CISA Adds Three Actively Exploited Vulnerabilities to KEV Catalog

The Cybersecurity and Infrastructure Security Agency (CISA) has added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, indicating active exploitation. These include Fortinet FortiSandbox OS Command Injection vulnerabilities (CVE-2026-25089, CVE-2026-39808) and a Microsoft SharePoint Deserialization of Untrusted Data Vulnerability (CVE-2026-58644). CISA urges organizations to prioritize remediation of these high-risk vulnerabilities.