CISA Adds 4 Critical Flaws to “Must-Patch” List as Exploits Surge

CISA added four actively weaponized vulnerabilities to its KEV catalog: a critical Traefik authentication bypass in Versa Concerto (CVE-2025-34026, CVSS 9.2) enabling access to administrative Actuator endpoints; a malicious code injection in eslint-config-prettier that executes node-gyp.dll on Windows during package install (CVE-2025-54313); a high-severity Local File Inclusion in Synacor Zimbra Webmail Classic (CVE-2025-68645, CVSS 8.8); and an improper access control in Vite exposing arbitrary file contents (CVE-2025-31125). Federal agencies are ordered to patch by February 12, 2026, and private organizations are urged to remediate immediately.