CISA KEV Catalog Expands with Critical Flaws in Hikvision, Rockwell, Cisco SD-WAN

The cybersecurity landscape faces renewed pressure as the U.S. government's cybersecurity agency confirms active exploitation of several critical vulnerabilities spanning enterprise networking and industrial control systems. The Cybersecurity and Infrastructure Security Agency (CISA) has formally added these flaws to its Known Exploited Vulnerabilities (KEV) catalog, a move that mandates immediate action for federal civilian agencies and serves as a stark warning for the private sector and critical infrastructure operators worldwide.

Critical Flaws in OT and Physical Security Systems

Among the most severe additions are two vulnerabilities carrying a maximum CVSS v3.1 score of 9.8 (Critical). The first, tracked as CVE-2026-XXXX (details pending final publication), affects certain Hikvision video management systems. Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary code on affected devices, potentially compromising physical security surveillance networks. Given Hikvision's global deployment in sensitive facilities, this flaw represents a significant cross-over threat where a digital breach can lead to physical security failures.

The second CVSS 9.8 flaw, identified as CVE-2026-YYYY, impacts Rockwell Automation's programmable logic controllers (PLCs), specifically certain ControlLogix and CompactLogix models. These devices are the workhorses of industrial automation, controlling machinery in manufacturing, energy, and water treatment facilities. Exploitation could enable an attacker to disrupt industrial processes, manipulate sensor readings, or cause physical damage. The inclusion of an OT vulnerability in the KEV catalog underscores the escalating trend of threat actors targeting the operational technology layer.

Cisco SD-WAN Manager Under Active Attack

Separately, Cisco has confirmed active exploitation of two high-severity vulnerabilities in its Catalyst SD-WAN Manager software. While CVE identifiers are forthcoming, Cisco's advisory indicates these flaws could allow an authenticated remote attacker to perform command injection attacks or access sensitive information. The Catalyst SD-WAN Manager is a central nervous system for software-defined wide area networks, managing policy, configuration, and analytics for distributed enterprise branches. A compromise at this management layer could enable an attacker to reroute or intercept traffic across an organization's entire WAN infrastructure.

CISA has added these Cisco vulnerabilities to the KEV catalog, requiring federal agencies to apply patches by a specified deadline—typically within three weeks for critical flaws. Cisco has released software updates addressing these issues and recommends customers upgrade immediately, emphasizing that workarounds are not available.

The KEV Catalog: A Mandate and a Barometer

CISA's KEV catalog is more than just a list; it is tied to Binding Operational Directive (BOD) 22-01, which requires federal civilian executive branch agencies to remediate listed vulnerabilities on a strict timeline. For the private sector, the catalog acts as a high-fidelity signal, curating the vulnerabilities that are not just theoretically dangerous but are confirmed to be in active use by adversaries. The simultaneous addition of flaws in disparate systems—physical security, industrial control, and enterprise networking—suggests a broad targeting campaign or the work of multiple threat groups exploiting newly public weaknesses.

The Expanding Challenge of Vulnerability Management

The rapid weaponization of these vulnerabilities highlights the immense pressure on security teams to identify, prioritize, and patch flaws before attackers can leverage them. This challenge is compounded by sprawling hybrid IT/OT environments and complex software supply chains. In response, managed security service providers (MSSPs) and managed service providers (MSPs) are scaling their capabilities to assist organizations. For instance, firms like LevelBlue are integrating advanced vulnerability management platforms, such as Tenable's solutions, into their service offerings. This enables MSSPs to provide continuous exposure assessment, contextual risk prioritization (tying vulnerabilities to specific business assets), and streamlined remediation workflows for their clients.

Actionable Guidance for Security Teams

1. Immediate Inventory and Assessment: Organizations must immediately inventory their estates for affected Hikvision, Rockwell Automation, and Cisco Catalyst SD-WAN Manager products. This includes both internet-facing and internal systems, as attackers often pivot from initial access points.
2. Prioritize Patching: Apply vendor-provided patches or updates immediately. For federal agencies, this is a mandate. For all others, it should be treated as a critical priority. If immediate patching is impossible, implement recommended mitigations or network segmentation to reduce attack surface.
3. OT/IT Convergence Security: The Rockwell flaw is a potent reminder for organizations with industrial assets. Security teams must collaborate with OT engineers to ensure critical control systems are included in vulnerability management programs, with patching schedules adapted for operational downtime requirements.
4. Leverage Threat Intelligence: The KEV catalog is a primary source. Subscribe to CISA alerts and vendor advisories. Consider engaging with MSSPs that can provide curated intelligence and managed remediation services, especially for complex environments.
5. Assume Compromise and Hunt: Given confirmed exploitation, organizations using these systems should proactively hunt for indicators of compromise (IOCs) within their networks, checking for anomalous authentication attempts, unexpected processes, or unusual network connections from management systems.

The expansion of the KEV catalog with these critical flaws is a clear call to action. It reflects a reality where the window between vulnerability disclosure and active exploitation is vanishingly small. In this environment, a proactive, intelligence-driven, and well-resourced vulnerability management strategy is not just best practice—it is a fundamental requirement for operational resilience.