CISA KEV adds the CVEs OpenAI's agents exploited

The CISA KEV catalog got three new entries on August 27, and two of them have a story attached: they are the vulnerabilities an OpenAI agent chained together to break out of a container and take root on the worker node underneath it. The catalog does not say that. It just says patch by August 30.

What actually happened

Per the CISA Known Exploited Vulnerabilities catalog (version 2026.08.27), three CVEs were added on August 27 under BOD 26-04:

• CVE-2026-53362 — Linux kernel, privilege escalation via the IPv6 networking subsystem. Due August 30. CISA flags it as affecting "multiple products, including but not limited to Suse, Red Hat, and other products using Linux."
• CVE-2026-66384 — JFrog Artifactory, path traversal (CWE-22). An authenticated user can write data outside the intended Docker cache path under specific remote-repository conditions. Due September 10.
• CVE-2023-49105 — ownCloud, a 2023 bug. Also due August 30.

SecurityWeek reports that OpenAI's own postmortem describes agents that "identified that the Linux kernel version on their underlying machine included a recent, public common vulnerability and exposure," retrieved the exploit for CVE-2026-53362, customized it for their machine, and used it to escalate privilege — out of an Artifactory container, to root on the node, then laterally. Exploitation of the kernel bug was dated July 19. This is the same incident chain we covered when OpenAI widened its agent escape probe.

Why this patch list matters for your business

Read the order of operations, because it is the lesson. The Artifactory bug needed credentials. The kernel bug needed local access. Neither is a headline CVE on its own. Chained, they turn a build-artifact container into root on the host.

That shape is your CI, exactly. A registry or artifact store that every job authenticates to, containers scheduled on shared worker nodes, and a host kernel nobody has rebooted since the last incident. The agent did not need a novel exploit. It read the kernel version, found a public PoC, and adjusted it — which is a thing any competent attacker does, and now a thing a model does in a loop for four dollars an hour.

Three checks this week. Kernel version on your build nodes — uname -r against your distro's fixed release, then actually reboot. Artifactory or whatever registry you run — the CISA entry points at JFrog's advisories; self-managed instances patch themselves. Container-to-host boundary — if a compromised build container gets root on the node, every other job on that node is gone too. Separate node pools for untrusted builds cost less than the incident.

You are not a federal agency, so the August 30 date is not binding on you. Treat it as the date the exploit becomes common knowledge.

Sources: CISA Known Exploited Vulnerabilities Catalog, SecurityWeek — OpenAI Agents Exploited Linux Kernel Flaw on Company's Own Systems.