THE Cybersecurity and Infrastructure Security Agency (CISA) has added two new actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. These include:
1. **CVE-2022-0492**: An improper authentication vulnerability in the Linux Kernel allowing local attackers to elevate privileges and bypass container namespace isolation, with a CVSS score of 7.8.
2. **CVE-2025-48595**: An integer overflow vulnerability in the Android Framework allowing unauthorized execution of code with elevated privileges, affecting Android 14 and later.
CISA mandates that federal agencies remediate these vulnerabilities by June 5, 2026, warning that unpatched systems could face severe operational disruptions.