WASHINGTON — The remediation window for three actively exploited Linux kernel vulnerabilities closes today for federal civilian agencies. It is one of the most demanding deadlines yet under the Cybersecurity and Infrastructure Security Agency’s (CISA) new risk-based patching directive, and it arrives less than two weeks after Microsoft shipped the largest security update in its history.
On Sept. 18, CISA added CVE-2025-39682, CVE-2025-39964 and CVE-2026-53266 to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. Under Binding Operational Directive (BOD) 26-04, Federal Civilian Executive Branch (FCEB) agencies were given until Sept. 21 to act. The flaws were also marked for forensic triage, which means agencies must fix affected systems and check whether they were already compromised.
A second deadline follows tomorrow. By Sept. 22, agencies must remediate two Windows privilege-escalation zero-days that Microsoft disclosed on Sept. 8 in a release covering 974 CVEs. Together, the two deadlines are the clearest picture so far of how the directive works when defenders face heavy volume and high urgency at once.
A Directive Built for This Moment
CISA issued BOD 26-04, “Prioritizing Security Updates Based on Risk,” on June 10, 2026. It revoked two directives that had shaped federal vulnerability management for years: BOD 19-02, which set remediation deadlines for internet-accessible systems, and BOD 22-01, which created the KEV catalog and applied one flat deadline to every entry.
The new directive scores each vulnerability on four variables: whether the affected asset is publicly exposed, whether the flaw appears in the KEV catalog, whether an adversary can automate exploitation, and whether exploitation gives an attacker partial or total control of the system. The combination of those answers sets the deadline. The most dangerous combinations must be fixed within three days, and the directive’s lowest-risk tier lets agencies defer the fix until a scheduled system upgrade.
The directive’s reasoning is spelled out in its text. “Cyber threat actors exploit unpatched vulnerabilities, and their use of AI may further narrow the time defenders have to react between patch release and possible exploitation,” CISA wrote.
The forensic-triage requirement is what separates the new model from its predecessors. For the highest-risk tier, the directive states that agencies must “complete remediation or mitigation action within the timeline (three days) and carry out a forensic triage of the asset to assess whether the system is compromised.” Under BOD 22-01, closing a KEV entry mostly meant applying the patch. Under BOD 26-04, agencies must also determine whether an attacker got in before the patch was applied.
Three Kernel Flaws, One Short Clock
The three Linux vulnerabilities affect different parts of the kernel:
- CVE-2025-39682 (CVSS 9.8) is an improper-condition check in the kernel’s Transport Layer Security (TLS) receive path. A zero-length record can bypass intended record-type handling.
- CVE-2026-53266 (CVSS 8.8) is an out-of-bounds write in the netfilter bridge ebtables SNAT target. It can occur during an Address Resolution Protocol (ARP) rewrite and could allow a local attacker to corrupt memory or escalate privileges.
- CVE-2025-39964 (CVSS 7.8) is a race condition in the AF_ALG cryptographic socket interface. A local attacker could use it to crash a system or corrupt the results of cryptographic operations.
CISA has not attributed the exploitation to any threat actor. Red Hat issued advisories for all three flaws early on Sept. 19 and warned that “there are known public exploits leveraging this vulnerability,” urging customers to address it “with high priority.”
The timing makes the deadline hard to meet. The flaws entered the catalog on a Friday, and the deadline falls on a Sunday. Linux runs across federal cloud workloads, network appliances, container hosts and embedded systems, and many of those systems are managed by contractors or run as vendor-maintained appliances. On those systems, agencies may have to wait for a vendor to ship a patched kernel. The forensic-triage requirement adds work on top of patching: security teams must review logs and look for signs of compromise on each exposed system within the same three days.
The Microsoft Backdrop: 974 Fixes in One Day
The kernel deadline follows a Patch Tuesday that set a new industry record. On Sept. 8, Microsoft fixed 974 CVEs, surpassing the 622 it shipped in July and more than doubling August’s 421. For comparison, The Register reported that Microsoft fixed 1,130 CVEs across all of 2025. Windows accounted for 723 of September’s fixes, the Office suite for 222 and SQL Server for 62, according to SecurityWeek.
Two of the flaws were already being exploited. CVE-2026-85880 is a heap-based buffer overflow in Windows Advanced Local Procedure Call (ALPC), and CVE-2026-81963 is an improper link-resolution flaw in the Windows Update Stack. Both allow an attacker who already has a foothold to escalate to SYSTEM-level privileges. CISA added both to the KEV catalog the same day, along with an actively exploited Adobe Commerce and Magento template-injection flaw (CVE-2026-75650, which researchers call “StyleSmuggler”) and an N-able N-central code-injection vulnerability (CVE-2026-86218).
