CISA added 7 new flaws to its Known Exploited Vulnerabilities Catalog

Palo Alto Networks PAN-OS contains a critical remote code execution flaw, driven by improper input validation and memory-safety weaknesses (CWE-20, CWE-119), that is reachable through the firewall's management interface. An unauthenticated remote attacker can trigger the flaw via crafted requests to the management interface, and successful exploitation grants the ability to execute arbitrary code with high impact on confidentiality, integrity, and availability (CVSS 3.1: 9.8). Only PAN-OS firewalls whose management interface is reachable from untrusted networks, such as the internet, are practically exploitable. Organizations running PAN-OS before the fixed releases (6.1.19, 7.0.19, 7.1.14, 8.0.6) are affected. The flaw is under active exploitation: it was added to CISA's Known Exploited Vulnerabilities Catalog on 2022-08-18, carries a 98.3% EPSS probability of exploitation within 30 days, and public proof-of-concept exploits are available on Exploit-DB.

Do: Upgrade PAN-OS to 6.1.19 or later (6.1.x), 7.0.19 or later (7.0.x), 7.1.14 or later (7.1.x), or 8.0.6 or later (8.0.x) per vendor instructions. Until patched, restrict access to the management interface to trusted administrative networks only and verify it is not exposed to the internet. Review logs for suspicious activity against the management interface, since this flaw is listed in CISA's KEV catalog and is being actively exploited.

CVE-2022-21971 is a remote code execution flaw in the Microsoft Windows Runtime caused by access to an uninitialized pointer (CWE-824). It is triggered locally: an attacker must convince a user (no privileges required) to open or run a specially crafted application or file, which then corrupts memory through the Windows Runtime component. Successful exploitation lets the attacker execute arbitrary code in the context of the affected user, with impacts to confidentiality, integrity, and availability at that user's privilege level, so any user of an affected Windows release is a potential target. Affected products include Windows 10 versions 1809 through 21H2, Windows 11 21H2, and Windows Server 2019, 2022, and 20H2. The flaw is confirmed as exploited in the wild — CISA added it to the Known Exploited Vulnerabilities catalog on 2022-08-18 — and EPSS assigns it a 53.9% probability of exploitation within 30 days (99th percentile), though no public PoC or specific ransomware use is documented.

Do: Apply Microsoft's security updates addressing CVE-2022-21971 (fixed in the January 2022 Patch Tuesday cumulative updates) to all Windows 10 1809–21H2, Windows 11 21H2, and Windows Server 2019/2022/20H2 systems, prioritizing endpoints used to open untrusted files and any servers on aged builds. Confirm remediation by checking that the relevant cumulative update is installed on each host. Until patched, warn users against opening files or apps from untrusted sources and watch for suspicious child-process activity tied to user-initiated file opens, since exploitation requires user interaction.

CVE-2022-22536 (CWE-444) is an HTTP request smuggling and request concatenation flaw in the Internet Communication Manager components of SAP NetWeaver Application Server ABAP and Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher. An unauthenticated remote attacker sends crafted HTTP requests whose framing is interpreted inconsistently by intermediary and back-end components, allowing arbitrary attacker-controlled data to be prepended to a victim's request. This lets the attacker execute functions impersonating the victim or poison intermediary web caches, and a successful attack could result in complete compromise of the confidentiality, integrity and availability of the system (CVSS 10.0). Any organization running the affected SAP components is exposed, especially internet-facing SAP systems and those fronted by reverse proxies or caches where front-end/back-end parsing differs. The flaw is being actively exploited: CISA added it to the Known Exploited Vulnerabilities Catalog on 2022-08-18 and EPSS assigns a 97.9% probability of exploitation within 30 days, although no public PoC is known and ransomware use is unconfirmed.

Do: Apply SAP's security updates per vendor instructions for CVE-2022-22536 (SAP Note 3123396), prioritizing internet-facing Web Dispatcher, ICM/NetWeaver and Content Server 7.53 systems as required by the CISA KEV listing. Until patched, restrict direct HTTP access to affected SAP components, review front-end proxies/caches for HTTP framing mismatches, and monitor for anomalous request concatenation or impersonation. Ransomware linkage is unknown, so treat this as general web-application exploitation risk.

