CISA adds 15 new flaws to its Known Exploited Vulnerabilities Catalog

CVE-2014-4404 is a heap-based buffer overflow (CWE-119) in the IOHIDFamily component of Apple OS X, and the flaw also affects iOS versions before 8 and Apple TV software before 7. IOHIDFamily is the OS X/iOS kernel component that handles Human Interface Device (HID) processing; the source data does not specify the exact trigger, but the overflow occurs when this kernel component handles crafted HID-related input or data. A successful attacker gains the ability to execute arbitrary code in a privileged context, effectively kernel-level privileges on the affected device. Affected populations are Apple OS X systems (per CISA), iOS devices running iOS 7 or earlier, and Apple TV units on software prior to version 7. Exploitation is confirmed in the wild: the flaw was added to the CISA Known Exploited Vulnerabilities catalog on 2022-02-10, and EPSS assigns a 49% probability of exploitation in the next 30 days (99th percentile).

Do: Apply updates per vendor instructions: upgrade iOS devices to iOS 8 or later and Apple TV to software 7 or later, and ensure Macs run an OS X build containing Apple's IOHIDFamily fix (verify against Apple's security update list, as the source data does not name the fixed OS X version). Inventory your estate for legacy iOS, Apple TV, and OS X installations, since these are 2014-era version ranges and the flaw is on CISA's KEV list, which mandates remediation per vendor instructions. Treat kernel-level code execution as full device compromise when triaging any suspected exploitation.

CVE-2015-1130 is a flaw in the XPC implementation of the Admin Framework in Apple OS X, where the framework fails to properly enforce authentication for administrative actions. A local user can trigger the vulnerable XPC service with a crafted request, bypassing the authentication check. Successful exploitation grants the attacker admin (root-level) privileges on the machine, enabling full local privilege escalation from an ordinary user account. Any Mac running OS X before 10.10.3 is affected, making this relevant to shared or multi-user Macs where attackers only need a low-privileged foothold. The flaw was patched by Apple in OS X 10.10.3, but CISA added it to the Known Exploited Vulnerabilities catalog on 2022-02-10, indicating confirmed exploitation in the wild; EPSS assigns it a 9.9% probability of exploitation in the next 30 days (95th percentile).

Do: Upgrade affected Macs to OS X 10.10.3 or later, per Apple's vendor instructions, as required by the CISA KEV listing. Since this is a local privilege escalation, prioritize shared, multi-user, and managed Macs where attackers are more likely to have a low-privileged foothold, and verify via endpoint inventory that no systems remain on pre-10.10.3 builds.

CVE-2015-1635 is a remote code execution flaw in HTTP.sys, the kernel-mode HTTP protocol stack component of Microsoft Windows that handles HTTP(S) traffic for IIS and other web-facing Windows roles. A remote, unauthenticated attacker can trigger it by sending specially crafted HTTP requests to a system listening via HTTP.sys, most commonly an internet-facing IIS web server. Successful exploitation yields arbitrary code execution with kernel/system-level privileges on the target server, giving the attacker full control of the host. Any Windows deployment where HTTP.sys is reachable is affected - typically IIS web servers and web-facing roles such as Exchange or WSUS - although the source data does not specify exact version ranges. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog (added 2022-02-10) with a ~100% EPSS probability of exploitation within 30 days, indicating active exploitation; public proof-of-concept code is not noted in the data and ransomware use is unknown.

Do: Apply Microsoft updates per vendor instructions (this CVE is addressed by the April 2015 MS15-034 bulletin) on every Windows system where HTTP.sys is reachable, prioritizing internet-facing IIS, Exchange, and WSUS hosts. Inventory your environment for systems running web-facing Windows roles and, if patching must be delayed, restrict inbound HTTP/80 and HTTPS/443 from untrusted sources or filter malformed HTTP requests at a front-end proxy/WAF. As a CISA KEV entry, this is a required patch for federal agencies; treat it as urgent everywhere else.

