The first week of June 2026 delivered a bracing reminder that the Known Exploited Vulnerabilities catalog is not a historical archive — it is a live fire map. Five entries, spanning a phone in your pocket to the firewall guarding your perimeter, are all confirmed as weaponized in the wild.
Quick Answer
CISA added five actively exploited vulnerabilities to the KEV catalog between May 29 and June 2, 2026: an Android Framework RCE (CVE-2025-48595), a Linux cgroups v1 privesc (CVE-2022-0492), an unauthenticated Oracle WebLogic T3/IIOP flaw (CVE-2024-21182), a PAN-OS VPN auth bypass (CVE-2026-0257), and trojanized Daemon Tools Lite builds (CVE-2026-8398). Federal agencies face BOD 22-01 patch deadlines of just 3–5 days — and every other organization should treat the list as its minimum patch priority queue.
Why a KEV Addition Matters More Than a CVSS Score
Plenty of vulnerabilities are scary on paper. KEV entries are different: inclusion in the Known Exploited Vulnerabilities catalog means CISA has verified active exploitation in the wild — there are victims, right now. Under BOD 22-01, federal civilian agencies must remediate each entry within tight deadlines (typically two weeks, but urgent entries have shipped with 3–5 day clocks). Private organizations get no formal mandate — only the practical reality that anything on this list is already in attacker playbooks. The June 2026 batch continues a pattern we tracked in the 2026 zero-day surge: attackers are converging on edge devices, mobile platforms, and the software supply chain.
The Five June 2026 KEV Entries, Ranked by Urgency
1. CVE-2026-0257 — Palo Alto PAN-OS Authentication Bypass (Critical)
Added: May 29, 2026 · Component: PAN-OS · Impact: Unauthorized VPN sessions
An authentication bypass in PAN-OS lets an attacker establish unauthorized VPN connections — effectively walking through the front door of the network the firewall was bought to protect. Palo Alto’s dominance in enterprise perimeter security gives this flaw an enormous blast radius: one bypassed gateway can expose entire internal segments. This continues 2026’s defining pattern, in which the defense layer itself becomes the entry point — the same playbook we documented in BlueHammer and RedSun: when the defender becomes the door.
Act now: apply the vendor patch, revoke and reissue VPN certificates and credentials that could have been harvested, and audit authentication logs for connections that bypassed MFA from unusual ASNs.
2. CVE-2024-21182 — Oracle WebLogic T3/IIOP Unauthorized Access (Critical)
Added: June 1, 2026 · Deadline: June 4, 2026 · Component: Oracle WebLogic Server
An unauthenticated network attacker exploiting the T3/IIOP protocols can gain complete access to all WebLogic data — encryption keys, database credentials, and business logic included. T3 is enabled by default on many installations, and internet-facing WebLogic instances have been a reliably profitable target for ransomware operators for years. No credentials, no interaction, full compromise: this is classic Java middleware exploitation at its worst.
Act now: apply the Oracle Critical Patch Update, disable T3/IIOP if unused, and remove WebLogic administration planes from internet exposure entirely.
3. CVE-2025-48595 — Android Framework Integer Overflow (Critical)
Added: June 2, 2026 · Deadline: June 5, 2026 · Component: Android Framework
An integer overflow in the Android Framework enables local privilege escalation escalating to remote code execution — sandbox escape, arbitrary code with elevated privileges, and access to credentials, messages, and financial data. Android’s installed base of more than 3 billion devices makes this a fleet-level problem for any enterprise with BYOD or corporate-owned mobile estates.
Act now: push the latest Android Security Bulletin patches via MDM, prioritize devices running pre-Android 14 builds, and layer mobile threat detection on endpoints that cannot be patched immediately.
4. CVE-2022-0492 — Linux Kernel cgroups v1 Privilege Escalation (High)
Added: June 2, 2026 · Deadline: June 5, 2026 · Component: Linux kernel (cgroups v1)
The oldest entry in the batch is also the sharpest lesson. CVE-2022-0492 abuses the cgroups v1 release_agent feature, whose improper authentication lets any unprivileged user gain root — and it is now confirmed exploited four years after disclosure. Container platforms that still default to cgroups v1, and cloud instances on older kernels, are the hotspots; the exploit is public and trivially reproducible.
Act now: migrate to cgroups v2, update to a current stable kernel, and constrain container runtime privileges. Old bugs don’t die — they get weaponized when defenders assume someone else patched them.
5. CVE-2026-8398 — Daemon Tools Lite Embedded Malicious Code (Critical)
Component: Daemon Tools Lite · Vector: Software supply chain
The strangest entry of the week: Daemon Tools Lite shipped with embedded malicious code. No vulnerable parse path, no memory-safety bug — the product itself was the payload. It is the consumer-grade echo of the resource-poisoning campaigns we covered in the node-ipc supply chain attack, and proof that build-pipeline compromise has moved from developer ecosystems to mainstream desktop software.
