CISA Expands KEV List with New Adobe and WSO2 Vulnerabilities

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) announced today that it has added two newly identified security flaws – one affecting Adobe software and another targeting the WSO2 integration platform – to its Known Exploited Vulnerabilities (KEV) catalog.

The KEV catalog is a centralized repository that tracks vulnerabilities confirmed to be actively exploited in the wild. Maintained by CISA, the list is intended to help federal agencies and private‑sector partners prioritize remediation efforts, align patching schedules, and allocate resources toward the most pressing threats.

Adobe products are ubiquitous across both consumer and enterprise environments, ranging from creative suites to document management tools. The vulnerability flagged by CISA could enable an attacker to execute arbitrary code or bypass security controls, underscoring the high‑risk nature of the flaw. Likewise, the WSO2 weakness impacts the open‑source middleware that many organizations rely on for API management, identity federation, and data integration, raising concerns for enterprises that depend on these services for core operations.

By placing the flaws in the KEV catalog, CISA is effectively mandating that affected entities address them without delay. Federal agencies are required to apply patches or implement mitigations within a prescribed timeframe, and the agency has issued guidance urging private organizations to follow suit. The move reflects a broader strategy to reduce the window of exposure for vulnerabilities that have already proven their exploitability.

Analysts expect the KEV list to continue growing as threat actors evolve their tactics and as more software vendors disclose critical issues. CISA’s collaboration with vendors, security researchers, and international partners aims to streamline the identification and disclosure process, helping stakeholders stay ahead of emerging threats. Organizations are advised to regularly consult the KEV catalog, verify their exposure, and integrate the latest remediation steps into their broader cyber‑risk management programs.