CISA 2026-07-21

CISA KEV — DD-WRT (CVE-2021-27137) +3 more

Machine-generated analysis · WAYSCloud LLM

CISA added four actively exploited CVEs—including two WordPress core flaws—to its KEV Catalog.

Context

The advisory lists CVE-2021-27137 affecting DD-WRT, CVE-2026-0770 affecting Langflow, and CVE-2026-63030 and CVE-2026-60137 affecting WordPress core. CISA states these vulnerabilities are being actively exploited and agencies must prioritize rapid remediation on publicly exposed assets. The advisory references BOD 26-04, which requires checking for compromise before patching.

Operator considerations

Check: inventory any DD-WRT, Langflow, or WordPress installations.
Isolate: segment publicly exposed instances of these products.
Patch: apply vendor patches or updates for the listed CVEs.
Log: monitor logs for exploitation attempts related to the CVEs.

From Cybersecurity and Infrastructure Security Agency ↗

CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

CVE-2021-27137 DD-WRT Stack-Based Buffer Overflow Vulnerability

CVE-2026-0770 Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability

CVE-2026-63030 WordPress Core Interpretation Conflict Vulnerability

CVE-2026-60137 WordPress Core SQL Injection Vulnerability

These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.

Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulne...

Read the full advisory on CISA →