CISA KEV 09 Jun 2026: 3 exploited flaws in Google, Cisco, Arista
3 vulnerabilities
AI-generated illustration by CyberShitty. Not a photograph or a document from the organisations named.
On 9 June 2026, CISA added 3 actively exploited vulnerabilities affecting Google, Cisco, Arista to its Known Exploited Vulnerabilities catalog. If you run any of these products, patch or mitigate now — exploitation is already happening.
CVE-2026-11645Federal deadline
In this section
Google Chromium V8 Out-of-Bounds Read and Write Vulnerability
Google / Chromium V8 / CWE-787, CWE-125
Google Chromium V8 out-of-bounds read and write vulnerability that could allow a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Cisco Catalyst SD-WAN Manager Improper Encoding or Escaping of Output Vulnerability
Cisco / Catalyst SD-WAN Manager / CWE-116
Cisco Catalyst SD-WAN Manager formerly SD-WAN vManage contains an improper encoding or escaping of output vulnerability. This vulnerability could allow an authenticated, local attacker to execute arbitrary commands as root by supplying a crafted file to the affected system.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Arista Extensible Operating System Incomplete Comparison with Missing Factors Vulnerability
Arista / Extensible Operating System / CWE-1023
Arista Extensible Operating System (EOS) contains an incomplete comparison with missing factors vulnerability when the switch incorrectly decapsulate and forwards other unexpected tunneled packet with a destination IP matching its configured decapsulation IP.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
