CISA

Johnson Controls EasyIO FG

A vulnerability exists in EasyIO FG relating to an attacker gaining unauthorized access to the system through hard-coded credentials and improper privilege management, potentially resulting in full ...
CISA

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-88779 Citrix NetScaler Improper Restriction of Operations ...
cisa

CISA Adds Two Known Exploited Vulnerabilities to Catalog

These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise. Binding Operational Directive (BOD) 26-04: Prioritizing ...
cisa

MikroTik RouterOS

The web management service in affected RouterOS versions contains an integer underflow in its HTTP request body handling that is reachable before authentication. This can be leveraged by an ...
cisa

CISA Whitepaper Charts Path to Establishing and Maturing CVE Program Quality

New Framework Defines Quality, Explains Strategy Alignment, Establishes Roadmap, and Provides Measurements to Success ...
cisa

Considerations for Critical Infrastructure Operators Working With Third-Party ICS Integrators

The Federal Bureau of Investigation (FBI) and Cybersecurity and Infrastructure Security Agency (CISA)—hereafter referred to as the “authoring agencies”—have published this fact sheet to highlight ...
cisa

Siemens Siveillance Control

A vulnerability has been identified in the Open Interface Services (OIS) web module affecting Siveillance Control and Siveillance Control Pro (versions OIS 3.x.y and OIS 4.x.y) . This vulnerability ...
cisa

Schneider Electric PowerChute Serial Shutdown

Schneider Electric is aware of vulnerabilities in its PowerChute Serial Shutdown product. The PowerChute Serial Shutdown product is a UPS management software enabling graceful system shutdown and ...
cisa

New CISA Guidance Helps Critical Infrastructure Detect, Observe and Impede Malicious Cyber Activity

Provides Practical Approaches to Implementing Cyber Decoy Strategies Aligned to MITRE Engage and ATT&CK Frameworks ...
cisa

Protecting Tokens and Assertions from Forgery, Theft, and Misuse: Implementation Recommendations for Agencies and Cloud Service Providers

Developed by the National Institute of Standards and Technology (NIST) and CISA, this interagency report provides federal agencies and cloud service providers with guidelines to protect the identity ...
cisa

CareCam CM2507

v3 7.5 CareCam CareCam CM2507 Missing Authentication for Critical Function, Empty Password in Configuration File, Inclusion of Functionality from Untrusted Control Sphere, Use of Password Hash With ...