CISA adds critical Microsoft Office, Linux Kernel, and SmarterMail vulnerabilities to KEV catalog

As outlined in Security Affairs, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has updated its Known Exploited Vulnerabilities (KEV) catalog, adding several critical flaws affecting widely used software including Microsoft Office, GNU InetUtils, SmarterTools SmarterMail, and the Linux Kernel.

The newly added vulnerabilities include an integer overflow in the Linux Kernel (CVE-2018-14634) that allows for privilege escalation, a security feature bypass in Microsoft Office (CVE-2026-21509) actively exploited in the wild, an argument injection flaw in GNU InetUtils telnet daemon (CVE-2026-24061) with a CVSS score of 9.8, and two critical SmarterTools SmarterMail vulnerabilities (CVE-2025-52691 and CVE-2026-23760) enabling unauthenticated remote code execution via arbitrary file upload. These flaws, discovered between 2018 and 2025, pose significant risks to systems running vulnerable versions of these applications.

The inclusion of these vulnerabilities in CISA's KEV catalog mandates federal agencies to address them by February 16, 2026, under Binding Operational Directive 22-01.

Source: Security Affairs