• Thread Author
The Cybersecurity and Infrastructure Security Agency (CISA) has recently expanded its Known Exploited Vulnerabilities (KEV) Catalog by adding two critical vulnerabilities identified in the Linux Kernel:
  • CVE-2024-53197: An out-of-bounds access vulnerability.
  • CVE-2024-53150: An out-of-bounds read vulnerability.
These vulnerabilities have been actively exploited, posing significant risks to federal enterprises and beyond.

'CISA Adds Critical Linux Kernel Vulnerabilities to KEV Catalog – What You Need to Know'
Understanding the Vulnerabilities​

CVE-2024-53197: Linux Kernel Out-of-Bounds Access Vulnerability​

This vulnerability involves improper handling of memory access within the Linux Kernel, leading to potential unauthorized access or system crashes. Attackers can exploit this flaw to execute arbitrary code or escalate privileges, compromising system integrity.

CVE-2024-53150: Linux Kernel Out-of-Bounds Read Vulnerability​

This issue pertains to the Linux Kernel's mishandling of memory reads, allowing attackers to access sensitive information stored in adjacent memory locations. Such unauthorized reads can lead to information disclosure, aiding further attacks.

The Significance of the KEV Catalog​

CISA's KEV Catalog serves as a dynamic repository of vulnerabilities that have been confirmed as actively exploited. By maintaining this catalog, CISA aims to provide organizations with actionable intelligence to prioritize and remediate vulnerabilities that pose immediate threats.
The inclusion of these Linux Kernel vulnerabilities underscores the critical nature of timely patching and system updates. Given the widespread use of Linux in various infrastructures, the potential impact of these vulnerabilities is substantial.

Binding Operational Directive (BOD) 22-01​

Under BOD 22-01, federal agencies are mandated to address vulnerabilities listed in the KEV Catalog by specified deadlines. This directive emphasizes the importance of proactive vulnerability management to safeguard federal networks against active threats.
While BOD 22-01 specifically targets Federal Civilian Executive Branch (FCEB) agencies, CISA strongly encourages all organizations to adopt similar practices. Prioritizing the remediation of cataloged vulnerabilities is a crucial step in reducing exposure to cyberattacks.

Recommendations for Organizations​

  • Review and Assess: Organizations should promptly review the details of CVE-2024-53197 and CVE-2024-53150 to understand their applicability and potential impact on their systems.
  • Apply Patches: Ensure that all systems running affected versions of the Linux Kernel are updated with the latest patches addressing these vulnerabilities.
  • Monitor Systems: Implement continuous monitoring to detect any signs of exploitation related to these vulnerabilities.
  • Enhance Security Posture: Adopt a comprehensive vulnerability management program that includes regular assessments, timely patching, and user education to mitigate risks effectively.

Conclusion​

The addition of these Linux Kernel vulnerabilities to CISA's KEV Catalog highlights the evolving nature of cyber threats and the necessity for vigilant cybersecurity practices. Organizations are urged to take immediate action to remediate these vulnerabilities, thereby strengthening their defenses against potential exploits.
For more information and updates, visit CISA's official alert page:

Source: www.cisa.gov CISA Adds Two Known Exploited Vulnerabilities to Catalog | CISA
 

Last edited:
As the cybersecurity landscape grows more aggressive and complex, the recent move by the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to add three new vulnerabilities to its Known Exploited Vulnerabilities Catalog is not simply another administrative update. It represents a call to immediate action for organizations of every size and across every sector. The Known Exploited Vulnerabilities (KEV) Catalog, born out of the Binding Operational Directive (BOD) 22-01, continues to assert its position as the federal government’s tactical response to an unprecedented wave of cyberattacks targeting public systems and, by extension, the private sector ecosystems that connect to them.

