CISA adds CVE-2026-116779 to KEV on 2026-11-09, sets remediation due date 2026-11-12
CISA added CVE-2026-116779 to the KEV on 2026-11-09 with a due date of 2026-11-12; agencies were urged to patch within three days. Track vendor and CISA advisories for technical details and apply fixes.
- Urgency
- L4
- 85
- 75
- 100
- 20
- 85
At a glance
On 2026-11-09 CISA added CVE-2026-116779 to its Known Exploited Vulnerabilities catalogue and set a remediation due date of 2026-11-12. Security reporting notes CISA urged federal agencies to patch within three days and that the issue has been observed in attacks. Operators should monitor vendor advisories and CISA publications for technical details and apply mitigations or patches as required.
- CISA added CVE-2026-116779 to the KEV on 2026-11-09 with a due date of 2026-11-12; agencies were urged to patch within three days. Track vendor and CISA advisories for technical details and apply fixes.
CHRONOS Wire · November 10 · Alert 16
What happened
U.S. cyber authorities added a vulnerability identified as CVE-2026-116779 to their Known Exploited Vulnerabilities list on 2026-11-09 and gave agencies a short remediation deadline of 2026-11-12. The listing signals that the flaw has been observed in attacks and federal agencies are being urged to apply fixes or mitigations quickly.
Why it matters
KEV placement obliges federal agencies to meet a short remediation timeline and public reporting indicates observed exploitation, increasing near-term risk for exposed systems.
CHRONOS Bottom Line
CVE-2026-116779 was added to the CISA KEV on 2026-11-09 with a remediation due date of 2026-11-12; federal agencies were urged to patch within three days and public reporting indicates observed exploitation.
Full detail
What changed
CISA added CVE-2026-116779 to the Known Exploited Vulnerabilities catalogue on 2026-11-09 and assigned a remediation due date of 2026-11-12, with reporting that the issue has been observed in attacks and a three-day remediation request for federal agencies.
What is genuinely new
The KEV listing for CVE-2026-116779 was posted on 2026-11-09 with a due date of 2026-11-12 and public reporting notes observed exploitation and a three-day remediation request for federal agencies.
Detailed analysis
Public sources confirm CISA placed CVE-2026-116779 on the KEV on 2026-11-09 with a remediation due date of 2026-11-12 and that reporting characterizes the issue as observed in attacks and subject to a three-day remediation request for federal agencies. Technical specifics, vendor advisories, and exploit counts are not present in the provided excerpts and require follow-up on vendor pages and CISA advisories for full technical and scope details.
U.S. Impact
Current impact
Low
CISA urged federal agencies to patch within three days of the KEV addition; exact remediation status across agencies is not publicly reported.
Potential impact
Elevated
Federal civilian agencies are required to remediate KEV-listed vulnerabilities within the specified due date under BOD 26-04, creating immediate patching and compliance workloads.
- Impact type
- Direct
- Confidence
- High
U.S. Impact is an analytical assessment of the estimated current and potential effects on the United States. It is not a probability forecast.