The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two (2) actively exploited privilege escalation vulnerabilities affecting Android and Linux systems to its Known Exploited Vulnerabilities (KEV) catalog, requiring federal agencies to remediate them by no later than June 5, 2026. The first flaw, tracked as CVE-2025-48595, is a high-severity integer overflow vulnerability in the Android Framework that affects Android 14 through 16 and can be exploited without user interaction to gain elevated privileges. Google has indicated the flaw may be under limited targeted exploitation and addressed it through its June 2026 Android security updates. The second vulnerability, tracked as CVE-2022-0492, impacts the Linux kernel’s cgroups v1 subsystem and allows attackers to bypass namespace isolation, escalate privileges, and potentially escape from containers to gain root access on the host system. By abusing the release_agent mechanism, attackers can execute malicious scripts with root privileges, making the flaw particularly dangerous in containerized environments that rely on cgroups and namespaces for isolation. While technical details of the Linux vulnerability have been public since 2022, recent reporting indicates it is now being actively exploited in the wild, prompting its addition to the KEV catalog. Although neither vulnerability is currently linked to ransomware activity, CISA’s inclusion of both flaws highlights the elevated risk they pose and the urgent need for organizations to apply available patches and mitigations to prevent compromise of enterprise, cloud, and mobile environments. CTIX analysts urge readers to upgrade their instances to the most recent version to prevent exploitation.