What Attackers Actually Exploited: Lessons from 75 CISA KEVs in Q1 FY 2026–27

What the quarter's exploited vulnerabilities reveal

Q1 FY 2026–27 showed that attackers do not care whether a vulnerability is new or attached to the highest CVSS score. They care whether it provides a reliable path into a valuable system. The 75 vulnerabilities CISA added to the Known Exploited Vulnerabilities (KEV) catalogue during the quarter ranged from current network-management and enterprise-platform flaws to Microsoft vulnerabilities dating back to 2008.

• 75 vulnerabilities were added to the KEV catalogue during the quarter, 31 in April, 21 in May, and 23 in June.
• Microsoft accounted for 15 additions and Cisco for 7, together representing nearly 30% of the quarter's total.
• The quarter spanned network edge appliances, enterprise platforms, browsers, developer tooling, and vulnerabilities first disclosed as far back as 2008.
• Authentication failures, uncontrolled file manipulation, and code or command injection repeatedly turned isolated bugs into full system compromise.
• Only 14 of 75 entries are marked "Known" for ransomware use. "Unknown" does not mean ransomware has not used them, it means CISA has not yet classified that use. CISA's KEV catalogue is an authoritative record of vulnerabilities exploited in the wild, not a simple list of high-severity CVEs (CISA KEV Catalog).

75 exploited vulnerabilities were added in three months

April was the busiest month, including a substantial set of legacy Microsoft and Adobe flaws alongside Cisco SD-WAN entries. May and June leaned more heavily toward current edge appliances and enterprise platforms.

Treat knownRansomwareCampaignUse: Unknown as an absence of confirmed classification, not as evidence a vulnerability has never been used in a ransomware intrusion. CISA maintains separate resources describing how it labels ransomware-linked vulnerabilities and misconfigurations (CISA ransomware-linked vulnerability resources).

Authentication failures allowed attackers to enter without valid credentials

Seven of the quarter's entries share the same underlying failure: a system trusted a request it should have challenged. Whether the missing check was a signature verification, a session validation, or a request filter, the result was the same, an attacker skipped authentication entirely and landed inside a privileged context.

The lesson generalizes cleanly: a token, session, or credential is only as strong as the verification step behind it. Skipping signature validation, or omitting a check entirely, is functionally identical to having no authentication at all, the interface just looks like there is one.

File-handling flaws allowed attackers to alter or take over systems

Nine entries this quarter involve path traversal, arbitrary upload, symlink abuse, or file-overwrite conditions. Calling these "path traversal" bugs understates the outcome, what actually matters is what the attacker can do once a file lands in the wrong place. The real severity depends on which directories are reachable, what privilege owns the written file, and whether that file happens to be a startup script, a configuration file, or an executable.

Unsafe input allowed attackers to run code and system commands

Command injection, SQL injection, and unsafe deserialization each let an attacker's input do more than the application designer intended, the difference is what that input controls once it reaches its destination.

How different input flaws lead to system compromise

Attackers targeted systems that control access to the network

Nine product families in this quarter's KEV batch sit at network boundaries or hold privileged administrative roles: Cisco Catalyst SD-WAN Manager, Palo Alto PAN-OS, Ivanti EPMM and Sentry, Fortinet FortiClient EMS, Ubiquiti UniFi OS, Check Point Security Gateway, D-Link DIR-823X, Arista EOS, and Cisco Unified CM. The interesting insight isn't that these products had vulnerabilities, it's that they routinely combine external or broad network reachability, high system privileges, access to management networks, valuable stored credentials and configuration, and comparatively thin endpoint monitoring relative to ordinary servers.

Six Cisco SD-WAN vulnerabilities exposed several paths to control

Six separate CVEs against the SD-WAN Manager product line landed in KEV this quarter. Individually each looks modest; together they sketch a full attack surface across authentication, file handling, credential storage, and information disclosure.

Chained in the order an attacker would prefer, bypass authentication, escalate through file or credential handling, then execute as root, this cluster illustrates why CISA issued dedicated hunt-and-hardening guidance for Cisco SD-WAN systems rather than treating each CVE as an isolated patch item.

Older vulnerabilities remained useful to attackers

This is probably the quarter's strongest narrative hook. Ten of the 75 additions were originally disclosed years, in several cases well over a decade, before they were added to KEV in Q1 FY 2026–27. That gap matters because it separates four dates that are easy to conflate: when a CVE was first published, when the vendor shipped a patch, when CISA added it to KEV, and when exploitation was actually observed. A vulnerability can sit quietly for years and then reappear as an active threat the moment legacy software, delayed patching, or reusable public exploit code puts it back in front of attackers.

The takeaway is not that these products are inherently insecure today, most have long since been patched by vendors. It's that vulnerability age is not a useful proxy for operational risk. Wherever legacy software, unmanaged appliances, or unpatched end-of-life systems remain reachable, a fifteen-year-old bug is exactly as dangerous as a brand-new one.

How defenders should prioritize and respond

Q1's KEV additions reveal that attackers repeatedly win through three transitions: unauthenticated access to privileged functionality, attacker-controlled input to code execution, and file-system access to full system compromise.

1. 1
   Inventory by product and exposure. Find every affected edge, remote-management, developer, and enterprise platform in your environment, not just the ones that made headlines.
2. 2
   Prioritize KEV presence first. KEV membership indicates observed exploitation; use CVSS to understand severity, not as the sole queueing mechanism.
3. 3
   Identify the exploitation primitive. Authentication bypass, arbitrary file write, and command execution each require a different hunting strategy, map the CVE to its primitive before you hunt.
4. 4
   Patch or isolate. Remove public reachability when remediation cannot be completed promptly, especially for edge and remote-management products.
5. 5
   Hunt for compromise. Patching closes the vulnerability but does not remove an existing web shell, stolen credential, or persistence mechanism already planted through it.
6. 6
   Validate the fix. Confirm the actual installed build and test that the vulnerable behavior is no longer reachable, don't rely on a changelog alone.

CISA's Binding Operational Directive establishes KEV remediation as a priority for U.S. federal civilian agencies and recommends the catalogue as an input to vulnerability-management prioritization more broadly (CISA BOD 22-01).

All 75 CVEs added during Q1 FY 2026–27

Every CVE added to CISA KEV during the quarter, one line each. Click a CVE ID to view its detail page.