KEV Adds Exploited Microsoft, WordPress Flaws; Adobe, ASUS Vulnerabilities Disclosed
CISA KEV sees new additions including actively exploited Microsoft and WordPress flaws, alongside critical Adobe and ASUS vulnerabilities.
A critical vulnerability in FreePBX (CVE-2025-57819) allows unauthenticated attackers to gain administrative access due to insufficient sanitization of user-supplied data. This impacts FreePBX versions 15, 16, and 17. Separately, another FreePBX vulnerability (CVE-2025-66039) permits authentication bypass when the authentication type is set to "webserver," potentially leading to unauthorized access.
Microsoft's Windows IKE Extension is affected by a critical double-free vulnerability (CVE-2026-33824) that could allow remote code execution over a network. This flaw has been added to the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation.
A supply chain compromise led to unauthorized modifications in ASUS Live Update client builds, creating a critical vulnerability (CVE-2025-59374) for specific ASUS devices. The exact impact depends on the targeted devices.
WordPress is facing a critical vulnerability (CVE-2026-87902) that allows unauthenticated attackers to include local PHP files, potentially leading to code execution. This flaw has been added to the CISA KEV catalog and is being actively exploited, with proof-of-concept exploits and patches available. As The Hacker News reported, attackers began probing WordPress sites for this vulnerability within hours of its disclosure.
Microsoft SharePoint has a critical vulnerability (CVE-2026-65660) that allows authenticated attackers to execute code remotely over a network. This flaw has also been added to the CISA KEV catalog due to active exploitation, as noted by SecurityWeek.
Adobe Experience Manager Forms JEE (CVE-2026-75745) and Adobe Campaign Classic (CVE-2026-75721) are impacted by critical vulnerabilities. The AEM Forms vulnerability allows arbitrary code execution in the context of the current user, while the Campaign Classic flaw enables code injection. Adobe has released patches for these issues, as reported by SecurityWeek.
Multiple critical vulnerabilities have been disclosed in Microsoft products, including Azure Logic Apps (CVE-2026-83944, CVE-2026-70200), Microsoft Fabric (CVE-2026-69843), Microsoft Container Registry (CVE-2026-69865), and Azure Arc (CVE-2026-69399). These flaws primarily involve privilege escalation through authentication bypass, path traversal, and improper access control. As detailed by Vypr Intelligence, these vulnerabilities pose a significant risk to Azure environments.
Cisco IOS and IOS XE Software have a high-severity vulnerability (CVE-2025-20352) in their SNMP subsystem. This flaw could allow an authenticated, low-privileged remote attacker to cause a denial of service.
Other critical vulnerabilities include an SQL injection flaw in Esri ArcGIS Server (CVE-2025-57870), an unrestricted file upload vulnerability in TalentSys Consulting Information Technology Industry Inc. Inka.Net (CVE-2025-9846) leading to command injection, and code injection vulnerabilities in WordPress themes Alone (CVE-2025-60206) and CMSSuperHeroes products (CVE-2025-49060, CVE-2025-48106). Additionally, Totolink routers are affected by an authentication bypass vulnerability (CVE-2025-13184) enabling unauthenticated root login.