CISA KEV Catalog Adds 4 Exploited Vulns
CISA Adds Four Actively Exploited Flaws in DD-WRT, Langflow, WordPress
Related Entities
Organizations
Products & Tech
CVE Identifiers
Full Report
Executive Summary
On July 21, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) updated its Known Exploited Vulnerabilities (KEV) catalog, adding four vulnerabilities that are being actively exploited by threat actors. This action mandates that Federal Civilian Executive Branch (FCEB) agencies patch these flaws by a specified deadline. The vulnerabilities affect a range of popular products, including DD-WRT firmware for routers, the Langflow AI application development framework, and the ubiquitous WordPress Core content management system. The inclusion in the KEV catalog serves as a critical alert for all organizations, public and private, to prioritize the remediation of these flaws immediately to prevent compromise.
Vulnerability Details
The four vulnerabilities added to the KEV catalog are:
- CVE-2021-27137: A stack-based buffer overflow vulnerability in DD-WRT. This type of flaw can allow an attacker to execute arbitrary code on a vulnerable router, potentially taking full control of the device and the network traffic passing through it.
- CVE-2026-0770: An 'Inclusion of Functionality from Untrusted Control Sphere' vulnerability in Langflow. This suggests a flaw where the application can be tricked into loading and executing code or components from an untrusted source, likely leading to remote code execution (RCE).
- CVE-2026-63030: An interpretation conflict vulnerability in WordPress Core. This type of flaw arises when different components interpret the same data in conflicting ways, which can lead to security bypasses or other unexpected behavior.
- CVE-2026-60137: A SQL injection vulnerability in WordPress Core. A classic and dangerous vulnerability, SQL injection allows an attacker to interfere with the queries that an application makes to its database, potentially leading to data theft, modification, or deletion.
Affected Systems
- DD-WRT: Various versions of the open-source firmware for wireless routers are affected by
CVE-2021-27137. - Langflow: Versions of the Langflow UI for LangChain are affected by
CVE-2026-0770. - WordPress Core: Versions of the core WordPress software are affected by
CVE-2026-63030andCVE-2026-60137.
Exploitation Status
CISA has confirmed that all four of these vulnerabilities are being actively exploited in the wild. This means that threat actors have developed working exploits and are using them in real-world attacks. The urgency for patching is therefore critical. Under Binding Operational Directive (BOD) 22-01, federal agencies must remediate these flaws, but the advisory serves as a strong recommendation for all organizations.
Impact Assessment
Exploitation of these vulnerabilities can have severe consequences. A compromised DD-WRT router could lead to man-in-the-middle attacks, traffic interception, and a pivot point into the internal network. A successful attack on Langflow could lead to the compromise of the application server and any sensitive data it processes. For WordPress, which powers a vast percentage of the web, these flaws could lead to website defacement, malware distribution, and the theft of user data on a massive scale. The SQL injection flaw (CVE-2026-60137) is particularly dangerous as it could allow attackers to extract entire databases of sensitive information.
Cyber Observables — Hunting Hints
The following patterns may help identify vulnerable or compromised systems:
wp-admin/ with SQL injection payloadsCVE-2026-60137, attackers may target admin-area URLs with malicious SQL queries.CVE-2026-0770, exploit attempts may involve URLs with paths to external or untrusted resources.CVE-2021-27137, a compromised DD-WRT router may initiate a C2 connection.Detection Methods
- Vulnerability Scanning: Use a vulnerability scanner to actively scan your perimeter and internal networks for instances of DD-WRT, Langflow, and WordPress, and check for the specific vulnerable versions.
- Web Application Firewall (WAF): Deploy a WAF with rulesets designed to detect and block SQL injection and other web-based attack patterns. This can provide a layer of protection if patching is delayed (D3-ITF: Inbound Traffic Filtering).
- Log Analysis: Monitor web server and application logs for error messages or suspicious requests that could indicate exploitation attempts. For WordPress, monitor for unexpected new admin account creations or plugin installations (D3-FA: File Analysis).
Remediation Steps
- Identify Affected Assets: Immediately conduct an inventory of all assets to identify any systems running vulnerable versions of DD-WRT, Langflow, or WordPress Core.
- Apply Patches: The primary remediation is to update to a patched version of the software as provided by the vendors. This is the most effective way to eliminate the risk.
- Implement Workarounds: If patching is not immediately possible, review vendor advisories for any temporary workarounds or mitigation guidance. For the web-based flaws, this may involve deploying stricter WAF rules or temporarily disabling the affected functionality.
- Verify Remediation: After applying patches or workarounds, re-scan the assets to confirm that they are no longer vulnerable.
Timeline of Events
MITRE ATT&CK Mitigations
The primary mitigation is to apply the security patches provided by the respective vendors immediately.
Mapped D3FEND Techniques:
Use a Web Application Firewall (WAF) to provide a virtual patch by blocking common exploit patterns like SQL injection.
Mapped D3FEND Techniques:
For WordPress, use file integrity monitoring to detect unauthorized changes to core files, themes, or plugins.
Mapped D3FEND Techniques:
Timeline of Events
CISA adds four actively exploited vulnerabilities to its KEV catalog.
Sources & References
Article Author
Jason Gomes
• Cybersecurity PractitionerCybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.
Editorial Standards & Analyst Review
CyberNetSec.io uses automation to assist source monitoring, deduplication, observable extraction, and structured intelligence generation. Published analysis follows human-defined editorial standards and adds defensive context including MITRE ATT&CK, D3FEND, STIX, and Sigma where applicable. Read our editorial policy.
Tags
📢 Share This Article
Help others stay informed about cybersecurity threats
🎯 MITRE ATT&CK Mapped
Every tactic, technique, and sub-technique used in this threat has been identified and mapped to the MITRE ATT&CK framework for consistent, actionable threat language.
🧠 Enriched & Analyzed
Observables and indicators of compromise (IOCs) have been extracted and cataloged. Risk has been assessed and correlated with known threat actors and historical campaigns.
🛡️ Actionable Guidance
Detection rules, incident response steps, and D3FEND-aligned mitigation strategies are included so your team can act on this intelligence immediately.
🔗 STIX Visualizer
Structured threat data is packaged as a STIX 2.1 bundle and can be visualized as an interactive graph — relationships between actors, malware, techniques, and indicators.
⚡ Sigma Generator
Sigma detection rules are derived from the threat techniques in this article and can be converted for deployment across any major SIEM or EDR platform.