CISA Adds Four Known Exploited Vulnerabilities to Catalog
CISA added four vulnerabilities to its KEV catalog, including flaws in Lantronix EDS5000 and Ubiquiti UniFi OS, citing active exploitation.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. The additions include CVE-2025-67038 affecting Lantronix EDS5000 series devices, and three Ubiquiti UniFi OS vulnerabilities: CVE-2026-34908 (improper access control), CVE-2026-34909 (path traversal), and CVE-2026-34910 (improper input validation). These flaws are being actively used by malicious cyber actors and pose significant risks to federal networks and critical infrastructure.
The Lantronix EDS5000 vulnerability (CVE-2025-67038) is a code injection flaw that could allow an attacker to execute arbitrary code on affected devices. The three Ubiquiti UniFi OS vulnerabilities collectively enable unauthorized access, file system traversal, and input validation bypass, potentially leading to full device compromise. CISA's KEV catalog inclusion signals that these vulnerabilities are being exploited in the wild, making remediation urgent.
CISA's Binding Operational Directive (BOD) 26-04, issued earlier this year, requires Federal Civilian Executive Branch (FCEB) agencies to prioritize remediation of KEV-listed vulnerabilities on publicly exposed assets that grant total control post-exploitation. The directive shifts federal vulnerability management from volume-based patching to risk-based prioritization, emphasizing actual exploit risk over CVSS scores alone. Agencies must also check for signs of compromise before applying patches.
While BOD 26-04 applies only to FCEB agencies, CISA strongly encourages all organizations—including private sector, state and local governments, and critical infrastructure operators—to adopt similar risk-based approaches. The agency recommends immediate patching of these four vulnerabilities and continuous monitoring for signs of exploitation.
CISA continues to expand the KEV catalog as new threats emerge. Organizations aware of exploited vulnerabilities not yet listed can submit them via CISA's KEV Nomination Form, provided they have a CVE ID, evidence of exploitation, and clear mitigation guidance. The addition of these four vulnerabilities underscores the persistent threat posed by unpatched software and the importance of proactive vulnerability management.
This latest KEV update follows a pattern of CISA adding multiple vulnerabilities at once, often from diverse vendors. Previous additions this year have included flaws in Cisco, Chrome, Arista, Ivanti, and others. The inclusion of both Lantronix and Ubiquiti products highlights the broad attack surface exposed by IoT and networking devices, which are frequent targets for initial access and lateral movement.
Organizations should prioritize patching these vulnerabilities, especially if the affected devices are internet-facing. For Lantronix EDS5000 users, firmware updates are available from the vendor. Ubiquiti has released patches for UniFi OS versions affected by the three CVEs. CISA recommends reviewing the respective advisories and applying updates immediately to mitigate risk.
CISA's latest KEV update specifically highlights CVE-2026-34908, an improper access control flaw in Ubiquiti UniFi OS, as actively exploited, and also includes two related bugs (CVE-2026-34909 and CVE-2026-34910) that can be chained for deeper compromise. Federal agencies must patch by June 26, 2026, under BOD 26-04. While no ransomware link is confirmed, CISA warns the access gained aligns with common ransomware operator tradecraft.
SecurityWeek adds technical depth to the Ubiquiti KEV entries, reporting that BishopFox reverse-engineered the patches and confirmed the authentication gateway bypass (CVE-2026-34908 and CVE-2026-34909) against a live UniFi OS 5.0.6 VM. The analysis reveals that crafted requests starting with an auth-exempt prefix are normalized by NGINX to reach authenticated internal routes, enabling unauthenticated command injection via CVE-2026-34910. Multiple users had already reported exploitation as zero-days creating rogue admin accounts under the username 'John Sim' before Ubiquiti acknowledged the issue.
BleepingComputer adds that the Ubiquiti KEV entries are actually three CVEs—CVE-2026-34908 (access control bypass), CVE-2026-34909 (path traversal), and CVE-2026-34910 (input validation RCE)—which researchers at Bishop Fox demonstrated can be chained to achieve full remote code execution with elevated privileges on UniFi OS devices. The same article also identifies the Lantronix vulnerability as CVE-2025-67038, a root-level command injection in EDS5000 firmware through the HTTP RPC module, with Lantronix releasing version 2.2.0.0R1 as a fix.
CISA added CVE-2025-67038 to the KEV catalog on Tuesday, warning federal agencies to patch by June 26, 2026. The 9.8-rated code injection flaw in Lantronix EDS5000 devices, originally disclosed as part of the BRIDGE:BREAK findings in April, allows unauthenticated remote command execution with root privileges when the HTTP RPC module logs failed authentication attempts.
SecurityWeek reports that CVE-2025-67038, a remote code execution flaw in Lantronix EDS5000 serial-to-IP converters disclosed during the BRIDGE:BREAK research project in April, is now being actively exploited in OT environments. While CISA added the vulnerability to its KEV catalog on June 23, no public reports detailing specific attacks have emerged, though Aviatrix described a scenario where attackers gain root access, move laterally, and exfiltrate data. ZoomEye data shows thousands of internet-exposed Lantronix systems, primarily in the United States, though it remains unclear how many are vulnerable.