CISA KEV Catalog Adds 4 Exploited Vulns

Originally published on CyberNetSec.

Executive Summary

On July 21, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) updated its Known Exploited Vulnerabilities (KEV) catalog, adding four vulnerabilities that are being actively exploited by threat actors. This action mandates that Federal Civilian Executive Branch (FCEB) agencies patch these flaws by a specified deadline. The vulnerabilities affect a range of popular products, including DD-WRT firmware for routers, the Langflow AI application development framework, and the ubiquitous WordPress Core content management system. The inclusion in the KEV catalog serves as a critical alert for all organizations, public and private, to prioritize the remediation of these flaws immediately to prevent compromise.

Vulnerability Details

The four vulnerabilities added to the KEV catalog are:

• CVE-2021-27137: A stack-based buffer overflow vulnerability in DD-WRT. This type of flaw can allow an attacker to execute arbitrary code on a vulnerable router, potentially taking full control of the device and the network traffic passing through it.
• CVE-2026-0770: An 'Inclusion of Functionality from Untrusted Control Sphere' vulnerability in Langflow. This suggests a flaw where the application can be tricked into loading and executing code or components from an untrusted source, likely leading to remote code execution (RCE).
• CVE-2026-63030: An interpretation conflict vulnerability in WordPress Core. This type of flaw arises when different components interpret the same data in conflicting ways, which can lead to security bypasses or other unexpected behavior.
• CVE-2026-60137: A SQL injection vulnerability in WordPress Core. A classic and dangerous vulnerability, SQL injection allows an attacker to interfere with the queries that an application makes to its database, potentially leading to data theft, modification, or deletion.

Affected Systems

• DD-WRT: Various versions of the open-source firmware for wireless routers are affected by CVE-2021-27137.
• Langflow: Versions of the Langflow UI for LangChain are affected by CVE-2026-0770.
• WordPress Core: Versions of the core WordPress software are affected by CVE-2026-63030 and CVE-2026-60137.

Exploitation Status

CISA has confirmed that all four of these vulnerabilities are being actively exploited in the wild. This means that threat actors have developed working exploits and are using them in real-world attacks. The urgency for patching is therefore critical. Under Binding Operational Directive (BOD) 22-01, federal agencies must remediate these flaws, but the advisory serves as a strong recommendation for all organizations.

Impact Assessment

Exploitation of these vulnerabilities can have severe consequences. A compromised DD-WRT router could lead to man-in-the-middle attacks, traffic interception, and a pivot point into the internal network. A successful attack on Langflow could lead to the compromise of the application server and any sensitive data it processes. For WordPress, which powers a vast percentage of the web, these flaws could lead to website defacement, malware distribution, and the theft of user data on a massive scale. The SQL injection flaw (CVE-2026-60137) is particularly dangerous as it could allow attackers to extract entire databases of sensitive information.

Cyber Observables — Hunting Hints

The following patterns may help identify vulnerable or compromised systems:
| Type | Value | Description | Context |
|---|---|---|---|
| url_pattern | wp-admin/ with SQL injection payloads | For CVE-2026-60137, attackers may target admin-area URLs with malicious SQL queries. | Web server access logs, WAF logs. |
| url_pattern | Unusual file inclusion parameters in URL | For CVE-2026-0770, exploit attempts may involve URLs with paths to external or untrusted resources. | Web server access logs, WAF logs. |
| network_traffic_pattern | Outbound connections from a router to an unknown IP | For CVE-2021-27137, a compromised DD-WRT router may initiate a C2 connection. | Firewall logs, NetFlow data. |

Detection Methods

• Vulnerability Scanning: Use a vulnerability scanner to actively scan your perimeter and internal networks for instances of DD-WRT, Langflow, and WordPress, and check for the specific vulnerable versions.
• Web Application Firewall (WAF): Deploy a WAF with rulesets designed to detect and block SQL injection and other web-based attack patterns. This can provide a layer of protection if patching is delayed (D3-ITF: Inbound Traffic Filtering).
• Log Analysis: Monitor web server and application logs for error messages or suspicious requests that could indicate exploitation attempts. For WordPress, monitor for unexpected new admin account creations or plugin installations (D3-FA: File Analysis).

Remediation Steps

1. Identify Affected Assets: Immediately conduct an inventory of all assets to identify any systems running vulnerable versions of DD-WRT, Langflow, or WordPress Core.
2. Apply Patches: The primary remediation is to update to a patched version of the software as provided by the vendors. This is the most effective way to eliminate the risk.
3. Implement Workarounds: If patching is not immediately possible, review vendor advisories for any temporary workarounds or mitigation guidance. For the web-based flaws, this may involve deploying stricter WAF rules or temporarily disabling the affected functionality.
4. Verify Remediation: After applying patches or workarounds, re-scan the assets to confirm that they are no longer vulnerable.