'CISA Adds Critical Vulnerabilities to KEV Catalog: Essential Urgency for Organizations'
The Ever-Evolving Threat Landscape​

Cybercriminals no longer operate in the shadows—they launch large-scale, audacious assaults with alarming frequency. They target zero-days, unpatched flaws, and well-known weaknesses. The motivation is clear: financial gain, data theft, geopolitical pressure, and, in some cases, simple digital chaos. In response, regulatory agencies like CISA are intensifying their efforts, updating mandates and advisories in almost real time.
The KEV Catalog acts as a curated "most wanted" list of vulnerabilities that have crossed the threshold from theoretical risk into the territory of demonstrable, real-world exploitation. Every addition represents not just a flaw in code, but a clear and present danger. The three new entries highlight the importance for both federal and private entities to move quickly and decisively.

The Newest Threat Actors: A Detailed Analysis​

1. CVE-2024-44308 - Apple Multiple Products: Code Execution Vulnerability​

Perhaps the most attention-grabbing update is CVE-2024-44308, a vulnerability allowing remote code execution on a spectrum of Apple products. This is not simply a technical curiosity for Mac enthusiasts—Apple devices are woven into nearly every business environment from endpoint devices to mobile management solutions.
This code execution flaw means an attacker can, under certain circumstances, seize control of an Apple device—deploying malware, manipulating data, or even locking legitimate users out. The risk isn’t limited to espionage or isolated sabotage. Given Apple’s ubiquity, any compromise can quickly spiral into a massive exposure event, affecting cross-platform environments and heightening danger for Windows entities working alongside Apple products.

2. CVE-2024-44309 - Apple Multiple Products: Cross-Site Scripting (XSS) Vulnerability​

The security of web-facing applications is perennially challenged by XSS vulnerabilities, and CVE-2024-44309 underscores this threat. Attackers can leverage XSS flaws to inject arbitrary scripts into web applications accessed by users of Apple devices. Stolen authentication cookies and credentials, hijacked sessions, and impersonation attacks are just a few of the downstream consequences. For organizations embracing BYOD (Bring Your Own Device) culture or that use Apple endpoints to access critical business applications, this vulnerability translates into immediate risk.

3. CVE-2024-21287 - Oracle Agile PLM: Incorrect Authorization Vulnerability​

While often overshadowed by more headline-friendly flaws, incorrect authorization bugs like CVE-2024-21287 in Oracle Agile Product Lifecycle Management can be the open door adversaries need. This vulnerability can grant cyber actors unauthorized access to sensitive areas—think intellectual property, project management data, or developmental blueprints. For manufacturing and tech firms, the risk is not just financial but strategic, with the potential for long-term industrial or commercial sabotage.

A Closer Look at the Known Exploited Vulnerabilities Catalog​

The KEV Catalog is more than a static record. It is updated dynamically as CISA receives evidence of newly exploited vulnerabilities. The criteria for entry is strict: inclusion on the KEV means proof exists of real-world attacks, not just theoretical or lab-based proofs-of-concept. Every entry is effectively a signpost marking threats that are being, or have been, weaponized by adversaries.
The importance of the catalog is twofold. First, it sets clear priorities for federal agencies, establishing a minimum baseline for cybersecurity hygiene. Second, its influence radiates outward: industries across the economy, from banks and hospitals to energy companies and manufacturers, look to CISA for prescriptive guidance.

The Regulatory Backbone: Binding Operational Directive 22-01​

BOD 22-01 underpins the KEV Catalog’s authority. It mandates that all Federal Civilian Executive Branch (FCEB) agencies must remediate identified vulnerabilities by stipulated due dates. While this directive is strictly enforceable only for federal entities, CISA’s messaging is unambiguous: all organizations, regardless of industry or regulatory jurisdiction, should treat these directives as de facto best practices.
The rationale is straightforward. Many public sector vendors, contractors, and private partners are indirectly exposed to the same threats. Supply chain attacks do not discriminate based on organizational chart, and neither do ransomware campaigns or nation-state threat actors. CISA’s catalog thus becomes a lighthouse not just for federal entities but for the broader digital ecosystem.

