CISA Adds 4 Exploited Flaws to KEV, Sets May 2026 Federal Deadline
CISA adds 4 actively exploited vulnerabilities to KEV catalog with May 2026 federal deadline.
CISA added four vulnerabilities to its Known Exploited Vulnerabilities catalog on April 25, 2026, including critical flaws in SimpleHelp, Samsung MagicINFO 9 Server, and D-Link DIR-823X routers, all with evidence of active exploitation. The SimpleHelp vulnerabilities (CVE-2024-57726, CVE-2024-57728) have been linked to ransomware campaigns by DragonForce, while Samsung and D-Link flaws are associated with Mirai botnet deployments. Federal agencies must apply patches or discontinue affected appliances by May 8, 2026.
AI summary of the linked source. Not reviewed by an editor. How this works
Run CISA?
Get an email when a new story names CISA, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
What helps against this
How we list vendors
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Device management (MDM and UEM)
Every company laptop and phone is known, encrypted, locked down and up to date.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2024-57726
- cve — CVE-2024-57728
- cve — CVE-2024-7399
- cve — CVE-2025-29635
- malware — DragonForce
- malware — Mirai
- malware — tuxnokill