Skip to content
OriginalSign in
Image: The Hacker News

The Hacker News

CISA Adds Three Exploited Vulnerabilities to KEV Catalog Affecting Citrix and Git

Part of the CISA story · since 26 Aug 2025

Quiet for 59 weekslast report 8 Sep36 articles8 outlets
26 Aug · GBHackers first26 Mar6 Jun17 AugNowThis article2nd of 36
  • Tue 26 Aug, 08:05 UTC. GBHackers, first report. CISA Issues Alert on Citrix Flaws Actively Exploited by Hackers.
  • Tue 26 Aug, 09:19 UTC. The Hacker News, its first report on the story. CISA Adds Three Exploited Vulnerabilities to KEV Catalog Affecting Citrix and Git. This article, 2nd of 36.
  • Tue 26 Aug, 19:15 UTC. BleepingComputer, its first report on the story. CISA warns of actively exploited Git code execution flaw.
  • Tue 26 Aug, 19:27 UTC. SecurityWeek, its first report on the story. Just a moment....
  • Tue 26 Aug, 19:27 UTC. Security Affairs, its first report on the story. U.S. CISA adds Citrix Session Recording, and Git flaws to its Known Exploited Vulnerabilities catalog.
  • Tue 26 Aug, 19:28 UTC. SecurityOnline, its first report on the story. CISA Adds Citrix and Git Flaws to Known Exploited Vulnerabilities Catalog.
  • Tue 26 Aug, 19:29 UTC. GBHackers. CISA Alerts on Git Arbitrary File Write Flaw Actively Exploited.
  • Wed 27 Aug, 09:45 UTC. GBHackers. CISA Issues New ICS Advisories on Critical Vulnerabilities and Exploits.
  • Wed 27 Aug, 12:00 UTC. SecurityWeek. Citrix Patches Exploited NetScaler Zero-Day.
  • Wed 27 Aug, 18:09 UTC. BleepingComputer. Over 28,000 Citrix devices vulnerable to new exploited RCE flaw.
  • Wed 27 Aug, 19:41 UTC. Security Affairs. U.S. CISA adds Citrix NetScaler flaw to its Known Exploited Vulnerabilities catalog.
  • Thu 28 Aug, 06:15 UTC. SecurityOnline. An Espionage System: NSA, CISA, & Partners Expose Chinese APT Groups.
  • Thu 28 Aug, 08:16 UTC. GBHackers. CISA Issues Alert on Citrix NetScaler 0-Day RCE Exploited in the Wild.
  • Thu 28 Aug, 08:16 UTC. GBHackers. CISA Releases Guide to Hunt and Mitigate Chinese State-Sponsored Threats.
  • Thu 28 Aug, 17:00 UTC. Dark Reading, its first report on the story. CISA's New SBOM Guidelines Get Mixed Reviews.
  • Thu 28 Aug, 21:10 UTC. Dark Reading. CISA, FBI, NSA Warn of Chinese 'Global Espionage System'.
  • Fri 29 Aug, 12:30 UTC. DataBreaches, its first report on the story. CISA steps in to help Nevada state government recover from cyberattack.
  • Wed 3 Sep, 01:00 UTC. SecurityOnline. CISA Warns of Critical Flaw in SunPower Solar Inverters (CVE-2025-9696, CVSS 9.6).
  • Wed 3 Sep, 01:01 UTC. SecurityOnline. CISA Flags Two Actively Exploited Vulnerabilities: TP-Link Router Reset Flaw and WhatsApp Zero-Day Chain.
  • Wed 3 Sep, 07:16 UTC. The Hacker News. CISA Adds TP-Link and WhatsApp Flaws to KEV Catalog Amid Active Exploitation.
  • Wed 3 Sep, 09:16 UTC. GBHackers. CISA Alerts on Critical SunPower Vulnerability Allowing Full Device Takeover.
  • Wed 3 Sep, 13:31 UTC. GBHackers. CISA Alerts on TP-Link Authentication Flaw Under Active Exploitation.
  • Wed 3 Sep, 13:31 UTC. Security Affairs. U.S. CISA adds WhatsApp, and TP-link flaws to its Known Exploited Vulnerabilities catalog.
  • Wed 3 Sep, 20:01 UTC. SecurityWeek. US Cybersecurity Agency Flags Wi-Fi Range Extender Vulnerability Under Active Attack.
  • Thu 4 Sep, 02:30 UTC. SecurityOnline. CISA Warns: Actively Exploited TP-Link Router Flaws Added to KEV Catalog.
  • Thu 4 Sep, 08:45 UTC. Security Affairs. U.S. CISA adds TP-Link Archer C7(EU) and TL-WR841N flaws to its Known Exploited Vulnerabilities catalog.
  • Thu 4 Sep, 12:15 UTC. The Hacker News. CISA Flags TP-Link Router Flaws CVE-2023-50224 and CVE-2025-9377 as Actively Exploited.
  • Thu 4 Sep, 20:47 UTC. BleepingComputer. New TP-Link zero-day surfaces as CISA warns other flaws are exploited.
  • Fri 5 Sep, 03:00 UTC. SecurityOnline. CISA Adds Three New Vulnerabilities to Catalog, Urges Immediate Patching.
  • Fri 5 Sep, 11:01 UTC. GBHackers. CISA Issues Alert on Android 0-Day Use-After-Free Vulnerability Under Active Exploitation.
  • Fri 5 Sep, 11:45 UTC. GBHackers. CISA Warns: TP-Link Vulnerabilities Under Active Exploitation.
  • Fri 5 Sep, 12:15 UTC. Security Affairs. U.S. CISA adds Sitecore, Android, and Linux flaws to its Known Exploited Vulnerabilities catalog.
  • Fri 5 Sep, 17:16 UTC. The Hacker News. CISA Orders Immediate Patch of Critical Sitecore Vulnerability Under Active Exploitation.
  • Sun 7 Sep, 11:35 UTC. DataBreaches. CISA orders federal agencies to patch Sitecore zero-day following hacking reports.
  • Mon 8 Sep, 06:15 UTC. GBHackers. CISA Alerts on WhatsApp 0-Day Vulnerability Actively Exploited in Attacks.
  • Mon 8 Sep, 10:35 UTC. DataBreaches. CISA Delays Cyber Incident Reporting Rule for Critical Infrastructure.

