When federal cybersecurity authorities add a vulnerability to their official list of actively exploited flaws, it is not bureaucratic housekeeping — it is a warning shot. The Cybersecurity and Infrastructure Security Agency has expanded its Known Exploited Vulnerabilities Catalog with two new entries that security teams across every sector should take seriously, and immediately.
What Was Just Added — and Why It Matters
The two newly catalogued vulnerabilities span distinctly different technology stacks, signaling that threat actors are casting a wide net across both enterprise networking infrastructure and widely deployed web hosting platforms.
Cisco Catalyst SD-WAN Manager: Path Traversal Under Fire
The first addition involves a directory traversal flaw in Cisco's Catalyst SD-WAN Manager platform. Path traversal vulnerabilities allow malicious actors to navigate outside restricted directories and access sensitive files on the underlying operating system — credentials, configuration data, private keys, or anything else that should remain locked behind application boundaries. In software-defined WAN environments, where SD-WAN controllers sit at the heart of distributed network architectures, a successful exploit can expose far more than a single server. It can hand attackers lateral movement opportunities across an entire organization's network fabric.
LiteSpeed cPanel Plugin: The Symlink Trap
The second vulnerability resides in the LiteSpeed cPanel Plugin and involves a UNIX symbolic link — or symlink — following flaw. This class of vulnerability exploits the operating system's file linking mechanism: by convincing a privileged process to follow a symlink to an unintended target, an attacker can read, write, or overwrite files they should never be able to touch. In shared hosting environments — precisely where cPanel is ubiquitous — this can mean one malicious tenant breaking out of their isolated environment and accessing data belonging to other users or the host system itself. The blast radius in high-density hosting scenarios is significant.
The Regulatory Weight Behind This Announcement
CISA's KEV Catalog does not exist in a vacuum. Binding Operational Directive 26-04 — which updates the earlier BOD 22-01 framework — establishes enforceable remediation requirements for all Federal Civilian Executive Branch agencies. Under this directive, agencies must prioritize rapid patching for high-risk KEV entries that involve publicly exposed assets capable of granting full system control post-exploitation. Critically, the directive also requires agencies to assess whether systems were compromised before a patch was applied — a recognition that patching alone is insufficient if an attacker already has a foothold.
Patching a vulnerability closes the door. Determining whether someone walked through it first is what separates reactive security from mature incident response.
While BOD 26-04 carries legal weight only for federal agencies, its underlying logic is universal. Any organization treating KEV additions as a federal-only concern is misreading the threat landscape. The catalog reflects real-world exploitation evidence — these are not theoretical risks, they are documented attack vectors in use right now.
The Broader Pattern: Diverse Targets, Persistent Pressure
The pairing of a network management platform vulnerability with a web hosting plugin flaw is instructive. It underscores that sophisticated threat actors — whether financially motivated criminal groups or state-affiliated operators — maintain active toolkits that target across technology layers simultaneously. SD-WAN infrastructure is attractive for its network-wide access; cPanel environments are attractive for their scale and the volume of sensitive data flowing through them. Security teams cannot afford narrow patch prioritization strategies that focus only on their primary enterprise stack while ignoring ancillary systems.
Organizations running Cisco Catalyst SD-WAN Manager should treat this as an emergency patch event and immediately audit whether the platform is exposed to untrusted networks. Those operating LiteSpeed-powered hosting environments — or using managed hosting services built on cPanel — need to pressure their vendors for patch confirmation and review file access logs for anomalous symlink activity.
What You Should Do
The Takeaway for Security Leadership
CISA's continuous expansion of the KEV Catalog is one of the most operationally useful threat intelligence signals available to security teams at no cost. Two new entries in a single release cycle — spanning enterprise networking and web hosting infrastructure — reinforces that the vulnerability exploitation landscape is relentless and varied. Organizations that align their remediation cadence with KEV additions are not simply following regulatory guidance; they are making a data-driven decision to focus limited security resources where real-world attackers are already operating. In a threat environment defined by speed, that alignment is not optional — it is a strategic imperative.