The D-Link DIR-645 wired/wireless router is vulnerable to OS command injection (CWE-77) in its HNAP interface: input supplied to the GetDeviceSettings action is not properly neutralized, so a remote attacker who sends a crafted HTTP request to the router's HNAP endpoint can have arbitrary operating-system commands executed on the device. Successful exploitation gives the attacker control of the router at the system level, enabling reconfiguration or abuse of the device, traffic interception or redirection, and recruitment into IoT botnets, as reflected in recent Moobot/MooBot botnet campaigns. Any site or household still running a DIR-645, especially one whose web/HNAP management interface is reachable from the internet, is affected; the product is end-of-life. The flaw is under active exploitation: it was added to CISA's Known Exploited Vulnerabilities catalog on 2022-02-10, and EPSS assigns a 97.1% probability of exploitation within 30 days (100th percentile). CISA's required action reflects the risk: disconnect the impacted product if it is still in use because it has reached end-of-life.

Do: Because the DIR-645 is end-of-life, CISA's required action is to disconnect it; replace the device where possible, or at minimum apply the latest available D-Link firmware for the DIR-645 and ensure the management/HNAP interface is not reachable from the internet (block or restrict remote administration on the WAN side). Check the device for signs of botnet infection, such as unexpected outbound traffic or unexpected HNAP POST/SOAP requests, and prioritize this fix given the 97.1% EPSS score and known in-the-wild exploitation.

CVE-2016-3088 is an improper input-validation flaw (CWE-434) in the Fileserver web application bundled with Apache ActiveMQ 5.x, which lets anyone upload files to the broker without authenticating. An attacker triggers it by sending an HTTP PUT request that uploads an attacker-controlled file (typically a crafted JSP) and then an HTTP MOVE request that relocates that file into a directory served by the embedded web console, where the Jetty web container executes it. This yields unauthenticated remote code execution with the privileges of the ActiveMQ process (CVSS 3.1: 9.8 critical, network-vector, no privileges or user interaction required). Any deployment of ActiveMQ 5.x prior to 5.14.0 is affected, and internet-exposed brokers are the most directly at risk. The flaw is actively exploited: it is in CISA's Known Exploited Vulnerabilities catalog (added 2022-02-10), has a public PoC on Exploit-DB, a 98.5% EPSS score, and has been used by real-world malware such as the XBash ransomware/miner and the Pro-Ocean crypto-mining campaign.

Do: Upgrade to Apache ActiveMQ 5.14.0 or later, ideally a current supported release per vendor instructions. If upgrading is not immediately possible, disable or remove the Fileserver web application or restrict network access to the embedded Jetty web console (default TCP 8161) so it is not internet-exposed. Check web-access logs for suspicious HTTP PUT/MOVE requests against /fileserver/ and for unexpected JSP or script files in the web console directories, which would indicate prior compromise.

CVE-2017-0144 is a remote code execution flaw in the SMBv1 server component of Microsoft Windows, commonly known as EternalBlue, and one of the SMB flaws fixed by Microsoft in the March 2017 MS17-010 bulletin. An attacker who can reach the SMB service over the network sends specially crafted packets that trigger memory corruption in the SMBv1 implementation, gaining the ability to execute arbitrary code on the target without user interaction. Successful exploitation yields full system compromise and has been heavily weaponized for wormable spread and ransomware delivery, notably via the leaked NSA exploit and in the WannaCry/NotPetya-era outbreaks, and the flaw has repeatedly been bundled into botnets and ransomware tooling since. Anyone running unpatched Windows Vista SP2 through Windows 10 1607 / Windows Server 2016 with SMBv1 enabled is affected, as are Siemens medical and laboratory devices (ACUSON ultrasound, syngo SC2000, Tissue Preparation System, VERSANT kPCR systems) whose firmware depends on SMBv1. Exploitation is actively ongoing: the flaw is in CISA's Known Exploited Vulnerabilities catalog (added 2022-02-10) with known ransomware use, carries a 99.2% EPSS exploitation probability (100th percentile), and multiple public exploits and PoCs are available.

