CISA added two flaws to its Known Exploited Vulnerabilities (KEV) catalogue on 2 June 2026 with a tight 5 June deadline1. The older one, CVE-2022-0492, is a four-year-old Linux cgroups bug, where cgroups are the kernel feature that fences off container resources; it lets a process break out of its container and reach root on the host underneath.
Alongside it sat CVE-2025-48595, a CVSS 8.4 integer-overflow elevation-of-privilege flaw across Android 14, 15 and 16, which lets an attacker already on the device climb to higher rights through a malicious app2. A container runtime and a mobile handset in one listing capture the breadth of the problem: the Office bug CISA surfaced in April had sat dormant for 17 years before exploitation, the same dynamic by which a 2022 kernel flaw resurfaces now.
For a defender triaging this batch, the cgroups entry is the more dangerous of the two. Cloud and Kubernetes estates run thousands of containers on shared hosts, and an escape to root on the host collapses the isolation those workloads depend on. CISA gave it three days where the WebLogic flaw in the same week got 21, because an attacker breaking out of a container moves faster than a patched maintenance window allows. The fix assumed applied in 2022 is the one to confirm first.
