[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fg4Lp2CQntUGf86wgsyaNfMynFQuhMOzv2fEm1FTup0Q":3},{"article":4,"iocs":43,"watch_terms":48,"solutions":49,"lesson":135},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":30},"74d4b29a-b097-4de5-a6c8-188f8e1c96e9","CISA Adds One Known Exploited Vulnerability to Catalog","cisa-adds-one-known-exploited-vulnerability-to-catalog-a8ddc2","CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-64849 MLflow Server-Side Request Forgery Vulnerability This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise. Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA’s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied. While BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria. Aware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through CISA’s KEV Nomination Form. Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance.","CISA has added CVE-2026-64849, an MLflow Server-Side Request Forgery vulnerability, to its Known Exploited Vulnerabilities (KEV) Catalog due to evidence of active exploitation. This addition mandates Federal Civilian Executive Branch (FCEB) agencies to prioritize its remediation under Binding Operational Directive (BOD) 26-04, which emphasizes risk-based vulnerability management for publicly exposed assets. CISA encourages all organizations to adopt similar practices.","CISA adds CVE-2026-64849 MLflow SSRF vulnerability to KEV Catalog.","https:\u002F\u002Fwww.cisa.gov\u002Fnews-events\u002Falerts\u002F2026\u002F08\u002F19\u002Fcisa-adds-one-known-exploited-vulnerability-catalog",null,"2026-08-19T12:00:00+00:00","2026-08-19T20:00:22.89267+00:00",8,[17,20,23],{"name":18,"type":19},"MLflow","product",{"name":21,"type":22},"Server-Side Request Forgery","technology",{"name":24,"type":25},"CISA","vendor","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":26,"icon":12,"name":28,"slug":29},"Vulnerabilities","vulnerabilities",[31,36,38],{"category":32},{"id":33,"icon":12,"name":34,"slug":35},"217d3263-c763-41ca-875e-06901f522fe0","NIST","nist",{"category":37},{"id":26,"icon":12,"name":28,"slug":29},{"category":39},{"id":40,"icon":12,"name":41,"slug":42},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[44],{"type":45,"value":46,"context":47},"cve","CVE-2026-64849","MLflow Server-Side Request Forgery Vulnerability added to KEV Catalog",[24,18],{"controls":50,"vendors":134},[51,80,109],{"slug":52,"name":53,"problem":54,"products":55},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[56,64,72],{"vendor_slug":57,"vendor_name":58,"vendor_logo":59,"product_slug":60,"product_name":61,"url":62,"description":63},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"slug":81,"name":82,"problem":83,"products":84},"patch-management","Automated patch management","Known holes get closed in days, not months.",[85,93,101],{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":42,"name":110,"problem":111,"products":112},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[113,121,129],{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":130,"product_name":131,"url":132,"description":133},"agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",[],{"slug":136,"title":137,"body":138,"framework_refs":139,"framework_notes":148},"active-mlflow-ssrf-exploit-highlights-urgent-patch-prioritization-need","Active MLflow SSRF Exploit Highlights Urgent Patch Prioritization Need","CVE-2026-64849, a Server-Side Request Forgery (SSRF) vulnerability in MLflow, has been added to CISA's Known Exploited Vulnerabilities Catalog due to confirmed active exploitation in the wild. SSRF vulnerabilities allow attackers to manipulate a server into making unauthorized internal requests, potentially exposing sensitive internal resources, credentials, or cloud metadata endpoints. The fact that this vulnerability is being actively exploited means organizations that have not patched are at immediate and tangible risk. CISA's KEV Catalog addition underscores the importance of risk-based vulnerability prioritization — especially for internet-facing assets — rather than treating all vulnerabilities with equal urgency. Delayed remediation of known-exploited vulnerabilities significantly increases the probability of a successful breach.",[140,141,142,143,144,145,146,147],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management Planning","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 SC-7: Boundary Protection","NIST CSF ID.RA-1: Asset Vulnerabilities Are Identified and Documented","CISA BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities","OWASP Top 10 A10:2021 – Server-Side Request Forgery (SSRF)",{}]