CISA Adds Five Known Exploited Vulnerabilities to Catalog


CISA has added five new vulnerabilities to its [Known Exploited Vulnerabilities Catalog](<https://www.cisa.gov/known-exploited-vulnerabilities-catalog>), based on evidence that threat actors are actively exploiting the vulnerabilities listed in the table below. These types of vulnerabilities are a frequent attack vector for malicious cyber actors of all types and pose significant risk to the federal enterprise. CVE Number | **CVE Title** | Remediation Due Date ---|---|--- [CVE-2020-11261](<https://nvd.nist.gov/vuln/detail/CVE-2020-11261>) | Qualcomm Multiple Chipsets Improper Input Validation Vulnerability | 06/01/2022 [CVE-2018-14847](<https://nvd.nist.gov/vuln/detail/CVE-2018-14847>) | MikroTik Router OS Directory Traversal Vulnerability | 06/01/2022 [CVE-2021-37415](<https://nvd.nist.gov/vuln/detail/CVE-2021-37415>) | Zoho ManageEngine ServiceDesk Authentication Bypass Vulnerability | 12/15/2021 [CVE-2021-40438](<https://nvd.nist.gov/vuln/detail/CVE-2021-40438>) | Apache HTTP Server-Side Request Forgery (SSRF) | 12/15/2021 [CVE-2021-44077](<https://nvd.nist.gov/vuln/detail/CVE-2021-44077>) | Zoho ManageEngine ServiceDesk Plus Remote Code Execution | 12/15/2021 [Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities](<https://www.cisa.gov/binding-operational-directive-22-01>) established the Known Exploited Vulnerabilities Catalog as a living list of known CVEs that carry significant risk to the federal enterprise. BOD 22-01 requires FCEB agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the [BOD 22-01 Fact Sheet](<https://www.cisa.gov/known-exploited-vulnerabilities>) for more information. Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of [Catalog vulnerabilities](<https://www.cisa.gov/known-exploited-vulnerabilities-catalog>) as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the Catalog that meet the meet the [specified criteria](<https://www.cisa.gov/known-exploited-vulnerabilities>). This product is provided subject to this Notification and this [Privacy & Use](<https://www.dhs.gov/privacy-policy>) policy. **Please share your thoughts.** We recently updated our anonymous [product survey](<https://www.surveymonkey.com/r/CISA-cyber-survey?product=https://us-cert.cisa.gov/ncas/current-activity/2021/12/01/cisa-adds-five-known-exploited-vulnerabilities-catalog>); we'd welcome your feedback.