CISA Adds 5 KEV Vulnerabilities: Apple, Craft CMS, and Laravel Livewire

CISA’s decision to add five more vulnerabilities to its Known Exploited Vulnerabilities catalog is another reminder that the agency’s exploitation-driven model is now the center of gravity for defensive prioritization. The latest additions span Apple, Craft CMS, and Laravel Livewire, underscoring a familiar but uncomfortable pattern: attackers keep finding value in widely deployed software layers that sit close to browsers, content workflows, and application logic. In practical terms, this is not just another patch notice; it is a signal that these bugs have already crossed the line from theoretical risk to real-world abuse. CISA’s KEV approach exists precisely because this kind of active exploitation demands faster triage than traditional severity scores alone can provide.

Background​

The KEV Catalog was created to solve a basic but painful problem in vulnerability management: organizations were drowning in CVEs but lacked a dependable way to tell which ones were being used in the wild. CISA’s Binding Operational Directive 22-01 turned that idea into an operational mandate for federal civilian agencies, requiring remediation by set deadlines once a vulnerability is placed in the catalog. That distinction matters because KEV entries are not merely “important” weaknesses; they are vulnerabilities with evidence of exploitation, which changes the urgency calculus entirely.
This is why the catalog has become so influential beyond the U.S. federal government. Even though BOD 22-01 formally applies to FCEB agencies, CISA repeatedly urges all organizations to treat KEV as a priority source of truth for patch management. The logic is straightforward: if an attacker is already using a flaw, every day of delay increases the chance that another intrusion will follow. In enterprise security, known exploited is a much sharper alarm than high severity.
The five newly listed CVEs fit the KEV mold unusually well. Two are tied to Apple platform components, two to Craft CMS, and one to Laravel Livewire. Each of those ecosystems sits in a high-leverage part of the modern attack surface: the browser stack, public-facing content management systems, and web application frameworks that can turn a single weakness into remote access or code execution. That mix explains why these entries matter beyond their individual product families. (support.apple.com)
It also reflects a broader trend in 2025 and 2026: attackers increasingly favor flaws that give them reliable footholds rather than flashy exploits. Buffer overflows, code injection, and improper locking bugs remain attractive because they can be chained, repeated, and weaponized across large fleets. The catalogue of exploited issues is not shrinking; it is getting more operationally diverse. (support.apple.com)

Why KEV matters more than raw CVSS​

A high CVSS score does not necessarily mean a vulnerability is being exploited. KEV solves that by prioritizing evidence, not just potential impact. That makes it especially useful for teams with limited patch windows, because it helps separate “eventually important” from “fix now.”

• KEV entries imply active exploitation, not just theoretical risk.
• Federal agencies must remediate KEV items by CISA’s deadline.
• Private-sector teams often use KEV as a patching shortlist.
• The catalog is intentionally dynamic, not static.

The New Additions in Context​

The Apple entries are especially noteworthy because Apple security bugs often have broad blast radius. CVE-2025-31277 is a buffer overflow in Apple multiple products, while CVE-2025-43510 is listed as an improper locking issue and CVE-2025-43520 as a classic buffer overflow vulnerability. Apple’s own security pages show these CVEs appearing in macOS release notes, which confirms they were addressed in product updates before surfacing in CISA’s exploited list. That sequence is increasingly common: patch first, confirm exploitation later. (support.apple.com)
The Craft CMS entry, CVE-2025-32432, is the kind of bug that should trigger immediate attention from any team that runs customer-facing or content-heavy websites. Craft CMS documented the issue as a code injection vulnerability and said it found evidence of exploitation in the wild as early as April 2025. It also recommended updating to fixed versions or, as a temporary stopgap, deploying its security patches library. The key lesson here is that CMS platforms remain attractive because they concentrate power: one flaw can expose content, credentials, and server-side execution paths. (craftcms.com)
The Laravel Livewire issue, CVE-2025-54068, is particularly interesting because it targets a framework layer used by developers to build interactive web interfaces. GitHub’s advisory says the flaw could allow unauthenticated remote command execution in specific scenarios in Livewire v3 up to 3.6.3, and that version 3.6.4 contains the fix. That is a classic example of why frameworks matter so much in modern exploitation: if the plumbing is weak, the applications built on top inherit the risk. (github.com)

The common thread​

Taken together, these five CVEs illustrate a pattern CISA knows well: attackers like vulnerabilities that are both remotely reachable and widely deployed. They also like software that supports automation, because exploitation can be scaled and repeated. That combination is what turns a vulnerability into a campaign.

