CISA expands KEV list with critical flaws in Cisco, Google Chromium, Fortinet and Citrix NetScaler

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has announced the latest update to its Known Exploited Vulnerabilities (KEV) catalog, adding four high‑profile flaws affecting Cisco networking gear, the Google Chromium V8 JavaScript engine, Fortinet security appliances and Citrix NetScaler application‑delivery controllers.

The KEV catalog, a central component of the federal government’s push to improve cyber‑resilience, was created under Executive Order 14028 to give organizations a clear, prioritized list of vulnerabilities that are confirmed to be under active exploitation. By flagging these weaknesses, CISA aims to help both public‑sector and private‑sector entities focus limited resources on the most urgent patching tasks.

The newly listed Cisco vulnerabilities pertain to core routing and switching platforms that manage traffic for enterprises and service providers, and they are believed to enable remote code execution if successfully leveraged. Google’s Chromium V8 engine, which powers the Chrome browser and many Chromium‑based applications, contains a flaw that could allow malicious web content to execute arbitrary code on a victim’s machine. Fortinet’s addition relates to its firewall and VPN products, while the Citrix NetScaler entry involves the load‑balancing and reverse‑proxy functionality used by many corporate web services.

Inclusion in the KEV catalog signals that these flaws are not merely theoretical; threat actors have already been observed exploiting them in the wild. This designation typically triggers a heightened response from security teams, as the risk of widespread compromise rises when attackers have reliable tools or scripts targeting the same weaknesses.

Cyber‑defenders are being urged to prioritize the deployment of vendor‑supplied patches or, where immediate remediation is not possible, to apply mitigations such as disabling vulnerable features, enforcing network segmentation, and increasing monitoring of relevant logs for signs of exploitation.

CISA’s ongoing collaboration with software vendors, the Federal Bureau of Investigation and other partners ensures that the KEV list reflects the most current intelligence on active threats. The agency updates the catalog on a regular cadence, and each addition is accompanied by technical advisories that detail remediation steps and recommended detection methods.

The latest entries underscore the relentless pressure on IT and security teams to stay ahead of a rapidly evolving threat landscape. As more critical infrastructure and everyday business applications rely on complex software stacks, the importance of timely vulnerability management—guided by resources like CISA’s KEV catalog—continues to grow.