The CISA has added three newly exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: one in Windows SMB Client and two in Kentico Xperience CMS. The Windows flaw (CVE-2025-33073, CVSS 8.8) allows privilege escalation via improper access control and has been exploitable since June, when proof-of-concept code was released. The Kentico vulnerabilities (CVE-2025-2746 and CVE-2025-2747, CVSS 9.6) are authentication bypass issues that could enable full administrative takeover when chained with remote code execution. CISA also confirmed exploitation of a 2022 Apple arbitrary code execution bug (CVE-2022-48503). Federal agencies now have three weeks to patch affected systems under Binding Operational Directive 22-01.
Will Baxter, Field CISO, Team Cymru had this to say:
“The inclusion of both recent and legacy vulnerabilities in CISA’s KEV catalog underscores how threat actors mix newly developed exploits with long-lived flaws to sustain access and expand operational reach. Even when patches are available, adversaries rely on delayed remediation and incomplete asset visibility — the very gaps KEV aims to close. Active monitoring of external infrastructure and intelligence sharing across organizations remain essential to identify when known vulnerabilities are being re-weaponized in the wild.”
Andrew Obadiaru, CISO, Cobalt follows with this:
“This is a reminder that patching and vulnerability scanning aren’t the same as true resilience. The lag between disclosure and exploitation is shrinking, and adversaries are quick to capitalize on unpatched systems even within well-defended networks. Continuous offensive testing—validating exploitability in real-world conditions—remains one of the most effective ways to ensure critical exposures are prioritized and remediated before attackers strike.
This is why I recommend that people patch all the things when patches appear or soon after they appear. The bad guys will not waste any time in terms of reverse engineering the flaws that these patches fix and using those to launch attacks.
Related
This entry was posted on October 21, 2025 at 3:23 pm and is filed under Commentary with tags CISA. You can follow any responses to this entry through the RSS 2.0 feed.
You can leave a response, or trackback from your own site.
CISA Adds Vulnerabilities To The KEV Catalog
The CISA has added three newly exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: one in Windows SMB Client and two in Kentico Xperience CMS. The Windows flaw (CVE-2025-33073, CVSS 8.8) allows privilege escalation via improper access control and has been exploitable since June, when proof-of-concept code was released. The Kentico vulnerabilities (CVE-2025-2746 and CVE-2025-2747, CVSS 9.6) are authentication bypass issues that could enable full administrative takeover when chained with remote code execution. CISA also confirmed exploitation of a 2022 Apple arbitrary code execution bug (CVE-2022-48503). Federal agencies now have three weeks to patch affected systems under Binding Operational Directive 22-01.
Will Baxter, Field CISO, Team Cymru had this to say:
“The inclusion of both recent and legacy vulnerabilities in CISA’s KEV catalog underscores how threat actors mix newly developed exploits with long-lived flaws to sustain access and expand operational reach. Even when patches are available, adversaries rely on delayed remediation and incomplete asset visibility — the very gaps KEV aims to close. Active monitoring of external infrastructure and intelligence sharing across organizations remain essential to identify when known vulnerabilities are being re-weaponized in the wild.”
Andrew Obadiaru, CISO, Cobalt follows with this:
“This is a reminder that patching and vulnerability scanning aren’t the same as true resilience. The lag between disclosure and exploitation is shrinking, and adversaries are quick to capitalize on unpatched systems even within well-defended networks. Continuous offensive testing—validating exploitability in real-world conditions—remains one of the most effective ways to ensure critical exposures are prioritized and remediated before attackers strike.
This is why I recommend that people patch all the things when patches appear or soon after they appear. The bad guys will not waste any time in terms of reverse engineering the flaws that these patches fix and using those to launch attacks.
Share this:
Like this:
Related
This entry was posted on October 21, 2025 at 3:23 pm and is filed under Commentary with tags CISA. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.