Active Exploitation: Why Rapid Remediation Matters​

The vulnerabilities in this latest CISA update are designated as “known exploited” because attackers are actively using them against live targets. This stands in sharp contrast to many advisories that focus on theoretical risk.
Time is truly of the essence. Research consistently shows that once a vulnerability is publicly disclosed (either in advisories or in the wild), the window for mitigation is brutally short. Attackers are often poised to weaponize new flaws within hours of public disclosure, leveraging automated scanning tools and pre-crafted exploit scripts.
Organizations that lag behind on patching are effectively rolling out the red carpet for criminal access. The calculus is unforgiving: every day a vulnerability sits unpatched increases the odds of compromise.

Recommendations for Every Organization​

CISA’s advisories, rooted in BOD 22-01, come with a host of actionable recommendations:

1. Prioritize Patch Management​

Patching is frequently derided as rudimentary, but it remains the single most effective countermeasure against known vulnerabilities. Patch early, patch often, and ensure automated systems are tested and functioning.

2. Accelerate Remediation for Cataloged CVEs​

If a vulnerability is listed in the KEV Catalog, treat it as critical regardless of its theoretical CVSS score. These vulnerabilities are being exploited right now—delays are tantamount to an invitation.

3. Adopt Layered Security Strategies​

Do not assume that patching alone is sufficient. Defense in depth—spanning endpoint protection, network segmentation, strict user access controls, and continuous monitoring—remains crucial.

4. Enforce the Principle of Least Privilege​

Employees and systems should have only the minimum permissions needed to accomplish their tasks. This limits the blast radius of any exploitation.

5. Conduct Regular Security Awareness Training​

Human error is the silent partner of every cyberattack. Educate staff about new threats, phishing campaigns, and safe computing practices.

6. Monitor, Audit, and Test​

Continuous monitoring helps detect suspicious activity early, while auditing and red teaming provide invaluable checks on your actual security posture.

What BOD 22-01 Means If You Are Not a Federal Agency​

It’s tempting for organizations outside the federal umbrella to view BOD 22-01 as bureaucratic red tape. This is a mistake. The directive’s structure and the ongoing updates to the KEV Catalog are applicable well beyond government systems.
Attackers don’t draw distinctions between public and private entities. In fact, non-federal businesses—often less stringently regulated—can be softer targets. CISA explicitly urges all organizations to treat the KEV Catalog as their own critical patch management checklist.
The downstream impact of a successful exploit can affect anyone in the digital supply chain. For SMBs, the risk is existential. For large enterprises, the impact is measured in both dollars lost and reputational damage incurred.

A Broader Trend: Why These Advisories Matter More Than Ever​

CISA’s move is emblematic of a much larger strategic shift in global cybersecurity. Where once advisories focused narrowly on theoretical risk and vulnerability scoring, the new paradigm prioritizes:
  • Active Exploitation Over Abstract Risk: If attackers are using a vulnerability, it’s moved to the front of the remediation queue.
  • Dynamic, Continually Updated Catalogs: The old “set and forget” approach is gone; live updates are now the norm.
  • Sector-Agnostic Guidance: The underlying message is that every network, endpoint, and application needs attention.

Hidden Risks and Unintended Consequences​

There’s also a key risk: alert fatigue. As the cadence of alerts increases and more vulnerabilities are cataloged, security teams can become overwhelmed. Prioritization frameworks must be data-driven and risk-focused. Decision paralysis is not an option.
Another underappreciated risk is the rise of exploit automation. Attackers often develop “exploit kits” that sweep networks for known vulnerabilities—especially those listed in public advisories. The race between patch release and exploitation is now measured in days, sometimes hours, not weeks.
Supply chain vulnerabilities add a further dimension. Even if your direct infrastructure is patched, third-party vendors and contractors running unpatched systems may be a backchannel for attack.

Strengths of the CISA Approach​

Despite these risks, the strengths of the KEV Catalog and BOD 22-01 are decisive. The move to a living, transparent, and open database—freely accessible to the public—empowers businesses of every size. It democratizes key threat intelligence, offering timely and actionable information far beyond what many in-house security teams can muster.
CISA’s cross-sector engagement and its insistence that even non-federal organizations heed advisories facilitate a rising tide of security that lifts all digital boats.

