The CISA KEV Catalogue, Searchable
Every flaw attackers are known to be using: what it is, how bad, and what fixes it.
- Flaws on the list
- 1,779
- Added in 30 days
- 40
- Used in ransomware
- 361
- In web & server software
- 181
13 Feb 2025 SimpleHelp SimpleHelp Path traversal
SimpleHelp remote support software v5.5.7 and before is vulnerable to multiple path traversal vulnerabilities that enable unauthenticated remote attackers to download arbitrary files from the SimpleHelp host via crafted HTTP requests. These files include server configuration files containing various secrets and hashed user passwords.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- simple-help simplehelp 5.5.8
- CISA due date
- 6 Mar 2025
- Weakness
- CWE-22
6 Feb 2025 Sophos CyberoamOS SQL injection
An SQL injection vulnerability in the WebAdmin of Cyberoam OS through 2020-12-04 allows unauthenticated attackers to execute arbitrary SQL statements remotely.
- What to do
- The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.
- CISA due date
- 27 Feb 2025
- Weakness
- CWE-89
24 Jan 2025 SonicWall SMA1000 Appliances Remote code execution
Pre-authentication deserialization of untrusted data vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) and Central Management Console (CMC), which in specific conditions could potentially enable a remote unauthenticated attacker to execute arbitrary OS commands.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- sonicwall sma8200v 12.4.3-02854, sonicwall sma7210 firmware 12.4.3-02854, sonicwall sma7200 firmware 12.4.3-02854, sonicwall sma6210 firmware 12.4.3-02854, sonicwall sma6200 firmware 12.4.3-02854
- CISA due date
- 14 Feb 2025
- Weakness
- CWE-502
14 Jan 2025 Fortinet FortiOS and FortiProxy Authentication bypass
An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 through 7.0.16 and FortiProxy version 7.0.0 through 7.0.19 and 7.2.0 through 7.2.12 allows a remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- fortinet fortiproxy 7.2.13, fortinet fortiproxy 7.0.20, fortinet fortios 7.0.17
- CISA due date
- 21 Jan 2025
- Weakness
- CWE-288
13 Jan 2025 Qlik Sense Input validation flaw
Qlik Sense Enterprise for Windows before August 2023 Patch 2 allows unauthenticated remote code execution, aka QB-21683. Due to improper validation of HTTP headers, a remote attacker is able to elevate their privilege by tunneling HTTP requests, allowing them to execute HTTP requests on the backend server that hosts the repository application. The fixed versions are August 2023 Patch 2, May 2023 Patch 6, February 2023 Patch 10, November 2022 Patch 12, August 2022 Patch 14, May 2022 Patch 16, February 2022 Patch 15, and November 2021 Patch 17. NOTE: this issue exists because of an incomplete fix for CVE-2023-41265.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 3 Feb 2025
- Weakness
- CWE-444
8 Jan 2025 Ivanti Connect Secure, Policy Secure, and ZTA Gateways Memory corruption
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a remote unauthenticated attacker to achieve remote code execution.
- What to do
- Apply mitigations as set forth in the CISA instructions linked below to include conducting hunt activities, taking remediation actions if applicable, and applying updates prior to returning a device to service.
