CISA Warns of Active Exploits in Linux and Android Systems

WASHINGTON — The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued a critical alert on Tuesday warning federal agencies and critical infrastructure operators of active cyberattacks exploiting high-severity vulnerabilities in the Linux kernel and Android operating system.

The agency added two specific Common Vulnerabilities and Exposures (CVEs) to its Known Exploited Vulnerabilities (KEV) catalog, signaling that threat actors are actively weaponizing these flaws. The directive mandates that federal agencies patch the identified systems immediately to prevent unauthorized access and data compromise.

The vulnerabilities affect a broad range of devices, from enterprise servers running Linux to consumer and industrial mobile devices utilizing Android. CISA stated that the exploitation of these flaws poses a significant risk to national security and the integrity of critical infrastructure sectors, including energy, transportation, and financial services.

Security officials emphasized that the vulnerabilities allow attackers to execute arbitrary code with elevated privileges, potentially enabling them to take full control of affected systems. The agency noted that the attacks are sophisticated and likely orchestrated by state-sponsored groups or organized criminal syndicates seeking to disrupt operations or exfiltrate sensitive data.

CISA’s warning comes as part of a broader effort to coordinate cybersecurity defenses across the public and private sectors. The agency urged organizations to review their systems for the specific CVEs and apply available patches without delay. For entities unable to patch immediately, CISA recommended implementing compensating controls, such as network segmentation and enhanced monitoring, to mitigate the risk of exploitation.

The alert underscores the growing threat landscape facing digital infrastructure, where software vulnerabilities are increasingly targeted by adversaries. While CISA has not disclosed the full scope of the attacks or the specific entities targeted, the inclusion of the CVEs in the KEV catalog indicates confirmed active exploitation in the wild.

Federal agencies are required to report their compliance status to CISA within 14 days of the alert. The agency will continue to monitor the situation and provide updates as new information becomes available. Industry experts warn that the window for exploitation may remain open until all affected systems are patched, leaving organizations vulnerable to further attacks.

Questions remain regarding the origin of the attacks and whether any significant data breaches have already occurred. CISA has not confirmed any specific incidents but advised organizations to assume compromise if they have not yet remediated the vulnerabilities. The agency’s warning serves as a stark reminder of the persistent and evolving nature of cyber threats targeting critical systems.