U.S. CISA adds Microsoft Windows, Apache HugeGraph-Server, Oracle JDeveloper, Oracle WebLogic Server, and Microsoft SQL Server bugs to its Known Exploited Vulnerabilities catalog

CVE-2019-1069 is a local elevation-of-privilege flaw in the Microsoft Windows Task Scheduler Service, which fails to correctly validate certain file operations (improper link/path resolution, CWE-59) that the service performs on behalf of running tasks. An attacker who has already gained unprivileged code execution on a target machine can trigger the vulnerable file operation so it is carried out by the Task Scheduler service with its elevated rights. Successful exploitation yields elevated privileges on the victim system, with CVSS impact rated High for confidentiality, integrity and availability, effectively giving the attacker full control of the local host. Affected products are Windows 10 versions 1507 through 1903 and Windows Server 1803, 1903, 2016 and 2019 — i.e., the Task Scheduler component in all of these builds. The flaw is exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2022-03-15 with known ransomware use, a public proof-of-concept has existed since June 2019, and EPSS estimates a ~6.1% probability of exploitation within 30 days (93rd percentile).

Do: Apply Microsoft's security updates for CVE-2019-1069 (released in the June 2019 Patch Tuesday cumulative updates) or later cumulative updates on Windows 10 1507–1903 and Windows Server 1803/1903/2016/2019, per CISA's required action. Verify installed OS builds against the affected list and prioritize shared/multi-user hosts (RDS/VDI, jump servers, workstations of users who run untrusted software), since ransomware operators chain this local privilege escalation after initial access. Where patching is delayed, restrict unprivileged code execution and monitor for suspicious scheduled-task and file-operation activity by the Task Scheduler service.

CVE-2020-0618 is a remote code execution flaw in Microsoft SQL Server Reporting Services (SSRS) caused by unsafe deserialization (CWE-502) of page-request/ViewState data submitted to a report server. An attacker with low-privilege (authenticated) access to a vulnerable SSRS instance can send a crafted serialized payload in a page request, with no user interaction, causing the server to deserialize attacker-controlled data and execute code. Successful exploitation yields remote code execution in the context of the SSRS service account, which is often highly privileged, enabling server compromise and lateral movement. Any organization running affected on-premises Microsoft SQL Server Reporting Services deployments is in scope. The flaw was patched in Microsoft's February 2020 Patch Tuesday, public PoCs have circulated since 2020, and CISA added it to the Known Exploited Vulnerabilities catalog on 2024-09-18 with known ransomware use and a near-certain EPSS score (99.0%), so exploitation in the wild is confirmed.

Do: Apply the SQL Server/SSRS security updates released in Microsoft's February 2020 Patch Tuesday (or subsequent cumulative updates) per Microsoft's guidance, satisfying CISA's KEV required action. Inventory environments for SSRS deployments — prioritizing internet-facing report servers — and hunt for evidence of exploitation given the known ransomware use. Restrict network access to report servers and confirm the SSRS service account is not over-privileged to limit impact if exploited.

CVE-2020-14644 is a critical (CVSS 9.8) unauthenticated remote code execution vulnerability in the Core component of Oracle WebLogic Server, Oracle's widely deployed Java application server within Oracle Fusion Middleware. An unauthenticated attacker with network access to a vulnerable WebLogic server can trigger the flaw by sending crafted requests over the IIOP or T3 protocols (the server's remote-access protocols, a well-known vector for WebLogic takeover bugs), and successful exploitation results in a complete takeover of the WebLogic Server with high impact on confidentiality, integrity and availability. Supported affected versions are 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0, and Oracle addressed the flaw in its July 2020 Critical Patch Update. Organizations running these WebLogic releases are affected, especially where the T3/IIOP listeners are reachable from untrusted networks or the internet. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2024-09-18, confirming exploitation in the wild, and EPSS assigns a 94.5% probability of exploitation within 30 days (100th percentile), although no public PoC is cataloged.

Do: Apply Oracle's July 2020 Critical Patch Update (or a later CPU) to WebLogic Server 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0, prioritizing internet-facing instances, and inventory your environment for WebLogic servers exposing the T3 and IIOP listeners to untrusted networks. Until patched, restrict access to the T3/IIOP listeners to trusted hosts only; per CISA's KEV required action (added 2024-09-18), apply vendor mitigations or discontinue use of unpatched deployments.

Oracle ADF Faces, the user-interface component of Oracle Application Development Framework (ADF) within Oracle Fusion Middleware, is vulnerable to deserialization of untrusted data (CWE-502) in versions 12.2.1.3.0 and 12.2.1.4.0. The flaw is easily exploitable: an unauthenticated attacker with network access sends malicious serialized data over HTTP, requiring no credentials, privileges, or user interaction. Successful attacks can result in takeover of the ADF deployment, with high confidentiality, integrity, and availability impacts reflected in the critical CVSS 3.1 score of 9.8. Organizations running ADF-based applications, typically built with Oracle JDeveloper and deployed as part of Oracle Fusion Middleware, are affected on the listed versions. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on 2024-09-18, confirming exploitation in the wild; EPSS assigns a 62.5% probability of exploitation within 30 days (99th percentile), while public PoC code and ransomware association are not documented.

Do: Inventory Oracle Fusion Middleware and JDeveloper-built deployments for ADF Faces versions 12.2.1.3.0 and 12.2.1.4.0 and apply the current Oracle Critical Patch Update as directed by the Fusion Middleware Patch Advisor. Prioritize internet-exposed ADF applications given confirmed in-the-wild exploitation, and per the CISA KEV required action, apply vendor mitigations or discontinue use if mitigations are unavailable. Until patched, restrict HTTP access to ADF Faces endpoints.

Apache HugeGraph-Server versions 1.0.0 through versions before 1.3.0 contain an improper access control flaw (CWE-284) that enables unauthenticated remote code execution through the server's network-facing API when the authentication system is not enabled. An attacker with network access to a vulnerable server can send crafted requests that execute arbitrary commands on the host with no credentials, privileges, or user interaction required, consistent with the CVSS 9.8 network/low-complexity vector. All deployments of HugeGraph-Server 1.0.0-1.2.x running on Java 8 or Java 11 are affected, especially instances exposed to untrusted networks with auth disabled. Exploitation is active: the bug was added to CISA's Known Exploited Vulnerabilities catalog on 2024-09-18, public reporting says it is under attack, and EPSS assigns a 99.2% probability of exploitation within 30 days (100th percentile). CISA's required action is to apply vendor mitigations per vendor instructions or discontinue use of the product.

Do: Upgrade to Apache HugeGraph-Server 1.3.0 running on Java 11 and enable the authentication (Auth) system, which fixes the issue per the vendor. If upgrading is not immediately possible, restrict network access to the HugeGraph-Server API to trusted clients and enable auth, and audit internet-exposed instances for signs of exploitation. Because this flaw is in CISA's KEV catalog, federal agencies and other bound organizations must apply the vendor mitigations or discontinue use by the required deadline.