Week of June 1, 2026: CISA Warns on Tank Gauge Hacking, Adds Four KEV Flaws

Security leaders watched CISA's joint warning about compromised automatic tank gauge systems across the energy, chemical, food and transportation sectors, alongside four new Known Exploited Vulnerabilities Catalog additions covering Oracle WebLogic Server, Linux Kernel, Android Framework, Mirasvit's Magento cache extension, and SolarWinds Serv-U. Phillips 66 also installed a new Chief Information Security Officer effective June 1, 2026, part of a broader round of cybersecurity leadership appointments reported for the week.

CISA Adds Oracle WebLogic Flaw to Known Exploited Vulnerabilities Catalog

CISA opened the week by adding CVE-2024-21182, an unspecified vulnerability in Oracle WebLogic Server, to its Known Exploited Vulnerabilities Catalog on June 1, 2026, citing evidence of active exploitation. The addition set a remediation deadline for Federal Civilian Executive Branch agencies under Binding Operational Directive 22-01, and CISA again encouraged all organizations to fold the WebLogic flaw into vulnerability management programs given its history as a target for malicious cyber actors. (CISA)

Phillips 66 Names Connie Devine Chief Information Security Officer

Phillips 66 promoted Connie Devine to Chief Information Security Officer effective June 1, 2026, succeeding Michael Morgan after she served as the company's Deputy CISO for more than a year. Devine's prior roles included positions at Excelerate Energy, ExxonMobil, and Honeywell. The move was one of several cybersecurity leadership changes reported for the week, alongside new appointments covering CISO, CTO, and CMO roles at firms including Cyera, Apiiro, and the Department of the Air Force. (SecurityWeek)

CISA, FBI, NSA and Partners Urge Hardening of Automatic Tank Gauge Systems

CISA, the FBI, NSA, DOE, EPA, TSA, DOT and USDA published a joint fact sheet on June 2, 2026, warning that cyber threat actors had compromised internet-exposed automatic tank gauge systems used across the Energy, Chemical, Food and Agriculture, and Transportation Systems sectors. The agencies said attackers modified device settings through command execution after gaining unauthorized access, and urged owners to use strong passwords, remove ATG systems from the internet, and enable logging. The activity had not yet been attributed to a specific group. (CISA)

CISA Adds Linux Kernel and Android Framework Bugs to KEV Catalog

CISA added two vulnerabilities to its Known Exploited Vulnerabilities Catalog on June 2, 2026: CVE-2022-0492, an improper authentication flaw in the Linux Kernel, and CVE-2025-48595, an integer overflow in the Android Framework. Both were added based on evidence of active exploitation, triggering remediation deadlines for federal civilian agencies under Binding Operational Directive 22-01. CISA again urged all organizations, not just federal agencies, to prioritize patching the vulnerabilities as part of ongoing vulnerability management practice. (CISA)

CISA Flags Mirasvit Magento Cache Warmer Flaw as Actively Exploited

CISA added CVE-2026-45247, a deserialization of untrusted data vulnerability in Mirasvit's Full Page Cache Warmer extension, to its Known Exploited Vulnerabilities Catalog on June 3, 2026, based on evidence of active exploitation. The entry affected a third-party Magento caching module and carried the standard Binding Operational Directive 22-01 remediation deadline for federal civilian agencies, while CISA again urged broader organizations to prioritize the fix as part of routine vulnerability management. (CISA)

CISA Adds SolarWinds Serv-U Flaw to Known Exploited Vulnerabilities Catalog

CISA added CVE-2026-28318, an uncontrolled resource consumption vulnerability in SolarWinds Serv-U, to its Known Exploited Vulnerabilities Catalog on June 5, 2026, citing evidence of active exploitation. The addition triggered remediation deadlines for Federal Civilian Executive Branch agencies under Binding Operational Directive 22-01, and CISA urged all organizations to prioritize patching. Serv-U file transfer software has previously drawn attention from threat actors, and the catalog entry gave network defenders a new flag for patch management pipelines. (CISA)