CISA KEV Catalog Additions: August 2026

Source context: this article examines information published by the source on August 27, 2026. This site’s publication date is shown separately. Check the latest vendor guidance before acting.

What the vulnerability is

On August 27, 2026, CISA added three vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation. The identified flaws are:

• CVE-2023-49105: An improper authentication vulnerability in ownCloud.
• CVE-2026-66384: An improper limitation of a pathname to a restricted directory vulnerability in JFrog Artifactory.
• CVE-2026-53362: An unspecified vulnerability within the Linux Kernel.

Exposure and applicability

These vulnerabilities affect organizations utilizing ownCloud, JFrog Artifactory, and various Linux Kernel implementations. The risk is particularly acute for assets that are publicly exposed. According to Binding Operational Directive (BOD) 26-04, which applies to Federal Civilian Executive Branch (FCEB) agencies, priority is placed on vulnerabilities in the KEV Catalog that grant total control of an asset post-exploitation.

Remediation priorities

Our analysis suggests a risk-based prioritization strategy for vulnerability management. Organizations should prioritize remediation based on the following criteria:

1. Public Exposure: Assets accessible from the internet should be addressed first, as these are primary targets for active exploitation.
2. Asset Criticality: Systems that grant total control of the asset upon successful exploitation represent a higher risk profile.
3. Compromise Assessment: In alignment with BOD 26-04 expectations for federal agencies, defenders should evaluate whether a system was compromised prior to applying patches.

How to validate remediation

Verification must move beyond confirming that a patch was deployed to ensuring the vulnerability is no longer exploitable. Our analysis recommends the following validation methods:

• Version Verification: Confirming the installed version matches the patched release provided by the vendor.
• Configuration Audit: For vulnerabilities involving path limitations or authentication (such as CVE-2026-66384 and CVE-2023-49105), verifying that restricted directories are inaccessible and authentication mechanisms are functioning as intended.
• Post-Patch Scanning: Utilizing vulnerability scanners to confirm the asset no longer reports the specific CVEs.

Limits and open questions

There is a significant information gap regarding CVE-2026-53362, which CISA lists only as an “Unspecified Vulnerability” in the Linux Kernel. Without further technical detail on the nature of the flaw, defenders cannot determine the specific attack vector or the exact conditions required for exploitation.

Additionally, while patching reduces exposure, it does not guarantee total prevention. Residual risk remains if the initial compromise occurred before the patch was applied; therefore, a version check alone is insufficient to prove the security of an asset.

Source and editorial note

CISA Adds Three Known Exploited Vulnerabilities to Catalog · Source date: August 27, 2026 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Request a Vulnerability Assessment