---
title: "CISA Warns of 7 Actively Exploited Vulnerabilities—Patch Now"
short_title: "CISA adds 7 exploited vulnerabilities to catalog"
description: "CISA has added seven actively exploited vulnerabilities to its KEV catalog, including critical flaws in Microsoft and Adobe. Learn the risks and mitigation steps."
author: "Vitus"
date: 2024-05-20
categories: [Cybersecurity, Vulnerabilities]
tags: [cisa, known-exploited-vulnerabilities, cve, cybersecurity, patch-management]
score: 0.87
cve_ids: [CVE-2008-4250, CVE-2009-1537, CVE-2009-3459, CVE-2010-0249, CVE-2010-0806, CVE-2026-41091, CVE-2026-45498]
---
## TL;DR
CISA has added seven vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, citing evidence of active exploitation. These flaws, affecting Microsoft Windows, Internet Explorer, Adobe Acrobat, and Microsoft Defender, pose significant risks to organizations. Federal agencies must patch immediately, but all organizations are urged to prioritize remediation to reduce exposure to cyberattacks.
Main Content
The Cybersecurity and Infrastructure Security Agency (CISA) has escalated its warnings after adding seven known exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog. These vulnerabilities, which include critical flaws in Microsoft and Adobe products, are being actively exploited by malicious cyber actors. The addition underscores the urgent need for organizations to prioritize patching and vulnerability management to mitigate risks.
### Key Points
- CISA has added seven vulnerabilities to the KEV Catalog based on evidence of active exploitation.
- Affected systems include Microsoft Windows, Internet Explorer, Adobe Acrobat and Reader, and Microsoft Defender.
- Federal Civilian Executive Branch (FCEB) agencies are required to remediate these vulnerabilities by specified deadlines under Binding Operational Directive (BOD) 22-01.
- While BOD 22-01 applies only to federal agencies, all organizations are strongly urged to patch these vulnerabilities to reduce their exposure to cyberattacks.
- CISA will continue to update the KEV Catalog as new threats emerge.
Technical Details
The vulnerabilities added to the KEV Catalog are as follows:
| CVE ID | Description | Affected Systems |
|---------------------|-------------------------------------------------------------------------------|-----------------------------------------------|
| CVE-2008-4250 | Microsoft Windows Buffer Overflow Vulnerability | Microsoft Windows |
| CVE-2009-1537 | Microsoft DirectX NULL Byte Overwrite Vulnerability | Microsoft DirectX |
| CVE-2009-3459 | Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability | Adobe Acrobat, Adobe Reader |
| CVE-2010-0249 | Microsoft Internet Explorer Use-After-Free Vulnerability | Microsoft Internet Explorer |
| CVE-2010-0806 | Microsoft Internet Explorer Use-After-Free Vulnerability | Microsoft Internet Explorer |
| CVE-2026-41091 | Microsoft Defender Elevation of Privilege Vulnerability | Microsoft Defender |
| CVE-2026-45498 | Microsoft Defender Denial of Service Vulnerability | Microsoft Defender |
These vulnerabilities are frequent attack vectors for cybercriminals and pose severe risks, including remote code execution, privilege escalation, and denial of service.
Impact Assessment
The inclusion of these vulnerabilities in the KEV Catalog highlights their high-risk nature and the potential for widespread exploitation. Malicious actors can leverage these flaws to:
- Gain unauthorized access to sensitive systems and data.
- Execute remote code on vulnerable machines.
- Escalate privileges to move laterally within networks.
- Disrupt critical services through denial-of-service attacks.
For federal agencies, the risks are particularly acute, as BOD 22-01 mandates timely remediation to protect federal networks. However, private sector organizations are equally vulnerable and must act swiftly to patch these flaws.
Mitigation Steps
CISA recommends the following actions to mitigate the risks posed by these vulnerabilities:
- Prioritize Patching: Apply the latest security updates for Microsoft Windows, Internet Explorer, Adobe Acrobat, Adobe Reader, and Microsoft Defender immediately.
- Follow BOD 22-01 Guidelines: Federal agencies must remediate these vulnerabilities by the specified deadlines. Non-federal organizations should adopt similar timelines.
- Monitor for Exploitation: Deploy intrusion detection systems (IDS) and endpoint protection solutions to detect and block exploitation attempts.
- Educate Employees: Train staff to recognize phishing attempts and other social engineering tactics that may exploit these vulnerabilities.
- Review CISA’s KEV Catalog Regularly: Stay informed about newly added vulnerabilities and emerging threats by monitoring the KEV Catalog.
Conclusion
The addition of these seven vulnerabilities to CISA’s Known Exploited Vulnerabilities Catalog serves as a critical reminder of the persistent threats facing organizations today. While federal agencies are required to act under BOD 22-01, all organizations must prioritize patching and vulnerability management to reduce their exposure to cyberattacks.
Failure to address these vulnerabilities promptly could result in data breaches, financial losses, and reputational damage. By taking proactive steps now, organizations can strengthen their defenses and mitigate the risks posed by these actively exploited flaws.
For more details, refer to CISA’s official advisory.
## References
[^1]: CISA. "CISA Adds Seven Known Exploited Vulnerabilities to Catalog". Retrieved 2024-05-20.
[^2]: CISA. "Known Exploited Vulnerabilities Catalog". Retrieved 2024-05-20.
[^3]: CISA. "Binding Operational Directive 22-01". Retrieved 2024-05-20.