CISA adds six vulnerabilities to KEV Catalog after signs of active exploitation

CISA said on Aug. 26 that it added six vulnerabilities to its Known Exploited Vulnerabilities Catalog after finding evidence of active exploitation.

The agency said exploited vulnerabilities are a frequent attack vector for malicious cyber actors and can pose significant risks to the federal enterprise. It said the catalog is meant to help organizations focus remediation on flaws that are already being used in the wild.

The alert did not list the six CVE identifiers in the page text provided. It also did not name affected products, remediation deadlines, or any additional incident details.

CISA tied the alert to Binding Operational Directive 26-04, titled Prioritizing Security Updates Based on Risk. The directive applies to Federal Civilian Executive Branch agencies and requires them to prioritize rapid remediation of high-risk vulnerabilities, especially CVEs listed in CISA’s KEV Catalog on publicly exposed assets that can grant total control after exploitation.

The agency said the directive also sets expectations for checking whether threat actors compromised a system before patching. For other organizations, CISA said to use risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities.

CISA said it will keep adding vulnerabilities that meet the catalog’s criteria. The alert says potential KEV nominations must have a CVE ID, evidence of exploitation, and clear mitigation guidance.

What happens next

CISA said it will continue updating the catalog as new vulnerabilities meet its criteria. The alert did not give a timeline for remediation or identify the six vulnerabilities in the text provided.

Sources

• CISA alert: CISA adds six known exploited vulnerabilities to catalog

Editorial note: This article was prepared with AI assistance and includes source attribution for reader review.