Threat-intel deep dive: five KEV additions in the week ending 2026-06-04

In the six days ending 2026-06-04, CISA added five entries to the Known Exploited Vulnerabilities catalog: a PHP object-deserialization bug in a Magento cache extension, a mobile-OS integer overflow, a Linux container-escape primitive from 2022 still being reused, a network-facing WebLogic bug reachable over T3 and IIOP, and an authentication bypass in a widely deployed edge VPN.

Taken together, they confirm that "actively exploited" spans the full stack: e-commerce plugins, mobile runtimes, container hosts, legacy Java middleware, and perimeter appliances. This post covers each entry and lays out the defensive posture your detection engineers and platform teams should adopt now.

The five entries

Every claim below reflects the KEV notice text.

Why this batch matters

Four of the five are unauthenticated or local-to-code-execution primitives that give an attacker an initial foothold; the fifth (the Android Framework overflow) is the local-privilege step that turns a foothold into device compromise. Consider the chain: a PAN-OS authentication bypass lands a VPN session (CVE-2026-0257), internal reconnaissance finds an internet-adjacent WebLogic instance (CVE-2024-21182), and a container escape on a Linux worker follows (CVE-2022-0492). That is not a hypothetical kill chain. Every link is on KEV right now.

The Mirasvit CacheWarmer bug

PHP object-injection bugs in Magento extensions have a long history, and CVE-2026-45247 fits the pattern: attacker-controlled serialized data is passed to unserialize and the resulting object graph triggers a POP chain during destruction or method resolution. The KEV entry names the sink precisely: the CacheWarmer cookie. Because the vector is a cookie, no session, no CSRF token, and no admin path is required. Any unauthenticated HTTP request to the storefront can carry the payload.

Two defensive actions belong on the same change window:

  1. Patch or remove the extension. If patching cannot happen today, strip or reject the CacheWarmer cookie at your reverse proxy or WAF.
  2. Review historical logs. Cache-warmer traffic tends to be predictable and internal; unexpected external clients setting a CacheWarmer cookie are a strong indicator of a compromise attempt.

An NGINX snippet that quarantines the cookie without breaking the site is the kind of stopgap you can deploy in minutes:

map $http_cookie $has_cachewarmer {
    default 0;
    "~*(^|;\s*)CacheWarmer=" 1;
}

server {
    # ... existing config ...

    if ($has_cachewarmer) {
        return 403;
    }
}

Log every hit; a 403 on this map is a lead worth triaging.

Android Framework: CVE-2025-48595

Integer overflow in the Android Framework, exploitable for code execution and local privilege escalation. Mobile fleets that lag on monthly patch bulletins compound the exposure: a local-code-execution primitive is exactly what a malicious app or browser-delivered payload needs to escalate. Enterprise MDM policy should enforce the current security patch level; if it does not, this CVE is the argument for that change.

CVE-2022-0492: an old container-escape primitive, still working

The release_agent feature of cgroups v1 lets a process register a helper program that the kernel invokes when the last task in a cgroup exits. CVE-2022-0492 is an improper authentication issue in how that registration is validated: in a container with the right capability posture, a workload can point release_agent at an arbitrary host path and have the host execute it as root. This is a four-year-old bug on KEV now because attackers keep finding hosts that still expose the preconditions: cgroups v1 in use, containers running with unneeded capabilities, and no seccomp or AppArmor profile blocking the mount.

A hardening pass takes minutes and is worth doing today:

That last item carries the highest detection signal. A single audit rule wired into your EDR or auditd catches every known variant of this technique.

WebLogic over T3/IIOP: CVE-2024-21182

The KEV entry is deliberately vague ("unspecified vulnerability"), but the reachability is precise: unauthenticated attacker, network access via T3 or IIOP, up to full access to all WebLogic-accessible data. If you run WebLogic, network posture matters as much as the patch. T3 and IIOP should never be reachable from the internet, and inside the perimeter they should be reachable only from the hosts that need them. A quick discovery pass looks like this:

# T3 typically 7001; IIOP often 7001 or 7002. Adjust to your environment.
nmap -Pn -p 7001,7002 --open -oG - 10.0.0.0/8 \
  | awk '/Ports:/ {print $2, $0}'

Anything the scan surfaces that is not on your allowlist is a segmentation gap, patch or no patch.

PAN-OS authentication bypass: CVE-2026-0257

An authentication bypass that yields an unauthorized VPN connection is a direct bootstrap into your internal network. Two follow-through steps matter as much as the vendor patch: rotate any credentials reachable from the tunnel, and review VPN session logs for sessions that predate the fix and originate from unexpected geographies or ASNs. If your VPN concentrator does not log the client certificate fingerprint alongside the session, add that field now; it makes future retro-hunts tractable.

What to do this week

Verifiable security.