CISA Adds Three Known Exploited Vulnerabilities to Catalog

Summary:

The Cybersecurity and Infrastructure Security Agency (CISA) has added three new vulnerabilities to its Known Exploited Vulnerabilities Catalog, which are being actively exploited. The new vulnerabilities are:

CVE-2023-40044: Progress WS_FTP Server Deserialization of Untrusted Data Vulnerability
CVE-2023-42824: Apple iOS and iPadOS Kernel Privilege Escalation Vulnerability
* CVE-2023-22515: Atlassian Confluence Data Center and Server Privilege Escalation Vulnerability

These vulnerabilities pose significant risks to the federal enterprise and are frequent attack vectors for malicious cyber actors. CISA recommends that all organizations prioritize timely remediation of these vulnerabilities as part of their vulnerability management practice to reduce their exposure to cyberattacks.

Note: BOD 22-01, Reducing the Significant Risk of Known Exploited Vulnerabilities, applies specifically to Federal Civilian Executive Branch agencies, but CISA strongly urges all organizations to follow the same guidelines to protect against active threats.