CISA plans to share more information on ransomware actors in its exploited vulnerability alerts

CVE-2023-20109 is an out-of-bounds write (CWE-787) in the Group Encrypted Transport VPN (GET VPN) feature of Cisco IOS and Cisco IOS XE, caused by insufficient validation of Group Domain of Interpretation (GDOI) and G-IKEv2 protocol attributes. An authenticated, remote attacker with administrative control of either a GET VPN group member or key server can trigger the flaw by compromising the installed key server or by modifying a group member's configuration to point at an attacker-controlled key server, then sending crafted GDOI/G-IKEv2 attributes. A successful exploit allows the attacker to execute arbitrary code and gain full control of the device, or to crash/reload it, causing a denial-of-service condition. Only organizations running Cisco IOS/IOS XE devices with the GET VPN feature configured (as group members or key servers) are affected; CVSS 3.1 rates it 6.6 (medium) because exploitation requires high privileges and high attack complexity. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2023-10-10, indicating confirmed in-the-wild exploitation, while EPSS estimates a 2.3% probability of exploitation in the next 30 days and no public PoC is known.

Do: Upgrade affected devices to a fixed release identified in Cisco's security advisory, and inventory GET VPN deployments with 'show crypto gdoi' to identify group members and their key servers. Because exploitation requires a compromised or attacker-controlled key server, harden and restrict access to key servers, verify that group member configurations point only to legitimate key servers, and rotate GET VPN keys if compromise is suspected. Per the CISA KEV required action, apply vendor mitigations promptly or discontinue use where mitigations are unavailable.

Adobe Acrobat and Reader contain a use-after-free memory-corruption flaw (CWE-416) that allows arbitrary code execution in the context of the current user. The bug is local and requires user interaction: a victim must open a malicious file, typically a crafted PDF delivered by email or web download, for the attacker's code to run. Affected builds are 22.003.20282 and earlier, 22.003.20281 and earlier, and 20.005.30418 and earlier, and CISA's affected list spans both Acrobat and Reader. Adobe shipped fixes in January 2023, but the flaw remained under active exploitation: CISA added it to the Known Exploited Vulnerabilities catalog on 2023-10-10 and EPSS gives it a 61.5% probability of exploitation within 30 days (99th percentile). No public proof-of-concept is known and any ransomware use is unconfirmed, but in-the-wild exploitation makes urgent patching necessary.

Do: Update every Acrobat and Reader installation to a build later than 22.003.20282, 22.003.20281, and 20.005.30418 per Adobe's security advisory, using the built-in updater or enterprise deployment packages and prioritizing endpoints that handle untrusted PDFs; CISA's KEV required action is to apply the vendor's mitigations or discontinue use of the product. Until patched, query your software inventory for installs at or below the affected versions and remind users that opening a malicious PDF from an untrusted source can execute attacker code at their privilege level.

CVE-2023-36563 is an information disclosure flaw (CWE-20, improper input validation) in Microsoft WordPad, the lightweight word processor bundled with supported Windows releases; Microsoft has published limited technical detail and CISA describes the flaw as unspecified. An attacker triggers it by persuading a user to open a specially crafted document in WordPad, where improper handling of the document content (including URL/remote-resource references) causes information to be disclosed to the attacker. A successful attacker gains access to sensitive information from the affected system rather than code execution, and exploitation requires user interaction with a malicious file. Any Windows installation with WordPad is potentially affected, making the population essentially the entire supported Windows installed base. Exploitation is confirmed: CISA added the flaw to its KEV catalog on 2023-10-10 and its advisory notes no public proof-of-concept is known and ransomware use is unknown; EPSS is 20.7% (97th percentile), indicating elevated near-term exploitation likelihood.

Do: Apply Microsoft's October 10, 2023 Windows security updates, which include the WordPad fix, prioritizing systems where users open untrusted documents; until patched, follow Microsoft's mitigation guidance to disable the WordPad URL protocol handler via the published registry change. Note that WordPad has since been removed entirely in Windows 11 24H2, so those systems are no longer exposed; per CISA, any ransomware linkage is unknown.

CVE-2023-41763 is a vulnerability in Microsoft Skype for Business Server that Microsoft classifies as an elevation-of-privilege issue, with the underlying weakness mapped to CWE-918 (server-side request forgery). The CVSS vector (AV:N/AC:L/PR:N/UI:N, scope unchanged) shows it can be triggered remotely by an unauthenticated attacker sending crafted network requests, and the impact is confined to confidentiality, meaning an attacker can potentially obtain limited sensitive information from the affected server. Any organization running on-premises Skype for Business Server is potentially affected; the source data does not specify the affected version ranges. The flaw was patched in Microsoft's October 2023 Patch Tuesday, where it was fixed alongside the actively exploited WordPad zero-day (CVE-2023-36563), and it was added to CISA's Known Exploited Vulnerabilities catalog on October 10, 2023, carrying a 90.4% EPSS probability of exploitation within 30 days.

Do: Apply Microsoft's October 2023 Patch Tuesday security updates for Skype for Business Server immediately; CISA's KEV required action is to apply vendor mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. No public proof-of-concept is known, but exploitation is confirmed in the wild, so prioritize internet-facing deployments and review Skype for Business web-service logs for anomalous requests. Check which Skype for Business Server versions your organization runs against Microsoft's advisory to confirm patch applicability.

CVE-2023-44487 is a flaw in the HTTP/2 protocol's stream handling (CWE-400, uncontrolled resource consumption) in which a client opens a large number of streams and immediately cancels them with RST_STREAM frames, forcing the server to repeatedly allocate and tear down per-stream state. When this 'rapid reset' pattern is driven at high volume from many sources, it exhausts server CPU and memory, producing a distributed denial-of-service; Google, Cloudflare and AWS all reported record-scale attacks using this technique. The only impact is availability (denial of service), not code execution or data exposure, but any system speaking HTTP/2 is in scope, including web servers, load balancers, API gateways and CDN edges, and client-side implementations are also affected in a reverse-direction variant. Because the weakness is in the protocol specification itself (attributed to IETF HTTP/2), virtually every deployment with HTTP/2 enabled is affected until vendors ship mitigations or patches. Exploitation is confirmed in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2023-10-10, and EPSS assigns a 100% probability of exploitation within 30 days.

Do: Apply mitigations per vendor instructions as required by CISA KEV/BOD 22-01 guidance — most major web server, load balancer, and CDN vendors have shipped patches or tuning knobs, so check and update each HTTP/2-facing component in your estate. Where patching is not yet possible, limit the number of concurrent HTTP/2 streams per connection, rate-limit new stream creation and inbound HTTP/2 connections, or disable HTTP/2 on internet-exposed servers. Confirm with your CDN or cloud provider that rapid-reset DDoS mitigations are in place at the edge.