U.S. CISA adds Sitecore, Android, and Linux flaws to its Known Exploited Vulnerabilities catalog

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added three flaws to its Known Exploited Vulnerabilities (KEV) catalog, covering Sitecore, Android and Linux products, according to CISA’s KEV update.

The entries are CVE-2025-38352, a Linux Kernel Time-of-Check Time-of-Use (TOCTOU) race condition vulnerability; CVE-2025-48543, an Android Runtime unspecified vulnerability; and CVE-2025-53690, a Sitecore deserialization of untrusted data flaw that affects Sitecore Experience Manager and Experience Platform up to version 9.0.

Google’s September 2025 Android Security Bulletin saw updates addressing 120 Android vulnerabilities, with two exploited in targeted attacks; CVE-2025-38352 has been singled out as potentially exploited by advanced threat actors in spyware campaigns, although Google did not disclose technical details of exploitation.

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies must address these issues, and CISA orders federal agencies to fix the vulnerabilities by 25 September 2025.