CISA adds WordPress Core TOCTOU flaw to exploited vulnerabilities catalog

The agency says unauthenticated attackers could execute code during full-package core upgrades. Forensic triage is required under BOD 26-04.

By Noor Haddad, Threats and incidents correspondentPublished Nov 3, 2026, 20:51 UTC1 min read

Screenshot of the WordPress dashboard administration interface — The WordPress administrative dashboard, the software at the center of the CISA exploited-vulnerabilities alert. Photograph: JackPotte/Wikimedia Commons (CC BY-SA 3.0)

CISA added a WordPress Core vulnerability to its Known Exploited Vulnerabilities Catalog on Nov. 3, with a due date of Nov. 6, according to the agency's catalog page. The entry, CVE-2026-119977, describes a time-of-check time-of-use race condition that could let unauthenticated attackers execute code on a server during the full-package core upgrade window. CISA attributes this to predictable, web-accessible staging paths used during upgrades. The agency marks forensic triage as required under BOD 26-04.

Other recent additions appear on the same page. Ivanti Connect Secure vulnerabilities CVE-2026-111357 and CVE-2026-118527 were added Oct. 30, with due dates of Nov. 2 and Nov. 13. Cisco Secure Firewall ASA Software and Secure FTD Software CVE-2026-76418 was added Oct. 29, due Nov. 1. GitLab Community Edition and Enterprise Edition CVE-2026-97229 was added Oct. 29, due Nov. 1. Linux Kernel CVE-2026-46300 was added Oct. 28, due Oct. 31. Broadcom VMware ESX CVE-2026-41709 was added Oct. 28, due Nov. 11. Google Brotli CVE-2026-111497 was added Oct. 27, due Nov. 10. Adobe Commerce and Magento CVE-2026-48356 was added Oct. 27, due Nov. 10. PHP CVE-2026-109618 and CVE-2026-109619 were added Oct. 26, due Oct. 29. Collabora Online CVE-2026-110447 and Arista VeloCloud Orchestrator CVE-2026-114625 were added Oct. 23, due Oct. 26. Siemens Software Center CVE-2026-110936, Plex Media Server CVEs CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656, and EG Secure Solutions SiteGuard Server Edition CVE-2026-106931 were added Oct. 20, with due dates ranging from Oct. 23 to Nov. 3. Fortinet multiple products CVE-2025-61624 was added Oct. 16, due Oct. 19.

For every entry, CISA's action column tells organizations to apply mitigations in line with vendor instructions, comply with BOD 26-04, and discontinue use of the product if mitigations are unavailable. The agency lists "Known To Be Used in Ransomware Campaigns" as "Unknown" for each vulnerability. CISA's guidance requires stakeholders to evaluate each asset's internet exposure and adhere to BOD 26-04 patching guidelines.

Sources

Known Exploited Vulnerabilities Catalog | CISA, Cybersecurity and Infrastructure Security Agency CISA

Noor Haddad

Noor Haddad covers attacks, breach disclosures and exploited vulnerabilities for Five Nines. Noor writes from CISA and vendor advisories, SEC disclosures and published reporting.

Corrections. Report an error to corrections@thefivenines.com. We list substantive corrections on the corrections page.