- CISA due date
- 15 Jan 2025
- Weakness
- CWE-121
7 Jan 2025 Mitel MiCollab Path traversal
Mitel MiCollab through 9.8 SP2 could allow an authenticated attacker with administrative privilege to conduct a local file read, due to insufficient input sanitization. A successful exploit could allow the authenticated admin attacker to access resources that are constrained to the admin access level, and the disclosure is limited to non-sensitive system information. This vulnerability does not allow file modification or privilege escalation.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 28 Jan 2025
- Weakness
- CWE-22
7 Jan 2025 Mitel MiCollab Path traversal
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to conduct a path traversal attack, due to insufficient input validation. A successful exploit could allow unauthorized access, enabling the attacker to view, corrupt, or delete users' data and system configurations.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 28 Jan 2025
- Weakness
- CWE-22
17 Dec 2024 Cleo Multiple Products Command injection
In Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.8.0.24, an unauthenticated user can import and execute arbitrary Bash or PowerShell commands on the host system by leveraging the default settings of the Autorun directory.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- cleo harmony 5.8.0.24, cleo lexicom 5.8.0.24, cleo vltrader 5.8.0.24
- CISA due date
- 7 Jan 2025
- Weakness
- CWE-276
13 Dec 2024 Cleo Multiple Products Malicious file upload
In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21, there is an unrestricted file upload and download that could lead to remote code execution.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- cleo harmony 5.8.0.21, cleo lexicom 5.8.0.21, cleo vltrader 5.8.0.21
- CISA due date
- 3 Jan 2025
- Weakness
- CWE-434
4 Dec 2024 CyberPersons CyberPanel Command injection
getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers to bypass authentication and execute arbitrary commands via /dns/getresetstatus or /ftp/getresetstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX. Versions through 2.3.6 and (unpatched) 2.3.7 are affected.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- cyberpanel 2.3.8
- CISA due date
- 25 Dec 2024
- Weakness
- CWE-276
3 Dec 2024 Zyxel Multiple Firewalls Path traversal
A directory traversal vulnerability in the web management interface of Zyxel ATP series firmware versions V5.00 through V5.38, USG FLEX series firmware versions V5.00 through V5.38, USG FLEX 50(W) series firmware versions V5.10 through V5.38, and USG20(W)-VPN series firmware versions V5.10 through V5.38 could allow an attacker to download or upload files via a crafted URL.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 24 Dec 2024
- Weakness
- CWE-22
25 Nov 2024 Array Networks AG/vxAG ArrayOS Authentication bypass
Array Networks Array AG Series and vxAG (9.4.0.481 and earlier) allow remote code execution. An attacker can browse the filesystem on the SSL VPN gateway using a flags attribute in an HTTP header without authentication. The product could then be exploited through a vulnerable URL. The 2023-03-09 vendor advisory stated "a new Array AG release with the fix will be available soon."
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 16 Dec 2024
- Weakness
- CWE-306
18 Nov 2024 Palo Alto Networks PAN-OS Command injection
A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to the management web interface to perform actions on the firewall with root privileges. Cloud NGFW and Prisma Access are not impacted by this vulnerability.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Additionally, the management interfaces for affected devices should not be exposed to untrusted networks, including the internet.
- Fixed in (NVD)
- paloaltonetworks pan-os 11.2.4, paloaltonetworks pan-os 11.1.5, paloaltonetworks pan-os 11.0.6, paloaltonetworks pan-os 10.2.12, paloaltonetworks pan-os 10.1.14
- CISA due date
- 9 Dec 2024
- Weakness
- CWE-77
18 Nov 2024 Palo Alto Networks PAN-OS Authentication bypass
An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges to perform administrative actions, tamper with the configuration, or exploit other authenticated privilege escalation vulnerabilities like CVE-2024-9474 https://security.paloaltonetworks.com/CVE-2024-9474 . The risk of this issue is greatly reduced if you secure access to the management web interface by restricting access to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue is applicable only to PAN-OS 10.2, PAN-OS 11.0, PAN-OS 11.1, and PAN-OS 11.2 software. Cloud NGFW and Prisma Access are not impacted by this vulnerability.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Additionally, management interface for affected devices should not be exposed to untrusted networks, including the internet.