The deadlines for those entries show the tiered model in practice. The Magento flaw can be exploited remotely without authentication against internet-facing storefronts, and agencies had until Sept. 11 to fix it. The two Windows flaws require local access, and agencies were given 14 days, until Sept. 22.
The zero-days were not the only serious problems in the release. Microsoft also fixed 20 flaws that researchers described as wormable, meaning they allow remote code execution without authentication or user interaction. They affect core network services including DHCP Server, Active Directory, Windows DNS Server, the SMB client, Netlogon, NFS, Routing and Remote Access, IP Helper and Message Queuing. One DNS flaw, CVE-2026-69730, rated CVSS 9.8, has been called a “spiritual successor” to SigRed, the critical Windows DNS bug disclosed in 2020. A Remote Desktop Services use-after-free flaw, CVE-2026-69525, also rated 9.8, lets an unauthenticated attacker on the same network run arbitrary code.
Researchers largely agree on what is driving the volume. Tenable’s Satnam Narang linked the surge to AI-assisted vulnerability discovery, which he said is producing far more findings for defenders to sort through. The Zero Day Initiative, in its own analysis, suggested that record-size releases now appear to be “the new normal.”
Why the Old Model Would Have Buckled
Under BOD 22-01, every KEV entry carried the same fixed deadline regardless of where the vulnerable system sat or what an attacker could do with it. In a month with this much volume, that model would have given the same urgency to a local privilege-escalation bug on an isolated workstation and a remotely exploitable flaw on an internet-facing server.
BOD 26-04 treats those cases differently. A wormable DNS flaw on a publicly exposed server moves to the front of the queue, while the same flaw on a system with no internet exposure gets a longer deadline. The directive also recalculates as conditions change. If an agency takes a vulnerable system off the public internet, its “publicly exposed” status changes and its deadline gets longer. That gives agencies a legitimate way to reduce risk while they wait for a vendor patch.
The model depends on agencies knowing exactly which of their assets are reachable from the internet. That is why the directive requires agencies to identify and tag all publicly reachable assets within 180 days. The same 180-day window, which runs to December 2026, is when agencies must fully align their processes with the directive’s timeline tables. Agencies that have not finished that inventory work are making this month’s tiering decisions with incomplete information.
The Resilience Question Behind the Patching
Patching deadlines are only part of how the federal government is preparing for a serious cyber incident. On Sept. 18, the same day the kernel flaws entered the catalog, CISA announced Cyber Storm X, the tenth exercise in its 20-year national cyber exercise series. According to the agency, about 2,000 participants from more than 200 organizations took part in a simulated nation-state campaign against transportation systems, including rail and ports, and against the water and wastewater sector.
“Cyber Storm helps critical infrastructure owners and operators understand how we would manage a large-scale cyber incident,” said Acting CISA Director Nick Andersen. CISA said it will publish lessons learned in a public after-action report.
The exercise and the directive address different parts of the same problem. Cyber Storm tests coordination after an intrusion has already occurred. BOD 26-04’s forensic-triage requirement is meant to find intrusions that may already have happened before defenders knew about a flaw.
What Agencies and Contractors Should Do Now
BOD 26-04 legally binds only FCEB agencies. However, federal contractors that operate or support covered systems are expected to help agencies comply, and cloud providers authorized under FedRAMP face related requirements. Private-sector critical infrastructure operators also have reason to follow the same priorities, because the KEV catalog tracks flaws that attackers are actively using. Security teams should consider the following steps:
- Confirm Linux kernel patch status today on every publicly exposed Linux asset, including vendor appliances. Where no patch exists yet, remove the system from internet exposure.
- Document forensic triage, not just patching. Keep records showing that each system in the three-day tier was checked for signs of compromise, including log review and integrity checks.
- Close out the Windows ALPC and Update Stack zero-days before the Sept. 22 deadline. Prioritize systems where an attacker may already have a local foothold.
- Sort the rest of the September release by exposure. Fix wormable DNS, DHCP, Netlogon and RDS flaws on reachable servers before lower-risk Office and developer-tool updates.
- Finish the asset inventory. Tiering decisions under BOD 26-04 are only as reliable as an organization’s knowledge of which assets are publicly exposed.
The directive was written for a period in which AI-assisted research is finding vulnerabilities faster than defenders can patch them. September’s releases are the first sustained test of whether risk-based prioritization can keep pace. The results will depend on agencies’ asset inventories and on how thoroughly they carry out the forensic checks, not only on whether patches are applied by the deadline.