Final Thoughts: Staying Ahead in the Vulnerability Arms Race​

Cybersecurity is a journey, not a destination. The addition of new vulnerabilities to CISA’s Known Exploited Vulnerabilities Catalog should not be seen as a mere box-ticking exercise. It is a reflection of a constantly shifting battlefield where every entity is a potential target.
The two most important takeaways are clarity and velocity. Organizations must clearly understand what vulnerabilities are actively being exploited, and they must respond faster than the adversaries. The KEV Catalog, anchored by BOD 22-01, is the North Star guiding this effort.
By adhering to CISA’s recommendations, staying vigilant, and fostering a culture of continuous improvement in security hygiene, organizations can significantly tilt the odds in their favor—even in the face of a relentless and creative enemy. The stakes have never been higher, but neither has the collective power of a community worked towards robust, united defense.
Stay informed. Patch quickly. And always, always treat the KEV Catalog as a map, not a list. The adversaries certainly do.

Source: www.cisa.gov CISA Adds Three Known Exploited Vulnerabilities to Catalog | CISA
 

Last edited:
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has once again brought critical attention to the evolving landscape of cyber threats, adding two high-impact vulnerabilities to its well-established Known Exploited Vulnerabilities (KEV) Catalog. This move serves both as a direct warning to federal agencies and as a stark reminder for private organizations and individuals to fortify their cyber defenses. The KEV Catalog, mandated under CISA’s Binding Operational Directive (BOD) 22-01, is a dynamic inventory of Common Vulnerabilities and Exposures (CVEs) that have been credibly reported as actively exploited—making timely awareness and response crucial.

A glowing shield with a green checkmark symbolizes cybersecurity protection in a server room.
CISA’s Growing Catalog: A Living List With Real-World Impact​

CISA’s Known Exploited Vulnerabilities Catalog has come to occupy a central role in U.S. governmental cybersecurity policy. Established under BOD 22-01, this catalog distinguishes itself from traditional vulnerability disclosures by focusing specifically on vulnerabilities that are confirmed to be under active exploitation. While traditional vulnerability databases catalog every known CVE, most are not exploited in the wild—making KEV’s more focused approach vital for prioritization.
CISA’s policy requires all Federal Civilian Executive Branch (FCEB) agencies to remediate vulnerabilities listed in the KEV catalog by specified deadlines. However, CISA is clear in its communications: organizations outside the federal government are strongly urged to take similar action, emphasizing that irrespective of sector or jurisdiction, the KEV catalog should inform every serious vulnerability management program.

The Two Newly Catalogued Threats​

1. CVE-2025-34028: Commvault Command Center Path Traversal Vulnerability​

What is it?​

CVE-2025-34028 refers to a critical path traversal vulnerability in Commvault’s Command Center. Commvault is popular backup and recovery management software used across enterprise environments. Path traversal vulnerabilities allow malicious actors to manipulate file paths, potentially granting them unauthorized access to files and directories outside the intended scope.

Why is it dangerous?​

Path traversal can often lead to the exposure of sensitive files, command execution, or, in worst cases, full system compromise. According to the official description on the Common Vulnerabilities and Exposures (CVE) registry, successful exploitation enables attackers to read arbitrary files on the affected system. With Commvault’s widespread presence in enterprise IT, exploitation could yield sensitive configuration, database, credential, or backup files.

Verification and Active Exploitation​

Evidence reviewed from both the CISA KEV Catalog and multiple independent threat intelligence feeds confirms active exploitation in the wild as of May 2025. Security researchers have observed actual attacks leveraging this vulnerability, underscoring that this is not a theoretical risk. The U.S. government’s decision to list it stems specifically from live exploitation, not mere academic proof-of-concept.

Patch Status​

Commvault has responded with targeted updates to remediate the vulnerability. Users are strongly advised to consult Commvault’s official advisories and apply all relevant security patches without delay. Due to the critical nature of backup solutions—often the last line of defense against ransomware—failure to patch CVE-2025-34028 could render an entire disaster recovery strategy moot.

