CISA 2026-08-27

CISA KEV — ownCloud (CVE-2023-49105) +2 more

Machine-generated analysis · WAYSCloud LLM

CISA added CVE-2023-49105 (ownCloud), CVE-2026-53362 (Linux kernel) and CVE-2026-66384 (JFrog Artifactory) to the KEV Catalog.

Context

The advisory states that the three CVEs affect ownCloud, the Linux kernel, and JFrog Artifactory respectively. It notes these vulnerabilities are actively exploited and that agencies should prioritize rapid remediation on publicly exposed assets per BOD 26-04. The Linux kernel entry is described only as an unspecified vulnerability, indicating limited public detail.

Operator considerations

Check for these products on publicly exposed assets and prioritize remediation according to BOD 26-04.

From Cybersecurity and Infrastructure Security Agency ↗

CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

CVE-2023-49105 ownCloud Improper Authentication Vulnerability

CVE-2026-53362 Linux Kernel Unspecified Vulnerability

CVE-2026-66384 JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability

These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.

Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabili...

Read the full advisory on CISA →