CISA Adds Three New Vulnerabilities to Catalog, Urges Immediate Patching

According to CISA, the Cybersecurity and Infrastructure Security Agency, three new vulnerabilities have been added to the Known Exploited Vulnerabilities (KEV) Catalog amid evidence of active exploitation in the wild, affecting the Linux kernel, Android Runtime and Sitecore CMS.

The first flaw, CVE-2025-38352, is a TOCTOU race condition in POSIX CPU timers that can disrupt task cleanup and destabilise the kernel, potentially leading to system crashes, denial of service or privilege escalation; it was disclosed in July 2025 and patched in kernel version 6.12.35-1 and later, with KEV inclusion now indicating real-world exploitation.

The second vulnerability, CVE-2025-48543, impacts the Android Runtime, with Google stating in its bulletin that there are indications these flaws may be under limited, targeted exploitation. The third flaw, CVE-2025-53690, stems from misconfiguration in legacy Sitecore CMS deployments, enabling attackers with a known key to craft deserialised payloads that can lead to remote code execution, with Mandiant noting observed exploitation in the wild. Federal agencies are required to remediate by 25 September 2025, and CISA urges all organisations to apply the mitigations.