CISA Adds Four Known Exploited Vulnerabilities to Catalog
Actively exploited. At least one CVE in this advisory is listed in the CISA Known Exploited Vulnerabilities catalog — exploitation has been observed in the wild. Treat remediation as urgent.
CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2021-27137 DD-WRT Stack-Based Buffer Overflow Vulnerability CVE-2026-0770 Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability CVE-2026-63030 WordPress Core Interpretation Conflict Vulnerability CVE-2026-60137 WordPress Core SQL Injection Vulnerability These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise. Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA’s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied. While BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities . CISA will continue to add vulnerabilities to the catalog that meet the specified criteria . Aware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through CISA’s KEV Nomination Form . Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance.
CSIRTS triage
- What
- CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation.
- Who is affected
- Federal agencies are affected as they must prioritize remediation of these vulnerabilities.
- Urgency
- Remediation is urgent due to the high risk and active exploitation of these vulnerabilities.
- Action
- Federal agencies should prioritize rapid remediation of the listed vulnerabilities.
AI-assisted analysis generated from the source advisory — verify against the original.
Details
Original advisory: https://www.cisa.gov/news-events/alerts/2026/07/21/cisa-adds-four-known-exploited-vulnerabilities-catalog
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Exploitation confirmedCVE-2021-27137Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 97% of all scored CVEs.
- Exploitation confirmedCVE-2026-0770Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 99% of all scored CVEs.
- Exploitation confirmedCVE-2026-63030Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 100% of all scored CVEs.
- Exploitation confirmedCVE-2026-60137Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 100% of all scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2021-27137 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-0770 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-63030 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-60137 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- critical[NEW] [critical] WordPress: Multiple vulnerabilities allow code executioncert-bund
- unknownDSA-6399-1 wordpress - security updatedebian
- unknownexploitedWordPress security advisory (AV26-723) - Update 1cccs
- criticalexploitedCVE-2026-0770: Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerabilitycisa-kev
- criticalexploitedCVE-2026-63030: WordPress Core Interpretation Conflict Vulnerabilitycisa-kev
- criticalexploitedCVE-2026-60137: WordPress Core SQL Injection Vulnerabilitycisa-kev
- criticalexploitedCVE-2021-27137: DD-WRT Stack-Based Buffer Overflow Vulnerabilitycisa-kev
- unknownWordPress Multiple Vulnerabilitieshkcert
- unknownexploitedMultiple vulnerabilities in WordPress (July 20, 2026)cert-fr-alerte
- unknownMultiple vulnerabilities in WordPress (July 20, 2026)cert-fr-avis
- unknownNCSC-2026-0250 [1.00] [H/M] Vulnerabilities fixed in WordPress by Automatticncsc-nl
- criticalexploitedCVE-2026-63030: WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint r…nvd
Recent advisories for CISA Adds Four
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- criticalexploitedCISA Adds Four Known Exploited Vulnerabilities to Catalogcisa · 2026-07-14
- highexploitedCISA Adds Four Known Exploited Vulnerabilities to Catalogcisa · 2026-06-23
More from CISA Cybersecurity Advisories
- criticalOpen Source Software: Security Principles and Practices2026-07-30
- criticalSchneider Electric IGSS2026-07-30
- criticalToptech Systems RCU II+ and Multiload II+2026-07-30
- criticalNASA Core Flight System (cFS) Health & Safety (HS) Application2026-07-30
- criticalMikroTik RouterOS2026-07-30