• Apple bugs can affect a huge consumer and enterprise footprint.
• Craft CMS often powers public web properties.
• Livewire sits in the request-processing path of dynamic web apps.
• Code injection and buffer overflows remain evergreen attacker favorites. (support.apple.com)

Apple’s Security Story Gets Another Chapter​

Apple vulnerabilities tend to draw outsized attention because they straddle consumer and enterprise risk. On the consumer side, they can be exploited through browsing, messaging, or media-handling paths that users never intentionally “install.” On the enterprise side, they can undermine managed fleets that rely on a patching cadence that is often slower than attacker timelines. The presence of multiple Apple CVEs in one KEV update suggests either a single exploitation wave or a broader offensive interest in Apple’s platform surface. (support.apple.com)
Apple’s security release notes show CVE-2025-31277 in macOS Sequoia security content, and Apple’s Sonoma 14.8.2 release notes show CVE-2025-43510 and CVE-2025-43520 as well. That matters because Apple often ships security fixes across multiple OS branches, and the same underlying bug can be relevant to both consumer and managed devices. In other words, the issue is not just “patch your Mac”; it is “patch every supported Apple endpoint with the right build.” (support.apple.com)

Buffer overflows still matter​

The term “buffer overflow” sounds old-school, but it remains highly relevant. Memory corruption bugs still offer attackers opportunities for crash, privilege escalation, or code execution depending on the target and exploit quality. In a world of hardened platforms, the exploit chain may be harder, but the payoff can be extremely high.

• CVE-2025-31277 appears in Apple’s security content.
• CVE-2025-43510 is listed in Apple’s Sonoma 14.8.2 notes.
• CVE-2025-43520 is also listed there as a kernel memory corruption issue.
• Apple’s patch notes confirm the vendor addressed these problems before CISA’s KEV entry. (support.apple.com)

The enterprise implication is subtle but important. Apple fleets are often treated as lower-maintenance than Windows fleets, but that perception can become a blind spot. If a vulnerability is actively exploited in the wild, the security team’s job is not to debate platform popularity; it is to make sure update enforcement, inventory, and compliance reporting are tight enough to catch stragglers. Mobile-first enterprises especially need to remember that Macs and iPads are not exempt from exploitation campaigns.

Craft CMS: A Familiar Web-Stack Trap​

Craft CMS is a reminder that content management systems remain one of the most strategically valuable targets on the internet. They often sit at the boundary between public traffic and authenticated admin workflows, which means a bug in request handling can become a beachhead into the rest of the environment. The vendor’s own advisory says the issue was exploited in the wild and that suspicious requests often targeted the actions/assets/generate-transform endpoint with __class in the body. (craftcms.com)
That kind of detail is valuable because it transforms a generic vulnerability alert into a real detection opportunity. Security teams can hunt for those request patterns, inspect web server logs, and identify whether the site was merely scanned or potentially compromised. Craft’s guidance is blunt for a reason: even after cleanup, automated re-infection can happen quickly if the underlying code remains unpatched. (craftcms.com)

Why CMS exploitation is so effective​

CMS attacks are so popular because they often bypass the need for phishing or credential theft. If the attacker can hit a public endpoint and trigger code execution, they can move directly toward data theft, web shells, or persistence. That is one reason CMS vulnerabilities often show up in ransomware and extortion investigations.

• Craft CMS handles both content and application logic.
• Public endpoints can become direct exploitation surfaces.
• Web logs may reveal probing before full compromise.
• Patch velocity is the most reliable defense. (craftcms.com)

There is also a broader strategic issue here. Many organizations think of CMS software as “just websites,” but those sites often connect to email, identity, analytics, APIs, and backend databases. Once an attacker gets code execution on a CMS host, the compromise can become organizational, not just web-facing. That makes Craft’s remediation guidance relevant well beyond the publishing team. (craftcms.com)

Laravel Livewire and Framework Risk​

Livewire is a different kind of target than a CMS, but the implications are just as serious. Framework vulnerabilities tend to be more dangerous than application-specific bugs because they can affect many downstream apps at once, particularly if developers rely on default behavior. According to GitHub’s advisory, CVE-2025-54068 affects Livewire v3 through 3.6.3 and can allow unauthenticated remote command execution in particular configurations. (github.com)
That description should make every Laravel team sit up. The issue does not require authentication or user interaction, which means the attack surface is not limited to insider misuse or social engineering. If a site exposes the relevant component pattern, the exploit path can be direct. The existence of a fix in v3.6.4 is good news, but it also creates a hard question for developers: how many apps are still running older releases because the framework feels “stable enough”? (github.com)

