CISA Cybersecurity Directives & Advisories
Material regulatory developments from Cybersecurity and Infrastructure Security Agency are tracked daily by Cresthaven Analytics. Over the last 90 days, 20 material briefs relevant to professionals operating in the technology, ai & competition sector have been published below. Each brief is sourced directly from the primary regulatory feed, summarized for institutional readers, and scored for materiality.
Recent material activity
A selection of recent published briefs; this is not a complete archive.
CISA adds Fortinet path traversal vulnerability to Known Exploited Vulnerabilities catalog with October 19 federal remediation deadline
CISA added CVE-2025-61624 to its Known Exploited Vulnerabilities catalog on October 16, 2026. The vulnerability is a path traversal flaw affecting FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager, with a federal rem…
Read the full CISA Cybersecurity Directives & Advisories brief →CISA adds BeyondTrust Remote Support authentication bypass flaw to Known Exploited Vulnerabilities catalog with October 19 federal remediation deadline
CISA added CVE-2026-102764, an authentication bypass by spoofing vulnerability in BeyondTrust Remote Support, to its Known Exploited Vulnerabilities catalog on October 16, 2026. The federal remediation deadline is Octobe…
Read the full CISA Cybersecurity Directives & Advisories brief →CISA adds Atlassian multi-product directory-traversal flaw to Known Exploited Vulnerabilities catalog with federal remediation deadline of October 18, 2026
CISA added CVE-2026-21589 to its Known Exploited Vulnerabilities catalog on October 15, 2026, covering eight Atlassian Data Center products. Federal agencies must remediate by October 18, 2026, under Binding Operational …
Read the full CISA Cybersecurity Directives & Advisories brief →CISA adds actively exploited Palo Alto PAN-OS remote code execution flaw to Known Exploited Vulnerabilities Catalog with October 17 remediation deadline
CVE-2026-0322, a remote code execution flaw in the PAN-OS management interface, was published by NIST's National Vulnerability Database on October 14, 2026, affecting PA-Series and VM-Series firewalls and Panorama. CISA …
Read the full CISA Cybersecurity Directives & Advisories brief →CISA adds Ahsay AhsayCBS authentication-bypass flaw to Known Exploited Vulnerabilities catalog with October 17 federal remediation deadline
CISA added CVE-2026-105133, an improper authentication vulnerability in Ahsay AhsayCBS, to its Known Exploited Vulnerabilities catalog on October 14, 2026. The listing carries a federal agency remediation deadline of Oct…
Read the full CISA Cybersecurity Directives & Advisories brief →CISA adds Cisco Secure Email Gateway path traversal flaw to Known Exploited Vulnerabilities catalog with October 17 federal deadline
CISA added CVE-2026-76519, a relative path traversal vulnerability in Cisco Secure Email Gateway, to its Known Exploited Vulnerabilities catalog on October 14, 2026. Active exploitation is confirmed. Federal agencies fac…
Read the full CISA Cybersecurity Directives & Advisories brief →CISA adds Ahsay AhsayCBS command injection flaw to Known Exploited Vulnerabilities catalog with October 17 federal remediation deadline
CISA added CVE-2026-105134, a command injection vulnerability in Ahsay AhsayCBS backup software, to its Known Exploited Vulnerabilities catalog on October 14, 2026. Federal agencies must remediate by October 17, 2026 and…
Read the full CISA Cybersecurity Directives & Advisories brief →CISA adds Microsoft Windows command injection flaw to Known Exploited Vulnerabilities catalog with October 16 federal remediation deadline
CISA added CVE-2026-96951, a command injection vulnerability in Microsoft Windows Shell, to its Known Exploited Vulnerabilities catalog on October 13, 2026. The listing imposes a federal agency remediation deadline of Oc…
Read the full CISA Cybersecurity Directives & Advisories brief →CISA adds Ivanti Connect Secure authentication bypass flaw to Known Exploited Vulnerabilities catalog with federal remediation deadline of October 16 2026
CISA added CVE-2026-104935, an authentication bypass by spoofing vulnerability in Ivanti Connect Secure, to its Known Exploited Vulnerabilities catalog on October 13, 2026. The flaw allows a remote unauthenticated attack…
Read the full CISA Cybersecurity Directives & Advisories brief →CISA adds five-year-old ONLYOFFICE Docs path traversal flaw to Known Exploited Vulnerabilities Catalog with three-day remediation deadline
CISA added CVE-2021-3199 to its Known Exploited Vulnerabilities Catalog on October 8, 2026. The vulnerability is a path traversal flaw in ONLYOFFICE Document Server versions before 5.6.3. Federal civilian executive branc…
