CISA Adds Two Known Exploited Vulnerabilities to Catalog

As cited

Copy frozen at 2026-09-18 17:14 UTC (site build).

vulnerabilities

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA added CVE-2025-39964 and CVE-2026-53266, two Linux kernel vulnerabilities subject to active exploitation, to its Known Exploited Vulnerabilities Catalog. Binding Operational Directive 26-04 requires federal agencies to prioritize patching of KEV Catalog vulnerabilities on publicly exposed assets, while CISA encourages all organizations to adopt the same risk-based approach.

Why it matters: Federal agencies must treat these two Linux kernel vulnerabilities as high priority for patching on exposed systems; all other organizations should adopt similar prioritization for KEV Catalog entries to reduce attack surface against active exploitation.

Source published

2026-09-18 12:00 UTC

First seen by Cybersecurity Tracker

2026-09-18 16:14 UTC