CISA's addition of CVE-2025-39682 to its Known Exploited Vulnerabilities catalog on September 18, 2026, highlights an important cybersecurity concern: a vulnerability that was patched months earlier can remain a serious threat when affected systems have not received the fix. The flaw affects the Linux kernel's TLS receive path and involves incorrect handling of a zero-length TLS record. Its inclusion in the KEV catalog indicates that CISA has evidence of exploitation, making it a priority for organisations operating potentially affected Linux systems. 

The vulnerability is particularly significant because it affects kernel TLS, commonly known as kTLS, which allows certain TLS record-processing operations to occur within the Linux kernel. Although TLS is designed to protect the confidentiality and integrity of communications, encryption cannot compensate for weaknesses in the software that processes encrypted traffic. A specially constructed or unexpected record sequence can expose implementation errors even when the underlying cryptographic protocol remains secure.

The technical issue involves incorrect handling of records retrieved from an internal receive queue. Under specific circumstances, an initial zero-length record can cause the receive logic to proceed with incorrect assumptions about subsequent records and their processing. This illustrates how an overlooked edge case in low-level networking code can undermine an important security boundary. Such vulnerabilities deserve particular attention because kernel code operates with privileges that ordinary applications do not possess.

CISA's confirmation of exploitation changes the urgency of remediation. However, the public advisory does not establish that every Linux system is vulnerable, identify a specific threat actor or confirm that the flaw is being used in ransomware campaigns. Actual exposure depends on the affected kernel code, deployed configuration and relevant functionality. Organisations should therefore determine which systems are genuinely affected rather than assuming that every Linux installation has identical exposure.

The vulnerability is relevant to Linux servers, cloud workloads, networking infrastructure and embedded security appliances that may incorporate affected kernel components. Administrators should consult their distribution or product vendor's security advisory, verify whether the correction has been backported and confirm that the patched kernel is actually running. Installing an updated kernel package without completing a required reboot may leave vulnerable code active.

Patching must also be distinguished from incident investigation. Applying the fix prevents future exploitation through the identified weakness, but it cannot establish whether an attacker previously compromised an exposed system. Where suspicious activity warrants investigation, organisations should review relevant system logs, process activity and network telemetry. Unexpected failures alone should not be treated as definitive indicators of exploitation without supporting evidence.

The broader lesson is that security protocols and secure implementations are two separate requirements. TLS can provide strong protection for data in transit, but the software responsible for receiving and processing TLS records must also handle unusual and potentially malicious input safely. Critical infrastructure components such as operating-system kernels, networking services and security appliances require continuous vulnerability management, even when their underlying technologies are mature and widely trusted.

The central cybersecurity lesson is clear: a previously fixed vulnerability can become an active threat wherever vulnerable code remains deployed. Organisations must maintain visibility into their kernel versions, verify security updates and prioritise known exploited vulnerabilities before attackers can take advantage of them.

CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2025-39682 Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise. Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA’s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied. While BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities . CISA will continue to add vulnerabilities to the catalog that meet the specified criteria . Aware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through C

Source: CISA Adds One Known Exploited Vulnerability to Catalog via CISA Advisories — published 18 Sep 2026.