CISA Adds Qualcomm and VMware Flaws to Known Exploited Catalog

CISA added two high-priority vulnerabilities to its Known Exploited Vulnerabilities catalog: CVE-2026-21385, a Qualcomm graphics integer overflow that can trigger memory corruption and has been observed in limited targeted exploitation, and CVE-2026-22719, a Broadcom-tracked command injection in VMware Aria Operations (CVSS 8.1) enabling unauthenticated RCE with reports of possible in-the-wild exploitation; federal agencies are required to remediate the VMware issue by March 24, 2026.