Alerts: CISA Adds Two Known Exploited Vulnerabilities to Catalog

Mar 13, 2025

—

Source URL: https://www.cisa.gov/news-events/alerts/2025/03/13/cisa-adds-two-known-exploited-vulnerabilities-catalog
Source: Alerts
Title: CISA Adds Two Known Exploited Vulnerabilities to Catalog

Feedly Summary: CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation.

CVE-2025-24201 Apple Multiple Products WebKit Out-of-Bounds Write Vulnerability
CVE-2025-21590 Juniper Junos OS Improper Isolation or Compartmentalization Vulnerability

These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.
Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the Known Exploited Vulnerabilities Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information.
Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.

AI Summary and Description: Yes

Summary: The text discusses two vulnerabilities recently added to CISA’s Known Exploited Vulnerabilities Catalog, emphasizing the urgency for federal agencies and organizations to remediate these vulnerabilities to mitigate risks from cyber threats.

Detailed Description: The content outlines significant cybersecurity vulnerabilities that have been recognized by the Cybersecurity and Infrastructure Security Agency (CISA). The focus is on the necessity for timely remediation to safeguard networks and systems from active exploitation.

– **CVE-2025-24201**: Identified as an Out-of-Bounds Write Vulnerability affecting various Apple products within the WebKit framework.
– **CVE-2025-21590**: Associated with an Improper Isolation or Compartmentalization Vulnerability in Juniper’s Junos OS.

Key points include:
– **Active Exploitation**: The vulnerabilities included are known to be actively exploited, necessitating immediate attention.
– **BOD 22-01**: This Binding Operational Directive mandates that Federal Civilian Executive Branch agencies address recognized vulnerabilities promptly to defend against potential cyberattacks.
– **Encouragement to All Organizations**: Although the directive targets specific federal agencies, CISA advocates that all organizations should prioritize the remediation of identified vulnerabilities.
– **Living Catalog**: The Known Exploited Vulnerabilities Catalog is a dynamic list that will continue to be updated with new vulnerabilities as necessary, ensuring organizations are aware of the latest threats.

These insights are crucial for security professionals, especially those focused on information security, compliance frameworks, and vulnerability management practices. Understanding and mitigating these vulnerabilities can significantly reduce the risk of successful attacks in both federal and private sectors.

01 1 2 24 3 4 5 a Act active exploitation active threats AI alerts alt and Apple Apple Products art as attack attack vector attack vectors attacks based Binding Operational Directive Bounds Write by C catalog CIA CISA Common Vulnerabilities Common Vulnerabilities and Exposures compartmentalization compliance compliance framework compliance frameworks content CVE cyber cyber actors cyber threat cyber threats cyberattack Cyberattacks cybersecurit Cybersecurity Cybersecurity and Infrastructure Security Agency Cybersecurity and Infrastructure Security Agency (CISA) cybersecurity vulnerabilities D de directive e end enterprise ERP event exp exploit Exploitation exploited vulnerabilities Exposures fact federal agencies Federal Civil Federal Civilian Executive Branch federal enterprise focused for framework frameworks g Gen Go H HR http HTTPS Improper Isolation in information information security infrastructure infrastructure security insights isolation ite J Juniper Junos k Key Known Exploited Vulnerabilities Known Exploited Vulnerabilities Catalog l led Li Living malicious cyber actors man management media multi N network networks news no o of on operation organization organizations out point potential private sector product products professionals prompt R rag RCE red remediation Risk risks Ro RoT s safe sec sector security security professionals Security Vulnerabilities Sig SoC source specific SSE system systems T test text the threat threats Time to Tor TP two type UI up update US use V vectors vents vulnerabilities vulnerabilities catalog vulnerability Vulnerability Management vulnerability management practice vulnerability management practices Ware web WebKit Wi x