CISA has added one new entry to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. The specific issue is CVE-2026-119977, a time-of-check time-of-use race condition in WordPress Core. This vulnerability poses significant risks to the federal enterprise and is a frequent attack vector for malicious cyber actors. Under Binding Operational Directive 26-04, Federal Civilian Executive Branch agencies must prioritize rapid remediation of high-risk vulnerabilities listed in the catalog. CISA encourages all organizations to adopt risk-based vulnerability management and prioritize these fixes.
Read the full story at cisa.gov.
Photo: Markus Spiske (CC0) via Openverse
