CISA Updates Catalog with Two New Exploited Vulnerabilities

TL;DR

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities Catalog, highlighting significant risks to federal and private cybersecurity infrastructure. The additions include vulnerabilities in Gladinet CentreStack and Microsoft Windows CLFS Driver, emphasizing the need for timely remediation.

Introduction

The Cybersecurity and Infrastructure Security Agency (CISA) has recently updated its Known Exploited Vulnerabilities Catalog with two new critical vulnerabilities. These additions are based on evidence of active exploitation, underscoring the urgent need for remediation to protect against cyber threats.

Newly Added Vulnerabilities

CVE-2025-30406: Gladinet CentreStack Use of Hard-coded Cryptographic Key

• Description: This vulnerability involves the use of a hard-coded cryptographic key in Gladinet CentreStack, which can be exploited by malicious actors to gain unauthorized access.
• Impact: This type of vulnerability is a frequent attack vector and poses significant risks to federal and private sector organizations.
• Reference: CVE-2025-30406

CVE-2025-29824: Microsoft Windows CLFS Driver Use-After-Free

• Description: This vulnerability affects the Microsoft Windows Common Log File System (CLFS) Driver, allowing attackers to execute arbitrary code due to a use-after-free condition.
• Impact: Similar to the Gladinet vulnerability, this issue is actively exploited and requires immediate attention for remediation.
• Reference: CVE-2025-29824

Importance of Remediation

These vulnerabilities highlight the ongoing challenge of securing digital infrastructure against evolving cyber threats. The Binding Operational Directive (BOD) 22-01 emphasizes the importance of timely remediation. This directive mandates Federal Civilian Executive Branch (FCEB) agencies to address identified vulnerabilities by specified due dates to safeguard against active threats.

Key Points of BOD 22-01

• Purpose: Establishes a living list of known Common Vulnerabilities and Exposures (CVEs) that pose significant risks.
• Requirement: FCEB agencies must remediate these vulnerabilities to protect federal networks.
• Additional Information: Refer to the BOD 22-01 Fact Sheet for detailed insights.

Recommendations for Organizations

Although BOD 22-01 specifically applies to FCEB agencies, CISA strongly advises all organizations to prioritize the remediation of Catalog vulnerabilities as part of their vulnerability management practices. Proactive measures can significantly reduce exposure to cyberattacks and enhance overall security posture.

Conclusion

The addition of these vulnerabilities to CISA’s catalog serves as a reminder of the continuous vigilance required in cybersecurity. Organizations must stay informed and act promptly to mitigate risks associated with known exploited vulnerabilities. By adhering to guidelines and directives, both federal and private entities can strengthen their defenses against cyber threats.

Additional Resources

For further insights, check:

• CISA Known Exploited Vulnerabilities Catalog
• CVE-2025-30406 Details
• CVE-2025-29824 Details

References

```