---
title: "CISA Warns: Two Actively Exploited Vulnerabilities Demand Immediate Patching"
short_title: "CISA adds two critical exploited vulnerabilities"
description: "CISA has added CVE-2022-0492 and CVE-2025-48595 to its KEV Catalog due to active exploitation. Learn why patching these vulnerabilities is critical for all organizations."
author: "Vitus"
date: 2024-10-02
categories: [Cybersecurity, Vulnerabilities]
tags: [cisa, cve-2022-0492, cve-2025-48595, vulnerability-management, threat-intelligence]
score: 0.87
cve_ids: [CVE-2022-0492, CVE-2025-48595]
---
## TL;DR
CISA has added two actively exploited vulnerabilities—CVE-2022-0492 (Linux Kernel) and CVE-2025-48595 (Android Framework)—to its Known Exploited Vulnerabilities (KEV) Catalog. Federal agencies must patch these flaws immediately, but all organizations are urged to prioritize remediation to mitigate risks from malicious cyber actors.
Main Content
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has escalated its response to two critical vulnerabilities after confirming their active exploitation in the wild. The flaws, CVE-2022-0492 and CVE-2025-48595, have been added to CISA’s Known Exploited Vulnerabilities (KEV) Catalog, signaling an urgent need for organizations to address them. These vulnerabilities pose significant risks, particularly to federal agencies, but their impact extends to enterprises and individuals alike.
### Key Points
- CVE-2022-0492 is a Linux Kernel vulnerability involving improper authentication, potentially allowing attackers to escalate privileges or execute arbitrary code.
- CVE-2025-48595 is an Android Framework flaw caused by an integer overflow, which could lead to remote code execution or unauthorized data access.
- Binding Operational Directive (BOD) 22-01 mandates that Federal Civilian Executive Branch (FCEB) agencies remediate these vulnerabilities by specified deadlines.
- While BOD 22-01 applies only to federal agencies, CISA strongly recommends that all organizations prioritize patching these vulnerabilities to reduce exposure to cyberattacks.
Technical Details
#### CVE-2022-0492: Linux Kernel Improper Authentication Vulnerability
This vulnerability affects the Linux Kernel’s handling of authentication mechanisms. Exploiting this flaw could allow an attacker with local access to escalate privileges or execute malicious code with elevated permissions. The vulnerability stems from a failure to properly validate user-supplied input, making it a prime target for threat actors seeking to compromise Linux-based systems.
#### CVE-2025-48595: Android Framework Integer Overflow Vulnerability
CVE-2025-48595 is an integer overflow flaw in the Android Framework. Integer overflows occur when a program attempts to store a value larger than the maximum limit of its data type, leading to unexpected behavior. In this case, the vulnerability could enable remote code execution or unauthorized access to sensitive data, particularly on unpatched Android devices.
### Impact Assessment
The inclusion of these vulnerabilities in CISA’s KEV Catalog underscores their severity and the immediate threat they pose. Active exploitation means that malicious actors are already leveraging these flaws to compromise systems, steal data, or deploy additional payloads like ransomware.
- Federal Agencies: BOD 22-01 requires FCEB agencies to remediate these vulnerabilities by the specified deadlines to protect critical infrastructure and sensitive data.
- Enterprises: Organizations outside the federal sector are equally at risk. Failure to patch these vulnerabilities could result in data breaches, financial losses, or reputational damage.
- Individuals: Users of Android devices or Linux-based systems should ensure their devices are updated to the latest security patches to avoid exploitation.
### Mitigation Steps
To mitigate the risks associated with these vulnerabilities, CISA and cybersecurity experts recommend the following actions:
- Patch Immediately: Apply the latest security updates for Linux Kernel and Android Framework to address CVE-2022-0492 and CVE-2025-48595.
- Prioritize KEV Catalog Vulnerabilities: Organizations should integrate the KEV Catalog into their vulnerability management programs and prioritize remediation of listed flaws.
- Monitor for Exploitation: Deploy intrusion detection systems (IDS) and endpoint protection solutions to detect and block exploitation attempts.
- Educate Stakeholders: Raise awareness among IT teams and end-users about the risks of unpatched vulnerabilities and the importance of timely updates.
## Conclusion
The addition of CVE-2022-0492 and CVE-2025-48595 to CISA’s KEV Catalog serves as a critical reminder of the evolving threat landscape. While federal agencies are required to act, all organizations and individuals must prioritize patching these vulnerabilities to safeguard their systems. Proactive vulnerability management is essential to staying ahead of cyber threats and minimizing the risk of exploitation.
For more information, refer to CISA’s official advisory and the KEV Catalog.
## References
[^1]: CISA. "CISA Adds Two Known Exploited Vulnerabilities to Catalog". Retrieved 2024-10-02.
[^2]: CVE Details. "CVE-2022-0492 Detail". Retrieved 2024-10-02.
[^3]: CVE Details. "CVE-2025-48595 Detail". Retrieved 2024-10-02.
[^4]: CISA. "Binding Operational Directive (BOD) 22-01". Retrieved 2024-10-02.