CISA Adds Three Known Exploited Vulnerabilities to Catalog

Summary:

The Cybersecurity and Infrastructure Security Agency (CISA) has recently updated its Known Exploited Vulnerabilities Catalog by adding three new vulnerabilities that have been evidence of active exploitation. The added vulnerabilities are:

1. CVE-2023-41991: Apple Multiple Products Improper Certificate Validation Vulnerability: This vulnerability affects Apple’s multiple products and allows an attacker to obtain sensitive information, potentially leading to a compromise of the affected systems.
2. CVE-2023-41992: Apple Multiple Products Kernel Privilege Escalation Vulnerability: This vulnerability enables an attacker to escalate privileges on affected Apple systems, granting them access to sensitive resources and data.
3. CVE-2023-41993: Apple Multiple Products WebKit Code Execution Vulnerability: This vulnerability allows an attacker to execute code on affected Apple systems, potentially leading to a complete system compromise.

These vulnerabilities are considered significant risks to the federal enterprise and are frequently used as attack vectors by malicious cyber actors. Therefore, it is crucial for organizations to prioritize timely remediation of these vulnerabilities as part of their vulnerability management practice.

In accordance with the Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, Federal Civilian Executive Branch (FCEB) agencies are required to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. CISA strongly urges all organizations, including those not bound by BOD 22-01, to follow this directive and reduce their exposure to cyberattacks by prioritizing the remediation of these vulnerabilities.

The Known Exploited Vulnerabilities Catalog is a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria, ensuring that organizations are aware of the latest threat landscape and can take necessary measures to protect their networks and systems.