- CISA due date
- 9 Dec 2024
- Weakness
- CWE-306
12 Nov 2024 Microsoft Windows Authentication bypass
Windows Task Scheduler Elevation of Privilege Vulnerability
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- microsoft windows server 2022 23h2 10.0.25398.1251, microsoft windows server 2022 10.0.20348.2849, microsoft windows server 2019 10.0.17763.6532, microsoft windows server 2016 10.0.14393.7515, microsoft windows 11 24h2 10.0.26100.2314 and 7 older
- CISA due date
- 3 Dec 2024
- Weakness
- CWE-287
7 Nov 2024 CyberPersons CyberPanel Authentication bypass
upgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before 5b08cd6 allows remote attackers to bypass authentication and execute arbitrary commands via /dataBases/upgrademysqlstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX. Versions through 2.3.6 and (unpatched) 2.3.7 are affected.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- cyberpanel 2.3.8
- CISA due date
- 28 Nov 2024
- Weakness
- CWE-276
22 Oct 2024 Microsoft SharePoint Remote code execution
Microsoft SharePoint Remote Code Execution Vulnerability
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 12 Nov 2024
- Weakness
- CWE-502
17 Oct 2024 Veeam Backup & Replication Remote code execution
A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution (RCE).
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- veeam backup & replication 12.2.0.334
- CISA due date
- 7 Nov 2024
- Weakness
- CWE-502
15 Oct 2024 Mozilla Firefox Memory corruption
An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had reports of this vulnerability being exploited in the wild. This vulnerability affects Firefox < 131.0.2, Firefox ESR < 128.3.1, Firefox ESR < 115.16.1, Thunderbird < 131.0.1, Thunderbird < 128.3.1, and Thunderbird < 115.16.0.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- mozilla firefox 131.0.2, mozilla firefox 128.3.1, mozilla thunderbird 128.3.1, mozilla firefox 115.16.1, mozilla thunderbird 115.16.0
- CISA due date
- 5 Nov 2024
- Weakness
- CWE-416
On Hacker News
Firefox use-after-free RCE15 Oct 2024 Microsoft Windows Race condition
Windows Kernel Elevation of Privilege Vulnerability
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- microsoft windows server 2022 23h2 10.0.25398.950, microsoft windows server 2022 10.0.20348.2522, microsoft windows server 2019 10.0.17763.5936, microsoft windows server 2016 10.0.14393.7070, microsoft windows 11 23h2 10.0.22631.3737 and 7 older
- CISA due date
- 5 Nov 2024
- Weakness
- CWE-367
18 Sep 2024 Microsoft SQL Server Remote code execution
A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page requests, aka 'Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability'.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 9 Oct 2024
- Weakness
- CWE-502
16 Sep 2024 Progress WhatsUp Gold SQL injection
In WhatsUp Gold versions released before 2024.0.0, a SQL Injection vulnerability allows an unauthenticated attacker to retrieve the users encrypted password.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- progress whatsup gold 24.0
- CISA due date
- 7 Oct 2024
- Weakness
- CWE-89
9 Sep 2024 SonicWall SonicOS Access control flaw
An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorized resource access and in specific conditions, causing the firewall to crash. This issue affects SonicWall Firewall Gen 5 and Gen 6 devices, as well as Gen 7 devices running SonicOS 7.0.1-5035 and older versions.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- sonicwall sonicos 6.5.4.15.116n, sonicwall sonicos 6.5.2.8-2n, sonicwall sonicos 5.9.2.14-13o
- CISA due date
- 30 Sep 2024
- Weakness
- CWE-284
9 Sep 2024 Linux Kernel Memory corruption
Linux distributions that have not patched their long-term kernels with https://git.kernel.org/linus/a87938b2e246b81b4fb713edb371a9fa3c5c3c86 (committed on April 14, 2015). This kernel vulnerability was fixed in April 2015 by commit a87938b2e246b81b4fb713edb371a9fa3c5c3c86 (backported to Linux 3.10.77 in May 2015), but it was not recognized as a security threat. With CONFIG_ARCH_BINFMT_ELF_RANDOMIZE_PIE enabled, and a normal top-down address allocation strategy, load_elf_binary() will attempt to map a PIE binary into an address range immediately below mm->mmap_base. Unfortunately, load_elf_ binary() does not take account of the need to allocate sufficient space for the entire binary which means that, while the first PT_LOAD segment is mapped below mm->mmap_base, the subsequent PT_LOAD segment(s) end up being mapped above mm->mmap_base into the are that is supposed to be the "gap" between the stack and the binary.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- linux kernel 4.0.2, linux kernel 3.19.7, linux kernel 3.18.14, linux kernel 3.16.35, linux kernel 3.14.41 and 4 older
