CISA Adds Critical Linux and Android Vulnerabilities to KEV Catalog

CISA has identified two actively exploited vulnerabilities - a Linux kernel authentication flaw and an Android framework integer overflow - that pose significant risk to federal and enterprise systems. These vulnerabilities are already being exploited in the wild, meaning attackers have developed working exploits and are using them against real targets. The addition to the Known Exploited Vulnerabilities (KEV) Catalog signals that immediate patching is critical, as these flaws provide attackers with proven pathways to compromise systems. Organizations that delay patching face elevated risk of successful cyberattacks through these well-documented attack vectors.

Tactical Insight

Immediate actions

Apply security patches for CVE-2022-0492 and CVE-2025-48595 to all affected Linux and Android systems
Scan enterprise networks to identify all systems running vulnerable versions of Linux kernel and Android framework
Prioritize patching of internet-facing and critical infrastructure systems first

Long-term improvements

Establish automated vulnerability scanning that cross-references findings with CISA's KEV Catalog
Implement emergency patching procedures with defined timelines for KEV-listed vulnerabilities
Maintain comprehensive asset inventory to enable rapid identification of affected systems

Monitoring measures

Deploy security monitoring to detect exploitation attempts targeting these specific vulnerabilities
Set up alerts for new additions to CISA's KEV Catalog for immediate response