CISA Adds Two Vulnerabilities to KEV Catalog: What Was Reportedly Exposed & What To Do

On July 10, 2026, CISA published an alert that added two vulnerabilities to its Known Exploited Vulnerabilities catalog. The action was based on evidence of active exploitation in the wild, and it marked the first public authoritative disclosure of confirmed exploitation for CVE-2026-48939 and CVE-2026-56291. Public information does not identify specific organizations or individuals whose data may have been affected. The precise scale of any resulting incidents remains unknown.

Breaking down the breach

CISA added CVE-2026-48939, described as an unrestricted file upload issue in iCagenda, and CVE-2026-56291, an unrestricted file upload issue in Balbooa Forms, to the KEV catalog. The alert cited evidence of active exploitation. No further details on timing, number of affected systems, or specific attack methods have been released beyond the catalog entries themselves.

How a breach like this happens

Vulnerabilities that permit unrestricted file uploads allow an attacker to place arbitrary files on a server. Once present, those files can be executed or used to gain further access. Such issues are typically discovered through public vulnerability disclosure, then confirmed as exploited when defenders or researchers observe malicious traffic or payloads targeting the flaw in production environments. Exploitation often begins with automated scanning for known vulnerable software versions.

Who is CISA Adds Two Vulnerabilities to KEV Catalog?

CISA is the U.S. Cybersecurity and Infrastructure Security Agency, the federal body responsible for publishing authoritative guidance on actively exploited vulnerabilities. Its KEV catalog serves as a reference list that organizations use to prioritize patching. Because the catalog influences defensive actions across both government and private-sector networks, updates to it reflect observed threat activity rather than internal data loss at CISA itself.

The information in question

The facts provided state that data types exposed are not disclosed. Public records do not confirm what information, if any, was accessed through exploitation of the two vulnerabilities. Organizations that operate web applications using the affected components may hold user account details, form submissions, or uploaded content, but the exact contents involved in these exploitation cases remain unconfirmed.

What's at stake

Exploitation of file-upload vulnerabilities can lead to unauthorized access to systems and any data those systems process. For individuals, this may result in exposure of personal information held by the affected applications. For the organizations running the software, the primary consequences are loss of control over servers and the need to investigate and remediate the intrusions.

What to do if you're exposed

Monitor official CISA alerts for further updates on the listed vulnerabilities and apply patches to any systems running the affected software. Review account activity on services that use iCagenda or Balboa Forms components. Readers can run a free exposure scan of their email address against known breach data to check for prior appearances in public records.

AICompiled with AI assistance from public sources and published under our editorial standards.