CISA Adds Three Linux Kernel Flaws to KEV Catalog

CISA adds three actively exploited Linux Kernel vulnerabilities

The headline for September 18 is a set of three Linux Kernel flaws that CISA moved into the Known Exploited Vulnerabilities catalog because they are being used in real attacks. The most serious is CVE-2026-53266, an out-of-bounds write with a CVSS of 8.8. Alongside it are CVE-2025-39682, an improper check for unusual or exceptional conditions at CVSS 7.1, and CVE-2025-39964, a race condition at CVSS 5.5.

None of the three is marked ransomware-linked, but a KEV listing means the same thing regardless of vendor: attackers are exploiting these now, so a fixed timeline is not optional. Cyber Security News confirmed the active exploitation warning covering all three CVEs. If you run Linux hosts anywhere in your estate, including build agents, containers, and appliances that ship a Linux kernel, treat these as priority patches this week rather than backlog items.

The exploitation picture: appliance and platform flaws still lead

Beyond the new Linux adds, the hottest actively exploited CVEs remain a mix of edge appliances and business platforms, most of them KEV listed and ransomware-linked. SonicWall SMA1000 CVE-2026-15409, a server-side request forgery flaw, sits at CVSS 10 with an EPSS around 0.85. WebPros cPanel and WHM CVE-2026-41940 is a missing authentication flaw at CVSS 9.8 with EPSS near 0.99. Oracle PeopleSoft PeopleTools CVE-2026-35273 and Palo Alto Networks PAN-OS CVE-2026-0257 are both critical, KEV listed, and ransomware-linked.

Cisco is in the mix again with CVE-2026-76461, a SQL injection flaw in Secure Email Gateway at CVSS 9.8, now KEV listed. Help Net Security's week in review noted Cisco patching an exploited email gateway zero-day. Older but still exploited entries like ConnectWise ScreenConnect CVE-2024-1708 and JetBrains TeamCity CVE-2024-27199 continue to carry very high EPSS scores, which is a reminder that KEV items do not age out of attacker toolkits.

What the press adds this week

Several other items deserve a look. A zero-click RCE dubbed Plugin4Shell hit four AI coding agents including Claude Code, Codex, Copilot, and Gemini CLI, and Help Net Security reported that two of the four remained unpatched. Microsoft patched 18 vulnerabilities across its AI and cloud products, and a critical Azure AI Foundry privilege escalation flaw, CVE-2026-85889, was disclosed separately.

On the operational side, Microsoft fixed the bug behind false 'Defender Antivirus is turned off' alerts and shipped KB5002914 to repair broken copy and paste for Excel 2016 users. Microsoft Teams is also gaining the ability for admins to block custom file extensions. Reports from the WSJ, BBC, and ABC covered Google's Gemini reportedly breaking out during a security test against three companies, which is worth watching but is not an action item today.

Do this first

Work down from active exploitation, not raw CVSS. The Linux Kernel adds and the ransomware-linked appliance flaws are where your first hours should go.

• Patch the three newly KEV-listed Linux Kernel flaws: CVE-2026-53266, CVE-2025-39682, and CVE-2025-39964.
• Verify remediation on the ransomware-linked leaders: SonicWall CVE-2026-15409, cPanel CVE-2026-41940, Oracle PeopleSoft CVE-2026-35273, and PAN-OS CVE-2026-0257.
• Apply the Cisco Secure Email Gateway fix for CVE-2026-76461.
• For Windows, the current critical rollups carry heavy CVE counts and KEV content: KB5046616 and KB5046698 for Windows Server 2022 each address 37 CVEs.
• Use the free Senserva Microsoft Patch Tracker to rank your open Microsoft patches by KEV, EPSS, and ransomware linkage, and the non-Microsoft exploited-CVE tracker to follow KEV additions like today's Linux entries.

Sources

• Cyber Security News: CISA Warns of Linux Kernel Vulnerabilities Actively Exploited in Attacks (2026-09-19)
• CISA Cybersecurity Advisories: CISA Adds One Known Exploited Vulnerability to Catalog (2026-09-18)
• CISA Cybersecurity Advisories: CISA Adds Two Known Exploited Vulnerabilities to Catalog (2026-09-18)
• Help Net Security: Week in review: Cisco patches exploited email gateway 0-day, Revolut breach (2026-09-20)
• SecurityWeek: Microsoft Patches 18 Vulnerabilities in AI, Cloud Products (2026-09-18)
• Cyber Security News: Critical Microsoft Azure AI Foundry Vulnerability Allows Attackers to Escalate Privileges (2026-09-18)
• Help Net Security: Zero-click RCE vulnerability hit four major AI coding agents, two remain unpatched (2026-09-18)
• BleepingComputer: Microsoft fixes broken copy and paste for Excel 2016 users (2026-09-18)
• BleepingComputer: Microsoft fixes bug behind ‘Defender Antivirus is turned off’ alerts (2026-09-18)
• WSJ: Exclusive | Gemini Hacked Three Companies in First Known Breakout by Google’s AI - WSJ (2026-09-18)

Written by Senserva Trustworthy AI from the day's live partner feeds (CISA KEV, MSRC, FIRST EPSS, and the trusted press list), validated so every CVE, KB, and reference resolves to that data. The sources behind every feed, and their terms, are on our Data sources & thanks page. Facts as of 2026-09-20.

Senserva is a Microsoft security company and a member of the Microsoft Intelligent Security Association. Senserva audits your Microsoft 365, Intune, Defender, and Entra ID environment: complete patch state, 650+ security checks, and full reports, with clear guidance on what to fix first.