CISA Adds One Known Exploited Vulnerability to Catalog

CISA added actively exploited Linux kernel flaw CVE-2025-39682 to its KEV catalog, requiring federal agencies to prioritize remediation under BOD 26-04.

CISA added CVE-2025-39682, an improper check for unusual or exceptional conditions in the Linux kernel, to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation. Under Binding Operational Directive 26-04, Federal Civilian Executive Branch agencies must prioritize rapid remediation of KEV-listed vulnerabilities on publicly exposed assets that grant total control post-exploitation, and must check whether systems were compromised before patching. CISA encourages all organizations to adopt risk-based vulnerability management and prioritize KEV remediation.