TL;DR

CISA has added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) list due to evidence of active exploitation. One notable flaw is a use-after-free issue in Google Chrome with CVSS score 8.8.

What happened

['Four security flaws were identified and added to the CISA KEV catalog.', 'CVE-2026-2441, a critical vulnerability affecting Google Chrome, was noted as being actively exploited.']

Why it matters for ops

["CISA's additions to the KEV list signal heightened risk for organizations using affected software.", 'Immediate action is required to mitigate potential security breaches due to these vulnerabilities.']

Mitigation

  • Patch and update Google Chrome immediately.
  • Monitor network for signs of exploitation activity related to added KEVs.

Action items

  • Install latest security patches for affected software components.
  • Review CISA’s KEV catalog regularly for updates on exploitable vulnerabilities.

Detection IOCs

  • Use-after-free events in Google Chrome
  • Network traffic indicating exploitation attempts against known CVEs

Source link

https://thehackernews.com/2026/02/cisa-flags-four-security-flaws-under.html