Loading story…
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has expanded its Known Exploited Vulnerabilities (KEV) Catalog by adding five new security flaws that are currently under active exploitation. The vulnerabilities include CVE-2021-21311 affecting Adminer, CVE-2025-20352 impacting Cisco IOS and IOS XE, CVE-2025-10035 in Fortra GoAnywhere MFT, CVE-2025-59689 in Libraesva Email Security Gateway, and CVE-2025-32463 in Sudo. The Adminer flaw is a Server-Side Request Forgery (SSRF) vulnerability that allows attackers to manipulate URL parameters, potentially enabling unauthorized access to internal resources and facilitating lateral movement within networks. The Cisco IOS and IOS XE vulnerability is a stack-based buffer overflow in the SNMP subsystem, which can be exploited by sending crafted SNMP packets, leading to denial of service or remote code execution as root, depending on attacker privileges. Fortra GoAnywhere MFT is affected by a critical deserialization vulnerability in its License Servlet, which could allow attackers to execute arbitrary code. Libraesva ESG suffers from a command injection vulnerability, and Sudo is impacted by a flaw involving the inclusion of functionality from an untrusted control sphere. CISA’s Product Security Incident Response Team (PSIRT) has confirmed that these vulnerabilities are being actively exploited in the wild. The addition of these flaws to the KEV Catalog is based on credible evidence of exploitation, and CISA has issued a Binding Operational Directive (BOD) 22-01 requiring Federal Civilian Executive Branch (FCEB) agencies to remediate these vulnerabilities by specified deadlines. The directive aims to reduce significant risk to federal networks, but CISA also strongly urges all organizations, not just federal agencies, to prioritize remediation of these vulnerabilities as part of their vulnerability management programs. The vulnerabilities span a range of critical systems, including database management tools, network operating systems, email security gateways, and managed file transfer platforms, highlighting the broad attack surface targeted by malicious actors. The Adminer SSRF vulnerability, with a CVSS score of 7.2, affects versions 4.0.0 to just before 4.7.9, while the Cisco IOS/IOS XE flaw, with a CVSS score of 7.7, impacts all devices with SNMP enabled. The Fortra GoAnywhere MFT vulnerability is rated as critical with a CVSS score of 10.0, underscoring the urgency of remediation. CISA’s ongoing updates to the KEV Catalog reflect the evolving threat landscape and the need for organizations to remain vigilant against actively exploited vulnerabilities. Organizations are encouraged to consult the KEV Catalog regularly and implement timely patches to mitigate the risk of compromise. The inclusion of these vulnerabilities in the KEV Catalog serves as a warning to both public and private sector entities about the heightened risk posed by these flaws. Failure to address these vulnerabilities could result in significant operational disruptions or unauthorized access to sensitive systems. CISA’s alert emphasizes the importance of proactive vulnerability management and cross-sector collaboration to defend against active cyber threats.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
CISA flagged four additional security vulnerabilities as actively exploited and added them to its Known Exploited Vulnerabilities Catalog. As with other KEV updates, the action signals required remediation timelines for federal agencies and broader patching urgency for defenders.
CISA added five vulnerabilities affecting Adminer, Cisco IOS/IOS XE, Fortra GoAnywhere MFT, Libraesva Email Security Gateway, and Sudo to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. The agency said Federal Civilian Executive Branch agencies must remediate them by the specified BOD 22-01 deadlines and urged all organizations to prioritize patching.
5 references tracked. Mallory keeps watching after this page renders.
