Vulnerabilities
CISA Adds Two Linux Kernel Vulnerabilities to KEV Catalog
CISA has added CVE-2025-39964 and CVE-2026-53266, both Linux kernel flaws, to its Known Exploited Vulnerabilities catalog. The additions underscore the need for rapid patching of publicly exposed assets that could grant full control. Defenders should verify patch status and monitor for exploitation indicators.
What Happened
CISA has added two Linux kernel vulnerabilities—CVE-2025-39964, a race condition, and CVE-2026-53266, an out-of-bounds write—to its Known Exploited Vulnerabilities catalog after confirming active exploitation.
Impact
Both flaws allow an attacker who can reach the affected kernel to gain total control of the host. Publicly exposed servers or cloud instances running affected kernel versions are at highest risk.
What to Do
Verify that your kernel is at a patched version (see vendor advisories). If unpatched, apply the update immediately and reboot. After patching, monitor logs for signs of exploitation such as unexpected privilege escalation or kernel panic events.
Policy Context
“Prioritizing Security Updates Based on Risk” (BOD 26-04) requires federal agencies to remediate KEV-listed CVEs on exposed assets first, with lower-risk issues deferred.
While the directive targets federal civilian agencies, all organizations should adopt a risk-based approach and treat KEV items as high-priority.
Related vulnerabilities
CISA Adds Four Exploited Vulnerabilities to KEV Catalog
CISA has added four CVEs—CVE‑2026‑0322, CVE‑2026‑76519, CVE‑2026‑105133, CVE‑2026‑105134—to its Known Exploited Vulnerabilities catalog. The vulnerabilities affect Palo Alto Networks PAN‑OS, Cisco Secure Email Gateway, and Ahsay AhsayCBS, and grant attackers full control of exposed assets. Defenders should prioritize patching and verify no compromise before applying updates.
Read briefing
Ubuntu Kernel Vulnerabilities - Oct 2026
Multiple vulnerabilities have been disclosed affecting the Linux kernel in Ubuntu. These vulnerabilities allow for potential remote code execution, privilege escalation, and denial-of-service conditions. Defenders should prioritize patching systems according to the provided Ubuntu Security Notices.
Read briefing
Microsoft September 2026 Patch Tuesday: 964 CVEs, Including Two Zero-Day Exploits (CVE-2026-81963, CVE-2026-85880)
Microsoft released its largest Patch Tuesday to date, addressing 964 CVEs—104 critical and 860 important—including two zero‑day vulnerabilities exploited in the wild. Defenders must prioritize applying updates to affected components such as .NET, Active Directory services, Azure services, Office, and Windows kernel drivers, and verify system integrity.
Read briefing
CISA Expands KEV Catalog with Seven Fresh Exploited Vulnerabilities
CISA has just added seven new CVEs to its Known Exploited Vulnerabilities (KEV) catalog, all confirmed to be actively exploited in the wild. The list includes SQL injection in Sangoma Switchvox, HTTP smuggling in Kludex Starlette, OS command injection in Kestra OSS, and several high‑impact flaws in BerriAI LiteLLM, JFrog Artifactory, and SonicWall SMA1000 appliances. Under BOD 26‑04, federal agencies must prioritize patching these high‑risk items on publicly exposed assets, while the broader community is urged to adopt the same risk‑based approach and submit any missing exploited CVEs for incl
Read briefing