CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added one vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. The vulnerability is CVE-2026-119977, a WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability.

CISA says this type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.

Binding Operational Directive (BOD) 26-04 applies to Federal Civilian Executive Branch (FCEB) agencies. It requires those agencies to prioritize rapid remediation of high-risk KEV Catalog vulnerabilities on publicly exposed assets that grant total control of the asset after exploitation. The directive also sets basic expectations for when agencies must check whether threat actors compromised a system before the patch was applied.

BOD 26-04 does not apply to organizations outside the federal government. CISA encourages all organizations to adopt risk-based vulnerability management and to prioritize remediation of KEV Catalog vulnerabilities.

Anyone who knows of an exploited vulnerability not yet in the catalog can submit it through