As reported by CISA on August 27, 2026, three vulnerabilities have been added to the Known Exploited Vulnerabilities (KEV) Catalog based on confirmed active exploitation. The additions span a surprisingly broad attack surface: a file-sharing platform, the Linux kernel, and a DevOps artifact repository. This diversity is a reminder that threat actors don't specialize—they opportunistically target whatever is exposed and exploitable.
Vulnerability Details
| CVE ID | Product | Vulnerability Type | Severity | Patch Available | Exploited in Wild |
|---|---|---|---|---|---|
| CVE-2023-49105 | ownCloud (graphapi app) | Improper Authentication | Critical (CVSS 10.0) | Yes | Yes |
| CVE-2026-53362 | Linux Kernel | Unspecified | Pending confirmation | Check vendor advisories | Yes |
| CVE-2026-66384 | JFrog Artifactory | Path Traversal | Pending confirmation | Check vendor advisories | Yes |
Why This Matters
The inclusion of CVE-2023-49105 is particularly notable. This ownCloud vulnerability—where the graphapi application exposed OAuth credentials (client_id and client_secret) in a readable configuration file—was disclosed back in November 2023 and carries a maximum CVSS score of 10.0. Its appearance in the KEV catalog now, nearly three years later, signals that a significant population of ownCloud deployments remains unpatched and is being actively compromised. Threat actors continue to mine old, high-severity vulnerabilities because defenders chronically under-patch edge services like file-sharing platforms.
The Linux kernel vulnerability (CVE-2026-53362) and the JFrog Artifactory path traversal flaw (CVE-2026-66384) represent two other high-value targets. Kernel vulnerabilities with confirmed exploitation typically enable privilege escalation or container escapes, making them critical for any multi-tenant or cloud-hosted environment. The Artifactory path traversal is equally concerning: artifact repositories are backbone infrastructure in CI/CD pipelines, and path traversal flaws can allow attackers to read sensitive configuration files, access tokens, or even overwrite build artifacts—turning a single compromise into a supply chain incident.
The KEV catalog is not a watch list—it is a triage list. Every entry carries confirmed evidence of active exploitation. Treat KEV additions as immediate-action items, not quarterly backlog items.
Who Is at Risk
Shield53 Recommendations
Immediate Actions
- CVE-2023-49105 (ownCloud): Update the graphapi app to the latest patched version immediately. If patching is delayed, remove or disable the graphapi app and rotate any exposed OAuth credentials. Check for signs of prior compromise—review access logs for unauthorized OAuth token usage.
- CVE-2026-53362 (Linux Kernel): Identify all Linux hosts in your environment, prioritize internet-facing and multi-tenant systems. Apply the latest stable kernel update from your distribution vendor. If a patch is not yet available for your distribution, monitor vendor channels and apply workarounds as published.
- CVE-2026-66384 (JFrog Artifactory): Upgrade Artifactory to the latest version per JFrog's security advisory. Restrict network exposure of Artifactory instances to internal networks or VPN-only access. Audit file access logs for anomalous path traversal patterns.
- Universal: For all three vulnerabilities, CISA's BOD 26-04 requires FCEB agencies to check for pre-patch compromise. All organizations should do the same—apply the patch, then hunt for indicators of prior access.
Broader Hardening
- Automate KEV catalog monitoring into your vulnerability management pipeline. New entries should trigger ticketed remediation tasks with SLA timers.
- Inventory and classify edge services (file sharing, artifact repositories, CI/CD tooling) separately from core infrastructure—these are consistently over-represented in KEV additions.
- Enforce network segmentation for DevOps tooling. Artifactory, Jenkins, GitLab, and similar platforms should never be directly internet-exposed without strong authentication and access controls.
The three-year gap between disclosure and KEV listing for CVE-2023-49105 underscores a persistent industry problem: vulnerability remediation cycles are too slow for edge services that lack dedicated ownership. Assign clear accountability for every externally facing service, and ensure patching SLAs are enforced—not merely documented.
