CISA Adds Cisco, Chrome, and Arista Flaws to KEV Catalog Amid Active Exploitation

CVE-2026-11645 is an out-of-bounds read and write (CWE-125/CWE-787) in V8, the JavaScript engine used by Google Chrome and Chromium. A remote attacker triggers the flaw by luring a user to a crafted HTML page, where malicious script causes V8 to read and write outside allocated memory buffers. Successful exploitation allows the attacker to execute arbitrary code inside the browser's security sandbox, providing limited privileges within that process rather than full system compromise. All Google Chrome versions prior to 149.0.7827.103 are affected, along with the Chromium V8 component identified by CISA. The flaw is being exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-06-09, and related headlines describe an actively exploited Chrome V8 zero-day, though no public proof-of-concept is known and ransomware use is unconfirmed.

Do: Update Google Chrome to 149.0.7827.103 or later and restart the browser to load the patched V8, prioritizing systems exposed to untrusted web content; because the flaw is in CISA's KEV catalog, federal agencies must apply vendor mitigations or follow BOD 22-01 guidance within the required timeframe. Organizations running Chromium-derived browsers (e.g., Edge, Brave, Opera) should apply vendor updates that incorporate the patched V8 as they become available. Restricting browsing of untrusted sites from high-value systems is a reasonable interim measure, and no public exploit code is known at this time.

Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage) contains an improper encoding or escaping of output flaw (CWE-116) in its handling of user-supplied files. An attacker who already has authenticated access to the system can trigger it by supplying a crafted file, because the file's contents are not properly escaped before being processed. Successful exploitation yields arbitrary command execution with root privileges, giving the attacker full control of the SD-WAN management platform. Organizations running Cisco Catalyst SD-WAN Manager/vManage to manage their SD-WAN fabric are affected. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-06-09, indicating active exploitation, though no public proof-of-concept is known and ransomware use has not been confirmed.

Do: Apply the fixed release per Cisco's security advisory (specific fixed versions are not included in the available data), and prioritize this patch given the KEV listing. Because the flaw requires authenticated local access, restrict management-plane access to trusted administrators and networks, review privileged accounts on the manager, and audit the system for unexpected processes or changes. Federal agencies must follow the KEV required action under BOD 22-01 (mitigate per vendor instructions or discontinue use).

Arista EOS switches configured for tunnel decapsulation — VXLAN, decap-groups, or a GRE tunnel interface — fail to verify the tunnel protocol type of incoming packets before decapsulating them (CWE-1023, incomplete comparison with missing factors). An attacker can send an unexpected type of tunneled packet whose destination IP matches the switch's configured decapsulation IP, causing the switch to incorrectly decapsulate and forward it as if it belonged to the configured tunnel. The result is a traffic-integrity problem — packets are processed and delivered through a path they were never intended for — reflected in the CVSS 4.0 score of 6.9 as network-triggered, unauthenticated, integrity-only impact with no confidentiality or availability loss. Only deployments running Arista EOS with a tunnel decapsulation configuration are affected; sites without VXLAN/decap-group/GRE decapsulation are not exposed to this flaw. Exploitation in the wild has been reported — CISA added the issue to the Known Exploited Vulnerabilities catalog on 2026-06-09 — though no public proof-of-concept is known and ransomware use has not been confirmed.

Do: Inventory Arista EOS devices for tunnel decapsulation configuration (VXLAN, decap-groups, or GRE tunnel interfaces) and check whether the configured decapsulation IP is reachable from untrusted networks. Upgrade to a fixed EOS release per Arista's advisory for CVE-2026-7473 (fixed versions are not specified in the available data) or apply the vendor's recommended mitigation, such as filtering unexpected tunnel traffic destined to the decapsulation IP; federal agencies must remediate within the BOD 22-01 timeline following the 2026-06-09 KEV addition. Because the scored impact is limited to traffic-handling integrity, prioritize the exposure assessment, but do not defer patching given confirmed in-the-wild exploitation.