thehackernews.com
Open sourcethecyberthrone.in
Open sourcesecurityaffairs.com
Open sourcethecyberexpress.com
Open sourcecisa.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Cybersecurity and Infrastructure Security Agency (CISA) has expanded its Known Exploited Vulnerabilities (KEV) Catalog to include several new security flaws that have been actively exploited in the wild. The newly added vulnerabilities span a wide range of products and platforms, including GNU Bash, Smartbedded Meteobridge, Juniper ScreenOS, Jenkins, Samsung mobile devices, and several legacy products from Mozilla, Microsoft, Linux, and Oracle. Among the most notable is the GNU Bash command injection flaw (CVE-2014-6278), a Shellshock-related vulnerability that allows remote attackers to execute arbitrary code on affected Linux and Unix systems. Juniper ScreenOS is affected by an improper authentication vulnerability (CVE-2015-7755), which can grant attackers administrative access via TELNET or SSH. Jenkins is impacted by a remote code execution bug (CVE-2017-1000353) that enables unauthenticated attackers to bypass deserialization safeguards through crafted Java objects. The Smartbedded Meteobridge device is vulnerable to a command injection issue (CVE-2025-4008), allowing remote, unauthenticated users to execute root-level commands through its web interface. Samsung mobile devices are at risk due to an out-of-bounds write flaw (CVE-2025-21043) in libimagecodec.quram.so, which can be exploited remotely for arbitrary code execution. CISA also added vulnerabilities such as CVE-2010-3765 (Mozilla products), CVE-2010-3962 (Microsoft Internet Explorer), CVE-2011-3402 and CVE-2013-3918 (Microsoft Windows), CVE-2021-22555 (Linux Kernel), CVE-2021-43226 (Microsoft Windows), and CVE-2025-61882 (Oracle E-Business Suite), all of which have evidence of active exploitation. Federal agencies have been directed to remediate these vulnerabilities by a specified deadline to comply with Binding Operational Directive (BOD) 22-01, which mandates timely mitigation of known exploited vulnerabilities. The directive is designed to reduce significant risk to the federal enterprise by ensuring that actively exploited vulnerabilities are addressed promptly. While BOD 22-01 is mandatory for Federal Civilian Executive Branch agencies, CISA strongly encourages all organizations to prioritize remediation of KEV Catalog vulnerabilities as part of their vulnerability management programs. The addition of these vulnerabilities underscores the persistent threat posed by both legacy and modern software flaws, and highlights the importance of continuous monitoring and rapid response to newly discovered exploits. CISA’s ongoing updates to the KEV Catalog serve as a critical resource for organizations seeking to defend against active cyber threats. The agency’s alert emphasizes that these vulnerabilities are frequent attack vectors for malicious actors and pose significant risks if left unaddressed. Organizations are advised to consult the KEV Catalog regularly and implement recommended mitigations to protect their networks. The inclusion of both recent and older vulnerabilities in the catalog reflects the reality that unpatched legacy systems remain a significant target for attackers. CISA’s proactive approach aims to drive widespread remediation efforts across both public and private sectors. The agency will continue to update the KEV Catalog as new evidence of exploitation emerges, reinforcing the need for vigilance and timely patching in cybersecurity operations.
Jun 29, 2026
The Cybersecurity and Infrastructure Security Agency (CISA) has expanded its Known Exploited Vulnerabilities (KEV) Catalog by adding six new vulnerabilities that are currently being exploited in the wild. This update includes five vulnerabilities announced on October 14, 2025, and one additional vulnerability added on October 15, 2025. The vulnerabilities affect a range of widely used products, including Microsoft Windows, Rapid7 Velociraptor, SKYSEA Client View, IGEL OS, and Adobe Experience Manager. Among the most critical is CVE-2025-24990, an elevation of privilege flaw in the Agere Modem driver bundled with all Windows releases, which allows local attackers to gain SYSTEM-level access through untrusted pointer dereference. Microsoft addressed this issue by removing the vulnerable driver in the October 2025 Patch Tuesday update, though this may impact dependent hardware. Another significant vulnerability is CVE-2025-54253, a code execution flaw in Adobe Experience Manager Forms, which has been confirmed as actively exploited and poses a substantial risk to federal and enterprise environments. The Rapid7 Velociraptor vulnerability (CVE-2025-6264) involves incorrect default permissions, potentially allowing unauthorized access or privilege escalation. SKYSEA Client View is affected by an improper authentication vulnerability (CVE-2016-7836), while IGEL OS faces a risk from the use of expired cryptographic keys (CVE-2025-47827). Additionally, Microsoft Windows is impacted by an improper access control vulnerability (CVE-2025-59230). CISA’s KEV Catalog serves as a critical resource for tracking vulnerabilities that are confirmed to be exploited in real-world attacks, and federal agencies are mandated under Binding Operational Directive (BOD) 22-01 to remediate these vulnerabilities by specified deadlines. CISA strongly encourages all organizations, not just federal agencies, to prioritize patching these vulnerabilities to reduce exposure to active cyber threats. The addition of these vulnerabilities underscores the ongoing risk posed by unpatched systems and the importance of timely remediation. CISA’s public alerts emphasize that these vulnerabilities are not theoretical and are being leveraged by malicious actors in current attack campaigns. The agency’s updates are based on evidence of active exploitation, highlighting the need for immediate action by security teams. Organizations are advised to consult the KEV Catalog regularly and integrate its findings into their vulnerability management processes. The removal of the Agere Modem driver by Microsoft demonstrates a decisive response to mitigate risk, though it may have operational impacts for some users. The inclusion of vulnerabilities across diverse platforms indicates that attackers are targeting a broad range of technologies. CISA’s ongoing updates to the KEV Catalog reflect its commitment to providing actionable intelligence to protect both federal and private sector networks. The agency’s guidance is clear: prompt remediation of known exploited vulnerabilities is essential to defend against active threats.
