CISA Adds 13 Known Exploited Vulnerabilities to Catalog


CISA has added 13 new vulnerabilities to its [Known Exploited Vulnerabilities Catalog](<https://www.cisa.gov/known-exploited-vulnerabilities-catalog>), based on evidence that threat actors are actively exploiting the vulnerabilities listed in the table below. These types of vulnerabilities are a frequent attack vector for malicious cyber actors of all types and pose significant risk to the federal enterprise. **CVE Number** | **CVE Title** | **Remediation Due Date** ---|---|--- [CVE-2021-44228](<https://nvd.nist.gov/vuln/detail/CVE-2021-44228>) | Apache Log4j2 Remote Code Execution Vulnerability | 12/24/2021 CVE-2021-44515 | Zoho Corp. Desktop Central Authentication Bypass Vulnerability | 12/24/2021 CVE-2021-44168 | Fortinet FortiOS Arbitrary File Download Vulnerability | 12/24/2021 [CVE-2021-35394](<https://nvd.nist.gov/vuln/detail/CVE-2021-35394>) | Realtek Jungle SDK Remote Code Execution Vulnerability | 12/24/2021 [CVE-2020-8816](<https://nvd.nist.gov/vuln/detail/CVE-2020-8816>) | Pi-Hole AdminLTE Remote Code Execution Vulnerability | 6/10/2022 [CVE-2020-17463](<https://nvd.nist.gov/vuln/detail/CVE-2020-17463>) | Fuel CMS SQL Injection Vulnerability | 6/10/2022 [CVE-2019-7238](<https://nvd.nist.gov/vuln/detail/CVE-2019-7238>) | Sonatype Nexus Repository Manager Incorrect Access Control Vulnerability | 6/10/2022 [CVE-2019-13272](<https://nvd.nist.gov/vuln/detail/cve-2019-13272>) | Linux Kernel Improper Privilege Management Vulnerability | 6/10/2022 [CVE-2019-10758](<https://nvd.nist.gov/vuln/detail/CVE-2019-10758>) | MongoDB mongo-express Remote Code Execution Vulnerability | 6/10/2022 [CVE-2019-0193](<https://nvd.nist.gov/vuln/detail/CVE-2019-0193>) | Apache Solr DataImportHandler Code Injection Vulnerability | 6/10/2022 [CVE-2017-17562](<https://nvd.nist.gov/vuln/detail/cve-2017-17562>) | Embedthis GoAhead Remote Code Execution Vulnerability | 6/10/2022 [CVE-2017-12149](<https://nvd.nist.gov/vuln/detail/CVE-2017-12149>) | Red Hat Jboss Application Server Remote Code Execution Vulnerability | 6/10/2022 [CVE-2010-1871](<https://nvd.nist.gov/vuln/detail/CVE-2010-1871>) | Red Hat Linux JBoss Seam 2 Remote Code Execution Vulnerability | 6/10/2022 [Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities](<https://www.cisa.gov/binding-operational-directive-22-01>) established the Known Exploited Vulnerabilities Catalog as a living list of known CVEs that carry significant risk to the federal enterprise. BOD 22-01 requires FCEB agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the [BOD 22-01 Fact Sheet](<https://www.cisa.gov/known-exploited-vulnerabilities>) for more information. Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of [Catalog vulnerabilities](<https://www.cisa.gov/known-exploited-vulnerabilities-catalog>) as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the Catalog that meet the meet the [specified criteria](<https://www.cisa.gov/known-exploited-vulnerabilities>). This product is provided subject to this Notification and this [Privacy & Use](<https://www.dhs.gov/privacy-policy>) policy. **Please share your thoughts.** We recently updated our anonymous [product survey](<https://www.surveymonkey.com/r/CISA-cyber-survey?product=https://us-cert.cisa.gov/ncas/current-activity/2021/12/10/cisa-adds-13-known-exploited-vulnerabilities-catalog>); we'd welcome your feedback.