The content discusses the addition of three exploited vulnerabilities to the CISA KEV catalog, specifically affecting Citrix and Git. It highlights the importance of addressing these vulnerabilities to enhance cybersecurity measures. The article emphasizes the need for organizations to stay updated on security threats and implement best practices to mitigate risks. Additionally, it features various resources, including webinars and articles, aimed at improving cybersecurity awareness and training.

How the story developed

All 36 articles
Quiet for 59 weekslast report 8 Sep36 articles8 outlets

36 articles from 8 outlets since 26 Aug. Quiet since 8 Sep. This was the 2nd report, 1 hour after the first.

Now26 Aug27302468101223 OctFirst reportGBHackers · 26 Aug, 08:05Picked up againafter 5 days quiet
  • Tue 26 Aug, 08:05 UTC. GBHackers, first report. CISA Issues Alert on Citrix Flaws Actively Exploited by Hackers.
  • Tue 26 Aug, 09:19 UTC. The Hacker News, its first report on the story. CISA Adds Three Exploited Vulnerabilities to KEV Catalog Affecting Citrix and Git. This article, 2nd of 36.
  • Tue 26 Aug, 19:15 UTC. BleepingComputer, its first report on the story. CISA warns of actively exploited Git code execution flaw.
  • Tue 26 Aug, 19:27 UTC. SecurityWeek, its first report on the story. Just a moment....
  • Tue 26 Aug, 19:27 UTC. Security Affairs, its first report on the story. U.S. CISA adds Citrix Session Recording, and Git flaws to its Known Exploited Vulnerabilities catalog.
  • Tue 26 Aug, 19:28 UTC. SecurityOnline, its first report on the story. CISA Adds Citrix and Git Flaws to Known Exploited Vulnerabilities Catalog.
  • Tue 26 Aug, 19:29 UTC. GBHackers. CISA Alerts on Git Arbitrary File Write Flaw Actively Exploited.
  • Wed 27 Aug, 09:45 UTC. GBHackers. CISA Issues New ICS Advisories on Critical Vulnerabilities and Exploits.
  • Wed 27 Aug, 12:00 UTC. SecurityWeek. Citrix Patches Exploited NetScaler Zero-Day.
  • Wed 27 Aug, 18:09 UTC. BleepingComputer. Over 28,000 Citrix devices vulnerable to new exploited RCE flaw.
  • Wed 27 Aug, 19:41 UTC. Security Affairs. U.S. CISA adds Citrix NetScaler flaw to its Known Exploited Vulnerabilities catalog.
  • Thu 28 Aug, 06:15 UTC. SecurityOnline. An Espionage System: NSA, CISA, & Partners Expose Chinese APT Groups.
  • Thu 28 Aug, 08:16 UTC. GBHackers. CISA Issues Alert on Citrix NetScaler 0-Day RCE Exploited in the Wild.
  • Thu 28 Aug, 08:16 UTC. GBHackers. CISA Releases Guide to Hunt and Mitigate Chinese State-Sponsored Threats.
  • Thu 28 Aug, 17:00 UTC. Dark Reading, its first report on the story. CISA's New SBOM Guidelines Get Mixed Reviews.
  • Thu 28 Aug, 21:10 UTC. Dark Reading. CISA, FBI, NSA Warn of Chinese 'Global Espionage System'.
  • Fri 29 Aug, 12:30 UTC. DataBreaches, its first report on the story. CISA steps in to help Nevada state government recover from cyberattack.
  • Wed 3 Sep, 01:00 UTC. SecurityOnline. CISA Warns of Critical Flaw in SunPower Solar Inverters (CVE-2025-9696, CVSS 9.6).
  • Wed 3 Sep, 01:01 UTC. SecurityOnline. CISA Flags Two Actively Exploited Vulnerabilities: TP-Link Router Reset Flaw and WhatsApp Zero-Day Chain.
  • Wed 3 Sep, 07:16 UTC. The Hacker News. CISA Adds TP-Link and WhatsApp Flaws to KEV Catalog Amid Active Exploitation.
  • Wed 3 Sep, 09:16 UTC. GBHackers. CISA Alerts on Critical SunPower Vulnerability Allowing Full Device Takeover.
  • Wed 3 Sep, 13:31 UTC. GBHackers. CISA Alerts on TP-Link Authentication Flaw Under Active Exploitation.
