CISA added CVE-2026-21962 to its Known Exploited Vulnerabilities Catalog more than six months after its initial disclosure.