Read the full CISA Cybersecurity Directives & Advisories brief →CISA adds Strapi sensitive-information disclosure vulnerability to Known Exploited Vulnerabilities Catalog with three-day remediation deadline
CISA added CVE-2023-22894, a cleartext storage vulnerability in Strapi versions 3.2.1 through 4.7.x, to its Known Exploited Vulnerabilities Catalog on October 8, 2026. Federal civilian agencies and covered entities must …
Read the full CISA Cybersecurity Directives & Advisories brief →CISA adds decade-old Apache Struts command injection flaw to Known Exploited Vulnerabilities catalog under BOD 26-04
CISA added CVE-2016-3081, an Apache Struts command injection vulnerability enabling remote arbitrary code execution, to its Known Exploited Vulnerabilities catalog on October 8, 2026. Federal agencies must remediate by O…
Read the full CISA Cybersecurity Directives & Advisories brief →CISA adds decade-old ISC BIND denial-of-service flaw to Known Exploited Vulnerabilities Catalog with three-day remediation deadline
CISA added CVE-2015-5477, a remotely exploitable denial-of-service vulnerability in ISC BIND 9.x, to its Known Exploited Vulnerabilities Catalog on October 8, 2026. Federal civilian agencies and covered entities face a m…
Read the full CISA Cybersecurity Directives & Advisories brief →CISA adds Citrix NetScaler memory buffer vulnerability to Known Exploited Vulnerabilities catalog with October 7 federal remediation deadline
CISA added CVE-2026-88779, a memory buffer vulnerability in Citrix NetScaler ADC and NetScaler Gateway, to its Known Exploited Vulnerabilities catalog on October 4, 2026. The addition mandates federal civilian agency rem…
Read the full CISA Cybersecurity Directives & Advisories brief →CISA adds Zammad privilege-escalation vulnerability to Known Exploited Vulnerabilities catalog with October 5 federal remediation deadline
CISA added CVE-2026-102490, an improper privilege management vulnerability in Zammad GmbH's Zammad help-desk platform, to its Known Exploited Vulnerabilities catalog on October 2, 2026. Federal agencies must remediate by…
Read the full CISA Cybersecurity Directives & Advisories brief →CISA adds Fortinet FortiMail path traversal flaw to Known Exploited Vulnerabilities catalog with October 4 federal remediation deadline
CISA added CVE-2026-104286, a path traversal and NULL byte neutralization vulnerability in Fortinet FortiMail, to its Known Exploited Vulnerabilities catalog on October 1, 2026. Federal agencies face a remediation deadli…
Read the full CISA Cybersecurity Directives & Advisories brief →CISA adds Cisco Catalyst SD-WAN Manager hex encoding flaw to Known Exploited Vulnerabilities catalog with October 3 federal remediation deadline
CISA added CVE-2026-76504, a hex encoding vulnerability in Cisco Catalyst SD-WAN Manager, to its Known Exploited Vulnerabilities catalog on September 30, 2026. The flaw allows an unauthenticated remote attacker to gain a…
Read the full CISA Cybersecurity Directives & Advisories brief →CISA adds Apple CoreGraphics out-of-bounds write flaw to Known Exploited Vulnerabilities catalog with October 2 federal remediation deadline
CISA added CVE-2026-86950 to its Known Exploited Vulnerabilities catalog on September 29, 2026. The vulnerability is an out-of-bounds write flaw in CoreGraphics affecting Apple iOS, macOS, and iPadOS. Federal agencies mu…
Read the full CISA Cybersecurity Directives & Advisories brief →CISA adds Citrix NetScaler unauthenticated remote code execution flaw to Known Exploited Vulnerabilities catalog
CISA added CVE-2026-88771 to its Known Exploited Vulnerabilities catalog on September 27, 2026. The vulnerability is an improper input validation flaw in Citrix NetScaler ADC and NetScaler Gateway that allows unauthentic…
Read the full CISA Cybersecurity Directives & Advisories brief →CISA adds Citrix NetScaler memory buffer vulnerability to Known Exploited Vulnerabilities catalog with September 30 federal remediation deadline
CISA added CVE-2026-88772, a memory buffer vulnerability in Citrix NetScaler ADC and NetScaler Gateway, to its Known Exploited Vulnerabilities catalog on September 27, 2026. The flaw enables remote code execution or deni…
Read the full CISA Cybersecurity Directives & Advisories brief →
Get every CISA Cybersecurity Directives & Advisories brief delivered the day it lands
From $149/month
Cresthaven Analytics monitors Cybersecurity and Infrastructure Security Agency continuously, applying institutional materiality scoring to every release. Subscribers receive structured briefs via email, portal, and (Professional tier and above) real-time alerts.
View all tiers →