Linux: 3 Actively-Exploited Flaws Added to CISA KEV
CISA has added three Linux vulnerabilities to its Known Exploited Vulnerabilities Catalog, confirming their active exploitation in the wild and underscoring the immediate risk to affected systems.
Key findings
- Three Linux vulnerabilities (CVE-2025-39682, CVE-2025-39964, CVE-2026-53266) added to CISA KEV.
- All three flaws are confirmed to be under active exploitation in the wild.
- Immediate patching and remediation are critical for all affected Linux systems.
- Organizations must consult vendor advisories for specific patch details and implement robust monitoring.
CISA has issued an alert regarding three Linux vulnerabilities, CVE-2025-39682, CVE-2025-39964, and CVE-2026-53266, which were added to its Known Exploited Vulnerabilities (KEV) Catalog on September 18, 2026. This inclusion signifies that these flaws are under active exploitation by threat actors, posing a critical threat to organizations utilizing affected Linux systems. The KEV catalog serves as a definitive list of vulnerabilities that federal civilian executive branch agencies are required to remediate within specified deadlines due to their proven exploitation.
The newly added vulnerabilities are:
- **CVE-2025-39682**: A Linux vulnerability confirmed to be actively exploited.
- **CVE-2025-39964**: Another actively exploited flaw impacting Linux systems.
- **CVE-2026-53266**: A third Linux vulnerability now confirmed to be under active attack.
The addition of these vulnerabilities to the KEV catalog highlights the urgent need for all organizations, not just federal agencies, to address these issues. Active exploitation means that adversaries are already leveraging these weaknesses to compromise systems, potentially leading to data breaches, system control, or further network infiltration. While specific details about the exploitation campaigns were not released, the confirmation of active use by CISA is a clear indicator of the severe risk.
Defenders must prioritize the immediate patching of these vulnerabilities across all affected Linux environments. Organizations should consult official Linux distribution advisories and vendor documentation for specific remediation steps and available patches. Beyond patching, it is crucial to implement robust monitoring for any signs of compromise and to review security configurations to minimize attack surfaces. Adhering to CISA's guidance and proactively managing these known exploited flaws is essential to bolster cyber defenses against persistent threats.