CISA Adds Two Known Exploited Vulnerabilities to Catalog
2026-06-03T15:24:13Z•3a4dd0269d5c789452446ecd84a9c055d500427c90c82d478dddc1f4c146a5c8
AndroidBOD 22-01CI/CDCISADaemon ToolsDrupalKEV CatalogLangflowLinux KernelLiteSpeedMegalodonNx ConsoleOracle WebLogicPalo Alto PAN-OSTanStackTrend Micro Apex Oneactive exploitationcPanelmalicious extensionsupply chainvulnerability
What happened
CISA announced multiple additions to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation. New entries span product categories and impact vectors—examples include a malicious Nx Console VS Code extension used in a GitHub compromise (CVE-2026-48027) and campaigns targeting CI/CD pipelines ("Megalodon"); other added CVEs affect Linux kernel authentication, Android framework, Oracle WebLogic, Palo Alto PAN-OS authentication bypass, Drupal SQL injection, cPanel/LiteSpeed privilege escalation, and multiple third-party libraries and developer tools. CISA reiters
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- cisa_ncas_current_activity
- Record identifier
- 3a4dd0269d5c789452446ecd84a9c055d500427c90c82d478dddc1f4c146a5c8
- Enrichment time
- 2026-06-03T15:24:13Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.