Organizations Urged to Fix 41 Vulnerabilities Added to CISA’s Catalog of Exploited Flaws

CVE-2016-0162 is an information disclosure flaw (CWE-200) in Microsoft Internet Explorer caused by improper handling of JavaScript, which can allow an attacker to detect the presence of specific files on a user's computer. It is triggered when Internet Explorer processes attacker-controlled JavaScript, typically when a user views a crafted webpage or embedded web content. What the attacker gains is reconnaissance value rather than code execution: confirmation that named files exist on the victim's machine, which can be used to tailor more targeted follow-on attacks. Any user running the affected Internet Explorer versions is potentially exposed, although the source data does not enumerate specific version ranges beyond 'Microsoft Internet Explorer.' The flaw was added to CISA's Known Exploited Vulnerability (KEV) catalog on 2022-05-24, confirming exploitation in the wild; EPSS estimates a 22.1% probability of exploitation within 30 days (98th percentile), and no public proof-of-concept is known.

Do: Apply Microsoft security updates for Internet Explorer per vendor instructions, prioritizing user workstations and any internet-facing systems where IE is in use, and treat this as a patch-now item given the KEV listing. Verify that IE builds are current against Microsoft's cumulative IE security updates, since the source data does not list specific fixed versions. Where feasible, reduce attack surface by steering users to supported modern browsers or restricting legacy IE to trusted sites; CISA lists ransomware association as unknown, so confirm whether your threat intel ties this CVE to known campaigns.

CVE-2020-0638 is a local elevation of privilege flaw in the way Microsoft's Update Notification Manager handles files (CWE-59, a link-following/race-condition class of bug), affecting Windows 10 versions 1709, 1803, 1809, 1903 and 1909, plus Windows Server 1803, 1903, 1909 and 2019. To trigger it, an attacker must first gain code execution on the victim system with limited privileges; no user interaction is required after that initial foothold. Successful exploitation allows the attacker to elevate privileges with high impact on confidentiality, integrity and availability, making it a useful step in ransomware and other intrusion chains to take full control of a host. Microsoft fixed the issue in its January 2020 Patch Tuesday security updates. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2022-05-23 with known ransomware use, confirming exploitation in the wild; no public proof-of-concept is known.

Do: Apply Microsoft's January 2020 security updates (or any later cumulative update) to all affected Windows 10 and Windows Server systems, prioritizing user workstations and servers where an attacker with an existing foothold would matter; federal agencies must patch per CISA KEV/BOD 22-01 timelines. Inventory endpoints still running Windows 10 builds 1709–1909 and Windows Server 1803/1903/1909/2019 and verify the installed cumulative update level. Because exploitation requires prior code execution, pair patching with EDR and least-privilege controls to disrupt ransomware chains.

CVE-2021-1048 is a use-after-free (CWE-416) in ep_loop_check_proc of eventpoll.c — the Android kernel's epoll event-notification code — that can corrupt kernel memory. A local attacker (e.g., a malicious app with no special permissions) can trigger the flaw, and no user interaction is required, yielding local escalation of privilege to kernel level. Any Android device running an unpatched Android kernel is affected. The flaw is being actively exploited: it is in CISA's Known Exploited Vulnerabilities Catalog (added 2022-05-23) and reporting indicates Google fixed it as a zero-day used in targeted attacks, with coverage tying Android kernel zero-days to Cytrox/Intellexa Predator spyware campaigns. EPSS currently puts the 30-day exploitation probability at ~1.0%, but the KEV listing and in-the-wild targeting make patching urgent.

Do: Apply updates per vendor instructions (CISA KEV required action): install the latest Android security/kernel updates from Google or your device OEM — Google's advisories indicate the complete fix shipped in the February 2022 Android security bulletin (2022-02-05 patch level), following the initial January 2022 fix. Fleet administrators should verify devices' security patch levels and prioritize high-value/targeted users, since observed exploitation has been targeted (spyware-linked) rather than mass-scale. No public PoC is known and ransomware use is unknown, but defenders should hunt for signs of local privilege escalation on unpatched fleets.

A vulnerability in the health check RPM of Cisco IOS XR Software causes TCP port 6379 to be opened by default when the RPM is activated, exposing the Redis instance running inside the NOSi container to unauthenticated, remote access. An attacker who can reach the exposed port simply connects to the Redis service; no credentials, authentication, or user interaction are required. A successful exploit allows the attacker to write to the Redis in-memory database, write arbitrary files to the container's filesystem, and retrieve information about the Redis database; because the container is sandboxed, the flaw does not permit remote code execution or compromise of the host IOS XR system. Any organization running Cisco IOS XR with the health check RPM activated and TCP 6379 remotely reachable is affected, which in practice means service-provider and large-enterprise router deployments. The flaw was added to CISA's Known Exploited Vulnerabilities Catalog on 2022-05-23 and was reported as actively exploited in the wild, although no public proof-of-concept code is known.

Do: Apply updated IOS XR releases per Cisco's security advisory, prioritizing internet-facing routers since the flaw is listed as actively exploited in CISA's KEV. Until patching, restrict or ACL access to TCP port 6379 on IOS XR devices (including via control-plane filtering) and check whether the health check RPM is activated on each device. Monitor for unexpected connections to port 6379 and review the Redis database and container filesystem for signs of unauthorized writes.