CISA Expands Known Exploited Vulnerabilities Catalog with Four Critical Issues

CISA added four actively exploited vulnerabilities to its Known Exploited Vulnerabilities Catalog: a Linux kernel uninitialized buffer memory-leak (CVE-2024-50302) and three VMware issues — an ESXi arbitrary kernel write (CVE-2025-22225, CVSS 8.2), a TOCTOU race enabling code execution (CVE-2025-22224, CVSS 9.3), and an out-of-bounds read information disclosure (CVE-2025-22226, CVSS 7.1). Organizations using affected Linux and VMware products are urged to prioritize patching, apply vendor guidance, and implement compensating controls to mitigate active exploitation risk.