- CISA due date
- 30 Sep 2024
- Weakness
- CWE-119
19 Aug 2024 Jenkins Command Line Interface (CLI) Path traversal
Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read arbitrary files on the Jenkins controller file system.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- jenkins 2.442, jenkins 2.426.3
- CISA due date
- 9 Sep 2024
- Weakness
- CWE-27
30 Jul 2024 VMware ESXi Authentication bypass
VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was previously configured to use AD for user management https://blogs.vmware.com/vsphere/2012/09/joining-vsphere-hosts-to-active-directory.html by re-creating the configured AD group ('ESXi Admins' by default) after it was deleted from AD.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- vmware cloud foundation 5.2
- CISA due date
- 20 Aug 2024
- Weakness
- CWE-305
9 Jul 2024 Rejetto HTTP File Server Remote code execution
Rejetto HTTP File Server, up to and including version 2.3m, is vulnerable to a template injection vulnerability. This vulnerability allows a remote, unauthenticated attacker to execute arbitrary commands on the affected system by sending a specially crafted HTTP request. As of the CVE assignment date, Rejetto HFS 2.3m is no longer supported.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 30 Jul 2024
- Weakness
- CWE-1336
13 Jun 2024 Microsoft Windows Privilege escalation
Windows Error Reporting Service Elevation of Privilege Vulnerability
- What to do
- Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
- Fixed in (NVD)
- microsoft windows server 2022 23h2 10.0.25398.763, microsoft windows server 2022 10.0.20348.2333, microsoft windows server 2019 10.0.17763.5576, microsoft windows 11 23h2 10.0.22631.3296, microsoft windows 11 22h2 10.0.22621.3296 and 6 older
- CISA due date
- 4 Jul 2024
- Weakness
- CWE-269
12 Jun 2024 PHP Group PHP Command injection
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- php 8.3.8, php 8.2.20, php 8.1.29
- CISA due date
- 3 Jul 2024
- Weakness
- CWE-78
30 May 2024 Check Point Quantum Security Gateways Information disclosure
Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the internet and enabled with remote Access VPN or Mobile Access Software Blades. A Security fix that mitigates this vulnerability is available.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 20 Jun 2024
- Weakness
- CWE-200
30 May 2024 Linux Kernel Memory corruption
A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The nft_verdict_init() function allows positive values as drop error within the hook verdict, and hence the nf_hook_slow() function can cause a double free vulnerability when NF_DROP is issued with a drop error which resembles NF_ACCEPT. We recommend upgrading past commit f342de4e2f33e0e39165d8639387aa6c19dff660.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- linux kernel 6.7.3, linux kernel 6.6.15, linux kernel 6.1.76, linux kernel 5.15.149
- CISA due date
- 20 Jun 2024
- Weakness
- CWE-416
20 May 2024 NextGen Healthcare Mirth Connect Remote code execution
NextGen Healthcare Mirth Connect before version 4.4.1 is vulnerable to unauthenticated remote code execution. Note that this vulnerability is caused by the incomplete patch of CVE-2023-37679.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- nextgen mirth connect 4.4.1
- CISA due date
- 10 Jun 2024
- Weakness
- CWE-502
14 May 2024 Microsoft DWM Core Library Memory corruption
Windows DWM Core Library Elevation of Privilege Vulnerability
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- microsoft windows server 2022 10.0.20348.2458, microsoft windows server 2019 10.0.17763.5820, microsoft windows server 2016 10.0.14393.6981, microsoft windows 11 23h2 10.0.22631.3593, microsoft windows 11 22h2 10.0.22621.3593 and 6 older
- CISA due date
- 4 Jun 2024
- Weakness
- CWE-122
12 Apr 2024 Palo Alto Networks PAN-OS Command injection
A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbitrary code with root privileges on the firewall. Cloud NGFW, Panorama appliances, and Prisma Access are not impacted by this vulnerability.
