Security News > 2022 > March > CISA adds 15 vulnerabilities to list of flaws exploited in attacks

The U.S. Cybersecurity & Infrastructure Security Agency has added fifteen additional flaws to its list of actively exploited vulnerabilities known to be used in cyberattacks.

Since threat actors have been observed targeting these flaws in the attacks, failing to address the security issues means risking a network compromise that can lead to a catastrophic data breach or ransomware attack.

Most flaws in the new set highlighted by CISA concern privilege escalation problems on Windows, of which one, CVE-2019-0841, has a published proof-of-concept exploit that threat actors can pick up and use immediately on vulnerable systems.

The significantly older CVE-2018-8120 on Win32k was first seen exploited for attacks as a zero-day back in May 2018, but apparently, it's still valuable for threat actors.

These latest additions bring CISA's Known Exploited Vulnerabilities Catalog to a total of 504 flaws, which admins cannot ignore as they're all used by threat actors.

Organizations are advised to monitor that list and ensure they have addressed all security gaps on their systems, as adversaries don't care how old a flaw is as long as it can give them unauthorized access to the target.

News URL

https://www.bleepingcomputer.com/news/security/cisa-adds-15-vulnerabilities-to-list-of-flaws-exploited-in-attacks/