Google: Actively-Exploited Flaw Added to CISA KEV
Google has had one actively-exploited vulnerability added to CISA's Known Exploited Vulnerabilities Catalog, confirming its active exploitation in the wild.
Key findings
- CISA added Google's CVE-2026-111497 to its KEV catalog on October 27, 2026.
- The vulnerability is confirmed to be under active exploitation by threat actors.
- Organizations must apply patches immediately to mitigate the critical risk.
- Federal agencies are mandated to remediate this flaw by October 27, 2026.
CISA has added a critical Google vulnerability, CVE-2026-111497, to its Known Exploited Vulnerabilities (KEV) catalog on October 27, 2026. This inclusion signifies that the flaw is under active exploitation by threat actors, posing an immediate and significant risk to organizations and users. The KEV catalog serves as a definitive list of vulnerabilities that federal civilian executive branch (FCEB) agencies are required to remediate within specific deadlines due to their proven exploitation.
While specific details regarding the nature of CVE-2026-111497 are not yet fully public, its presence in the KEV catalog underscores its severity and the urgency for immediate action. This vulnerability is not currently associated with ransomware campaigns, according to available information. However, any actively exploited flaw can serve as an entry point for various malicious activities, including data exfiltration, system compromise, and further network penetration.
Defenders are strongly urged to prioritize the immediate patching of CVE-2026-111497 across all affected Google products and services. CISA's directive mandates that FCEB agencies remediate this vulnerability by October 27, 2026. However, given the confirmed active exploitation, all organizations, regardless of their federal affiliation, should treat this as an emergency and apply available security updates without delay. Proactive patching is the most effective defense against known exploited vulnerabilities.