Act now: remove or quarantine affected versions, hunt for the indicators in the vendor advisory, and start treating SBOM tracking as an operational control rather than a compliance checkbox.
All Five Entries at a Glance
| CVE | Component | Flaw | Attacker Gain | KEV Added | Fed Deadline |
|---|---|---|---|---|---|
| CVE-2026-0257 | Palo Alto PAN-OS | Authentication bypass | Unauthorized VPN connections | May 29 | BOD 22-01 window |
| CVE-2024-21182 | Oracle WebLogic | T3/IIOP unauthenticated access | Complete data access | June 1 | June 4 |
| CVE-2025-48595 | Android Framework | Integer overflow | LPE → RCE, sandbox escape | June 2 | June 5 |
| CVE-2022-0492 | Linux kernel (cgroups v1) | release_agent auth flaw |
Unprivileged → root | June 2 | June 5 |
| CVE-2026-8398 | Daemon Tools Lite | Embedded malicious code | Backdoored hosts | June batch | — |
A Patch Priority Plan for the Next 72 Hours
The ordering above is deliberate: internet-exposed edge and middleware first, fleets second, supply chain verification as the parallel workstream. Concretely:
- Hour 0–4: Inventory exposure. Which PAN-OS gateways, WebLogic instances, and VPN concentrators are internet-facing? Export the KEV JSON feed into your vulnerability management platform and join it against your asset database.
- Hour 4–24: Patch PAN-OS and WebLogic. If patching must wait, enforce strict network allow-listing in front of both. Rotate VPN credentials assuming prior collection.
- Hour 24–48: Push Android Security Bulletin updates through MDM; audit kernel and cgroups versions across the container estate.
- Hour 48–72: Verify no Daemon Tools installs exist on managed endpoints; review SBOM tooling so the next trojanized release is caught before deployment.
- Ongoing: Subscribe to KEV updates and treat catalog additions as automatic P1 tickets. Dead bugs bite — see how quickly patch-Tuesday zero-days and KEV adds compound into exposure.
What This Batch Signals About the 2026 Landscape
Read together, the five entries sketch the year’s threat geometry. Perimeter infrastructure (PAN-OS, WebLogic) is the preferred breach point. Legacy software (a 2022 kernel bug, a 2024 middleware flaw) keeps resurfacing because patch debt never ages out. Mobile fleets are now state-sponsored-grade targets. And supply chain compromise has matured from a developer-tools problem into a consumer-software problem. All four vectors feed the broader currents in the May threat picture (weekly threat intelligence) and in AI-powered attack operations, where fast patching is the control that most often separates a near-miss from an incident.
Frequently Asked Questions
What is the CISA KEV catalog?
The Known Exploited Vulnerabilities catalog is CISA’s authoritative list of flaws with verified active exploitation. Inclusion is based on evidence of real-world attacks, not theoretical severity — which is why a KEV entry is a stronger priority signal than a high CVSS score alone.
Do BOD 22-01 deadlines apply to private companies?
Formally, no — the directive binds federal civilian executive agencies. Practically, yes: the deadlines (as short as 3–5 days in this batch) encode CISA’s view of how fast exploitation spreads, and most large organizations adopt KEV as their minimum remediation baseline to stay insurable and contract-compliant.
Which June 2026 KEV entry should I patch first?
Patch internet-exposed PAN-OS gateways and WebLogic instances first — CVE-2026-0257 and CVE-2024-21182 give attackers unauthenticated network access to perimeter and middleware assets. Android fleet and Linux kernel updates follow; Daemon Tools verification runs in parallel.
How can I track KEV additions automatically?
CISA publishes the catalog as a machine-readable JSON feed. Import it into your vulnerability scanner or ticketing system and auto-generate P1 tickets on every addition — several open-source KEV-to-Jira and KEV-to-Nessus integrations exist, or a daily cron against the feed is enough to start.
References
- CISA — Known Exploited Vulnerabilities Catalog
- CISA — BOD 22-01: Mitigations Are Imperative
- Android — Android Security Bulletin
- Oracle — Oracle Security Alerts & Critical Patch Updates
- Palo Alto Networks — Security Advisories
- Hmmnm — Defender Becomes the Door: BlueHammer and RedSun Zero-Days
- Hmmnm — Zero-Day Surge 2026: Critical Vulnerabilities
- Hmmnm — node-ipc Supply Chain Attack 2026
- Hmmnm — Microsoft Patch Tuesday April 2026
- Hmmnm — Weekly Cyber Threat Intelligence — May 2026