Do: Apply the Microsoft MS17-010 (March 2017) security updates on every listed Windows version and the corresponding Siemens firmware updates for ACUSON, syngo SC2000, Tissue Preparation System, and VERSANT kPCR devices, per CISA's required action to apply vendor updates. Where patching is not yet possible, disable SMBv1 or block inbound TCP 445 (and UDP 137/138) at network boundaries and isolate legacy/medical systems from the internet. Sweep exposed and legacy hosts for compromise indicators, including DOUBLEPULSAR implants delivered over SMB, as public tooling for detecting and neutralizing this implant is available.

Microsoft Office 2010 SP2, Office 2013 SP1, and Office 2016 fail to properly handle objects in memory, creating a remote code execution condition when the software processes a specially crafted file. Triggering the flaw requires user interaction - the CVSS vector (AV:L, UI:R) indicates an attacker must get a user to open a malicious document, typically via a phishing email or similar file-delivery channel. Successful exploitation runs arbitrary code in the context of the current user, exposing the confidentiality, integrity, and availability of everything that account can access on the endpoint (CVSS 3.1: 7.8, High). Any organization running the affected Office versions is affected; the flaw was one of several Office zero-days fixed in Microsoft's May 2017 Patch Tuesday (distinct from CVE-2017-0261 and CVE-2017-0281) and was reportedly exploited by Russian APT actors (APT28/Sofacy) around that time. Exploitation is confirmed: CISA added it to the Known Exploited Vulnerabilities catalog on 2022-02-10, and EPSS currently rates the 30-day exploitation probability at 81% (100th percentile), so unpatched endpoints should be treated as actively targeted.

Do: Apply Microsoft's May 2017 security updates for Office 2010 SP2, Office 2013 SP1, and Office 2016, per the CISA KEV required action, and verify through asset inventory that no endpoint is running an unpatched Office build. Because exploitation requires user interaction with a crafted file, harden email and attachment handling (block or detonate Office files from untrusted sources) and brief users on unsolicited documents. Office 2010 and 2013 have since reached end of support, so migrate any remaining deployments to a currently supported Office release.

CVE-2017-0263 is a use-after-free flaw (CWE-416) in the Windows kernel-mode drivers (Win32k) that allows a locally authenticated user to elevate privileges. It is triggered by running a specially crafted application that mishandles kernel memory on Windows 7 SP1, Windows 8.1, Windows RT 8.1, Windows 10 1507/1511/1607/1703, and Windows Server 2008 SP2/R2 SP1, Server 2012 Gold/R2, and Server 2016. Successful exploitation yields kernel-level privileges, effectively giving an attacker full control of the host and making it a common link in chained attacks alongside other bugs; related 2017 reporting associated the flaw with Sofacy (APT28) activity. Any unpatched Windows installation of the affected releases is affected, including long-lived legacy desktops and servers. The flaw is confirmed exploited in the wild — it is listed in CISA's Known Exploited Vulnerabilities Catalog (added 2022-02-10) — with two public PoC/exploit references and a ~10% EPSS probability of exploitation in the next 30 days (95th percentile).

Do: Apply Microsoft security updates per vendor instructions - this Win32k bug was fixed in the April 2017 Patch Tuesday release - prioritizing hosts where untrusted or low-privileged users can execute code (terminal/VDI servers, shared workstations, jump hosts). Windows 7/8.1 and Server 2008/2012 are past end of extended support, so use Extended Security Updates or migrate where patching in place is not possible. Verify installed builds against the affected version list above and close out the CISA KEV remediation requirement promptly.

Oracle WebLogic Server (CVE-2017-10271) contains a remote code execution flaw in its WLS Security component, where an XMLDecoder deserialization bug allows unauthenticated attackers to execute arbitrary code. The flaw is triggered by sending specially crafted XML requests to exposed WebLogic HTTP endpoints, so any instance whose WebLogic ports are reachable by untrusted users is at risk. Successful exploitation yields arbitrary code execution on the application server host, and the bug has been widely leveraged to install cryptominers and ransomware payloads. Organizations running Oracle WebLogic Server — particularly instances directly exposed to the internet — are affected, and the flaw has been on CISA's Known Exploited Vulnerabilities catalog since 2022-02-10 with confirmed ransomware use. Exploitation is assessed as essentially certain in the near term (EPSS 100.0%, 100th percentile), and defenders should treat it as an actively exploited, high-priority issue.

