CISA Flags Actively Exploited Vulnerabilities in Cisco, Kentico, PaperCut, Synacor, Quest, and JetBrains Products

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has expanded its Known Exploited Vulnerabilities (KEV) Catalog to include a new set of security flaws affecting widely used networking, enterprise management, content management, printing, and collaboration platforms from Cisco, Kentico, PaperCut, Synacor, Quest, and JetBrains.

The KEV Catalog is reserved for vulnerabilities that CISA has confirmed are being actively exploited in the wild, signaling elevated risk and the need for immediate remediation particularly across federal environments and critical infrastructure sectors.

Newly Added Vulnerabilities

The following weaknesses were recently added to the catalog:

• CVE‑2026‑20133 – Cisco Catalyst SD‑WAN Manager
  Exposure of Sensitive Information to an Unauthorized Actor

• CVE‑2023‑27351 – PaperCut NG/MF
  Improper Authentication Vulnerability

• CVE‑2024‑27199 – JetBrains TeamCity
  Relative Path Traversal Vulnerability

• CVE‑2025‑2749 – Kentico Xperience
  Path Traversal Vulnerability

• CVE‑2025‑32975 – Quest KACE Systems Management Appliance (SMA)
  Improper Authentication Vulnerability

• CVE‑2025‑48700 – Synacor Zimbra Collaboration Suite (ZCS)
  Cross‑Site Scripting (XSS) Vulnerability

• CVE‑2026‑20122 – Cisco Catalyst SD‑WAN Manager
  Incorrect Use of Privileged APIs

• CVE‑2026‑20128 – Cisco Catalyst SD‑WAN Manager
  Storing Passwords in a Recoverable Format

Active Exploitation and Threat Actor Use

Several of these vulnerabilities are far more than theoretical weaknesses. They have already been leveraged in real‑world attacks, frequently serving as initial access vectors for ransomware operators, cybercriminal groups, and state‑linked threat actors.

A prominent example is CVE‑2023‑27351, the improper authentication flaw in PaperCut NG/MF. In 2023, this vulnerability was heavily exploited by ransomware groups including Clop and LockBit, who used it to gain unauthenticated access to vulnerable print servers. Once inside, the attackers deployed payloads, harvested credentials, and moved laterally across enterprise networks.

Similarly, CVE‑2024‑27199 affecting JetBrains TeamCity was rapidly weaponized following public disclosure. Threat actors exploited the path traversal issue to access sensitive files, extract secrets from configuration directories, and in some cases implant persistent backdoors on CI/CD servers posing a serious risk to software supply chains.

The Quest KACE SMA flaw (CVE‑2025‑32975) has also been observed in opportunistic attack campaigns. By bypassing authentication controls, attackers can obtain administrative access to device‑management infrastructure, opening the door to distributed malware deployment and abuse of endpoint management capabilities.

In the email and collaboration space, CVE‑2025‑48700 impacting Zimbra Collaboration Suite (ZCS) has been linked to exploitation activity involving cross‑site scripting payloads. These campaigns often aim to hijack user sessions, capture authentication tokens, or steal credentials from targeted organizations.

Cisco Catalyst SD‑WAN Manager Risks

The most recent entries CVE‑2026‑20133, CVE‑2026‑20122, and CVE‑2026‑20128 affect Cisco Catalyst SD‑WAN Manager, a critical management platform used to administer enterprise and service‑provider networks. While widespread exploitation campaigns have not yet been publicly documented, the vulnerabilities pose high exploitation potential, given their ability to expose sensitive data, misuse privileged APIs, and recover stored passwords.

Historically, vulnerabilities in network management planes especially Cisco products have been quickly adopted by attackers once proof‑of‑concept exploits or offensive write‑ups emerge. As a result, these flaws represent a significant risk if left unpatched.

Kentico Xperience and Web‑Based Risks

The Kentico Xperience path traversal vulnerability (CVE‑2025‑2749) fits a familiar and dangerous pattern. Although confirmed large‑scale exploitation remains limited, path traversal bugs are routinely incorporated into automated scanning and exploitation frameworks, allowing attackers to retrieve sensitive files and escalate their access in web environments shortly after disclosure.

Broader Security Implications

Taken together, the newly added vulnerabilities reflect a consistent and troubling trend: flaws that enable unauthenticated access, path traversal, credential exposure, or privilege escalation are rapidly operationalized by attackers. In many cases, exploitation begins within days or even hours of disclosure, dramatically narrowing the response window for defenders.

These vulnerabilities are commonly abused for:

• Initial access
• Credential harvesting
• Privilege escalation
• Lateral movement
• Persistence across enterprise environments

Required Actions and Deadlines

Under Binding Operational Directive (BOD) 22‑01, all Federal Civilian Executive Branch (FCEB) agencies are required to remediate vulnerabilities listed in the KEV Catalog by CISA‑mandated deadlines.

CISA has directed federal agencies to:

• Remediate most of the newly added vulnerabilities by May 4, 2026
• Address the Cisco Catalyst SD‑WAN Manager and Synacor Zimbra Collaboration Suite flaws earlier, by April 23, 2026

While the directive formally applies to federal agencies, CISA strongly encourages private‑sector organizations to review the KEV Catalog and address listed vulnerabilities within their own environments. Given the history of exploitation, delaying remediation significantly increases the risk of compromise.