CISA Flags Actively Exploited Vulnerabilities in SolarWinds Web Help Desk and Major Platforms

CISA added multiple vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, triggering mandatory remediation timelines for U.S. federal civilian agencies. The newly listed issues include an actively exploited flaw in SolarWinds Web Help Desk (CVE-2025-40536) with an accelerated patch deadline, alongside additional KEV additions affecting Apple platforms (iOS, macOS, tvOS, watchOS, visionOS), Microsoft products, and Notepad++. Apple stated it was aware of reports the issue “may have been exploited in an extremely sophisticated attack against specific targeted individuals,” with Google Threat Analysis Group credited with discovery, underscoring continued targeting of high-value users via mobile/endpoint zero-days.

Separate reporting highlighted the broader operational context driving these directives: Microsoft’s February security update addressed 59 vulnerabilities, including six zero-days under active exploitation, reinforcing that exploit timelines are compressing and patching is increasingly a “defense sprint.” In parallel, CISA also moved to reduce systemic exposure at the perimeter by ordering agencies to remove unsupported network edge devices (e.g., firewalls/routers) within a year, reflecting concern that end-of-support infrastructure and rapidly weaponized vulnerabilities are converging into a persistent, high-impact federal risk.