CISA Flags Seven Critical Flaws as Hackers Leverage Reverse Shells and Crypto‑Mining Payloads

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) announced on Wednesday that it has added seven newly‑exploited software flaws to its Known Exploited Vulnerabilities (KEV) catalog, signaling a sharp uptick in active threat activity.

The KEV list is a curated inventory of weaknesses that have been observed in the wild, intended to help federal and private‑sector defenders prioritize patching. Inclusion on the list typically follows verification that threat actors are successfully weaponizing the flaw, often resulting in rapid remediation efforts across the ecosystem.

Among the newly cataloged issues is CVE‑2026‑83548, which carries a perfect CVSS score of 10.0, indicating a critical remote‑code‑execution vulnerability. While the agency has not disclosed the affected product, the severity rating suggests that an unauthenticated attacker could execute arbitrary code without user interaction, a scenario that security teams aim to mitigate immediately.

The other six vulnerabilities, though not named in the release, have been linked to campaigns that drop reverse‑shell connections on compromised hosts. Reverse shells grant attackers a persistent command channel, bypassing typical inbound firewall rules and enabling further lateral movement within networks.

In parallel, the same exploit chains have been observed delivering cryptocurrency‑mining software. Cybercriminal groups increasingly monetize compromised infrastructure by installing miners that harvest digital assets, a tactic that generates revenue while remaining largely under the radar of traditional detection tools.

CISA’s advisory urges organizations to apply vendor patches without delay, to review intrusion‑detection signatures for the identified techniques, and to monitor threat‑intel feeds for indicators of compromise tied to these flaws. As exploitation trends evolve, the agency says it will continue to expand the KEV catalog, providing a transparent signal to the broader security community about which vulnerabilities demand the highest attention.