CISA Adds Three Known Vulnerabilities to Catalog

Summary:

The Cybersecurity and Infrastructure Security Agency (CISA) has recently added three new vulnerabilities to its Known Exploited Vulnerabilities Catalog. These vulnerabilities, namely CVE-2023-35674, CVE-2023-20269, and CVE-2023-4863, have been identified as being actively exploited and pose significant risks to the federal enterprise.

The Known Exploited Vulnerabilities Catalog is a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. It was established through Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, which requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by their due date to protect FCEB networks against active threats.

While BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to prioritize the timely remediation of Catalog vulnerabilities as part of their vulnerability management practice. This includes FCEB agencies, as well as other organizations that may be vulnerable to cyberattacks.

The three new vulnerabilities added to the catalog are:

CVE-2023-35674: Android Framework Privilege Escalation Vulnerability
CVE-2023-20269: Cisco Adaptive Security Appliance and Firepower Threat Defense Unauthorized Access Vulnerability
* CVE-2023-4863: Google Chrome Heap-Based Buffer Overflow Vulnerability

These vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise. Therefore, CISA recommends that all organizations take prompt action to remediate these vulnerabilities and reduce their exposure to cyberattacks.

For more information on the Known Exploited Vulnerabilities Catalog and BOD 22-01, please refer to the CISA website or contact your organization’s security team.