Last week, the Cybersecurity and Infrastructure Security Agency (CISA) added a further 75 vulnerabilities to its Known Exploited Vulnerability Catalog. The Known Exploited Vulnerability Catalog is a list of vulnerabilities in software and operating systems that are known to be exploited in real-world attacks. The list now includes 737 vulnerabilities.
The latest additions came in three batches that were added on Tuesday (21), Wednesday (20), and Thursday (34). Under Binding Operational Directive (BOD) 22-01, all Federal Civilian Executive Branch (FCEB) agencies are required to scan for the vulnerabilities and ensure patches are applied or the vulnerabilities are otherwise mitigated within two weeks.
The majority of the vulnerabilities added to the list last week are not new flaws. In most cases, patches were released to address the laws several years ago and in some cases, the vulnerabilities were publicly disclosed 12 years ago. Some of the vulnerabilities affect products that have long since passed end-of-life, such as Adobe Flash Player, Virtual System/Server Administrator (VSA), Microsoft Silverlight, and InfoSphere BigInsights. If those solutions are still installed or in use, the products should be uninstalled or disconnected.
Recent vulnerabilities include the Cisco IOS XR open port vulnerability (CVE-2022-20821), a memory corruption vulnerability in multiple Apple products (CVE-2021-30883), and two vulnerabilities in the Android Kernel – a use-after-free vulnerability (CVE-2021-1048) and a race condition vulnerability (CVE-2021-0920).
The vulnerabilities affect products from the following vendors: Adobe, Android, Apple, Artifex, Cisco, Google, IBM, Kaseya, Linux, Meta Platforms, Microsoft, Mozilla, Oracle, QNAP, Red Hat, and WebKitGTK.
While BOD 22-01 only applies to FCEB agencies, CISA encourages all organizations to reduce their exposure to cyberattacks by ensuring the vulnerabilities on the Known Exploited Vulnerability Catalog are remediated in a timely manner as part of their vulnerability management practices.
The post CISA Adds 75 Vulnerabilities to the Known Exploited Vulnerability Catalog appeared first on HIPAA Journal.