5SEP

A quiet KEV fortnight, then a 2008 bug

2 min read

12:09UTC

CISA's Known Exploited Vulnerabilities catalogue added seven low-profile CVEs between 5 and 14 July, capped by an 18-year-old Cisco IOS flaw.

← Back to Four privileged platforms under live attack Jump to analysis ↓

TechnologyDeveloping

Key takeaway

A quiet KEV fortnight is ambiguous: a genuine exploitation lull or a triage doctrine, not yet separable.

CISA's Known Exploited Vulnerabilities (KEV) catalogue, the US register of flaws confirmed under active exploitation, added seven CVEs between 5 and 14 July, none from a headline enterprise-security vendor⁠¹. Six sit in web software: four Joomla extensions, the AI-app builder Langflow, and Adobe ColdFusion, with no Cisco, Fortinet, Microsoft or Ivanti entry among them. The seventh breaks the pattern: CVE-2008-4128, an 18-year-old cross-site request forgery (CSRF) flaw in Cisco IOS, added on Monday 13 July.

The catalogue stood at 1,638 entries on 14 July, up from 1,585 at the end of April, roughly 53 additions in ten weeks⁠². April alone added 16 in 13 days. CVE-2008-4128 is the oldest KEV entry this beat has tracked, extending the ancient-revival thread that ran through a 17-year-old Office bug in April.

Two readings fit the slowdown, and a single fortnight cannot separate them. Either confirmed active exploitation genuinely eased over the summer, or BOD 26-04, the risk-tiered directive that replaced patch-everything rules in June, is already reshaping what gets listed and how fast. The fortnight-of-triage note two weeks ago raised the same question. KEV feeds patch prioritisation in tools like Qualys, Tenable and Rapid7, so any editorial shift behind the listings propagates into every enterprise treating the feed as ground truth. Ten weeks is too short to credit a doctrine shift, so this stays a hypothesis to watch.

Deep Analysis

In plain English

CISA, the US government's cyber-security agency, keeps a public list called the Known Exploited Vulnerabilities catalogue: software and hardware flaws that criminals are actually using in real attacks, rather than theoretical weaknesses. This fortnight was quiet: only seven new entries, six in ordinary web software. The odd one out was an 18-year-old bug in Cisco's router software, first found in 2008, only now confirmed as being actively exploited, which means some Cisco routers out there are still running software old enough to vote.

Deep Analysis

Root Causes

CISA lists a flaw on the KEV catalogue once there is evidence of active exploitation, not at the point of disclosure. CVE-2008-4128 sat off the catalogue for eighteen years because nobody had evidence it was being exploited in the wild.

Its addition this fortnight means that evidence now exists, most likely against unsupported, end-of-life Cisco IOS devices that were never going to receive the 2008 patch through a normal vendor update cycle.

Source Landscape

This story draws on neutral-leaning sources

Primary parallel: ID:4175's Arista EOS flaw showed CISA adding a legacy network-device vulnerability to KEV years after disclosure with no realistic near-term vendor fix. CVE-2008-4128 takes that pattern to its extreme: a fix has existed since 2008, but any Cisco IOS device still unpatched eighteen years later is unlikely to receive one now, so the deadline falls on network Teams to isolate the device rather than patch it.

Counter-parallel: Most of the KEV catalogue's growth this year has come from CISA acting within weeks of disclosure under BOD 26-04's risk-tiered clock, the opposite pattern of fast-turnaround entries for freshly exploited software, which is where six of this fortnight's seven additions sit.

Sources:CISA

Mentions:CISA →CVE-2008-4128 →Cisco IOS →Known Exploited Vulnerabilities →BOD 26-04 →Adobe ColdFusion →Langflow →JoomShaper SP Page Builder →iCagenda →Balbooa Forms →Ivanti →Arista EOS →Rapid7 →Tenable →Fortinet →Cisco →Microsoft →Joomla →

First Reported In

Update #10 · One operator worked both ransomware brands

CISA· 14 Jul 2026

Read original →

Causes and effects

Caused by

CISA tears up its KEV deadline rules

BOD 26-04's risk-tiered directive from June may be reshaping the pace and selection of this fortnight's KEV additions.

Occurred 10 Jun 2026

Read story →

BOD 26-04, a fortnight of triage

The fortnight-of-triage note two weeks ago raised the same lull-versus-triage question this window's quiet fortnight extends.

Occurred 4 Jul 2026

Read story →

17-year-old Office RCE back on KEV

The 17-year-old Office RCE added to KEV in April is extended by CVE-2008-4128, an 18-year-old Cisco IOS flaw, as the ancient-CVE thread continues.

Occurred 14 Apr 2026

Read story →

This Event

A quiet KEV fortnight, then a 2008 bug

A slow KEV fortnight muddies catalogue velocity as an active-threat gauge, with BOD 26-04 triage a plausible but unproven driver.

Different Perspectives

Hospital Sírio-Libanês

Hospital Sírio-Libanês said a 21 September attack reached a reporting system for its social projects, possibly exposing patients' and staff identity numbers and health information, while its general patient database was untouched. It notified the ANPD and the Polícia Federal and warned of fraud attempts.

The Foschini Group

The Foschini Group told the Johannesburg exchange on 13 October that an attack found on 11 October disrupted IT systems at its TFG London brands, while stores stayed open. It has not identified the attackers or established whether personal data was taken.

FirstVDS

FirstVDS said attackers used a VMmanager 6 flaw to copy customers' passwords, cloud credentials and cryptocurrency wallets from beneath their virtual servers, and told notified customers to assume theft and rotate credentials. ISPsystem's flaw was not fully fixed on 19 October.

ESET

ESET says Russia-aligned UAC-0099 phished a Ukrainian grain logistics firm in July 2025 and apparently passed its access to GRU-linked Sandworm, which wiped the company's data that September. It treats the attackers' use of the Yggdrasil network as a first for a state-aligned actor.

JPCERT/CC

JPCERT/CC issued emergency alert AT-2026-0032 on 14 October as EG Secure Solutions confirmed attacks on the SiteGuard Server Edition flaw. It told operators to save diagnostic data before updating, because the update may erase traces of the attack.

Cyber Security Agency of Singapore

The Cyber Security Agency of Singapore said on 20 October that attackers are exploiting Ivanti Connect Secure, seven days after Ivanti's disclosure, having flagged PAN-OS exploitation on 16 October. It issued a PHP2Shell alert on 21 October, the day the fixes shipped.

Written with AI from Lowdown's published reporting. Not individually reviewed by an editor. Editorial standards.