CISA Adds Four Critical Vulnerabilities to Known Exploited Vulnerabilities Catalog

The Cybersecurity and Infrastructure Security Agency (CISA) has expanded its Known Exploited Vulnerabilities (KEV) Catalog with four new critical entries, highlighting ongoing cybersecurity threats to federal and private organizations. The latest additions include a significant Fortinet FortiOS vulnerability and three Microsoft Windows Hyper-V issues, reflecting the persistent challenge of securing vital infrastructure against emerging threats.

Key Takeaways:

• Four new vulnerabilities added to CISA’s KEV Catalog require immediate attention
• Affected systems include Fortinet FortiOS and Microsoft Windows Hyper-V components
• Federal agencies must address these vulnerabilities by specified due dates
• The KEV Catalog now contains over 925 known exploited vulnerabilities
• Microsoft products represent a significant portion of listed vulnerabilities

Understanding the Latest CISA Advisory

The recent expansion of CISA’s KEV Catalog marks another critical moment in ongoing cybersecurity efforts. The inclusion of the Fortinet FortiOS Authorization Bypass (CVE-2024-55591) vulnerability demonstrates the persistent risks facing network security infrastructure. Recent sophisticated attacks have highlighted the importance of prompt vulnerability remediation.

Microsoft Windows Vulnerabilities in Focus

Three of the four new additions target Microsoft Windows Hyper-V NT Kernel Integration VSP components. These critical vulnerabilities (CVE-2025-21333, CVE-2025-21334, CVE-2025-21335) pose substantial risks to virtualized environments. Windows security flaws continue to be a primary concern for security professionals.

Impact on Federal Agencies

Under Binding Operational Directive (BOD) 22-01, federal agencies must address these security vulnerabilities within specified timeframes. The directive’s requirements reflect CISA’s commitment to reducing cybersecurity risks across federal networks. Organizations can streamline their security processes using automation tools like Latenode to stay ahead of emerging threats.

Broader Security Implications

The expanding KEV Catalog indicates a growing threat landscape affecting both public and private sectors. Similar vulnerabilities in popular platforms demonstrate the widespread nature of these security challenges. Microsoft’s prominent position in the catalog, with 258 vulnerabilities, underscores the importance of maintaining updated Windows environments.

Recommended Security Measures

Organizations should take these practical steps to address the latest vulnerabilities:

• Implement immediate patches for the newly identified vulnerabilities
• Conduct regular security assessments of critical systems
• Monitor CISA advisories for new additions to the KEV Catalog
• Maintain comprehensive vulnerability management programs

Looking Forward

The addition of these four vulnerabilities to CISA’s catalog serves as a reminder of the dynamic nature of cybersecurity threats. Organizations must maintain vigilance and adopt proactive security measures to protect their digital assets. Regular updates, patch management, and security automation will continue to play crucial roles in effective vulnerability management.