CISA Adds Actively Exploited WordPress Core Vulnerability to KEV Catalog
Summary
CISA added CVE-2026-119977, a WordPress Core TOCTOU race condition vulnerability, to its KEV Catalog based on evidence of active exploitation. Federal agencies must prioritize remediation under BOD 26-04.
Key points
- CISA added CVE-2026-119977, a WordPress Core time-of-check to time-of-use race condition, to the KEV Catalog.
- CISA cited evidence of active exploitation as the basis for the addition.
- BOD 26-04 requires FCEB agencies to prioritize remediation of KEV-listed vulnerabilities on publicly exposed assets that grant total control after exploitation.
- The directive sets basic expectations for agencies to check whether systems were compromised before a patch was applied.
- CISA encourages all organizations to prioritize KEV vulnerabilities through risk-based vulnerability management.
Article Details
- Vulnerability Types
- Time-of-check time-of-use (TOCTOU) race condition
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- unknown