CISA Adds Three Known Exploited Vulnerabilities to Catalog
CISA added three actively exploited vulnerabilities to its KEV catalog: CVE-2023-49105 (ownCloud), CVE-2026-53362 (Linux kernel), and CVE-2026-66384 (JFrog Artifactory).
CISA added three new entries to the Known Exploited Vulnerabilities catalog based on evidence of active exploitation: ownCloud improper authentication (CVE-2023-49105), an unspecified Linux kernel vulnerability (CVE-2026-53362), and JFrog Artifactory improper path restriction (CVE-2026-66384). KEV listing confirms these flaws are being exploited in the wild rather than posing theoretical risk. Under BOD 26-04, federal civilian executive branch agencies must prioritize remediation of KEV entries.
- Three new KEV entries backed by evidence of active exploitation
- Includes ubiquitous Linux kernel and JFrog Artifactory path traversal flaw
- BOD 26-04 requires FCEB agencies to patch KEV entries on deadline
- Organizations
- CISA
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2023-49105 | Improper Authentication in ownCloud Server Allows Unauthenticated File Access | 9.8 | 43% | KEV | KEV |
| CVE-2026-53362 | Out-of-Bounds Write in Linux Kernel IPv6 Stack via UDPv6 MSG_SPLICE_PAGES | 7.8 | <1% | KEV | KEV |
| CVE-2026-66384 | Authenticated Path Traversal Write in JFrog Artifactory Exploited in the Wild | 5.3 | <1% | KEV | KEV |
From the original article
CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
By CISA · cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.