CISA Adds Six Actively Exploited Vulnerabilities to Known Exploited Vulnerabilities Catalog

Washington, D.C. – The Cybersecurity and Infrastructure Security Agency (CISA) announced the addition of six new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on confirmed evidence of active exploitation in the wild. The move reinforces the urgency for organizations to patch high-risk flaws that are frequently weaponized by malicious cyber actors.

The six newly listed CVEs are:
- CVE-2015-3246: A race condition vulnerability in Red Hat libuser.
- CVE-2015-5287: A privilege escalation vulnerability in the Red Hat Automatic Bug Reporting Tool (abrt).
- CVE-2019-1068: A remote code execution vulnerability in Microsoft SQL Server.
- CVE-2021-23758: A deserialization of untrusted data vulnerability in Ajax.NET Professional.
- CVE-2022-0995: An out-of-bounds write vulnerability in the Linux Kernel.
- CVE-2026-8452: An improper restriction of operations within the bounds of a memory buffer vulnerability in Citrix NetScaler ADC and NetScaler Gateway.

CISA emphasized that these vulnerabilities represent a frequent attack vector for malicious actors and pose significant risks to the federal enterprise. Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. The directive requires agencies to prioritize rapid remediation of KEV Catalog vulnerabilities on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 also establishes expectations for agencies to check whether threat actors had already compromised systems before patches were applied.

While BOD 26-04 applies specifically to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management practices and prioritize remediation of KEV Catalog vulnerabilities. CISA noted that it will continue to add vulnerabilities to the catalog that meet the specified criteria of active exploitation. Organizations aware of exploited vulnerabilities not currently listed are encouraged to submit them via CISA's KEV Nomination Form.

Known exploited vulnerabilities are a primary initial access vector for ransomware groups and state-sponsored actors. CISA's KEV Catalog serves as an authoritative list for vulnerability management prioritization, helping organizations focus remediation efforts on flaws with confirmed wild exploitation.