CISA Adds New Vulnerabilities to KEV Catalog Due to Active Exploitation

CISA has updated its Known Exploited Vulnerabilities (KEV) Catalog with new entries based on evidence of active exploitation of the listed vulnerabilities.

Among the newly added vulnerabilities are CVE-2026-41709, an Insufficient Logging Vulnerability in Broadcom VMWare ESX, and CVE-2026-46300, a Missing Initialization of a Variable Vulnerability in the Linux Kernel.

CISA also included CVE-2026-97229, an Integer Overflow or Wraparound vulnerability in GitLab Community and Enterprise Editions, and CVE-2026-76418, an Unchecked Return Value to NULL Pointer Dereference Vulnerability in Cisco Secure Firewall ASA Software and Cisco Secure FTD Software.

Further additions to the KEV Catalog are CVE-2026-111357 and CVE-2026-118527, both affecting Ivanti Connect Secure. The former is a Missing Authentication for Critical Function Vulnerability, while the latter involves the Generation of Predictable Numbers or Identifiers.

CVE-2026-119977, a Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability in WordPress Core, has also been added to the catalog.

Federal Civilian Executive Branch agencies are required by Binding Operational Directive 26-04 to prioritize the rapid remediation of high-risk vulnerabilities listed in CISA’s KEV Catalog. CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of these vulnerabilities.