Two WordPress core flaws, a Langflow code execution risk, and an ageing DD-WRT buffer overflow join CISA’s KEV Catalog as confirmed exploitation targets.
Summary
- CISA has added four vulnerabilities to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation in the wild.
- The four CVEs span DD-WRT networking firmware, the Langflow AI workflow platform, and two separate WordPress core vulnerabilities covering SQL injection and interpretation conflict.
- Binding Operational Directive 26-04 now requires US federal civilian agencies to prioritise rapid remediation of KEV-listed vulnerabilities on publicly exposed assets, particularly those enabling full asset compromise.
- BOD 26-04 also establishes baseline expectations for agencies to determine whether a system was compromised prior to patching.
- CISA encourages all organisations — not only federal agencies — to treat the KEV Catalog as a primary prioritisation signal for vulnerability management programmes.
Four New Entries Join the Catalog
CISA has confirmed the addition of four vulnerabilities to its Known Exploited Vulnerabilities Catalog. The affected products span router firmware, an AI development platform, and one of the world’s most widely deployed content management systems. The four CVEs are: CVE-2021-27137, a stack-based buffer overflow in DD-WRT; CVE-2026-0770, an inclusion of functionality from an untrusted control sphere in Langflow; CVE-2026-63030, a WordPress core interpretation conflict; and CVE-2026-60137, a WordPress core SQL injection flaw. Active exploitation has been confirmed for all four, though the specific threat actors or campaign details are not described in the available source material.
What Each Vulnerability Represents
The DD-WRT entry, CVE-2021-27137, is a stack-based buffer overflow — a class of vulnerability that typically allows an attacker to execute arbitrary code or crash a targeted device. DD-WRT is open-source firmware used across a broad range of consumer and small-business routers, meaning the potential attack surface is diffuse and often unmanaged. The age of this CVE is notable: it was assigned in 2021, suggesting that unpatched DD-WRT deployments remain reachable and are still being actively targeted years after the flaw became public knowledge.
The Langflow entry, CVE-2026-0770, is categorised as an inclusion of functionality from an untrusted control sphere. Langflow is a platform used to build and deploy AI agent workflows, making it an increasingly attractive target as organisations expand their AI tooling footprint. A vulnerability of this type can allow an attacker to introduce and execute unauthorised code or functionality, with the precise technical impact dependent on how an organisation has deployed the product. Security teams that have recently adopted AI development infrastructure should treat this entry with particular attention.
The two WordPress core vulnerabilities — an interpretation conflict and a SQL injection flaw — reflect persistent risk in widely deployed web infrastructure. SQL injection remains one of the most reliable techniques for extracting data or escalating access within a web application. An interpretation conflict vulnerability can allow an attacker to manipulate how an application processes input or requests in ways the developer did not intend. Given the scale of WordPress deployments globally, including in government, healthcare, and financial services, both entries warrant immediate attention from security teams responsible for web properties.
BOD 26-04 Formalises Prioritisation for Federal Agencies
Alongside the catalog update, CISA has referenced Binding Operational Directive 26-04, which establishes formal vulnerability management requirements for US Federal Civilian Executive Branch agencies. The directive requires those agencies to prioritise rapid remediation of KEV-listed vulnerabilities found on publicly exposed assets where exploitation would grant total control of the affected system. It also sets baseline expectations for post-compromise assessment — agencies must determine whether a threat actor gained access before a patch was applied, not simply apply the patch and move on. While BOD 26-04 is binding only on US federal agencies, its logic is sound practice for any organisation managing internet-facing assets.
Relevance Beyond the Federal Perimeter
CISA has explicitly encouraged all organisations to adopt the same risk-based posture the directive demands of federal agencies. The KEV Catalog is a useful signal precisely because inclusion requires a CVE identifier, confirmed evidence of active exploitation, and available mitigation guidance. It removes the guesswork from triage by anchoring prioritisation in observed attacker behaviour rather than theoretical severity scores alone. Organisations that are not already cross-referencing their vulnerability inventory against the KEV Catalog on a regular cycle are leaving a practical and freely available tool unused.
Why it matters
For CISOs, these four additions represent a concrete, evidence-based prioritisation signal. Two of the entries affect WordPress core — software present in a significant proportion of organisational web estates, often managed outside the direct oversight of security teams. The Langflow entry is a reminder that AI infrastructure is not exempt from the same vulnerability lifecycle that governs all software. The DD-WRT entry underscores that ageing, unmanaged network devices continue to be exploited long after disclosure. Collectively, these entries reinforce that attackers are working across every layer of the stack — from perimeter networking gear to content management systems to emerging AI tooling. Boards and risk committees increasingly expect CISOs to demonstrate structured vulnerability prioritisation; a well-maintained KEV-aligned remediation programme provides that evidence.
What to do now
- Cross-reference your current vulnerability inventory against all four new KEV entries and identify any affected assets, with priority given to publicly exposed systems.
- Ensure DD-WRT firmware deployments across your network estate are identified and assessed; where patching is not available or feasible, evaluate whether those devices should remain connected.
- Assess any Langflow deployments within your AI development or operations environment and apply available mitigations or patches.
- Audit WordPress core installations across your web properties and apply the relevant security updates addressing the SQL injection and interpretation conflict vulnerabilities.
- Review your vulnerability management programme to ensure it incorporates the CISA KEV Catalog as a standing prioritisation input, not just an ad-hoc reference.
- For systems that may have been exposed prior to patching, conduct post-compromise assessment to determine whether exploitation occurred before remediation was applied.
- If your organisation is aware of an exploited vulnerability not currently in the KEV Catalog, submit it via CISA’s KEV Nomination Form.