Jun 29, 2026
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has expanded its Known Exploited Vulnerabilities (KEV) catalog by adding seven high-impact vulnerabilities that are currently being exploited in the wild. This update includes critical flaws affecting Oracle E-Business Suite, Mozilla Firefox, Thunderbird, SeaMonkey, Microsoft Windows, Microsoft Internet Explorer, the Linux Kernel, and Microsoft Windows privilege escalation mechanisms. Among the most severe is CVE-2025-61882, a remotely exploitable vulnerability in Oracle E-Business Suite’s BI Publisher Integration, which allows unauthenticated attackers to compromise the Oracle Concurrent Processing component via HTTP. This flaw, rated CVSS 9.8, has been actively exploited in ransomware campaigns, notably by the Cl0p ransomware group, leading to data theft and potential remote code execution. Oracle responded by releasing an emergency patch for affected versions 12.2.3 through 12.2.14, and organizations are urged to apply this fix immediately and monitor for suspicious HTTP traffic targeting BI Publisher endpoints. Another addition, CVE-2010-3765, is a memory corruption vulnerability in Mozilla products, including Firefox, Thunderbird, and SeaMonkey, which can be exploited via JavaScript to execute arbitrary code. This flaw has been leveraged by the "Belmoo" malware in real-world attacks. Microsoft vulnerabilities added to the catalog include CVE-2011-3402, a TrueType font parsing flaw in the Windows kernel (win32k.sys) that enables remote code execution through malicious font files, and CVE-2010-3962, an uninitialized memory corruption issue in Internet Explorer. CVE-2013-3918, another Microsoft Windows vulnerability, was originally used in the 2009 Aurora attack and later repurposed by the EQUATION group to target government users in Afghanistan. The Linux Kernel vulnerability CVE-2021-22555, a heap out-of-bounds write, and CVE-2021-43226, a Windows privilege escalation flaw, are also included due to their active exploitation and potential for significant impact. CISA’s KEV catalog serves as a critical resource for organizations, highlighting vulnerabilities that require urgent attention due to their exploitation in real-world attacks. Federal agencies are mandated to address these vulnerabilities within a defined timeframe under Binding Operational Directive (BOD) 22-01. The inclusion of both recent and older vulnerabilities underscores the persistent risk posed by unpatched systems, as threat actors continue to exploit legacy flaws alongside newly discovered ones. Security experts emphasize the importance of immediate patching, robust monitoring, and comprehensive vulnerability management to mitigate the risks associated with these actively exploited vulnerabilities. The update reflects ongoing efforts by CISA to enhance the security posture of federal and enterprise environments by ensuring that known exploited vulnerabilities are promptly addressed. Organizations are advised to review the KEV catalog regularly, prioritize remediation of listed vulnerabilities, and implement additional security controls where patching is not immediately feasible. The addition of these vulnerabilities highlights the evolving threat landscape and the need for continuous vigilance against both new and longstanding security weaknesses. CISA’s proactive approach aims to reduce the attack surface and limit the opportunities for threat actors to compromise critical infrastructure. The agency’s guidance is particularly relevant for entities operating Oracle E-Business Suite, Microsoft products, and Linux systems, given the active exploitation of these platforms. The KEV catalog update serves as a call to action for all organizations to assess their exposure and take decisive steps to protect their assets from ongoing cyber threats.
Jun 29, 2026