CISA Adds One Known Exploited Vulnerability to Catalog

CISA updates its Known Exploited Vulnerabilities (KEV) Catalog with one new vulnerability, CVE-2026-85046, related to Google Chromium's V8 Type Confusion Vulnerability.

By CISASep 4cisa.gov1 min read

Intelligence analysis by Qwen 2.5 (3B)

CISA has added a new vulnerability to its KEV Catalog, CVE-2026-85046, due to evidence of active exploitation. This update reinforces the importance of the KEV Catalog and vulnerability management requirements.

CISA found a new bug in a popular web browser that could let bad guys take control of computers. They added this bug to a list of known bad bugs that need to be fixed quickly.

Analysis

Binding Operational Directive 26-04: Prioritizing Security Updates Based on Risk":"Binding Operational Directive (BOD) 26-04, established by CISA, mandates that federal agencies prioritize the management of vulnerabilities based on their risk level. This directive emphasizes the importance of the KEV Catalog, which lists vulnerabilities that have been exploited.","

Vulnerability Management Requirements":"BOD 26-04 requires federal agencies to address high-risk vulnerabilities, particularly those listed in the KEV Catalog, which grants full control over the asset post-exploitation. Lower-risk vulnerabilities are deferred.","

Basic Expectations for Threat Actor Mitigation":"Agencies are expected to verify if threat actors have compromised the system before applying a patch. This directive aims to ensure that agencies are prepared to mitigate potential cyber threats effectively.","

Encouragement for All Organizations":"CISA encourages all organizations to adopt risk-based vulnerability management practices, aligning with the requirements set by BOD 26-04. This includes prioritizing remediation of vulnerabilities listed in the KEV Catalog."}

Key points

CISA added one new vulnerability to its KEV Catalog
The vulnerability is related to Google Chromium's V8 Type Confusion Vulnerability
BOD 26-04 mandates prioritization of security updates based on risk
CISA encourages all organizations to adopt risk-based vulnerability management practices

The Upside

By adding this new vulnerability to the KEV Catalog, CISA is helping federal agencies stay better prepared to protect against cyber threats.

The Downside

If threat actors are already exploiting this vulnerability, agencies may not be able to prevent it from being used, even with the new information.

Tagssecurity vulnerability kev-catalog federal-agencies cyber-threats

Oct 24thehackernews.com

Researchers Push Over 2 Million Updates to Remotely Disable Popcorn Time Updater That Could Fuel a Botnet

Eye Security pushed over 2 million updates to disable a background updater for Popcorn Time, a pirated film streaming app. The updates are now being handled by Shadowserver Foundation.

Oct 24thehackernews.com

Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software

Memory-corruption flaw in Brotli decoder affects Node.js, Bun, Python, and other software. Google's Brotli decoder has been fixed in versions 1.0.3 to 1.2.0 and 1.0.10, 1.1.1, 1.2.1.

Oct 24thehackernews.com

CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud

CISA has added two critical vulnerabilities, CVE-2026-110447 in Collabora Online and CVE-2026-114625 in Arista VeloCloud Orchestrator, to its Known Exploited Vulnerabilities catalog due to active exploitation in the wild.

Oct 23bleepingcomputer.com

Abandoned Popcorn Time app exposes millions of devices to RCE attacks

Researchers found a security flaw in an abandoned app that could have allowed attackers to execute malicious code on millions of devices.

CISA Adds One Known Exploited Vulnerability to Catalog

Vulnerability Management Requirements":"BOD 26-04 requires federal agencies to address high-risk vulnerabilities, particularly those listed in the KEV Catalog, which grants full control over the asset post-exploitation. Lower-risk vulnerabilities are deferred.","

Basic Expectations for Threat Actor Mitigation":"Agencies are expected to verify if threat actors have compromised the system before applying a patch. This directive aims to ensure that agencies are prepared to mitigate potential cyber threats effectively.","

Encouragement for All Organizations":"CISA encourages all organizations to adopt risk-based vulnerability management practices, aligning with the requirements set by BOD 26-04. This includes prioritizing remediation of vulnerabilities listed in the KEV Catalog."}

More from this desk

Researchers Push Over 2 Million Updates to Remotely Disable Popcorn Time Updater That Could Fuel a Botnet

Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software

CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud

Abandoned Popcorn Time app exposes millions of devices to RCE attacks

CISA Adds One Known Exploited Vulnerability to Catalog

Vulnerability Management Requirements":"BOD 26-04 requires federal agencies to address high-risk vulnerabilities, particularly those listed in the KEV Catalog, which grants full control over the asset post-exploitation. Lower-risk vulnerabilities are deferred.","

Basic Expectations for Threat Actor Mitigation":"Agencies are expected to verify if threat actors have compromised the system before applying a patch. This directive aims to ensure that agencies are prepared to mitigate potential cyber threats effectively.","

Encouragement for All Organizations":"CISA encourages all organizations to adopt risk-based vulnerability management practices, aligning with the requirements set by BOD 26-04. This includes prioritizing remediation of vulnerabilities listed in the KEV Catalog."}

More from this desk

Researchers Push Over 2 Million Updates to Remotely Disable Popcorn Time Updater That Could Fuel a Botnet

Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software

CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud

Abandoned Popcorn Time app exposes millions of devices to RCE attacks