CVE-2022-26923 is an elevation-of-privilege flaw in Microsoft Active Directory Domain Services (CWE-295, improper certificate validation), widely known as the 'sAMAccountName spoofing' issue. An attacker with ordinary domain-user credentials can create or rename a computer account so its sAMAccountName matches a domain controller's name, obtain a certificate for that account, and use the flawed certificate-to-account name mapping to authenticate as that domain controller. Successful exploitation grants the attacker Domain Admin privileges and effectively full control over the Active Directory forest. Any organization running AD DS on the affected Windows 10/11, Windows 8.1, Windows RT 8.1, or Windows Server releases is exposed until patched. The flaw was fixed in Microsoft's May 2022 Patch Tuesday updates and is confirmed exploited in the wild: CISA added it to the Known Exploited Vulnerabilities Catalog on 2022-08-18, EPSS puts its 30-day exploitation probability at 83.5% (100th percentile), no public PoC is cataloged, and ransomware use is unknown.

Do: Apply Microsoft's May 2022 security updates (or later cumulative updates) to every domain controller and affected Windows/Windows Server host, prioritizing domain controllers, and verify patch status fleet-wide. Until patched, audit recently created or renamed computer accounts whose sAMAccountName matches a domain controller name, restrict which users can add machine accounts, and monitor for unusual certificate-based logons by privileged accounts. Patching is required for U.S. federal agencies since the flaw is in CISA's KEV catalog (required action: apply updates per vendor instructions).

CVE-2022-2856 is an insufficient input validation flaw (CWE-20) in the Intents component of Google Chrome on Android. A remote attacker can trigger it by convincing a user to open a crafted HTML page, requiring no privileges beyond user interaction. On success, the attacker can make the victim's browser arbitrarily browse to a malicious, attacker-chosen website, an integrity impact (CVSS 3.1: 6.5, AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N). It affects Chrome on Android prior to 104.0.5112.101, and Fedora's chromium packages were also affected per the CPE data. The flaw is being exploited in the wild: it was added to CISA's Known Exploited Vulnerabilities catalog on 2022-08-18, with headlines indicating it was the ninth actively exploited Chrome zero-day patched by Google in 2022.

Do: Update Chrome on Android to 104.0.5112.101 or later (check via Chrome's About page or the Play Store) and apply the updated Fedora chromium packages as they are released, per the CISA KEV required action. Verify fleet versions for managed Android/Chrome deployments and confirm no devices remain below 104.0.5112.101. Until patched, treat links from untrusted sources with caution since exploitation requires user interaction with a crafted page.

CVE-2022-32893 is an out-of-bounds write flaw (CWE-787) in Apple's WebKit browser engine, caused by insufficient bounds checking. It is triggered when a device processes maliciously crafted web content, meaning a user can be attacked simply by loading an attacker-controlled webpage. A successful exploit allows arbitrary code execution on the victim's device, with high impact on confidentiality, integrity, and availability (CVSS 3.1: 8.8). Affected users include anyone running iOS/iPadOS before 15.6.1, macOS Monterey before 12.5.1, or Safari before 15.6.1, as well as consumers of WebKitGTK and WPE WebKit shipped in Fedora and Debian. Apple confirmed the issue was being actively exploited in the wild, and CISA added it to the Known Exploited Vulnerabilities catalog on 2022-08-18; EPSS estimates a 9.9% probability of exploitation in the next 30 days (95th percentile), while no public PoC is known.

Do: Immediately update to iOS 15.6.1, iPadOS 15.6.1, macOS Monterey 12.5.1, and Safari 15.6.1; per vendor reporting, Apple also released updates for older iPhone models, and users of devices running the iOS 15.7 beta should apply 15.6.1. Fedora and Debian users should install the patched WebKitGTK/WPE WebKit packages from their distribution's advisories. Because exploitation requires only loading malicious web content, there is no reliable workaround — prioritize patching on all endpoints that browse web content, and treat unpatched Apple devices as actively targeted.