CISA's KEV Catalog Is Filling Up Again, and the Entry-Level Hiring Paradox Is Getting Worse

September 15, 2026 — Active exploits are dominating the news this week, CISA has added a fresh batch of vulnerabilities to its Known Exploited Vulnerabilities catalog, and new hiring data reveals why certification holders are positioned well even as entry-level openings feel strangely out of reach.

News CISA added eleven new exploited CVEs to its KEV catalog this week. The latest additions include vulnerabilities in JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS — all being actively exploited in the wild. CISA's KEV catalog is a living document updated whenever CISA confirms real-world exploitation; agencies are required to remediate KEV entries within defined deadlines, and many private-sector orgs treat it as a de facto patching priority list. If you're studying for Security+, CySA+, or CASP+, the KEV catalog is one of the best free resources for seeing exactly what threat actors are actively targeting. (Source: Senserva — CISA KEV Additions September 2026) A critical GitLab vulnerability is now under active attack. CISA issued a warning that threat actors are exploiting a maximum-severity GitLab flaw. GitLab is used by development teams worldwide for source code management, so exploitation can give attackers access to codebases, CI/CD pipelines, and deployment secrets — a scenario with obvious supply chain implications. Security professionals with DevSecOps responsibilities should treat this as a high-priority patch signal. (Source: BleepingComputer) A China-aligned threat group is exploiting CVE-2026-51990 in Sogou Input Method for Windows. Researchers identified a critical vulnerability in Tencent's Sogou Input Method — software with a large install base in enterprise environments — being used to deploy the GrayRabbit backdoor by an espionage-focused threat actor. This is a reminder that the attack surface extends to input method editors and language tools, not just browsers and operating systems. (Source: Boston Institute of Analytics — Cybersecurity News Week of Aug 29–Sept 4, 2026) The entry-level cybersecurity hiring paradox is getting documented attention. Despite organizations claiming severe talent shortages, a significant percentage made zero entry-level hires in 2024, and many roles labeled "entry-level" still demand 2–3 years of experience. Meanwhile, the U.S. Bureau of Labor Statistics projects 29% growth in information security analyst roles from 2024 to 2034. The gap between demand projections and actual junior hiring is real — but certifications, demonstrated projects, and community involvement remain the most effective ways to make the credential-versus-experience trade-off work in your favor. (Sources: DestCert — Cybersecurity Job Demand 2026, StationX — Cybersecurity Job Market Statistics 2026) 65% of organizations now require certification for client-facing cybersecurity roles. Separate hiring data shows certifications are increasingly a hard gate, not a soft preference, for roles with client or compliance visibility. The three certifications most referenced in cybersecurity job postings remain CISSP, CISM, and CISA — all vendor-neutral governance credentials. For practitioners earlier in their career, Security+ and the ISC2 CC continue to be the most commonly cited entry requirements for SOC and analyst roles. (Source: Programs.com — Cybersecurity Certification Demand 2026) Study & Passing Tips

Use the CISA KEV catalog as a free, real-world study aid. The KEV catalog lists every vulnerability CISA has confirmed is being exploited, with CVE IDs, vendor, product, and vulnerability type. When you're studying vulnerability management for Security+, CySA+, or CASP+, cross-referencing exam topics with KEV entries gives you a sense of what actually matters in the field. Knowing that ConnectWise ScreenConnect and MikroTik RouterOS have appeared in the KEV makes "remote monitoring software vulnerabilities" more concrete than any textbook example. The catalog is free at cisa.gov/known-exploited-vulnerabilities-catalog.

Build a public portfolio to counter the experience paradox. If you're running into the entry-level catch-22 — certified but no experience, no experience because no one will hire you — a documented home lab or capstone project is the most practical workaround. Even a short write-up describing how you set up a pfSense firewall, configured a SIEM, or ran a network scan against a test environment gives a hiring manager something concrete to evaluate. GitHub, a personal blog, or a LinkedIn post all count. Certifications open the resume filter; a portfolio is what gets you through the interview.

When preparing for scenario-based questions, start with the outcome the attacker achieves, then work backward. News items like the Sogou Input Method backdoor are perfect study frames. Ask yourself: What type of attack is this? (Supply chain, exploitation of a trusted software component.) What's the likely goal? (Persistence, data exfiltration.) What controls would have caught or prevented it? (Application allowlisting, patch management, network monitoring, least privilege on language tools.) Walking backward from an incident to the controls that would have helped maps almost directly to how CySA+, Security+, and CASP+ frame their scenario questions.

On the Security+ SY0-801 timeline: read official CompTIA channels, not forums. With Security+ SY0-801 targeting a November launch, study forums are filling up with speculation, leaked content claims, and second-hand rumor. None of it is reliable. CompTIA announces exam changes officially at comptia.org, and the official exam objectives document is the only source you should trust for what will be tested. Until the official objectives are published, your SY0-701 prep is the right prep.

How Test Prep Lite Can Help

The threat intelligence side of this week's news — CISA KEV entries, active GitLab exploits, supply chain attacks — maps directly to the vulnerability management, threat hunting, and incident response domains that CySA+ and CASP+ test most heavily. Test Prep Lite covers all of those exams with domain-tracked practice questions, so you can see not just whether you're getting questions right, but which domains still have gaps. If you're working toward CySA+, Security+, or any of the CompTIA or ISC2 certifications, it's worth checking out at https://app.testpreplite.com

Also Worth Knowing

CISA publishes free advisories, threat reports, and KEV updates at no cost — cisa.gov is worth bookmarking alongside your study materials. Their Known Exploited Vulnerabilities catalog, cybersecurity alerts, and joint advisories with international partners are exactly the kind of primary-source material that shows up (in paraphrased form) on hands-on certification exams like CySA+ and CASP+.