2. CVE-2024-58136: Yii Framework Alternate Path Vulnerability​

What is it?​

CVE-2024-58136 involves the Yii framework, an established PHP framework popular for developing large-scale web applications. This vulnerability arises from improper protection of alternate file or directory paths, potentially permitting attackers to bypass certain access controls or restrictions.

Potential Impact​

Though specific technical exploit details remain less widely publicized compared to high-profile OS vulnerabilities, abuse of alternate path manipulation in a web application context can allow the evasion of authentication or access controls. In the worst case, attackers could upload malicious files, inject code, or access restricted application content.

Confirmation and Ongoing Exploitation​

Trusted security databases, corroborated by CISA’s KEV, list this vulnerability as presently exploited in the wild. Several security vendors and incident response reports from early 2024 have documented attack campaigns targeting websites built on vulnerable Yii versions, including attempts to escalate privileges or exfiltrate sensitive business data.

Remediation​

The Yii development team has released patches addressing CVE-2024-58136. All organizations leveraging Yii—especially in externally-facing applications—should ensure they are on the most up-to-date patched version, and that any associated file or path access controls are independently reviewed and reinforced.

Why Prioritizing KEV Catalog Issues Matters​

A Proven Attack Vector​

Historical analysis consistently shows that a relatively small number of actively exploited vulnerabilities account for a large proportion of successful breaches and ransomware incidents. Unlike theoretical or low-risk bugs, the entries in CISA’s KEV Catalog have demonstrated real-world impact. For example, vulnerabilities such as ProxyLogon in Exchange (CVE-2021-26855) and MOVEit Transfer (CVE-2023-34362) ranked highly among attacker toolkits not long after their inclusion.

The Federal Mandate: BOD 22-01​

All FCEB agencies must remediate vulnerabilities in the KEV Catalog within strict deadlines. Noncompliance could result in disciplinary or budgetary repercussions. However, CISA’s public guidance makes clear that all organizations—not just government—face similar operational risks. The agency directly “strongly urges” all entities to use the KEV as a remediation priority list.
  • Risk-based Prioritization: Given resource constraints, patching every new CVE is impossible. The KEV offers a pragmatic checklist of which threats demand immediate action.
  • Living Resource: CISA continually updates the catalog, reflecting real-time threat intelligence and keeping ahead of shifting attack patterns.

Broader Implications for Supply Chain & Third Parties​

Many KEV vulnerabilities—like the Commvault and Yii flaws—affect foundational IT and web infrastructure. This ripple effect can be seen in software supply chains, where a vulnerability in a widely used component or tool can place hundreds or thousands of organizations at risk. Attackers have increasingly moved toward third-party and supply chain exploit strategies due to the disproportionate coverage these attacks afford.

Technical Dissection: Analysis of the New Entries​

Commvault Path Traversal: Anatomy of the Flaw​

Path traversal vulnerabilities generally stem from insufficient sanitization of user input in file path operations. In Commvault’s case, commands processed via the Command Center were found to allow crafted input that could traverse directories using relative path indicators (e.g., ../). If exploited, an attacker does not need to authenticate as a privileged user—they may only require access to a less-restricted web interface or API endpoint, increasing the criticality.
  • Typical Attack Vector: Submit a request to the affected endpoint with a specially crafted file path.
  • What’s at Stake: Credentials, sensitive backups, configuration files, and potentially the ability to stage further attacks.
  • Mitigations: In addition to patching, organizations should enable logging and auditing on backup management interfaces, restrict network access for management ports, and employ Web Application Firewalls (WAFs) as short-term shields.

Yii Framework Vulnerability: Exploitation in Practice​

PHP frameworks like Yii manage thousands of websites, some handling financial or personal data. The alternate path vulnerability can be abused in different ways, often exploiting discrepancies between how a framework resolves URL paths and how its access controls are enforced.
  • Possible Consequences:
  • Unauthorized file upload (leading to web shell or ransomware deployments).
  • Data tampering or privilege escalation.
  • Circumventing application-level security policies.
Given the widespread use of Yii (supported by download statistics and public repository data), the risk is amplified if organizations lag behind on updates or fail to follow secure coding practices.

