CISA Adds One Known Exploited Vulnerability to Catalog | CISA
Catalog has a newly disclosed security flaw that anyone running it should be aware of.
Catalog has a newly disclosed security flaw that anyone running it should know about.
This requires local or already-authenticated access to reach.
CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation.
BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA’s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities.
Aware of an exploited vulnerability not currently listed in the KEV Catalog?
We recently updated our anonymous product survey ; we welcome your feedback.
Anyone running Catalog is exposed, specifically wherever Catalog is actually deployed rather than just licensed or installed somewhere unused.
This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.
BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied.
What an attacker actually gains: the advisory describes a real security impact once the vulnerable path is reached.
Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies.
While BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities .
CISA will continue to add vulnerabilities to the catalog that meet the specified criteria .
Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance.
Confirm whether Catalog is present anywhere in your asset and software inventory.
No exploitation has been reported yet, but that status can change, so keep watching vendor guidance while you remediate.
What happened
Catalog has a newly disclosed security flaw that anyone running it should be aware of.
This vulnerability requires local or already-authenticated access to be exploited.
CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation.
What changed
BOD 26-04 reinforces the importance of the KEV Catalog and mandates that federal agencies prioritize the rapid remediation of high-risk vulnerabilities, particularly those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA’s KEV Catalog on publicly exposed assets that allow total control post-exploitation, while deferring action on lower-risk vulnerabilities.
If you are aware of an exploited vulnerability not currently listed in the KEV Catalog, please report it.
We have recently updated our anonymous product survey and welcome your feedback.
Who is affected
Anyone running Catalog is at risk, particularly in environments where Catalog is actively deployed rather than merely licensed or installed in unused locations.
This type of vulnerability is a common attack vector for malicious cyber actors and poses significant risks to the federal enterprise.
BOD 26-04 further establishes clear expectations for when agencies must verify whether threat actors have compromised the system prior to the application of the patch.
Why it matters
The advisory outlines the actual security impact an attacker can achieve once the vulnerable path is exploited.
Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies.
Although BOD 26-04 applies exclusively to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize the remediation of vulnerabilities listed in the KEV Catalog.
Technical details
CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.
Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance.
What security teams should do
Confirm whether Catalog is included in your asset and software inventory.
While no exploitation has been reported yet, that status can change, so monitor vendor guidance while you work on remediation.
Attribution
CISA: CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation.
What to watch next
Watch for additional victim details, indicators of compromise and follow-on exploitation reports.
Watch for revised vendor guidance, fixed versions and mitigation updates.