41.3 F
Washington D.C.
Friday, March 29, 2024

CISA Adds 15 Known Exploited Vulnerabilities to Catalog

BOD 22-01 requires FCEB agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats.

CISA has added 15 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence that threat actors are actively exploiting the vulnerabilities listed in the table below. These types of vulnerabilities are a frequent attack vector for malicious cyber actors of all types and pose significant risk to the federal enterprise.

CVE Number CVE Title Remediation Due Date
CVE-2021-36934 Microsoft Windows SAM Local Privilege Escalation Vulnerability 2/24/2022
CVE-2020-0796 Microsoft SMBv3 Remote Code Execution Vulnerability 8/10/2022
CVE-2018-1000861 Jenkins Stapler Web Framework Deserialization of Untrusted Data Vulnerability 8/10/2022
CVE-2017-9791 Apache Struts 1 Improper Input Validation Vulnerability 8/10/2022
CVE-2017-8464 Microsoft Windows Shell (.lnk) Remote Code Execution Vulnerability 8/10/2022
CVE-2017-10271 Oracle Corporation WebLogic Server Remote Code Execution Vulnerability 8/10/2022
CVE-2017-0263 Microsoft Win32k Privilege Escalation Vulnerability 8/10/2022
CVE-2017-0262 Microsoft Office Remote Code Execution Vulnerability 8/10/2022
CVE-2017-0145 Microsoft SMBv1 Remote Code Execution Vulnerability 8/10/2022
CVE-2017-0144 Microsoft SMBv1 Remote Code Execution Vulnerability 8/10/2022
CVE-2016-3088 Apache ActiveMQ Improper Input Validation Vulnerability 8/10/2022
CVE-2015-2051 D-Link DIR-645 Router Remote Code Execution 8/10/2022
CVE-2015-1635 Microsoft HTTP.sys Remote Code Execution Vulnerability 8/10/2022
CVE-2015-1130 Apple OS X Authentication Bypass Vulnerability 8/10/2022
CVE-2014-4404 Apple OS X Heap-Based Buffer Overflow Vulnerability 8/10/2022

Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the Known Exploited Vulnerabilities Catalog as a living list of known CVEs that carry significant risk to the federal enterprise. BOD 22-01 requires FCEB agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information.

Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the Catalog that meet the meet the specified criteria.

Read more at CISA

CISA Adds 15 Known Exploited Vulnerabilities to Catalog Homeland Security Today
Homeland Security Today
The Government Technology & Services Coalition's Homeland Security Today (HSToday) is the premier news and information resource for the homeland security community, dedicated to elevating the discussions and insights that can support a safe and secure nation. A non-profit magazine and media platform, HSToday provides readers with the whole story, placing facts and comments in context to inform debate and drive realistic solutions to some of the nation’s most vexing security challenges.
Homeland Security Today
Homeland Security Todayhttp://www.hstoday.us
The Government Technology & Services Coalition's Homeland Security Today (HSToday) is the premier news and information resource for the homeland security community, dedicated to elevating the discussions and insights that can support a safe and secure nation. A non-profit magazine and media platform, HSToday provides readers with the whole story, placing facts and comments in context to inform debate and drive realistic solutions to some of the nation’s most vexing security challenges.

Related Articles

Latest Articles