CISA Warns of 5 Actively Exploited Security Flaws: Urgent Action Required

CVE-2019-1388 is an elevation-of-privilege vulnerability in the Windows Certificate Dialog that fails to properly enforce user privileges (CWE-269). An attacker who can already run code or open crafted certificate content on a local machine can trigger the vulnerable dialog and cause privileged components to execute attacker-chosen actions without proper privilege checks. Successful exploitation yields high-impact control of confidentiality, integrity, and availability, effectively a full SYSTEM-level compromise of the host. Essentially every Windows client and server release in service at disclosure is affected, including Windows 7, 8.1 and RT 8.1, Windows 10 versions 1507 through 1903, and Windows Server 2008, 2012 and 1903. The flaw was fixed in Microsoft's November 2019 security updates, but CISA added it to the Known Exploited Vulnerabilities catalog on 2023-04-07 with known ransomware use, and EPSS currently estimates an 8.6% probability of exploitation within 30 days (95th percentile).

Do: Apply Microsoft security updates (November 2019 cumulative updates or later) to all in-scope Windows 7, 8.1, 10, RT 8.1 and Server 2008/2012/1903 systems, prioritizing hosts where unprivileged users can log on, per the KEV required action. For legacy releases past mainstream support, confirm Extended Security Update (ESU) coverage or plan migration, and verify installed patch levels via the OS build number. Because CISA notes known ransomware use, review incident timelines and endpooint logs for local-privilege-escalation activity preceding ransomware deployment.

Veritas Backup Exec Agent — the remote agent component of Veritas Backup Exec — still accepts a legacy 'SHA' authentication scheme that current versions no longer use but had never disabled, an improper authentication flaw tracked as CVE-2021-27877. Because the obsolete scheme remains enabled, a remote, unauthenticated attacker can authenticate to the Agent's network service and issue privileged commands, effectively achieving remote code execution on the host (CVSS 3.1: 9.8, Critical). Any Backup Exec deployment running a version before 21.2 is affected wherever the Agent service is reachable — either exposed to the internet or reachable inside the network after an initial compromise. A public proof-of-concept remote code execution exploit is available, and the flaw carries a very high near-term exploitation likelihood (EPSS ~65%). The bug is actively exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2023-04-07 with known ransomware use, and the ALPHV/BlackCat ransomware affiliate has been reported targeting Veritas Backup Exec flaws.

Do: Upgrade Veritas Backup Exec to 21.2 or later per vendor instructions, as required by CISA's Known Exploited Vulnerabilities catalog. As an interim mitigation, restrict the Backup Exec Agent service (TCP/10000) to trusted backup servers and block it from untrusted networks, including the internet. Given confirmed ransomware use by ALPHV/BlackCat, prioritize patching internet-exposed and high-value backup servers.

A memory leak (CWE-401) in Arm's Mali GPU kernel drivers affects Midgard (all versions r6p0-r32p0), Bifrost (all versions r0p0-r42p0), Valhall (all versions r19p0-r42p0), and Avalon (r41p0-r42p0), allowing a non-privileged local user to perform valid GPU processing operations that expose sensitive kernel metadata. A local attacker or app on an affected device gains an information-disclosure primitive that reads otherwise protected kernel memory (CVSS 3.1 base score 3.3, confidentiality impact only), potentially aiding further attacks. Exposure applies to any device whose CPU incorporates an affected Mali GPU and runs the corresponding driver, most commonly Android smartphones and tablets built on licensed Mali designs. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog (added 2023-04-07), indicating active exploitation, and Arm has issued patched drivers, with fixes also delivered through vendor/Android update channels; ransomware use is unknown.

Do: Apply Arm's patched Mali kernel driver releases (versions beyond the affected ranges) via your SoC/OEM vendor, and on Android devices install the latest Google/OEM security updates, per CISA's required action. Inventory fleets for devices running affected Mali driver generations (Android phones, tablets, and embedded/edge devices) and confirm they receive the fixed driver; note that patching is mandatory for U.S. federal agencies under the KEV program despite the low severity of this local information-disclosure flaw.

CVE-2023-28205 is a use-after-free flaw (CWE-416) in the WebKit engine shipped with Apple iOS, iPadOS, macOS, and the Safari browser, where memory is freed and then incorrectly reused while processing HTML. It is triggered when a device processes maliciously crafted web content, meaning simply loading an attacker-controlled page in Safari or any WebKit-based HTML renderer can trigger the bug. Successful exploitation allows the attacker to achieve code execution in the context of the WebKit process on the victim device. All users of iOS, iPadOS, macOS, and Safari are potentially affected, as are non-Apple products that rely on WebKit for HTML processing. The flaw is being actively exploited in the wild — it was added to CISA's Known Exploited Vulnerabilities catalog on 2023-04-10, with the required action to apply updates per vendor instructions — and EPSS assigns a 27.1% probability of exploitation within 30 days (98th percentile).

Do: Apply Apple's current security updates for iOS, iPadOS, macOS, and Safari as soon as possible, per the vendor instructions cited in the CISA KEV listing. Because this is a browser/HTML-engine flaw exploited in the wild, prioritize patching internet-facing and high-risk user fleets; users of non-Apple WebKit-based HTML parsers should check with their software vendors for updated WebKit components. Until patched, exercise caution with untrusted web content.

Apple's IOSurfaceAccelerator component in iOS, iPadOS, and macOS contains an out-of-bounds write flaw (CWE-787). The bug is triggered by an application running locally on the device, which can corrupt memory in the component during a write past a buffer boundary. A successful exploit allows the app to execute arbitrary code with kernel privileges, giving it full control of the device beyond the normal app sandbox. Any user of an Apple iOS, iPadOS, or macOS device running an affected, unpatched version is exposed. The flaw was added to CISA KEV on 2023-04-10, confirming known in-the-wild exploitation; ransomware use is unknown, no public PoC is available, and EPSS assigns a 24.5% probability of exploitation within 30 days (98th percentile).

Do: Update all iPhones, iPads, and Macs to the latest iOS/iPadOS/macOS versions available as of April 2023, per CISA's required action and Apple's security advisories. Use MDM or patch-reporting tooling to inventory endpoints and confirm no devices remain on pre-patch builds. Because exploitation is confirmed in the wild and any local app can act as the trigger, patching is the primary mitigation and there is no dependable configuration workaround.