  • Wed 3 Sep, 13:31 UTC. Security Affairs. U.S. CISA adds WhatsApp, and TP-link flaws to its Known Exploited Vulnerabilities catalog.
  • Wed 3 Sep, 20:01 UTC. SecurityWeek. US Cybersecurity Agency Flags Wi-Fi Range Extender Vulnerability Under Active Attack.
  • Thu 4 Sep, 02:30 UTC. SecurityOnline. CISA Warns: Actively Exploited TP-Link Router Flaws Added to KEV Catalog.
  • Thu 4 Sep, 08:45 UTC. Security Affairs. U.S. CISA adds TP-Link Archer C7(EU) and TL-WR841N flaws to its Known Exploited Vulnerabilities catalog.
  • Thu 4 Sep, 12:15 UTC. The Hacker News. CISA Flags TP-Link Router Flaws CVE-2023-50224 and CVE-2025-9377 as Actively Exploited.
  • Thu 4 Sep, 20:47 UTC. BleepingComputer. New TP-Link zero-day surfaces as CISA warns other flaws are exploited.
  • Fri 5 Sep, 03:00 UTC. SecurityOnline. CISA Adds Three New Vulnerabilities to Catalog, Urges Immediate Patching.
  • Fri 5 Sep, 11:01 UTC. GBHackers. CISA Issues Alert on Android 0-Day Use-After-Free Vulnerability Under Active Exploitation.
  • Fri 5 Sep, 11:45 UTC. GBHackers. CISA Warns: TP-Link Vulnerabilities Under Active Exploitation.
  • Fri 5 Sep, 12:15 UTC. Security Affairs. U.S. CISA adds Sitecore, Android, and Linux flaws to its Known Exploited Vulnerabilities catalog.
  • Fri 5 Sep, 17:16 UTC. The Hacker News. CISA Orders Immediate Patch of Critical Sitecore Vulnerability Under Active Exploitation.
  • Sun 7 Sep, 11:35 UTC. DataBreaches. CISA orders federal agencies to patch Sitecore zero-day following hacking reports.
  • Mon 8 Sep, 06:15 UTC. GBHackers. CISA Alerts on WhatsApp 0-Day Vulnerability Actively Exploited in Attacks.
  • Mon 8 Sep, 10:35 UTC. DataBreaches. CISA Delays Cyber Incident Reporting Rule for Critical Infrastructure.
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 36 articles as a list
  1. Tue 26 AugDay 07
    1. CISA Issues Alert on Citrix Flaws Actively Exploited by Hackers08:05 · GBHackers · First report
    2. CISA Adds Three Exploited Vulnerabilities to KEV Catalog Affecting Citrix and Git09:19 · The Hacker News · This article, 2nd of 36
    3. CISA warns of actively exploited Git code execution flaw19:15 · BleepingComputer
    Show 4 more from 26 Aug
    1. Just a moment...19:27 · SecurityWeek
    2. U.S. CISA adds Citrix Session Recording, and Git flaws to its Known Exploited Vulnerabilities catalog19:27 · Security Affairs
    3. CISA Adds Citrix and Git Flaws to Known Exploited Vulnerabilities Catalog19:28 · SecurityOnline
    4. CISA Alerts on Git Arbitrary File Write Flaw Actively Exploited19:29 · GBHackers
  2. Wed 27 AugDay 14
    1. CISA Issues New ICS Advisories on Critical Vulnerabilities and Exploits09:45 · GBHackers
    2. Citrix Patches Exploited NetScaler Zero-Day12:00 · SecurityWeek
    3. Over 28,000 Citrix devices vulnerable to new exploited RCE flaw18:09 · BleepingComputer
    4. U.S. CISA adds Citrix NetScaler flaw to its Known Exploited Vulnerabilities catalog19:41 · Security Affairs
  3. Thu 28 AugDay 25
    1. An Espionage System: NSA, CISA, & Partners Expose Chinese APT Groups06:15 · SecurityOnline
    2. CISA Issues Alert on Citrix NetScaler 0-Day RCE Exploited in the Wild08:16 · GBHackers
    3. CISA Releases Guide to Hunt and Mitigate Chinese State-Sponsored Threats08:16 · GBHackers
    Show 2 more from 28 Aug
    1. CISA's New SBOM Guidelines Get Mixed Reviews17:00 · Dark Reading
    2. CISA, FBI, NSA Warn of Chinese 'Global Espionage System'21:10 · Dark Reading
  4. Fri 29 AugDay 31
    1. CISA steps in to help Nevada state government recover from cyberattack12:30 · DataBreaches

