix GHSA-8qqm-fp2q-v734) in github.com/zalando/skipper
Other news entries
- PHP shares mitigation for new RCE vulnerability with no patchNewsBleepingComputer
- ConnectWise warns of new ScreenConnect flaw without patchNewsBleepingComputer
- PaperCut Releases Emergency Patch for Exploited Zero-DayNewsSecurityWeek
- CISA Adds 10 CVEs to Known Exploited Vulnerabilities Catalog, Five with Three-day Mitigation DeadlinesVulnerabilitySANS NewsBites
- New GPUThor Rowhammer Defeats ECC on NVIDIA RTX A6000 to Gain Host Root AccessNewsThe Hacker News
- KEV: Oracle, Zimbra, TrueConfVulnerabilitySANS NewsBites
- Critical GitLab Zero-Click Flaw Poses Mitigation ChallengesNewsDark Reading
- CISA Adds Five CVEs to Known Exploited Vulnerabilities CatalogVulnerabilitySANS NewsBites
Source: https://www.theregister.com/
ID