CISA Adds Three Known Exploited Vulnerabilities to Catalog

The Cybersecurity and Infrastructure Security Agency (CISA) announced the addition of three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog on August 27, 2026. According to the agency, all three flaws have evidence of active exploitation in the wild, prompting their inclusion in the catalog designed to prioritize remediation efforts across federal and civilian networks.

The three CVEs added are:
- CVE-2023-49105: An improper authentication vulnerability in ownCloud.
- CVE-2026-53362: An unspecified vulnerability in the Linux Kernel.
- CVE-2026-66384: An improper limitation of a pathname to a restricted directory in JFrog Artifactory.

CISA noted that these types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise. The agency referenced Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk, which establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 requires agencies to prioritize rapid remediation of KEV Catalog vulnerabilities on publicly exposed assets that grant total control of the asset post-exploitation, and to check whether threat actors may have already compromised systems before patches were applied.

While BOD 26-04 applies specifically to FCEB agencies, CISA encouraged all organizations to adopt risk-based vulnerability management practices and prioritize remediation of KEV Catalog vulnerabilities. The agency also noted that it will continue to add vulnerabilities to the catalog that meet the specified criteria of evidence of active exploitation.

CISA invited the public to submit any known exploited vulnerabilities not currently listed through the KEV Nomination Form, provided they include a CVE ID, evidence of exploitation, and clear mitigation guidance.