2026-06-03: CISA adds Oracle WebLogic CVE-2024-21182 to KEV catalog after active exploitation with federal

Show Notes - 2026-06-03

Stories Covered

• June 3, 2026
• Today:
• Oracle WebLogic CVE-2024-21182 Actively Exploited (CVE-2024-21182) [Critical Alerts]
• Google Patches Exploited Android Zero-Day (CVE-2025-48595) [Critical Alerts]
• Linux Kernel Privilege Escalation Added to KEV (CVE-2022-0492) [Critical Alerts]
• Unpatched NTLM Coercion in Windows Search URI Handler (No CVE) [Windows / AD Security]
• Microsoft Backtracks on Zero-Day Researcher Legal Threats [General Security News]
• VS Code Zero-Day Allows GitHub Token Theft via Link Click [General Security News]
• AI-Built Ransomware Toolkit Automates EDR Evasion [General Security News]
• DriveSurge Campaign Hijacks Thousands of Sites for Malware Delivery [General Security News]
• Exchange Online Outage Causes Email Delays and Failures [General Security News]
• Gamaredon Exploits WinRAR to Deliver Malware Against Ukraine [Ransomware & Extortion]
• WordPress Kirki Plugin Privilege Escalation Exploited (CVE-2026-8206) [Vulnerability Disclosures]
• Microsoft Office Vulnerability (CVE-2026-21509) Used by APT28 [Vulnerability Disclosures]

CVEs Referenced

CVE-2022-0492, CVE-2024-21182, CVE-2025-48595, CVE-2025-8088, CVE-2026-21509, CVE-2026-33825, CVE-2026-33829, CVE-2026-41091, CVE-2026-45498, CVE-2026-8206

Indicators of Compromise

IP Addresses: 12.2.1.4, 14.1.1.0

Read the full brief