The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, which tracks security flaws that are actively being exploited in real-world cyberattacks. The decision follows confirmed evidence that threat actors are leveraging these vulnerabilities in ongoing attacks.

Vulnerabilities included in the KEV Catalog represent some of the highest cybersecurity risks for organizations. Unlike theoretical or unconfirmed vulnerabilities, these flaws have already been weaponized by attackers. For this reason, CISA strongly recommends that organizations remediate them as quickly as possible.

What Is the KEV Catalog?

The Known Exploited Vulnerabilities (KEV) Catalog is a special repository maintained by CISA that contains vulnerabilities confirmed to be actively exploited by cybercriminals.

Unlike the general CVE database, which includes thousands of publicly disclosed vulnerabilities, the KEV Catalog only lists vulnerabilities that have been verified as being exploited in real-world attacks. Consequently, cybersecurity professionals are advised to closely monitor the KEV Catalog and prioritize remediation of the vulnerabilities it contains.

1. Critical Vulnerability in Zimbra Collaboration Suite (CVE-2025-68645)

One of the most significant additions is a critical vulnerability affecting the Synacor Zimbra Collaboration Suite (ZCS) email platform.

Vulnerability Overview

This vulnerability is classified as a PHP Remote File Inclusion (RFI) flaw, allowing an unauthenticated remote attacker to load files into the system using specially crafted HTTP requests.

By exploiting the /h/rest endpoint, an attacker can include arbitrary files located within the WebRoot directory.

Successful exploitation could allow an attacker to:

• Read sensitive files stored on the server;
• Execute malicious code;
• Gain complete control of the affected system;
• Launch additional attacks through the compromised email server.

Key Details

• CVE: CVE-2025-68645
• CVSS Score: 8.8 (High)
• Affected Product: Synacor Zimbra Collaboration Suite
• Fixed Version: ZCS 10.1.13 and later

According to security researchers at CrowdSec, exploitation attempts targeting this vulnerability have been observed since January 14, 2026.

2. Authentication Bypass Vulnerability in Versa Concerto SD-WAN (CVE-2025-34026)

The second vulnerability affects the Versa Concerto SD-WAN orchestration platform.

Vulnerability Overview

This flaw allows attackers to bypass the authentication mechanism.

As a result, an attacker may:

• Access the administrative interface;
• Interact with management APIs;
• Modify network configurations;
• Gain full control over the SD-WAN infrastructure.

Key Details

• CVE: CVE-2025-34026
• CVSS Score: 9.2 (Critical)
• Fixed Version: Versa Concerto 12.2.1 GA

Because SD-WAN infrastructures are widely deployed across large enterprises and government organizations, this vulnerability poses a particularly severe security risk.

3. Improper Authorization Vulnerability in Vite (Vitejs) (CVE-2025-31125)

The third vulnerability affects Vite (Vitejs), a widely used modern web application development platform.

Vulnerability Overview

Due to improper authorization controls, an attacker can use specially crafted URL parameters such as ?inline&import or ?raw?import to read the contents of certain server-side files directly through a web browser.

Although the vulnerability has a relatively modest CVSS score, it remains practically dangerous because it may expose configuration files, API keys, or other sensitive information.

Key Details

• CVE: CVE-2025-31125
• CVSS Score: 5.3

Patched versions include:

• 6.2.4
• 6.1.3
• 6.0.13
• 5.4.16
• 4.5.11

4. npm Supply Chain Attack (CVE-2025-54313)

One of the most notable additions to the KEV Catalog involves a software supply chain attack targeting the eslint-config-prettier package.

Vulnerability Overview

In July 2025, unknown threat actors launched a phishing campaign targeting maintainers of popular npm packages.

Victims received fraudulent emails prompting them to verify their accounts through fake login pages.

After entering their credentials:

• Their accounts were compromised;
• Attackers published new package versions containing malicious code to the npm registry.

The compromised packages included:

• eslint-config-prettier;
• eslint-plugin-prettier;
• synckit;
• @pkgr/core;
• napi-postinstall;
• got-fetch;
• is.

On Windows systems, the malicious code executed a DLL loader known as Scavenger Loader, which subsequently downloaded information-stealing malware.

Key Details

• CVE: CVE-2025-54313
• CVSS Score: 7.5

This incident is widely regarded as one of the most significant software supply chain attacks in recent years.

Why Is the KEV Catalog Important?

The vulnerabilities included in the KEV Catalog differ fundamentally from ordinary CVEs.

While the CVE database contains thousands of disclosed vulnerabilities, the KEV Catalog includes only those that:

• Have been exploited in real-world attacks;
• Have confirmed active exploitation;
• Pose a significant threat to organizations.

For this reason, many government agencies and large enterprises prioritize vulnerability remediation based on the KEV Catalog.

CISA Recommendations

Under the requirements of Binding Operational Directive (BOD) 22-01, U.S. Federal Civilian Executive Branch (FCEB) agencies are required to remediate these vulnerabilities by February 12, 2026.

Security experts recommend that all organizations:

• Verify the versions of software currently in use;
• Immediately install security updates released by vendors;
• Regularly audit internet-facing servers;
• Analyze system and network logs for signs of exploitation;
• Monitor suspicious activity using WAF, EDR, and SIEM solutions;
• Strengthen software supply chain security by verifying the integrity of third-party packages before deployment.

CISA’s decision to add four additional vulnerabilities to the KEV Catalog demonstrates that cybercriminals are actively targeting not only operating systems and networking equipment, but also enterprise email platforms, SD-WAN infrastructures, web development frameworks, and open-source software packages.

In particular, the vulnerabilities affecting Zimbra Collaboration Suite and Versa Concerto SD-WAN present significant risks to enterprise environments, while the eslint-config-prettier incident once again highlights that software supply chain attacks have become one of the most critical cybersecurity threats facing organizations today.

Organizations should therefore continuously monitor the KEV Catalog, prioritize remediation of the vulnerabilities listed within it, and deploy security updates without delay. Doing so remains one of the most effective ways to protect information systems against today’s rapidly evolving cyber threats.