CISA Adds One Known Exploited Vulnerability to Catalog (CVE-2026-119977)

The Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-119977 to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation. The flaw stems from a Time-of-check Time-of-use (TOCTOU) race condition vulnerability in WordPress Core that can lead to system compromise on exposed web servers. Under Binding Operational Directive (BOD) 26-04, federal agencies and external enterprise organizations are instructed to prioritize immediate remediation of this vulnerability.

Source: CISA Cybersecurity Advisory

How Mangudai Discovers This Issue

Mangudai's port module detects publicly accessible WordPress instances on open HTTP/HTTPS ports and identifies unpatched WordPress Core versions by analyzing advertised metadata and asset version tags against CVE-2026-119977.

Continuous Autonomous AuditsMangudai scans target perimeters multiple times daily to catch configuration drift instantly.

Zero-Agent ArchitectureIdentifies exposure angles without requiring local installations or server access.

Check what your own domain exposes

A free scan lists the services, software versions, certificates and headers your domain shows to the internet, so you can see whether a flaw like this could apply to you. It reads what is visible from the outside; it does not confirm that a specific vulnerability can be exploited.

Launch Scan For My Domain