  5. Quiet for 5 days

    Wed 3 SepDay 87
    1. CISA Warns of Critical Flaw in SunPower Solar Inverters (CVE-2025-9696, CVSS 9.6)01:00 · SecurityOnline · Picked up again
    2. CISA Flags Two Actively Exploited Vulnerabilities: TP-Link Router Reset Flaw and WhatsApp Zero-Day Chain01:01 · SecurityOnline
    3. CISA Adds TP-Link and WhatsApp Flaws to KEV Catalog Amid Active Exploitation07:16 · The Hacker News
    Show 4 more from 3 Sep
    1. CISA Alerts on Critical SunPower Vulnerability Allowing Full Device Takeover09:16 · GBHackers
    2. CISA Alerts on TP-Link Authentication Flaw Under Active Exploitation13:31 · GBHackers
    3. U.S. CISA adds WhatsApp, and TP-link flaws to its Known Exploited Vulnerabilities catalog13:31 · Security Affairs
    4. US Cybersecurity Agency Flags Wi-Fi Range Extender Vulnerability Under Active Attack20:01 · SecurityWeek
  6. Thu 4 SepDay 94
    1. CISA Warns: Actively Exploited TP-Link Router Flaws Added to KEV Catalog02:30 · SecurityOnline
    2. U.S. CISA adds TP-Link Archer C7(EU) and TL-WR841N flaws to its Known Exploited Vulnerabilities catalog08:45 · Security Affairs
    3. CISA Flags TP-Link Router Flaws CVE-2023-50224 and CVE-2025-9377 as Actively Exploited12:15 · The Hacker News
    4. New TP-Link zero-day surfaces as CISA warns other flaws are exploited20:47 · BleepingComputer
  7. Fri 5 SepDay 105
    1. CISA Adds Three New Vulnerabilities to Catalog, Urges Immediate Patching03:00 · SecurityOnline
    2. CISA Issues Alert on Android 0-Day Use-After-Free Vulnerability Under Active Exploitation11:01 · GBHackers
    3. CISA Warns: TP-Link Vulnerabilities Under Active Exploitation11:45 · GBHackers
    Show 2 more from 5 Sep
    1. U.S. CISA adds Sitecore, Android, and Linux flaws to its Known Exploited Vulnerabilities catalog12:15 · Security Affairs
    2. CISA Orders Immediate Patch of Critical Sitecore Vulnerability Under Active Exploitation17:16 · The Hacker News

  8. Quiet for 2 days

    Sun 7 SepDay 121
    1. CISA orders federal agencies to patch Sitecore zero-day following hacking reports11:35 · DataBreaches
  9. Mon 8 SepDay 132
    1. CISA Alerts on WhatsApp 0-Day Vulnerability Actively Exploited in Attacks06:15 · GBHackers
    2. CISA Delays Cyber Incident Reporting Rule for Critical Infrastructure10:35 · DataBreaches

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in