Frameworks amplify both speed and risk​

Frameworks are designed to make developers faster, but that speed can become liability when security assumptions break. A flaw in hydration logic, request handling, or server-side expression processing can spread across countless deployments faster than many security teams realize. This is the platform tax of modern web development: abstraction helps productivity, but it also concentrates risk.

• Livewire v3 up to 3.6.3 is affected.
• The issue can lead to remote command execution.
• No known workaround is available beyond upgrading.
• The fix is in 3.6.4 or later. (github.com)

The enterprise angle is that application teams need to track framework versions with the same discipline they apply to operating systems. Too often, patch management ends at infrastructure while application dependencies remain under-governed. KEV entries like this expose that blind spot immediately: if the framework is vulnerable and publicly exposed, the business is vulnerable regardless of how clean the server hardening baseline looks. (github.com)

What This Says About Attackers​

The five CVEs in this round are diverse, but the attacker logic is consistent. Modern intrusions often start with a single remotely reachable weakness, then move quickly to persistence or data access. Buffer overflows, code injection, and framework-level command execution all map neatly to that playbook, especially when the target is internet-facing or widely distributed. (support.apple.com)
One reason CISA’s catalog matters so much is that it reveals the market reality of exploitation. Attackers do not care whether a bug is elegant; they care whether it works, whether it is reachable, and whether defenders are slow. The best signal for urgency is not theoretical impact but observed abuse. That is exactly the point of KEV.

Active exploitation changes the response​

Once active exploitation is confirmed, the defensive response changes from “patch when convenient” to “patch immediately, contain if needed, and verify exposure.” That means asset inventories, dependency maps, and logs become just as important as the patch itself. In some cases, the most valuable action is not the update but the hunt for evidence of compromise.

• Prioritize internet-facing systems first.
• Validate whether the vulnerable component is actually deployed.
• Review logs for exploitation indicators and anomalous requests.
• Assume scanning may have begun before public disclosure. (craftcms.com)

This is also where the public-private divide becomes less meaningful. CISA’s mandate is federal, but attackers do not respect sector boundaries. A vulnerability exploited against a university, publisher, SaaS provider, or small business can become a pivot point into larger ecosystems, supply chains, or managed service relationships. That is why KEV updates often ripple far beyond Washington.

Enterprise vs Consumer Impact​

For enterprises, the immediate question is exposure management: which devices, servers, and apps are actually affected, and which business processes depend on them? Apple endpoints often sit inside MDM-controlled fleets, making rapid deployment feasible in theory but uneven in practice. Craft CMS and Livewire, by contrast, depend on application owners and DevOps teams, which means remediation can be delayed if accountability is fuzzy. (support.apple.com)
Consumers face a different kind of risk. They may never know a vulnerability existed until a security update appears, and that is precisely why patch adoption matters so much on Apple devices. End users tend to trust device makers to handle the heavy lifting, but active exploitation means the window of exposure can be short and the consequence serious. Consumers should not view these updates as optional housekeeping. (support.apple.com)

Different remediations, same urgency​

Organizations should treat the same KEV entry differently depending on where it lives. An Apple issue might be handled through MDM rollout and compliance enforcement, while a Craft CMS or Livewire issue might need code deployment, infrastructure validation, and forensic review. The paths differ, but the urgency is the same.

• Endpoint teams should push Apple updates aggressively.
• Web teams should verify Craft CMS patch levels and logs.
• App teams should upgrade Livewire and inventory affected apps.
• Security teams should coordinate evidence review across all three. (support.apple.com)

A second distinction is visibility. Consumer devices may be easier to patch if they are centrally managed, but they are harder to observe in depth. Web apps are the reverse: telemetry is richer, but ownership can be fragmented. That means the most mature organizations will pair patching with hunting, because remediation without validation is only half a defense.

