CISA's KEV Catalog Updated with 3 New Flaws Threatening IT Management Systems

CVE-2020-5741 is a deserialization-of-untrusted-data flaw (CWE-502) in Plex Media Server on Windows: the server deserializes a serialized Python (pickle) object supplied over the network without adequate validation. A remote attacker who has already authenticated with high-privilege credentials to the server can submit a maliciously crafted serialized object, causing the server to execute arbitrary Python code upon deserialization. Successful exploitation yields code execution in the context of the Plex Media Server process on the Windows host, exposing that machine's data and credentials and, as demonstrated in the 2022 LastPass breach, potentially providing a foothold into connected environments. Windows installations running a release without the vendor's 2020 security fix are affected; Linux/NAS deployments are outside the described scope of this flaw. Exploitation is confirmed: it carries a 72.9% EPSS probability (99th percentile), has public PoC exploits (Tenable TRA-2020-32 and a PacketStorm write-up), was added to CISA's KEV catalog on 2023-03-10, and is publicly linked to the LastPass breach, where an unpatched Plex Media Server on an employee's PC was the entry point.

Do: Update Plex Media Server on every Windows host to the latest release per vendor instructions (a fix shipped in 2020), prioritizing machines used by staff with privileged or remote access, and verify versions by inventory since unpatched instances remain common. Because exploitation requires authenticated high-privilege Plex credentials, review and rotate those credentials and check affected hosts for indicators of compromise such as unexpected processes or lateral movement, as demonstrated in the LastPass incident.

CVE-2021-39144 is a remote code execution vulnerability in XStream, a widely used Java library that serializes objects to XML and back, caused by unsafe deserialization of a manipulated input stream (CWE-502, CWE-94, CWE-306). An attacker with sufficient rights to feed crafted input into an application running an affected XStream version can trigger arbitrary type instantiation and execute commands on the host, with high impact to confidentiality, integrity and availability (CVSS 3.1: 8.5, scope changed). Only deployments relying on XStream's default blacklist configuration are affected; users who configured XStream's security framework with a whitelist limited to the minimal required types are not affected, and XStream 1.4.18 removed the vulnerable default blacklist behavior. The library is embedded in many downstream products in the data, including Debian Linux and Fedora packages, NetApp SnapManager, and numerous Oracle Communications, Commerce and Retail products, and it was exploited in VMware Cloud Foundation and NSX Manager. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2023-03-10, is being actively exploited in the wild per current headlines, and EPSS assigns a 98.1% probability of exploitation within 30 days.

Do: Upgrade XStream to 1.4.18 or later, or configure its security framework with a whitelist limited to the minimal required types; apply vendor-supplied updates for VMware Cloud Foundation/NSX Manager, Oracle, NetApp, Debian and Fedora per the CISA KEV required action. Prioritize internet-exposed VMware NSX Manager and Cloud Foundation deployments, which are being actively exploited, and audit any applications that pass untrusted XML input into XStream.

CVE-2022-28810 is an operating system command injection flaw (CWE-78) in the policy custom script feature of Zoho ManageEngine ADSelfService Plus, compounded by use of a default administrator password (CWE-798). A remote authenticated administrator can run arbitrary OS commands through a crafted custom script, and, because the password field is unsanitized, a partially authenticated attacker may also inject commands through it. Successful exploitation executes commands as SYSTEM, giving the attacker full control of the hosting Windows server. Organizations running ADSelfService Plus builds before 6122 are affected. The flaw has public proof-of-concept code and a Metasploit module, a 71% EPSS score, and was added to CISA's Known Exploited Vulnerabilities Catalog on 2023-03-07, indicating active in-the-wild exploitation.

Do: Upgrade ManageEngine ADSelfService Plus to build 6122 or later per the vendor's instructions; this is a required action for federal agencies under the CISA KEV listing. Until patched, restrict internet exposure of the console and self-service endpoints, replace default administrator credentials, and review configured policy custom scripts and SYSTEM-context process logs for signs of command injection. Given the product's history of APT targeting, hunt for follow-on activity on any host that ran ADSelfService Plus unpatched.

VMware Cloud Foundation (NSX-V) contains an XML External Entity (XXE) vulnerability. On VCF 3.x instances with NSX-V deployed, this may allow a user to exploit this issue leading to a denial-of-service condition or unintended information disclosure.

CVE-2022-33891 is an OS command injection flaw (CWE-78) in Apache Spark's HttpSecurityFilter, which handles access-control checks for the Spark UI. When ACLs are enabled via the spark.acls.enable configuration option, a remote party reaching the Spark UI can supply an arbitrary username that is accepted for impersonation, and that attacker-controlled input is ultimately used to build and execute a Unix shell command. A successful attacker gains arbitrary shell command execution as the operating-system user under which Spark is running, with the CVSS v3.1 vector (network vector, low complexity, low privileges, no user interaction, high C/I/A) rating this 8.8 High. It affects Apache Spark 3.0.3 and earlier, 3.1.1 through 3.1.2, and 3.2.0 through 3.2.1 — essentially deployments with ACLs enabled and a Spark UI reachable by untrusted users. Exploitation is confirmed in the wild: a public PoC exists, CISA added the flaw to its Known Exploited Vulnerabilities Catalog on 2023-03-07, and headlines report a Zerobot botnet variant spreading by exploiting Apache Spark, with EPSS at 93.1% (100th percentile).

Do: Upgrade Apache Spark to a patched release per Apache's and CISA's vendor instructions, as the flaw is in the KEV Catalog with a required action of applying updates. As an interim mitigation, disable spark.acls.enable if ACLs are not required, and restrict network access to the Spark UI from untrusted networks or expose it only behind authentication at the network layer. Check Spark hosts for suspicious child processes or unexpected commands executed under the Spark service account, which would indicate successful exploitation.

GLPI, a widely deployed open-source IT asset management platform, bundles a third-party htmlawed library whose htmLawedTest.php script permits unauthenticated PHP code injection (CWE-74) in GLPI versions through 10.0.2. An attacker triggers it by sending a crafted HTTP request with injected PHP parameters to the directly web-reachable /vendor/htmlawed/htmlawed/htmLawedTest.php script, with no authentication and no user interaction required (AV:N/AC:L/PR:N/UI:N). Successful exploitation yields remote code execution on the web server as the web service account, enabling data theft, lateral movement, and follow-on activity such as ransomware staging or botnet recruitment. Any organization running GLPI 10.0.2 or earlier is affected, particularly internet-facing instances where the test script is directly reachable. The flaw is under active exploitation: it was added to CISA's Known Exploited Vulnerabilities Catalog on 2023-03-07 (required action: apply vendor updates), carries a 99.7% EPSS score, and multiple public proof-of-concept exploits are available.

Do: Upgrade GLPI to a fixed release newer than 10.0.2 (or update the bundled htmlawed library to a patched version); as an interim mitigation, remove or block direct web access to /vendor/htmlawed/htmlawed/htmLawedTest.php. Prioritize internet-facing instances given active exploitation and the 99.7% EPSS score, and review web access logs for requests to htmLawedTest.php plus signs of webshells or unexpected administrator accounts. As a CISA KEV entry, federal agencies and other KEV subscribers are required to apply vendor updates per the catalog instructions.