CISA Adds One Known Exploited Vulnerability to Catalog

Summary:

On [Date], the Cybersecurity and Infrastructure Security Agency (CISA) added a new vulnerability to its Known Exploited Vulnerabilities Catalog, citing evidence of active exploitation. The newly added vulnerability is CVE-2023-5217, specifically a Google Chrome libvpx Heap Buffer Overflow Vulnerability.

These types of vulnerabilities, which are frequent attack vectors for malicious cyber actors, pose significant risks to the federal enterprise. The Known Exploited Vulnerabilities Catalog is a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. The catalog was established by Binding Operational Directive (BOD) 22-01, which requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats.

Notably, while BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria, which includes evidence of active exploitation.

In summary, the addition of CVE-2023-5217 to the Known Exploited Vulnerabilities Catalog highlights the importance of prioritizing vulnerability remediation to protect against active threats. Organizations are advised to review the catalog regularly and remediate identified vulnerabilities in a timely manner to reduce their exposure to cyberattacks.