The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added three (3) critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. The vulnerabilities affect TP-Link, Apache, and Oracle products, and are all under active-exploitation by threat actors according to CISA. The first flaw, tracked as CVE-2023-1389, is a command injection vulnerability in the TP-Link Archer AX-21 router that could be exploited to conduct remote code execution (RCE). Researchers have observed threat actors associated with the Mirai botnet exploiting CVE-2023-1389 since early April 2023. The second vulnerability, tracked as CVE-2021-45046, is a deserialization of untrusted data flaw in the Apache Log4j2 logging library which is also being exploited to conduct RCE. Although specific threat actors have not been attributed to exploiting this weakness, researchers have observed exploitation attempts from at least seventy-four (74) unique IP addresses that have also been observed exploiting the notorious Log4Shell vulnerability (CVE-2021-44228). The third flaw, tracked as CVE-2023-21839, is an unspecified server vulnerability in Oracle WebLogic Servers that allows unauthenticated threat actors who have already gained access to the target network to access sensitive data for exfiltration. The presence of these vulnerabilities on CISA’s KEV mandates that all Federal Civilian Executive Branch (FCEB) agencies patch these vulnerabilities or apply vendor-approved mitigation techniques by no later than May 22, 2023, or face being held accountable by regulators. CTIX analysts urge any users or organizations leveraging the aforementioned devices/software to update and harden their systems as soon as possible.