CISA Adds Three Security Flaws with Active Exploitation to KEV Catalog

CVE-2020-2551 is a critical flaw in the WLS Core Components of Oracle WebLogic Server that allows an unauthenticated attacker with network access to the IIOP protocol to remotely compromise the server. An attacker sends crafted IIOP requests directly to a listening WebLogic instance and gains takeover of the server, with high impact to confidentiality, integrity, and availability (CVSS 9.8). Oracle WebLogic Server versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, and 12.2.1.4.0 are affected, spanning widely deployed enterprise and government middleware environments. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2023-11-16, and EPSS assigns a 93.2% probability of exploitation within 30 days (100th percentile), indicating active and likely broad targeting. Because exploitation requires only network reachability to the IIOP listener and no credentials or user interaction, internet-exposed WebLogic servers are the primary targets.

Do: Apply the Oracle fixes for CVE-2020-2551 (October 2020 Critical Patch Update) to each affected WebLogic release, or move to a patched supported release per Oracle's instructions, consistent with CISA's KEV required action. Until patched, block or restrict IIOP traffic to WebLogic listeners (default port 7001) from untrusted networks and remove direct internet exposure of WebLogic admin and application servers. Review access logs for anomalous IIOP connections and check patched and unpatched hosts for signs of compromise.

Sophos Web Appliance contains a command injection flaw (CWE-77) in the handler that processes 'warn and proceed' requests from the appliance's block page, allowing untrusted input to reach a shell command. An attacker who can reach the warn-proceed endpoint sends a crafted request whose parameters inject arbitrary operating system commands, resulting in remote code execution on the appliance. Successful exploitation gives the attacker control of the appliance host, a foothold at the network perimeter, and a platform for follow-on actions such as credential theft or lateral movement. Any organization running Sophos Web Appliance, especially where the appliance's web interface or warning pages are reachable from the internet, is affected. The flaw is being actively exploited: CISA added it to the Known Exploited Vulnerabilities catalog on 2023-11-16, and EPSS assigns it a 100% probability of exploitation in the next 30 days, though no public proof-of-concept is known.

Do: Update Sophos Web Appliance to the fixed release identified in Sophos's advisory and confirm the running build is patched; restrict access to the appliance's web interface to trusted networks and review access logs for suspicious requests to the warn-proceed endpoint. If mitigations are unavailable or the deployment is on an unsupported build, follow the CISA KEV required action and discontinue use of the product.

PHP Remote File Inclusion in GitHub repository unilogies/bumsys prior to 2.1.1.

A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet allows attacker to execute unauthorized code or commands via crafted API requests.

A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiSIEM version 5.4.0 and 5.3.0 through 5.3.3 and 5.2.5 through 5.2.8 and 5.2.1 through 5.2.2 and 5.1.0 through 5.1.3 and 5.0.0 through 5.0.1 and 4.10.0 and 4.9.0 and 4.7.2 allows attacker to execute unauthorized code or commands via crafted API requests.

Microsoft Windows' Mark of the Web (MOTW) feature, which tags files downloaded from the internet so that security checks such as SmartScreen warnings and opening restrictions can apply, fails to correctly apply the mark in affected Windows versions. An attacker can trigger the bypass by delivering a crafted file over the network (typically downloaded or opened by a user), so Windows treats the file as originating from a trusted local source; the CVSS vector confirms network attack surface with required user interaction (AV:N/UI:R). A successful bypass lets a specially crafted application run without the security warnings and restrictions normally applied to internet-originated files, weakening endpoint defenses during malware delivery (per CVSS, integrity and availability are partially impacted with no confidentiality impact from the bypass itself). Any organization or user running Windows 10 (1507, 1809, 21H1, 22H2), Windows 11 (21H2, 22H2), or Windows Server 2008 through 2022 is affected. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2023-11-16, confirming in-the-wild exploitation, and EPSS assigns a roughly 3.1% probability of exploitation in the next 30 days (87th percentile); no public proof-of-concept is known.

Do: Apply the November 2023 Windows cumulative security updates for each affected Windows 10, Windows 11, and Windows Server version, consistent with CISA's KEV required action (apply vendor mitigations or discontinue use if updates are unavailable). Prioritize user workstations and any systems where users open downloaded files or documents, since exploitation requires user interaction with a crafted internet-delivered file. Verify patch coverage across all listed Windows branches, as exploitation is confirmed in the wild and the primary gain is defeating MOTW-based warnings to aid malware delivery.

CVE-2023-36884 is a race condition (TOCTOU) vulnerability in Microsoft Windows Search that permits remote code execution, rated 7.5 (high) on CVSS 3.1. It is triggered over the network with user interaction — for example, when a user opens or interacts with a specially crafted document that causes the vulnerable search code path to race, allowing arbitrary code execution in the context of the current user. An attacker gains code execution on the victim's Windows system, which the RomCom threat actor chained with Firefox flaws to deploy backdoors against political targets, and CISA notes known ransomware use. Virtually every supported Windows client and server release at the time is affected, spanning Windows 10 1507 through 22H2, Windows 11 21H2/22H2, and Windows Server 2008 through 2022. The flaw was actively exploited as a zero-day before being fixed in the July 2023 Patch Tuesday; it was added to the CISA KEV catalog on 2023-07-17 and carries a 98.9% EPSS score (100th percentile).

Do: Apply the July 2023 Patch Tuesday Windows security updates to all Windows 10, Windows 11, and Windows Server systems, prioritizing high-value and frequently attacked endpoints since the bug was exploited as a zero-day by RomCom and carries a KEV deadline (US civilian agencies were directed to remediate by August 1, 2023). Because exploitation requires user interaction, caution users against opening untrusted documents, and verify patch status via your patch management or vulnerability scanner against the KEV requirement. If patching is not possible, follow vendor mitigations per CISA's required action or discontinue use.