Do: Apply Oracle's updates for CVE-2017-10271 per Oracle's instructions (the vendor's required action for this KEV entry). Until patched, restrict network access to WebLogic HTTP/admin ports from untrusted networks and limit or remove access to the XML/WSAT endpoints used for exploitation. Because ransomware operators are known to exploit this flaw, review internet-exposed WebLogic instances for signs of compromise, such as unexpected processes, new scheduled tasks, webshells, or ransomware artifacts.

CVE-2017-8464 is a remote code execution flaw in how the Windows Shell handles .LNK shortcut files, evoking the 2010 Stuxnet-era LNK bug that Microsoft had to fix repeatedly. It is triggered when Windows Explorer, or any other application that parses shortcut icons, processes a crafted .LNK file — for example while browsing a USB drive, network share, or downloaded folder — and the CVSS vector requires user interaction but no privileges. A successful attacker can execute arbitrary code in the context of the logged-on user, with high impact on confidentiality, integrity, and availability. Nearly every Windows release in support at disclosure time is affected, spanning Windows 7 SP1, Windows 8/8.1, Windows RT 8.1, Windows 10 (Gold through 1703), and Windows Server 2008 through 2016. Exploitation is confirmed: CISA added it to the Known Exploited Vulnerabilities catalog on 2022-02-10, EPSS assigns a 90% 30-day exploitation probability (100th percentile), public PoCs exist, and headlines tie it to malware campaigns such as Lucifer and BlackSquid.

Do: Apply Microsoft security updates per vendor instructions (released with the June 2017 Patch Tuesday and carried forward in later cumulative/rollup updates) on all affected systems, prioritizing legacy Windows 7/8/RT 8.1 and Server 2008/2012/2016 hosts that remain in service, including any under Extended Security Updates. Since CISA lists this as actively exploited, verify patch status fleet-wide and hunt for suspicious .LNK activity; as interim mitigation, be cautious with untrusted removable media, network shares, and downloaded shortcuts, and consider Microsoft's guidance on disabling shortcut icon display.

CVE-2017-9791 is an improper input validation flaw (CWE-20) in the Struts 1 plugin shipped with Apache Struts 2.1.x and 2.3.x. When a user-supplied field value is passed as a raw message to ActionMessage, it is evaluated as an expression, allowing an unauthenticated attacker to achieve remote code execution with the privileges of the Java web application. Organizations running Struts 2.1.x/2.3.x applications with the Struts 1 plugin enabled are affected, and Oracle has separately shipped patches for Struts bundled in its products. The flaw is listed in CISA's Known Exploited Vulnerabilities Catalog (added 2022-02-10) and carries a 98.9% EPSS score (100th percentile), indicating active, widespread exploitation, though no public proof-of-concept is catalogued.

Do: Apply updates per vendor instructions as required by CISA by upgrading Struts 2.1.x/2.3.x to a patched release and, where feasible, disabling or removing the Struts 1 plugin; audit application code for ActionMessage calls that pass unvalidated user input as raw messages. For Oracle products that bundle Struts, apply Oracle's Struts-related security patches. Prioritize internet-facing applications given confirmed in-the-wild exploitation (KEV) and the near-certain near-term exploitation probability (EPSS 98.9%).