- What to do
- Apply mitigations per vendor instructions as they become available. Otherwise, users with vulnerable versions of affected devices should enable Threat Prevention IDs available from the vendor. See the vendor bulletin for more details and a patch release schedule.
- CISA due date
- 19 Apr 2024
- Weakness
- CWE-20, CWE-77
26 Mar 2024 Microsoft SharePoint Server Remote code execution
Microsoft SharePoint Server Remote Code Execution Vulnerability
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 16 Apr 2024
- Weakness
- CWE-94
25 Mar 2024 Fortinet FortiClient EMS SQL injection
A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiClientEMS version 7.2.0 through 7.2.2, FortiClientEMS 7.0.1 through 7.0.10 allows attacker to execute unauthorized code or commands via specially crafted packets.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- fortinet forticlient enterprise management server 7.2.3, fortinet forticlient enterprise management server 7.0.11
- CISA due date
- 15 Apr 2024
- Weakness
- CWE-89
25 Mar 2024 Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) Remote code execution
A code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an unauthenticated user to execute arbitrary code with limited permissions (nobody).
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 15 Apr 2024
- Weakness
- CWE-94
7 Mar 2024 JetBrains TeamCity Authentication bypass
In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- jetbrains teamcity 2023.11.4
- CISA due date
- 28 Mar 2024
- Weakness
- CWE-288
4 Mar 2024 Microsoft Windows Memory corruption
Windows Kernel Elevation of Privilege Vulnerability
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- microsoft windows server 2022 10.0.20348.2322, microsoft windows server 2019 10.0.17763.5458, microsoft windows 11 23h2 10.0.22631.3155, microsoft windows 11 22h2 10.0.22621.3155, microsoft windows 11 21h2 10.0.22000.2777 and 3 older
- CISA due date
- 25 Mar 2024
- Weakness
- CWE-822
22 Feb 2024 ConnectWise ScreenConnect Authentication bypass
ConnectWise ScreenConnect 23.9.7 and prior are affected by an Authentication Bypass Using an Alternate Path or Channel vulnerability, which may allow an attacker direct access to confidential information or critical systems.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- connectwise screenconnect 23.9.8
- CISA due date
- 29 Feb 2024
- Weakness
- CWE-288
15 Feb 2024 Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) Information disclosure
A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to retrieve memory contents on an affected device, which could lead to the disclosure of confidential information. The vulnerability is due to a buffer tracking issue when the software parses invalid URLs that are requested from the web services interface. An attacker could exploit this vulnerability by sending a crafted GET request to the web services interface. A successful exploit could allow the attacker to retrieve memory contents, which could lead to the disclosure of confidential information. Note: This vulnerability affects only specific AnyConnect and WebVPN configurations. For more information, see the Vulnerable Products section.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- cisco adaptive security appliance software 9.13.1.10, cisco adaptive security appliance software 9.12.3.9, cisco adaptive security appliance software 9.10.1.40, cisco adaptive security appliance software 9.9.2.67, cisco adaptive security appliance software 9.8.4.20 and 4 older
- CISA due date
- 7 Mar 2024
- Weakness
- CWE-200
13 Feb 2024 Microsoft Windows Security flaw
Internet Shortcut Files Security Feature Bypass Vulnerability
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- microsoft windows server 2022 23h2 10.0.25398.709, microsoft windows server 2022 10.0.20348.2322, microsoft windows server 2019 10.0.17763.5458, microsoft windows 11 23h2 10.0.22631.3155, microsoft windows 11 22h2 10.0.22621.3155 and 4 older
- CISA due date
- 5 Mar 2024
- Weakness
- CWE-693
9 Feb 2024 Fortinet FortiOS Memory corruption
