Organizations Warned of Exploited Cisco, Kentico, Zimbra Vulnerabilities
CISA added eight new vulnerabilities to its KEV catalog, including exploited flaws in Cisco, Kentico, and Zimbra
Run Cisco?
Get an email when a reviewed story names Cisco, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch works
Summary
CISA has expanded its Known Exploited Vulnerabilities (KEV) catalog with eight new flaws. These include a Cisco Catalyst SD-WAN Manager information disclosure bug, Kentico Xperience and Zimbra Collaboration Suite remote code execution (RCE) vulnerabilities, and others in Quest KACE, JetBrains TeamCity, and PaperCut.
Full text
The US cybersecurity agency CISA on Monday expanded its Known Exploited Vulnerabilities (KEV) catalog with eight more flaws, including three that have not previously been flagged as exploited. The most recent of these is CVE-2026-20133, a high-severity information disclosure bug in Cisco Catalyst SD-WAN Manager that was patched in February. Insufficient file system access restrictions could allow an attacker to access the API of an affected system and read information on the underlying operating system. The CVE was disclosed in February alongside CVE-2026-20122 and CVE-2026-20128, two SD-WAN flaws that Cisco flagged as exploited in March. Now, CISA has added all three to the KEV list. The agency also warned that two security defects disclosed last year in Kentico Xperience and Zimbra Collaboration Suite (ZCS), both leading to remote code execution (RCE), have been exploited in attacks. Tracked as CVE-2025-2749, the Kentico bug is described as a path traversal and arbitrary file upload issue that could allow attackers to execute content on the server remotely.Advertisement. Scroll to continue reading. The weakness exists because the Staging Sync Server of Kentico Xperience versions 13.0.178 and prior would upload arbitrary files to path-relative locations. Authentication is required for successful exploitation. In March last year, WatchTowr explained that hackers could chain three flaws in Kentico, including an authenticated RCE issue, to compromise deployments. Two of the weaknesses, tracked as CVE-2025-2746 and CVE-2025-2747, were added to CISA’s KEV catalog in October. The ZCS vulnerability that CISA added to KEV this week is CVE-2025-48700, an XSS bug in the Zimbra Classic UI that can be exploited to execute JavaScript code within the user’s session. Rooted in the insufficient sanitization of HTML content, the flaw can be triggered when the user opens a crafted message in the Classic UI. The other three flaws added to CISA’s KEV on Monday include CVE-2025-32975, a critical Quest KACE issue flagged as potentially exploited last month; CVE-2024-27199, a JetBrains TeamCity weakness exploited for over two years; and CVE-2023-27351, a PaperCut defect exploited since April 2023. CISA urges federal agencies to patch the Cisco and Zimbra vulnerabilities by April 23, and the other four issues by May 4. Related: Hackers Fail to Exploit Flaw in Discontinued TP-Link Routers Related: Recent Apache ActiveMQ Vulnerability Exploited in the Wild Related: Cursor AI Vulnerability Exposed Developer Devices Related: NIST Prioritizes NVD Enrichment for CVEs in CISA KEV, Critical Software Written By Ionut Arghire Ionut Arghire is an international correspondent for SecurityWeek. Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights. More from Ionut Arghire Geordie Raises $30 Million for AI Security and Governance PlatformCarnival Data Breach Exposed 6 Million PeopleNew BTMOB Android Malware Enables Full Device TakeoverCritical FortiClient EMS Vulnerability Exploited in Fresh AttacksGitea Vulnerability Exposed 30,000 Deployments to AttacksGoogle Unveils AI Threat Defense Platform to Fight AI-Powered CyberattacksRevEng.AI Raises $15 Million to Hunt for Flaws and Backdoors in Software BinariesGlassWorm Botnet Disrupted Latest News Russian Spies Are Aggressively Seeking Western Technology as Sanctions Bite, Officials SayExploit Code Published for Critical Flowise RCE VulnerabilityIn Other News: Trump Mobile Data Breach, FIFA World Cup Phishing, CISA Responds to Supply Chain AttacksCharter Communications Data Breach Could Impact Nearly 5 MillionMokN Raises $15 Million for Phish-Back PlatformGogs Zero-Day Exposes Servers to Remote Code ExecutionCalifornia Sues 23andMe, Alleging It Failed to Protect User Data in 2023 BreachChrome 148 Update Patches 151 Vulnerabilities Trending Daily Briefing NewsletterSubscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. Virtual Event: Threat Detection and Incident Response Summit On-Demand Delve into big-picture strategies to reduce attack surfaces, improve patch management, conduct post-incident forensics, and tools and tricks needed in a modern organization. Register Webinar: Third-Party Risk in Practice June 4, 2026 Organizations are investing heavily in third-party risk management, but breaches, delays, and blind spots continue to persist. Join this live webinar as we examine the gap between how organizations think their third-party risk programs are performing and what’s actually happening in practice. Register People on the MoveAnurag Jain has been appointed Senior Vice President of Engineering at CodeHunterCTERA has appointed Tal Sarfaty as Senior Vice President of Cybersecurity.Quantum Secure Encryption has named Michael Massing as Chief Technology Officer.More People On The MoveExpert Insights Raising the Cybersecurity Stakes: Ante up for the Agentic Era CISOs are now facing machine-speed attacks and asking, “How do I agent?” The industry must provide remediation at scale. (Nadir Izrael) Caught Off Guard: Securing AI After It Hits Production As enterprises rush AI projects into production, security teams are increasingly being forced into reactive mode. (Joshua Goldfarb) Cyber Resilience is the New Business Continuity Plan The organizations best prepared to face disruption are those that align security, continuity and risk management around what the business cannot afford to lose. (Steve Durbin) Enhancing Data Center Security Without Sacrificing Performance For AI data centers, where the stakes are the highest and performance constraints are the tightest, security and performance are no longer a zero-sum game. (Nadir Izrael) Is the SOC Obsolete, and We Just Haven’t Admitted It Yet? Many AI-first enterprises have already embraced sovereign architectures for general AI initiatives; cybersecurity—and the SOC—should be next. (Danelle Au) Flipboard Reddit Whatsapp Whatsapp Email
Indicators of Compromise
- cve — CVE-2026-20133
- cve — CVE-2025-2749
- cve — CVE-2025-48700
- cve — CVE-2025-32975
- cve — CVE-2024-27199
- cve — CVE-2023-27351
- cve — CVE-2026-20122
- cve — CVE-2026-20128
- cve — CVE-2025-2746
- cve — CVE-2025-2747