ADVISORY SUMMARY
CISA added four actively exploited vulnerabilities to the KEV catalog on July 21, 2026: a DD-WRT stack-based buffer overflow enabling unauthenticated RCE via UPnP (CVE-2021-27137), a Langflow untrusted control sphere inclusion flaw (CVE-2026-0770), and two chained WordPress Core flaws — an interpretation conflict enabling SQL injection (CVE-2026-63030) and a SQL injection vulnerability (CVE-2026-60137) — that together achieve remote code execution. The WordPress flaws have received public proof-of-concept exploit code and are being actively chained in the wild.
AFFECTED SYSTEMS
MITIGATION GUIDANCE
Apply mitigations per BOD 26-04: disable UPnP on DD-WRT devices or upgrade firmware; upgrade Langflow to v1.9.0 or later; update WordPress Core immediately and remove unused plugins. Federal agencies must remediate per BOD 26-04 Forensics Triage Requirements before the agency-set due date.
DETECTION SIGNATURES
For DD-WRT: monitor UPnP ports (TCP/UDP 1900, 5000) for unexpected external connections. For Langflow: alert on anomalous flow_id references in API calls. For WordPress: detect REST API batch-route abuse and unexpected SQL queries in web access logs; monitor for unauthorized admin account creation.
REFERENCES
- → https://www.cisa.gov/news-events/alerts/2026/07/21/cisa-adds-four-known-exploited-vulnerabilities-catalog
- → https://nvd.nist.gov/vuln/detail/CVE-2021-27137
- → https://nvd.nist.gov/vuln/detail/CVE-2026-0770
- → https://nvd.nist.gov/vuln/detail/CVE-2026-63030
- → https://nvd.nist.gov/vuln/detail/CVE-2026-60137
- → https://github.com/langflow-ai/langflow/releases/tag/v1.9.0