CISA Adds Seven Known Exploited Vulnerabilities to Catalog | CISA

What it is

CISA added seven CVEs to the Known Exploited Vulnerabilities (KEV) Catalog on evidence of active exploitation. The existing summary names the products and bug classes but not the CVE IDs, which you need to match against your inventory and scanners:

Preconditions / Affected

The page gives no affected version ranges, fixed versions, or exploit details for any of the seven. Both SonicWall CVEs are on SMA1000 appliances. Under BOD 26-04, the highest-priority KEV entries are those on publicly exposed assets that give total control of the asset after exploitation.

What to do

• Search your inventory for the seven products. Starlette and LiteLLM are libraries or services that may be pulled in transitively, so check dependency manifests and container images as well as deployed apps.
• Prioritise any instance reachable from the internet, in line with BOD 26-04.
• Check for prior compromise before or alongside patching. BOD 26-04 sets expectations for this, but the alert does not say what the checks are. Patching alone will not remove an attacker who got in earlier.
• Get fixed versions and mitigations from each vendor's advisory, since this alert has none. CISA says KEV entries require clear mitigation guidance, but the alert does not reproduce it.

Caveats

• BOD 26-04 binds only Federal Civilian Executive Branch agencies. CISA encourages everyone else to adopt risk-based vulnerability management and prioritise KEV entries.
• The alert gives no remediation due dates, no indicators of compromise, and no information on who is exploiting these bugs or how.
• CISA says it will keep adding entries that meet the KEV criteria.