How Security Teams Should Respond​

The right response is not merely to “install updates” but to treat KEV items as operational incidents. First, identify whether any of the affected products are present in the environment. Second, map exposure by internet reachability, privilege level, and business criticality. Third, patch or mitigate immediately, then verify logs and endpoint telemetry for signs of prior exploitation.
It is also worth remembering that vendor guidance can be highly specific. Craft CMS pointed administrators toward log patterns and temporary stopgaps, while Livewire’s advisory emphasizes that there is no known workaround and that upgrading is the only real fix. Apple, by contrast, usually resolves issues through its normal software update channels, which places more emphasis on fleet discipline than manual mitigation. Different products, different playbooks — but the security objective is identical. (craftcms.com)

A practical response sequence​

• Inventory every instance of the affected software and versions.
• Determine whether it is externally reachable or user-facing.
• Apply vendor patches or upgrades immediately.
• Search logs for exploitation indicators and suspicious requests.
• Review whether credentials, tokens, or data may have been exposed.
• Validate that patching succeeded across all asset classes. (craftcms.com)

The best teams will also use this moment to refine automation. KEV entries are ideal candidates for policy-driven patching, conditional escalation, and compliance reporting because the signal is already high-confidence. In other words, these vulnerabilities are not just a problem to solve; they are a chance to improve the organization’s entire remediation pipeline.

Strengths and Opportunities​

CISA’s latest KEV update shows why exploitation-based prioritization remains one of the most useful tools in modern defense. It gives security teams a concrete, action-oriented list rather than a sea of abstract risk scores, and it helps narrow remediation to what matters most right now. Just as importantly, the mix of Apple, CMS, and framework issues shows that KEV can illuminate risk across very different technology stacks.

• Fast triage: teams can focus on vulnerabilities with confirmed abuse.
• Clear operational value: KEV supports patching, hunting, and compliance.
• Vendor validation: affected product makers have already acknowledged fixes.
• Cross-platform relevance: the same list helps endpoint, web, and app teams.
• Better board-level reporting: active exploitation is easier to explain than abstract severity.
• Stronger threat modeling: repeated KEV patterns can shape future architecture decisions.
• Opportunity for automation: patch orchestration can be keyed to KEV status.

Risks and Concerns​

The main concern is not just that these vulnerabilities exist, but that they are already being exploited, which shortens the reaction window dramatically. Organizations with incomplete asset inventories, weak version tracking, or fragmented ownership may miss their exposure entirely. Another concern is that highly reusable bug classes like code injection and buffer overflow continue to evade the industry’s best efforts, proving that secure-by-design progress is real but still incomplete.

• Delayed patching creates avoidable exposure windows.
• Unknown asset ownership leaves vulnerable systems unremediated.
• Incomplete logging makes compromise hard to prove or disprove.
• Framework dependencies can hide risk in application layers.
• CMS hosting can expose credentials and content at once.
• Patch fatigue may cause teams to underreact to repeated KEV entries.
• Reinfection risk remains high if cleanup happens before patching. (craftcms.com)

The deeper risk is normalization. When organizations see KEV updates every week, they can start to treat them as routine background noise. That is exactly the wrong instinct, because routine in CISA’s catalog usually means the vulnerability has already attracted enough attacker interest to cross a threshold. Routine notice should never be mistaken for routine risk.

---

Looking Ahead​

Expect CISA to keep using the KEV Catalog as a live pressure signal for defenders. The catalog’s value will only increase if organizations treat it as a required input into patch SLAs, exception handling, and executive reporting. For vendors, the message is equally clear: the faster a fix is published and adopted, the less likely a bug is to become the next public KEV entry.
The more interesting question is how quickly organizations can close the gap between knowing and acting. Many teams now have better vulnerability tools than ever, but the operational bottleneck remains coordination, asset visibility, and change management. KEV entries like this one punish slow processes far more than slow scanners.

• Verify whether any Apple devices need immediate updates.
• Confirm whether Craft CMS instances are running fixed releases.
• Upgrade Livewire to 3.6.4 or later where applicable.
• Hunt for signs of prior exploitation in logs and endpoints.
• Reassess how quickly KEV items move from alert to action. (support.apple.com)

In the end, this KEV update is less about the five CVEs individually than about what they reveal together: attackers still prize high-reach, high-reliability flaws, and defenders still win by compressing the time between disclosure, exploitation, and remediation. The organizations that thrive will be the ones that treat KEV not as a compliance chore, but as a continuously updated map of where the next intrusion is most likely to begin.

---

Source: CISA CISA Adds Five Known Exploited Vulnerabilities to Catalog | CISA