News AnalysisStanding

KEV entry confirms exploitation of MLflow SSRF

Updated 20 August 2026 · Timeframe: Current snapshot

The headline states CISA added one known exploited vulnerability. Our data shows the addition occurred on 2026-08-19, two days after CVE-2026-64849 was published. The record lists CWE-918 with CVSS 9.3 and EPSS at the 63rd percentile. Scenario counts record 153 confirmed app-vuln-management cases tied to this entry.

Why it matters

KEV status means confirmed exploitation rather than prediction, so exposure checks apply only to MLflow users.

What to do

• Security leaders. Verify whether any MLflow tracking servers exist in the environment and confirm they are not reachable from the internet.
• Lean IT orgs. Patch the affected MLflow instances this week if they are present; otherwise ignore the CVE.
• MSPs. Run an inventory scan for MLflow deployments and apply the vendor fix on any internet-facing instances first.

Our take

Our own data behind a live news story, generated on tap — the depth the headline skips.