CISA Adds One Known Exploited Vulnerability to Catalog

Here is a comprehensive summary of the provided document, formatted using the provided template:

Summary

The Cybersecurity and Infrastructure Security Agency (CISA) has recently added a new vulnerability to its Known Exploited Vulnerabilities Catalog, specifically CVE-2023-29357, Microsoft SharePoint Server Privilege Escalation Vulnerability. This vulnerability has been identified as an active exploit, indicating its potential as a frequent attack vector for malicious cyber actors. The inclusion of this vulnerability in the catalog highlights the significance of the risk it poses to the federal enterprise.

The Known Exploited Vulnerabilities Catalog is a catalog of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. The catalog was established through the Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities. This directive requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats.

While BOD 22-01 only applies to FCEB agencies, CISA strongly advises all organizations to prioritize the timely remediation of vulnerabilities listed in the catalog as part of their vulnerability management practices. By doing so, these organizations can reduce their exposure to cyberattacks. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria, highlighting the importance of regular checks and updates to ensure the protection of networks and systems.

Overall, the addition of CVE-2023-29357 to the Known Exploited Vulnerabilities Catalog serves as a reminder of the need for proactive and timely vulnerability management to mitigate the risk of cyber threats.