CISA Adds One Known Exploited Vulnerability to Catalog
Summary
CISA has added CVE-2026-119977, a WordPress Core TOCTOU race condition vulnerability, to its Known Exploited Vulnerabilities (KEV) Catalog due to evidence of active exploitation. This addition, following Binding Operational Directive (BOD) 26-04, emphasizes the need for federal agencies to prioritize remediation of high-risk vulnerabilities in publicly exposed assets.
IFF Assessment
The addition of a new exploited vulnerability to CISA's KEV catalog indicates a real-world threat that defenders must actively address, representing bad news for security posture.
Severity
CISA KEV: Listed as actively exploited. Federal patch due: November 06, 2026. Known ransomware use: Unknown.
Defender Context
Defenders should be aware of CVE-2026-119977 affecting WordPress, as it has been actively exploited and added to CISA's KEV catalog. Prioritizing patching and applying security updates for this vulnerability, especially on publicly exposed assets, is crucial to mitigate risks to their infrastructure.