CISA Adds Cisco, Chrome, and Arista Flaws to KEV Catalog Amid Active Exploitation

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog following reports of active exploitation. The vulnerabilities include CVE-2026-20245 in Cisco Catalyst SD-WAN Manager, CVE-2026-11645 in Google Chrome V8, and CVE-2026-7473 in Arista Extensible Operating System (EOS).

CVE-2026-20245 (CVSS 7.8) is an improper encoding or escaping of output vulnerability that could allow an authenticated, local attacker to execute arbitrary commands as root by supplying a crafted file. CVE-2026-11645 (CVSS 8.8) is an out-of-bounds read and write vulnerability in Google Chrome V8 that could allow a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. CVE-2026-7473 (CVSS 6.9) is an incomplete comparison with missing factors vulnerability in Arista EOS that could be exploited to process non-configured tunnel traffic.

Arista has acknowledged that CVE-2026-7473 is being exploited in the wild but has stated that no patches are planned, citing risks of breaking existing configurations. The company has provided mitigations involving ACLs on upstream or affected devices. Federal Civilian Executive Branch (FCEB) agencies are required to apply fixes or mitigations by June 23, 2026.