[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f9BsQ11pK9jpMUNluW8bDWzbkkXBuLTFpqmMLmPLRbSo":3},{"article":4,"iocs":59,"watch_terms":81,"solutions":82,"lesson":35},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":33,"category":34,"article_tags":38},"30cd9135-b2b9-4e5d-aeb7-4f083acf73d2","CISA Adds 4 Exploited Flaws to KEV, Sets May 2026 Federal Deadline","cisa-adds-4-exploited-flaws-to-kev-sets-may-2026-federal-deadline-ff0558","The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added four vulnerabilities impacting SimpleHelp, Samsung MagicINFO 9 Server, and D-Link DIR-823X series routers to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The list of vulnerabilities is below - CVE-2024-57726 (CVSS score: 9.9) - A missing authorization vulnerability in","CISA added four vulnerabilities to its Known Exploited Vulnerabilities catalog on April 25, 2026, including critical flaws in SimpleHelp, Samsung MagicINFO 9 Server, and D-Link DIR-823X routers, all with evidence of active exploitation. The SimpleHelp vulnerabilities (CVE-2024-57726, CVE-2024-57728) have been linked to ransomware campaigns by DragonForce, while Samsung and D-Link flaws are associated with Mirai botnet deployments. Federal agencies must apply patches or discontinue affected appliances by May 8, 2026.","CISA adds 4 actively exploited vulnerabilities to KEV catalog with May 2026 federal deadline.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F04\u002Fcisa-adds-4-exploited-flaws-to-kev-sets.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEgBMgO4j_Nf0B9HdU4WtN1axBdJFNJgV6Xvb8pCk0kooK6_-gNIxfURSqLIJuuzaufzvoXVTkFFg9WfMkyHvu4h_DBQK4QMJ21JYdwWtLem-CSOgTEYFhXazp4aSPJJglbiZel1V5aatqMKFCXk3scw-3UmMzQPrmTn-CbgBBjpLu_i4TBfNyS2kgZSkreW\u002Fs1600\u002Fcisa-kev.jpg","2026-04-25T05:08:00+00:00","2026-04-25T08:00:17.372308+00:00",9,[17,20,23,25,27,30],{"name":18,"type":19},"CISA","vendor",{"name":21,"type":22},"SimpleHelp","product",{"name":24,"type":22},"Samsung MagicINFO 9 Server",{"name":26,"type":22},"D-Link DIR-823X",{"name":28,"type":29},"DragonForce","threat_actor",{"name":31,"type":32},"Known Exploited Vulnerabilities (KEV) Catalog","technology","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":33,"icon":35,"name":36,"slug":37},null,"Vulnerabilities","vulnerabilities",[39,44,49,54],{"category":40},{"id":41,"icon":35,"name":42,"slug":43},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":45},{"id":46,"icon":35,"name":47,"slug":48},"7d8b5ab8-ea0b-4ced-ae97-ec251b86993a","Ransomware","ransomware",{"category":50},{"id":51,"icon":35,"name":52,"slug":53},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":55},{"id":56,"icon":35,"name":57,"slug":58},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[60,64,67,70,73,75,78],{"type":61,"value":62,"context":63},"cve","CVE-2024-57726","Missing authorization in SimpleHelp allowing privilege escalation (CVSS 9.9)",{"type":61,"value":65,"context":66},"CVE-2024-57728","Path traversal in SimpleHelp enabling arbitrary code execution (CVSS 7.2)",{"type":61,"value":68,"context":69},"CVE-2024-7399","Path traversal in Samsung MagicINFO 9 Server for arbitrary file write (CVSS 8.8)",{"type":61,"value":71,"context":72},"CVE-2025-29635","Command injection in D-Link DIR-823X routers (CVSS 7.5)",{"type":53,"value":28,"context":74},"Ransomware operation exploiting SimpleHelp vulnerabilities",{"type":53,"value":76,"context":77},"Mirai","Botnet deployed via Samsung MagicINFO and D-Link CVE-2024-7399",{"type":53,"value":79,"context":80},"tuxnokill","Mirai botnet variant targeting D-Link DIR-823X devices",[18,21,24],{"controls":83,"vendors":155},[84,113,141],{"slug":85,"name":86,"problem":87,"products":88},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[89,97,105],{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"slug":114,"name":115,"problem":116,"products":117},"patch-management","Automated patch management","Known holes get closed in days, not months.",[118,125,133],{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":114,"product_name":122,"url":123,"description":124},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"slug":142,"name":143,"problem":144,"products":145},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[146,147],{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},{"vendor_slug":148,"vendor_name":149,"vendor_logo":150,"product_slug":151,"product_name":152,"url":153,"description":154},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",[156,162],{"slug":157,"name":158,"logo_path":159,"roles":160},"akamai","Akamai","\u002Fvendor-logos\u002Fakamai.png",[161],"reported_by",{"slug":163,"name":164,"logo_path":165,"roles":166},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png",[161]]