CISA Expands Vulnerability Catalog with Four New Critical Flaws

The Cybersecurity and Infrastructure Security Agency (CISA) has expanded its Known Exploited Vulnerabilities Catalog with four new critical vulnerabilities that are currently being exploited in active attacks. This addition brings the total number of cataloged vulnerabilities to over 1,000 entries, underscoring the persistent threat landscape organizations face.

The newly added vulnerabilities include:

CVE-2024-38094 - A critical remote code execution vulnerability in Microsoft SharePoint Server. Attackers can exploit this flaw to execute arbitrary code on affected systems without authentication. Microsoft has released patches as part of its June 2024 security updates.

CVE-2024-21269 - A high-severity deserialization vulnerability in Oracle WebLogic Server. This flaw could allow unauthenticated attackers to compromise vulnerable systems. Oracle addressed this vulnerability in its Critical Patch Update from April 2024.

CVE-2024-21887 - Another critical vulnerability in Oracle WebLogic Server related to deserialization. This vulnerability, also patched in April 2024, poses similar risks to the previously mentioned WebLogic flaw.

CVE-2024-21887 - A high-severity vulnerability in Google Chrome that could allow attackers to execute arbitrary code through a use-after-free flaw in the browser's animation component. Google released fixes in version 124.0.6367.201 for Windows and Mac, and 124.0.6367.201 for Linux.

"These vulnerabilities represent active threats to organizations across all sectors," said a CISA spokesperson. "We strongly encourage all organizations to prioritize patching these flaws immediately, as threat actors are actively incorporating them into their attack toolkits."

CISA's catalog serves as a prioritized list of known vulnerabilities that have been actively exploited in the wild. The agency recommends that federal agencies apply patches within specific timeframes, while private sector organizations are urged to follow suit as quickly as possible.

For organizations struggling with patch management, CISA recommends:

• Implementing automated patch management systems where feasible
• Prioritizing critical vulnerabilities that enable remote code execution
• Segmenting networks to limit the spread of potential compromises
• Maintaining regular backups that are isolated from production networks

The addition of these four vulnerabilities comes amid a broader trend of increasing exploitation of known flaws rather than zero-day vulnerabilities. According to recent threat intelligence reports, over 60% of successful cyberattacks leverage vulnerabilities for which patches were already available.

Organizations can access the complete Known Exploited Vulnerabilities Catalog and related resources through CISA's Shields Up initiative, which provides actionable guidance for defending against current cyber threats.