CISA Expands Catalog with Two New Exploited Vulnerabilities

CISA Expands Catalog with Two New Exploited Vulnerabilities

Overview

The Cybersecurity and Infrastructure Security Agency (CISA) has recently expanded its Known Exploited Vulnerabilities Catalog by adding two new vulnerabilities that have been actively exploited in the wild. These vulnerabilities, identified as CVE-2025-24472 and CVE-2025-30066, represent significant risks to federal networks and, by extension, to the broader cybersecurity landscape. This report will analyze the implications of these additions, the nature of the vulnerabilities, and the strategic importance of CISA’s efforts in mitigating cyber threats.

Understanding the Vulnerabilities

The two newly cataloged vulnerabilities are:

• CVE-2025-24472: This vulnerability affects Fortinet’s FortiOS and FortiProxy, allowing for authentication bypass. Such vulnerabilities can enable unauthorized access to sensitive systems, potentially leading to data breaches or further exploitation.
• CVE-2025-30066: This vulnerability is associated with the tj-actions/changed-files GitHub Action, which can embed malicious code. This poses a risk not only to individual repositories but also to the integrity of the software supply chain, as malicious actors can exploit this to introduce harmful code into widely used applications.

The Role of CISA and BOD 22-01

CISA’s expansion of the Known Exploited Vulnerabilities Catalog is part of a broader strategy outlined in Binding Operational Directive (BOD) 22-01. This directive mandates that Federal Civilian Executive Branch (FCEB) agencies address identified vulnerabilities by specified deadlines. The intent is to bolster the cybersecurity posture of federal networks against active threats.

While BOD 22-01 specifically targets federal agencies, CISA encourages all organizations to adopt similar practices. The rationale is straightforward: vulnerabilities like those cataloged can serve as entry points for cybercriminals, and timely remediation is essential for reducing exposure to attacks.

Implications for Federal and Private Sector Security

The addition of these vulnerabilities to the catalog underscores the ongoing challenges faced by both federal and private sector organizations in managing cybersecurity risks. The nature of these vulnerabilities highlights several key points:

• Increased Attack Surface: As organizations increasingly rely on third-party software and cloud services, the potential for vulnerabilities to be exploited grows. The tj-actions vulnerability exemplifies how a seemingly innocuous tool can become a vector for significant risk.
• Need for Proactive Measures: The Fortinet vulnerability illustrates the importance of proactive security measures. Organizations must not only patch known vulnerabilities but also implement robust security practices to detect and mitigate potential threats before they can be exploited.
• Collaboration and Information Sharing: The rapid identification and cataloging of vulnerabilities by CISA demonstrate the importance of collaboration between government and private sectors. Sharing information about vulnerabilities and threats can enhance collective security efforts.

Historical Context and Trends

The rise in the number of known exploited vulnerabilities is not a new phenomenon. Over the past decade, the cybersecurity landscape has evolved dramatically, with an increasing number of high-profile breaches attributed to unpatched vulnerabilities. For instance, the Equifax breach in 2017, which exposed the personal information of approximately 147 million people, was largely due to a failure to patch a known vulnerability in Apache Struts.

Moreover, the COVID-19 pandemic accelerated the shift to remote work, leading to a surge in cyberattacks. According to a report by Cybersecurity Ventures, global cybercrime damages are expected to reach $10.5 trillion annually by 2025, highlighting the urgent need for organizations to prioritize cybersecurity.

Strategic Recommendations

In light of the recent additions to the Known Exploited Vulnerabilities Catalog, organizations should consider the following strategic recommendations:

• Implement a Robust Vulnerability Management Program: Organizations should establish a comprehensive vulnerability management program that includes regular assessments, timely patching, and continuous monitoring of systems for potential threats.
• Enhance Employee Training: Cybersecurity awareness training for employees can significantly reduce the risk of exploitation. Employees should be educated on recognizing phishing attempts and understanding the importance of reporting suspicious activities.
• Leverage Threat Intelligence: Organizations should utilize threat intelligence services to stay informed about emerging vulnerabilities and threats. This can aid in prioritizing remediation efforts based on the potential impact on their specific environment.
• Foster Collaboration: Engaging in information sharing with industry peers and government agencies can enhance an organization’s ability to respond to threats. Participating in cybersecurity forums and initiatives can provide valuable insights and resources.

Conclusion

The addition of CVE-2025-24472 and CVE-2025-30066 to CISA’s Known Exploited Vulnerabilities Catalog serves as a critical reminder of the evolving nature of cyber threats. As organizations navigate an increasingly complex cybersecurity landscape, proactive measures, collaboration, and a commitment to continuous improvement will be essential in safeguarding against potential exploits. By prioritizing vulnerability management and fostering a culture of cybersecurity awareness, organizations can better protect themselves against the ever-present threat of cyberattacks.