CISA Adds Five Actively Exploited Vulnerabilities to the KEV Catalog

CISA added five vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation, urging organizations to prioritize remediation and reminding U.S. Federal Civilian Executive Branch (FCEB) agencies that BOD 22-01 requires fixes by mandated due dates. The newly added KEVs are CVE-2017-7921 (Hikvision improper authentication), CVE-2021-22681 (Rockwell insufficiently protected credentials), and three Apple issues: CVE-2021-30952 (integer overflow/wraparound), CVE-2023-41974 (iOS/iPadOS use-after-free), and CVE-2023-43000 (use-after-free affecting multiple Apple products). CISA emphasized that KEV-listed flaws are common attack vectors and represent elevated risk, even for non-federal organizations.

CISA’s public kev-data repository reflects the same update, increasing the catalog count from 1531 to 1536 and recording a remediation due date of 2026-03-26 for at least CVE-2017-7921 (with required action to apply vendor mitigations or discontinue use if unavailable). Separately, Cisco Talos published a 2025 CVE retrospective that provides broader context on the growing volume of vulnerabilities and KEV additions, noting a year-over-year increase in KEVs and highlighting persistent exploitation of older CVEs; however, it does not add incident-specific details about the five newly listed KEVs beyond reinforcing the operational importance of patching and compensating controls for unpatchable systems.