Alerts: CISA Adds One Known Exploited Vulnerability to Catalog

Apr 2, 2025

—

Source URL: https://www.cisa.gov/news-events/alerts/2025/04/01/cisa-adds-one-known-exploited-vulnerability-catalog
Source: Alerts
Title: CISA Adds One Known Exploited Vulnerability to Catalog

Feedly Summary: CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation.

CVE-2025-24813 Apache Tomcat Path Equivalence Vulnerability

These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.
Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the Known Exploited Vulnerabilities Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information.
Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.

AI Summary and Description: Yes

Summary: CISA has identified a new vulnerability, CVE-2025-24813, related to Apache Tomcat, emphasizing its implications for federal networks and offering guidance for vulnerability remediation. This highlights the urgent need for organizations to prioritize vulnerability management, especially for known exploited vulnerabilities.

Detailed Description: The text details the introduction of a new vulnerability (CVE-2025-24813) into CISA’s Known Exploited Vulnerabilities Catalog. This catalog is critical for the federal enterprise’s cybersecurity posture, particularly in light of increasing cyber threats. Here are the major points covered:

– **New Vulnerability Identified**: CISA has added CVE-2025-24813, a specific vulnerability related to Apache Tomcat, to its catalog based on evidence of active exploitation. This underlines the need for immediate attention as it represents a known threat vector.

– **Impact on Federal Agencies**: These vulnerabilities are often targeted by malicious actors and can have severe implications for the security of federal networks. The acknowledgment of such vulnerabilities emphasizes their potential for exploitation within government infrastructures.

– **Binding Operational Directive (BOD) 22-01**: This directive mandates that Federal Civilian Executive Branch (FCEB) agencies must remediate these vulnerabilities by specified deadlines. It serves as a policy framework ensuring that security measures are taken against known risks.

– **Broader Recommendations**: Although BOD 22-01 applies specifically to federal agencies, CISA advocates that all organizations adopt similar diligence regarding remediation of vulnerabilities listed in the catalog. This advocacy extends the importance of vulnerability management principles beyond federal entities.

– **Continuous Updates to the Catalog**: CISA will continually add vulnerabilities that meet specific criteria to the catalog. This indicates an ongoing commitment to keeping the cybersecurity landscape updated and proactive in addressing vulnerabilities.

**Implications for Security and Compliance Professionals**:
– Professionals in cybersecurity should prioritize the monitoring of the Known Exploited Vulnerabilities Catalog to mitigate risks against active threats.
– Implementing a structured vulnerability management process is crucial, especially for organizations that may not fall under the specific mandates of BOD 22-01 but still face similar cyber threats.
– Awareness of these vulnerabilities and compliance with remediation guidelines can help safeguard against potential cyberattacks, making it a best practice for all organizations.

01 1 2 2025 24 3 4 5 a Act active exploitation active threats advocacy AI alerts alt and Apache Apache Tomcat app art as attack attack vector attack vectors attacks awareness based Best Binding Operational Directive by C catalog CI CIA CISA co commit Common Vulnerabilities Common Vulnerabilities and Exposures compliance compliance professionals critical CVE cyber cyber actors cyber threat cyber threats cyberattack Cyberattacks cybersecurit Cybersecurity cybersecurity landscape cybersecurity posture D de directive e end enterprise ERP event exp exploit Exploitation exploited vulnerabilities exploited vulnerability Exposures face fact federal agencies Federal Civil Federal Civilian Executive Branch federal enterprise Federal Networks for framework g Gen Go government government infrastructure guidance guidelines H high Highlight HR http HTTPS implications in information infrastructure infrastructures ite J k Known Exploited Vulnerabilities Known Exploited Vulnerabilities Catalog l land led Li Living making malicious actors malicious cyber actors man management media Mila Monitor monitoring N network networks news no o of off on one only operation opt organization organizations over point policy policy framework post potential pre principles proactive process professionals Q R RCE recommendations red remediation Risk risks Ro RoT s safe sec security security and compliance security landscape security measure security measures security posture Sig Sim source specific structured structures T Tails targeted text the threat threat vector threats Time to Tor TP two type UI under up update updates US V val vectors vents vulnerabilities vulnerabilities catalog vulnerability Vulnerability Management vulnerability management practice vulnerability remediation Ware Wi x