Skip to content

Back to the catalog

cisa.govadvisory

CISA Adds One Known Exploited Vulnerability to Catalog

CISA added CVE-2026-119977, a WordPress Core time-of-check time-of-use (TOCTOU) race condition, to its Known Exploited Vulnerabilities Catalog on 3 November 2026, citing evidence of active exploitation. The alert restates BOD 26-04, which requires Federal Civilian Executive Branch agencies to prioritise fast remediation of KEV entries on exposed assets and to check for prior compromise. It also links the KEV nomination form.

TL;DR CISA lists WordPress Core TOCTOU race condition CVE-2026-119977 as actively exploited and reminds agencies of BOD 26-04 deadlines.
Open original ↗

Organisations named here

  • CISA

CVEs named here

  • CVE-2026-119977

Technologies named here

  • WordPress Core
  • Known Exploited Vulnerabilities Catalog
  • CISA KEV Nomination Form
  • WordPress

Standards and laws named here

  • BOD 26-04

Techniques named here

  • Time-of-check Time-of-use Race Condition
  • Risk-based vulnerability management
  • TOCTOU race condition

Concepts named here

  • Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk

Also named here

  • CISA KEV

Related in AppSec