A out-of-bounds write vulnerability in Fortinet FortiOS 7.4.0 through 7.4.2, FortiOS 7.2.0 through 7.2.6, FortiOS 7.0.0 through 7.0.13, FortiOS 6.4.0 through 6.4.14, FortiOS 6.2.0 through 6.2.15, FortiOS 6.0 all versions, FortiProxy 7.4.0 through 7.4.2, FortiProxy 7.2.0 through 7.2.8, FortiProxy 7.0.0 through 7.0.14, FortiProxy 2.0.0 through 2.0.13, FortiProxy 01.02 all versions, FortiProxy 1.2 all versions, FortiProxy 01.01 all versions, FortiProxy 1.1 all versions, FortiProxy 01.00 all versions allows attacker to execute unauthorized code or commands via specifically crafted requests
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- fortinet fortiproxy 7.4.3, fortinet fortios 7.4.3, fortinet fortiproxy 7.2.9, fortinet fortios 7.2.7, fortinet fortiproxy 7.0.15 and 5 older
- CISA due date
- 16 Feb 2024
- Weakness
- CWE-787
31 Jan 2024 Ivanti Connect Secure, Policy Secure, and Neurons Server-side request forgery
A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) and Ivanti Neurons for ZTA allows an attacker to access certain restricted resources without authentication.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 2 Feb 2024
- Weakness
- CWE-918
24 Jan 2024 Atlassian Confluence Data Center and Server Input validation flaw
A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected instance. Customers using an affected version must take immediate action. Most recent supported versions of Confluence Data Center and Server are not affected by this vulnerability as it was ultimately mitigated during regular version updates. However, Atlassian recommends that customers take care to install the latest version to protect their instances from non-critical vulnerabilities outlined in Atlassian’s January Security Bulletin.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- atlassian confluence data center 8.5.4, atlassian confluence server 8.5.4
- CISA due date
- 14 Feb 2024
- Weakness
- CWE-74
18 Jan 2024 Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication bypass
An authentication bypass vulnerability in Ivanti EPMM 11.10 and older, allows unauthorized users to access restricted functionality or resources of the application without proper authentication. This vulnerability is unique to CVE-2023-35078 announced earlier.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- ivanti endpoint manager mobile 11.11.0
- CISA due date
- 8 Feb 2024
- Weakness
- CWE-287
10 Jan 2024 Ivanti Connect Secure and Policy Secure Command injection
A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 22 Jan 2024
- Weakness
- CWE-77
10 Jan 2024 Ivanti Connect Secure and Policy Secure Authentication bypass
An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a remote attacker to access restricted resources by bypassing control checks.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 22 Jan 2024
- Weakness
- CWE-287
10 Jan 2024 Microsoft SharePoint Server Security flaw
Microsoft SharePoint Server Elevation of Privilege Vulnerability
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 31 Jan 2024
- Weakness
- CWE-303
Know when it's your software
Get an email within half an hour when a flaw in your software is added. Free.
About the KEV Catalogue
What is the CISA KEV catalogue?
CISA's list of flaws attackers are known to be using. A flaw is added only with reliable evidence of attacks and a known fix.
Why does it matter more than the CVSS score?
Few CVEs are ever used in attacks. These are, so fix them first, whatever their score.
What is the due date?
The deadline for US federal agencies to fix it (BOD 26-04, which replaced BOD 22-01): as little as three days for recent entries. A sensible deadline for anyone.
Does it apply outside the US?
The deadlines don't, but the flaws are in software used everywhere. If you run it, it applies to you.
What does "used in ransomware" mean?
CISA knows ransomware groups have used the flaw.
How often is it updated?
CISA adds flaws several times a week. CVE Hawk checks hourly and alerts you within half an hour if it's your software.