Loading story…
CISA added CVE-2025-39682, CVE-2026-53266, and CVE-2025-39964 to its Known Exploited Vulnerabilities (KEV) Catalog after evidence of active exploitation. The vulnerabilities affect the Linux kernel TLS receive path, ebtables SNAT ARP rewrite handling, and AF_ALG sockets, respectively. CVE-2025-39682 can cause TLS records to be handled using incorrect zero-copy and queueing assumptions; CVE-2026-53266 is an ebtables SNAT out-of-bounds write; and CVE-2025-39964 is an AF_ALG race condition that can interleave data and leave socket state inconsistent.
CISA said the flaws can create denial-of-service, memory-disclosure, data-integrity, or local privilege-escalation risk, although public details on the observed attacks and whether the vulnerabilities were chained have not been released. Federal civilian executive branch agencies must apply vendor mitigations by September 21, 2026, conduct required forensic triage, and follow BOD 26-04 risk-based update guidance; Red Hat has also updated advisories to recognize active exploitation and prioritize remediation. Ransomware use is currently listed as unknown for all three vulnerabilities.
See which actors are running it and whether you're in range.
3 events from the most recent confirmed update back to the earliest known activity.
Red Hat updated its advisories for CVE-2025-39682, CVE-2026-53266, and CVE-2025-39964 to acknowledge active exploitation. It characterized the flaws as high risk, noted public exploits were known, and urged prioritized remediation.
CISA added CVE-2025-39682 to its KEV Catalog based on evidence of active exploitation. The Linux kernel TLS receive-path flaw allows a zero-length record to bypass intended recvmsg() record-type handling, potentially causing later records to be processed with incorrect zero-copy and queueing assumptions.
CISA released KEV Catalog version 2026.09.18, adding CVE-2025-39964, an AF_ALG socket race condition, and CVE-2026-53266, an ebtables SNAT out-of-bounds write. CISA cited active exploitation, required forensic triage, and directed affected organizations to apply vendor mitigations under BOD 26-04.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
4 references tracked. Mallory keeps watching after this page renders.
thehackernews.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcecve.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISA added six vulnerabilities to its **Known Exploited Vulnerabilities (KEV)** Catalog after confirming active exploitation affecting Citrix NetScaler ADC and Gateway, Microsoft SQL Server, Ajax.NET Professional, the Linux kernel, Red Hat ABRT, and Red Hat libuser. The additions include **CVE-2026-8452**, a high-severity NetScaler memory-buffer vulnerability reportedly used for web-shell deployment and reconnaissance activity; internet-facing NetScaler appliances, SQL Server instances, and applications using Ajax.NET Professional are priority targets for exposure review, patching, and compromise hunting. The older Linux and Red Hat vulnerabilities can enable local privilege escalation following an initial compromise, increasing their operational significance despite their age. CISA directed U.S. federal civilian agencies to remediate **CVE-2019-1068** and **CVE-2026-8452** by August 29, 2026, and the other four KEV entries by September 9; organizations should similarly prioritize remediation according to confirmed exploitation, internet exposure, asset criticality, and potential business impact.
Aug 28, 2026
CISA added **five vulnerabilities** to its **Known Exploited Vulnerabilities (KEV) Catalog** based on evidence of **active exploitation**, reinforcing that these issues are being used as real-world attack vectors and should be prioritized for remediation. The newly listed CVEs are **CVE-2018-14634** (Linux kernel integer overflow / local privilege escalation), **CVE-2025-52691** (SmarterTools *SmarterMail* unrestricted file upload enabling RCE), **CVE-2026-21509** (Microsoft Office security feature bypass), **CVE-2026-23760** (SmarterTools *SmarterMail* authentication bypass via alternate path/channel), and **CVE-2026-24061** (GNU *InetUtils* argument injection). CISA reiterated that these vulnerability classes are frequently leveraged by threat actors and pose material risk to enterprise environments. Under **BOD 22-01**, U.S. Federal Civilian Executive Branch (FCEB) agencies are required to remediate KEV-listed vulnerabilities by CISA-specified due dates, and CISA urged all organizations to treat KEV entries as high-priority items in vulnerability management. Additional technical context highlighted that **CVE-2025-52691** can enable unauthenticated arbitrary file upload leading to **remote code execution** (noted as **CVSS 10.0** in the reporting) and that **CVE-2018-14634**, while older, remains relevant where legacy Linux kernels persist—underscoring that KEV additions can include long-standing flaws when exploitation is observed in the wild.
Jun 29, 2026
CISA added four vulnerabilities to its Known Exploited Vulnerabilities catalog, raising the total from 1666 to 1670 entries and flagging active exploitation affecting **Microsoft Internet Key Exchange (IKE) Service Extensions**, **Microsoft SharePoint**, **Broadcom VMware vCenter**, and **Apple macOS Screen Sharing**. The newly listed issues are `CVE-2026-33824`, `CVE-2026-55040`, `CVE-2026-59310`, and `CVE-2026-65400`, covering weaknesses that can enable remote code execution, path traversal, weak authentication, or improper authentication. Under **BOD 22-01**, CISA directed U.S. federal agencies to remediate all four flaws by **2026-08-21** and urged other organizations to review exposure and apply available fixes. Reporting on the update said the SharePoint issue is tied to a JWT forgery attack chain, while the macOS Screen Sharing flaw was confirmed as actively exploited by the Dutch National Cyber Security Centre; Apple has already released patches, and CISA's KEV data indicates ransomware use is currently unknown for all four CVEs.
Aug 23, 2026