FBI, CISA detail SafePay ransomware: 600+ victims since 2024
Joint advisory AA26-293A documents SafePay ransomware: 600+ victims since Aug 2024, five exploited CVEs, and a full IOC set. The .SafePay extension and LockBit code overlap.
Stories tagged: #cisa
US seizes Flax Typhoon tools, adds five flaws to CISA KEV
DOJ and FBI seized Flax Typhoon tools Microscan and FishHub tied to Integrity Technology Group, and CISA added five exploited flaws to its KEV catalog with an October 11 federal deadline.
FortiSandbox: CVE-2026-25089 and CVE-2026-39808 land in KEV, exploited
CISA added two critical unauthenticated OS command injection flaws in Fortinet FortiSandbox to KEV on July 16, 2026. BOD 26-04 gave FCEB agencies until July 19 to patch. Both are CVSS 9.1.
AD FS zero-day CVE-2026-56155: Microsoft DART finds DKM ACL bug already exploited
Microsoft's DART discovered CVE-2026-56155 during a live intrusion. CISA added it to KEV on July 14. Patch KB 5121391 audits DKM ACLs today, auto-remediates October 13.
SonicWall SMA1000 zero-days chained: CISA adds CVE-2026-15409 and 15410 to KEV
CISA added SonicWall SMA1000 zero-days CVE-2026-15409 (SSRF, CVSS 10.0) and CVE-2026-15410 to KEV on July 14, chained by Rapid7 MDR. Federal deadline July 17.
CISA adds SharePoint CVE-2026-56164 to KEV, chained with two prior bugs
CISA added SharePoint auth-bypass CVE-2026-56164 to KEV on July 14 and re-issued a hardening alert citing three chained on-prem SharePoint CVEs under active exploitation. FCEB deadline July 17.
SonicWall SMA1000 CVE-2026-15409/15410 chained in the wild, KEV
SonicWall confirms in-the-wild chaining of an unauth SSRF (CVE-2026-15409, CVSS 10.0) and a post-auth command injection (CVE-2026-15410, CVSS 7.2) on SMA1000 6210/7210/8200v. CISA KEV due 2026-07-17.
Two more Joomla extensions hit CISA KEV: iCagenda and Balbooa Forms
CISA added CVE-2026-48939 (iCagenda) and CVE-2026-56291 (Balbooa Forms) to KEV on July 10. Both unauth file-upload to RCE. Patches: iCagenda 4.0.8/3.9.15, Balbooa Forms 2.4.1.
Two Joomla page-builder RCEs hit CISA KEV, remediation due today
CISA added CVE-2026-48908 (JoomShaper SP Page Builder) and CVE-2026-56290 (Page Builder CK) to KEV on July 7. Both CVSS 10.0, unauth file-upload to RCE. FCEB deadline: July 10.
Langflow CVE-2026-55255 IDOR added to CISA KEV, patch to 1.9.2
CISA added the Langflow /api/v1/responses IDOR (CVE-2026-55255, CVSS 9.9) to KEV on July 7. Sysdig first observed exploitation on June 25. Third Langflow flaw to hit KEV in seven months.
CISA gives feds 3 days to patch Ivanti Sentry CVE-2026-10520
Unauthenticated root RCE in Ivanti Sentry. CVSS 10.0. Shadowserver sees exploitation a day after the patch. CISA KEV deadline is June 14.
CISA adds Oracle WebLogic CVE-2024-21182 to KEV catalog
CISA added the two-year-old Oracle WebLogic auth-bypass CVE-2024-21182 to KEV on June 1, citing active exploitation. Federal agencies have until June 4 to patch.
CISA flags Langflow CVE-2025-34291: CORS chain yields RCE
CISA added CVE-2025-34291 to the KEV catalog on May 21. An overly permissive CORS plus a misconfigured refresh-token cookie chain to account takeover and code execution in Langflow ≤ 1.6.9.