CISA Adds 20 Known Exploited Vulnerabilities to Catalog

CISA has added six new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

ICSMA-26-295-01 – InterSystems Corporation InterSystems IRIS for Health
ICSA-26-295-01 – Kiloview E3 NDI Encoder
ICSA-26-295-02 – Siemens Industrial Edge App Publisher
ICSA-26-295-03 – Siemens Software Center
ICSA-26-295-04 – Siemens Capital Embedded AR Classic
ICSA-26-295-05 – Siemens SENTRON 3NA COM Fuse
ICSA-26-295-06 – Siemens PSS(R)SINCAL
ICSA-26-295-07 – Siemens SIMATIC IPCs
ICSA-26-295-08 – Siemens APOGEE, TALON and Desigo PXC/PXM Products
ICSA-26-295-09 – Siemens Industrial Edge Device Kit
ICSA-26-295-10 – Siemens SIMATIC S7 Webserver API
ICSA-26-295-11 – Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP
ICSA-26-295-12 – Siemens RUGGEDCOM CROSSBOW
ICSA-26-295-13 – Siemens WinCC
ICSA-26-295-14 – Siemens SIMATIC S7 PLCs Web Server
ICSA-26-295-15 – Siemens RUGGEDCOM CROSSBOW Station Access Controller
ICSA-26-295-16 – Siemens SIMATIC S7-1500 TM MFP
ICSA-26-295-17 – Siemens Industrial Edge Devices
ICSA-26-295-18 – Siemens RUGGEDCOM APE1808 Devices
ICSA-26-274-06 – Meari IoT Cloud Platform OpenAPI Service (Update A)

These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.
Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA’s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied.
While BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.
Aware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through CISA’s KEV Nomination Form. Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance.