{"uuid": "9750238f-2f85-4ac2-9b51-e7e030a97f6d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20133", "type": "seen", "source": "https://t.me/CyberDispatch/1348", "content": "CISA Adds 8 Actively Exploited Vulnerabilities to KEV Catalog\n\nThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) urgently added eight zero-day vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog on April 20, 2026, confirming active exploitation across enterprise tools from Cisco, Quest, PaperCut, TeamCity, Kentico, and Zimbra.\n\nKey flaws include three Cisco SD-WAN vulnerabilities\u2014CVE-2026-20127 (authentication bypass), CVE-2022-20775 (privilege escalation), and CVE-2026-20133 (sensitive info exposure)\u2014plus CVE-2025-32975 (CVSS 10.0) in Quest KACE SMA, enabling full user impersonation without credentials.\n\nOthers: CVE-2023-27351 (PaperCut improper auth, CVSS 8.2); CVE-2024-27199 (TeamCity path traversal, CVSS 7.3); CVE-2025-2749 (Kentico path traversal, CVSS 7.2).", "creation_timestamp": "2026-08-29T20:00:17.237664Z"}