CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
- CVE-2026-33017 Langflow Code Injection Vulnerability
This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.
Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the KEV Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information.
Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of KEV Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.
This product is provided subject to this Notification and this Privacy & Use policy.

Facts Only

Actor: Cybersecurity and Infrastructure Security Agency (CISA)
Action: Added a new vulnerability to the Known Exploited Vulnerabilities (KEV) Catalog
Vulnerability: CVE-2026-33017 Langflow Code Injection Vulnerability
Event: Active exploitation of the vulnerability
Timeline: Unspecified
Location: Federal networks and potentially other organizations

Executive Summary

The Cybersecurity and Infrastructure Security Agency (CISA) has added a new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. The identified vulnerability is CVE-2026-33017, also known as the Langflow Code Injection Vulnerability. This type of vulnerability is commonly used by malicious cyber actors and poses significant risks to federal networks. Binding Operational Directive (BOD) 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect against active threats. Although this directive only applies to FCEB agencies, CISA strongly urges all organizations to prioritize timely remediation of KEV Catalog vulnerabilities as part of their vulnerability management practice.

Full Take

Steelman: CISA has identified a new vulnerability, CVE-2026-33017, which is being actively exploited by malicious cyber actors. This poses significant risks to federal networks and has prompted the agency to add it to their Known Exploited Vulnerabilities (KEV) Catalog. Binding Operational Directive (BOD) 22-01 requires FCEB agencies to remediate identified vulnerabilities by the due date, and CISA strongly urges all organizations to prioritize timely remediation of KEV Catalog vulnerabilities as part of their vulnerability management practice.
Patterns detected: ARC-0024 Ambiguity (the directive only applies to FCEB agencies but CISA encourages other organizations to follow the same practices)
Root Cause: The presence and exploitation of this vulnerability highlight the ongoing risks associated with cyber threats and the need for proactive measures in vulnerability management.
Implications: The identified vulnerability poses a significant risk to federal networks, emphasizing the importance of timely remediation. Encouraging all organizations to prioritize vulnerability management practices may help reduce overall cybersecurity risks across various sectors.
Bridge Questions: What steps are being taken by organizations other than FCEB agencies to address this vulnerability? How can we improve the efficiency and coordination of vulnerability management practices across different sectors? What other measures can be taken to mitigate the risks associated with known exploited vulnerabilities?