CISA Adds Two Actively Exploited Flaws to Its Catalog

On August 20, 2026, CISA listed two more vulnerabilities in its KEV Catalog after finding evidence of active exploitation [1]. The agency directed federal civilian agencies to prioritize fixing two exploited flaws in the TrueConf Server self-hosted communications platform [5]. CISA made similar additions earlier in the week, four on August 18 and one on August 17 [2][3]. Under BOD 26-04, federal civilian executive branch agencies must move quickly on high-risk CVEs in the catalog [1].

Sources

1. cisa.gov · CISA Adds Two Known Exploited Vulnerabilities to Catalog Aug 20, 2026
2. cisa.gov · CISA Adds Four Known Exploited Vulnerabilities to Catalog Aug 18, 2026
3. cisa.gov · CISA Adds One Known Exploited Vulnerability to Catalog Aug 17, 2026
4. cisa.gov · CISA Releases Foundational, Flexible Guidance to Help Federal Agencies Implement Effective Logging, Visibility and Operational Standards Aug 20, 2026
5. bleepingcomputer.com · CISA orders feds to patch actively exploited TrueConf Server flaws Aug 21, 2026
6. axios.com · Trump's higher ed shakeup starts a new semester Aug 21, 2026

This is the neutral brief the press writes once, for everyone, before each reader’s paper adds its own so-what. It links out; it does not republish. 6 articles clustered.

Print your own paper