CISA Adds Two Known Exploited Vulnerabilities to Catalog | CISA
Catalog has a newly disclosed security flaw that users should be aware of.
Catalog has a newly disclosed security flaw that anyone running it should know about.
This requires local or already-authenticated access to reach.
CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation.
BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA’s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities.
Aware of an exploited vulnerability not currently listed in the KEV Catalog?
We recently updated our anonymous product survey ; we welcome your feedback.
Anyone running Catalog is exposed, specifically wherever Catalog is actually deployed rather than just licensed or installed somewhere unused.
These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.
BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied.
What an attacker actually gains: the advisory describes a real security impact once the vulnerable path is reached.
Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies.
While BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities .
CISA will continue to add vulnerabilities to the catalog that meet the specified criteria .
Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance.
Confirm whether Catalog is present anywhere in your asset and software inventory.
No exploitation has been reported yet, but that status can change, so keep watching vendor guidance while you remediate.
What happened
Catalog has a newly disclosed security flaw that users should be aware of.
This vulnerability requires local or already-authenticated access to exploit.
CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog due to evidence of active exploitation.
What changed
BOD 26-04 emphasizes the importance of the KEV Catalog and mandates that federal agencies prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA’s KEV Catalog, particularly on publicly exposed assets that allow total control post-exploitation, while deferring action on lower-risk vulnerabilities.
If you are aware of an exploited vulnerability that is not currently listed in the KEV Catalog,
we have recently updated our anonymous product survey and welcome your feedback.
Who is affected
Anyone running Catalog is at risk, especially in environments where Catalog is actively deployed rather than just licensed or installed but unused.
These types of vulnerabilities are frequently targeted by malicious cyber actors and pose significant risks to the federal enterprise.
BOD 26-04 further establishes expectations for when agencies must verify whether threat actors compromised the system before the patch was applied.
Why it matters
The advisory outlines the actual security impact an attacker can achieve once the vulnerable path is exploited.
Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk sets forth vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies.
While BOD 26-04 is applicable only to FCEB agencies, CISA encourages all organizations to implement risk-based vulnerability management and prioritize remediation of vulnerabilities in the KEV Catalog.
Technical details
CISA will continue to add vulnerabilities to the catalog that meet the established criteria.
Potential additions to the KEV Catalog must have a CVE ID, evidence of exploitation, and clear mitigation guidance.
What security teams should do
Verify whether Catalog is present in your asset and software inventory.
Although no exploitation has been reported yet, this status may change, so continue to monitor vendor guidance as you remediate.
Attribution
CISA: CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation.
What to watch next
Watch for additional victim details, indicators of compromise and follow-on exploitation reports.
Watch for revised vendor guidance, fixed versions and mitigation updates.