CISA expands KEV list, flagging critical Windows, N‑able and Adobe flaws

The Cybersecurity and Infrastructure Security Agency (CISA) announced on Tuesday that it has added three newly identified security weaknesses to its Known Exploited Vulnerabilities (KEV) catalog. The entries cover a flaw in Microsoft Windows, a vulnerability in the N‑able N‑central remote‑management suite, and an issue affecting Adobe software, all of which are reported to be actively exploited by threat actors.

The KEV catalog, established under an executive order in 2021, serves as a centralized inventory of vulnerabilities that have been observed in the wild and pose a heightened risk to U.S. federal networks and critical infrastructure. By publishing the list, CISA aims to give agencies and private‑sector partners a clear prioritization signal for patching and mitigation.

The Windows vulnerability, which impacts multiple supported versions of the operating system, is believed to enable remote code execution when a specially crafted file is processed. Because Windows remains the most widely deployed desktop and server platform in the United States, exploitation of this flaw could provide attackers with a foothold across a broad range of environments.

N‑able’s N‑central product is a popular remote‑monitoring and management (RMM) tool used by managed‑service providers to administer client networks. The newly cataloged flaw could allow an unauthenticated adversary to bypass authentication and execute commands on the management console, potentially granting control over any devices under the RMM’s oversight.

Adobe’s entry relates to a vulnerability in one of its flagship applications, which researchers say can be triggered through malicious documents. Successful exploitation may lead to arbitrary code execution on the victim’s machine, a scenario that aligns with the long‑standing targeting of Adobe products by ransomware groups and other cybercriminals.

CISA’s advisory urges organizations to apply vendor‑supplied patches without delay and to employ compensating controls such as network segmentation, intrusion‑detection signatures, and strict application whitelisting where immediate remediation is not feasible. The agency also recommends increased monitoring for indicators of compromise linked to the three vulnerabilities.

The addition of these flaws reflects a broader trend of adversaries rapidly weaponizing publicly disclosed bugs, underscoring the importance of coordinated vulnerability disclosure and timely patch distribution. Federal agencies are required to report remediation status to CISA, while the agency’s public list helps private entities align their security roadmaps with the most pressing threats.

CISA indicated that the KEV catalog will continue to be updated as new exploited weaknesses emerge. Stakeholders are advised to review the agency’s guidance regularly, incorporate the catalog into vulnerability‑management workflows, and stay alert for future bulletins that may expand the list of critical, actively exploited vulnerabilities.