CVE-2018-1000861 is a critical flaw (CVSS 3.1: 9.8) in the Stapler web framework used by Jenkins, located in stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java, where crafted URLs cause the framework to invoke Java object methods that were never intended to be reachable over HTTP (CWE-502, deserialization of untrusted data). By chaining these unintended method invocations, an unauthenticated remote attacker can achieve code execution on the affected Jenkins instance. All Jenkins releases up to and including 2.153 (weekly line) and 2.138.3 (LTS line) are affected, and Red Hat OpenShift Container Platform deployments that ship bundled Jenkins/Stapler components are also in scope. Exploitation is confirmed in the wild: CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2022-02-10, EPSS assigns a 98.3% probability of exploitation within 30 days, and related reporting documents hackers exploiting this Jenkins flaw, with coverage of the WatchBog cryptomining botnet known to target it. No public proof-of-concept exploit is catalogued and ransomware use is unknown, but the KEV listing alone confirms real-world exploitation.

Do: Upgrade Jenkins to a release newer than 2.153 (weekly) or newer than 2.138.3 (LTS), per vendor instructions (fixed releases are 2.154 / 2.138.4 or later), and apply Red Hat updates for OpenShift Container Platform images that bundle Jenkins. Until patched, keep Jenkins controllers off the open internet, restrict unauthenticated/anonymous access to the Jenkins UI, and review controller logs for crafted URLs that invoke unintended methods on Java objects. Because the flaw is in CISA KEV with a 98.3% EPSS score, treat patching as urgent and check internet-exposed controllers for signs of compromise such as cryptomining activity.

CVE-2020-0796 ('SMBGhost') is a memory-corruption (CWE-119) flaw in Microsoft's Server Message Block 3.1.1 (SMBv3) implementation, in which certain crafted requests — notably malformed compressed SMBv3 messages — can corrupt memory on the target. An unauthenticated remote attacker can trigger it by sending specially crafted SMBv3 packets directly to any SMB-enabled host, with no credentials or user interaction required. Successful exploitation yields arbitrary code execution on the target server or client, giving the attacker full control of the host, and the flaw was widely characterized as wormable because a compromised host can then attack others. Any Windows system running SMBv3 is affected — SMBv3 is enabled by default on modern Windows 10 and Windows Server builds, with Windows 10 versions 1903/1909 and Windows Server 2019/versions 1903/1909 identified in Microsoft's advisory. Exploitation is confirmed in the wild: the CVE is in CISA KEV (added 2022-02-10) with known ransomware use, EPSS assigns a 99.8% probability of exploitation within 30 days (100th percentile), and no public PoC is listed in the source data.

Do: Apply Microsoft's updates per vendor instructions immediately, prioritizing Windows 10 1903/1909 and Windows Server 2019/1903/1909 hosts and anything with SMB (TCP 445) reachable by untrusted networks. Until patched, disable SMBv3 compression per Microsoft's mitigation guidance (setting DisableCompression=1 under LanmanServer) and restrict inbound TCP 445 to trusted sources. Given confirmed ransomware use, hunt for post-exploitation activity on unpatched hosts.

CVE-2021-36934 is an elevation of privilege vulnerability in Windows caused by overly permissive Access Control Lists (ACLs) on multiple system files, including the Security Accounts Manager (SAM) database. A local attacker who already has the ability to execute low-privileged code on a victim system can leverage the misconfigured ACLs to gain arbitrary code execution with SYSTEM privileges, then install programs, view, change or delete data, or create new accounts with full user rights. Affected products per the CPE data are Windows 10 versions 1809, 1909, 2004, 20H2 and 21H1, with related coverage noting the bug impacts all Windows 10 versions released in the past 2.5 years and also references Windows 11. CISA added the flaw to its Known Exploited Vulnerabilities Catalog on 2022-02-10, confirming in-the-wild exploitation, and EPSS assigns a 67.3% probability of exploitation within 30 days (99th percentile). Mitigation is two-step: installing the security update alone is not sufficient — administrators must also manually delete all shadow copies of system files, including the SAM database, per KB5005357.

Do: Apply Microsoft's security update per vendor instructions, then follow KB5005357 to manually delete all shadow copies of system files (including the SAM database), because the update alone does not fully mitigate the vulnerability. Restrict or verify ACLs on the System32 config directory and shadow-copy access if shadow-copy deletion cannot be done immediately, and prioritize patching given the flaw's listing in CISA's Known Exploited Vulnerabilities Catalog.