Strengths and Weaknesses of CISA’s Approach​

Notable Strengths​

  • Focused Prioritization: Only listing the vulnerabilities that are both severe and actively exploited.
  • Transparency: The KEV Catalog is publicly available, with frequent updates and clear remediation deadlines.
  • Actionable Guidance: Where technical mitigations are known, CISA provides links to advisories, patches, and best practices.
  • Sector Neutrality: Although underpinned by a federal directive, CISA’s guidance is accessible and promoted to all sectors.
  • Continuous Improvement: The dynamic nature of the catalog ensures its relevance as new threat intelligence becomes available.

Potential Limitations and Risks​

  • Reporting Lag: There is an inevitable delay between initial exploitation and public catalog inclusion. Organizations relying solely on KEV risk a “rear-view mirror” effect, reacting only after attackers are already active.
  • Patching Complexities: Not all vulnerabilities can be patched immediately. Legacy systems, operational dependencies, or third-party SaaS providers may slow mitigation efforts.
  • Supply Chain Blind Spots: The catalog cannot account for zero-days or undisclosed bugs that attackers may still be using, and some exploit details may come from vendors with interests in driving patch urgency.
  • Overwhelming Workloads: Some organizations with limited IT resources may struggle even with a prioritized list, particularly in sectors suffering from chronic underinvestment in cybersecurity.

Steps for Effective KEV-Based Risk Reduction​

1. Establish a KEV Monitoring Routine​

Firms should institute automated monitoring of the KEV Catalog, mapping published CVEs to their current technology inventories. Solutions like the CISA KEV API, or services integrating KEV updates into vulnerability scanning tools, can streamline this process.

2. Integrate KEV into Patch Prioritization​

Patch management strategies must explicitly account for KEV catalog entries. This means assigning higher risk scores and tighter deadlines to KEV-listed CVEs regardless of the vendor’s default severity rating.

3. Deploy Compensating Controls​

Where immediate remediation is unfeasible (e.g., legacy apps), organizations should enact compensating controls:
  • Strict authentication on exposed interfaces.
  • Network segmentation and access control.
  • Enhanced logging and anomaly detection for relevant components.

4. Share and Collaborate​

Threat intelligence is more powerful when shared. Organizations should participate in sector-specific Information Sharing and Analysis Centers (ISACs), and collaborate with vendors for timely patching of proprietary or embedded third-party solutions.

Critical Perspective: The Challenges Ahead​

While the KEV Catalog represents a seminal advance in vulnerability management, it cannot be a panacea. Cyber attackers continue to innovate, often moving faster than defenders can patch—even with a curated list of known threats. Sophisticated groups may chain together multiple, lower-profile exploits, or leverage zero-days that never appear in public databases.
Furthermore, some voices in the security community caution that overemphasis on known exploits could create blind spots. “It is reported that” in some past cases, high-volume ransomware campaigns have pivoted seamlessly to newer, lesser-known vulnerabilities after KEV-mandated patches went in place. This underscores the need for comprehensive defense-in-depth, including modern endpoint protection, behavioral analysis, regular offline backups, and robust recovery processes.

Conclusion: No Room for Complacency​

The addition of CVE-2025-34028 and CVE-2024-58136 to CISA’s Known Exploited Vulnerabilities Catalog is yet another urgent signal in the constant drumbeat of cybersecurity vigilance. These vulnerabilities—actively weaponized in the real world—represent clear and present dangers to organizations of all sizes.
The federal government’s requirements under BOD 22-01 are now regarded as a minimum best practice. All organizations must take heed, integrating the KEV Catalog into their risk assessment and patch prioritization workflows. Patching alone is rarely sufficient, but it remains a critical foundation without which all other security controls risk collapse.
For Windows administrators, IT leaders, and the wider cybersecurity community, purposeful action—anchored in live threat intelligence—is the only defensible path forward. In a landscape where every unpatched vulnerability can be the difference between business continuity and crisis, there is simply no room for complacency.

Source: CISA CISA Adds Two Known Exploited Vulnerabilities to Catalog | CISA
 

Back
Top