CISA Adds Six Actively Exploited Flaws to KEV Catalog

Introduction

The Cybersecurity and Infrastructure Security Agency (CISA) has issued a critical update to its Known Exploited Vulnerabilities (KEV) catalog, adding six security flaws confirmed to be under active exploitation. This move underscores the persistent threat landscape where threat actors rapidly weaponize disclosed vulnerabilities, often faster than organizations can patch them. The latest additions span diverse technologies—from application delivery controllers and database servers to the core Linux kernel—highlighting that no layer of the technology stack is immune.

For federal civilian executive branch (FCEB) agencies, this update triggers mandatory remediation deadlines under Binding Operational Directive (BOD) 22-01. For the broader private sector, the KEV catalog serves as an essential, curated intelligence feed for risk-based vulnerability prioritization. Ignoring these entries is no longer an option; it is an invitation for compromise.

Breaking Down the Latest KEV Catalog Additions

The six vulnerabilities added this cycle represent a mix of remote code execution (RCE) and privilege escalation vectors. While the catalog spans several years of disclosure dates, their inclusion today confirms that exploit code is functional, available, and being used in active campaigns. Security teams must treat the "Date Added" to KEV as the effective start of the exploitation clock, regardless of the original CVE publication date.

• CVE-2023-3519 (Citrix NetScaler ADC/NetScaler Gateway): An unauthenticated remote code execution flaw allowing attackers to take full control of unpatched appliances.
• CVE-2019-1068 (Windows Kernel): A legacy elevation of privilege vulnerability that remains relevant in environments with delayed patch cycles or legacy system dependencies.
• CVE-2024-1086 (Linux Kernel netfilter): A use-after-free vulnerability in the nf_tables component allowing local users to escalate privileges to root.
• CVE-2024-21410 (Microsoft Exchange Server): A privilege escalation vulnerability enabling attackers to gain elevated access on compromised mail servers.
• CVE-2024-20699 (Microsoft SQL Server): An elevation of privilege flaw in the SQL Server Native Client (SNAC) OLE DB provider.
• CVE-2024-21351 (Windows SmartScreen): A security feature bypass vulnerability allowing attackers to evade SmartScreen protections and execute malicious payloads.

The Critical NetScaler Threat Landscape

The inclusion of CVE-2023-3519 is particularly alarming due to the strategic value of NetScaler appliances. These devices sit at the network edge, managing load balancing, VPN access, and application delivery for critical enterprise workloads. An unauthenticated RCE on this platform grants threat actors a foothold equivalent to breaching the perimeter firewall. We have observed threat actors chaining this vulnerability with post-exploitation frameworks to harvest credentials, pivot to internal networks, and deploy ransomware.

Organizations running NetScaler ADC or Gateway must verify they are on a fixed build immediately. Given the appliance nature of these devices, patching often requires scheduled downtime, but the risk of delay far outweighs the operational inconvenience. Network segmentation and strict management plane access controls serve as vital compensating controls until maintenance windows can be executed.

Linux Kernel and SQL Server: Privilege Escalation Risks

The addition of CVE-2024-1086 (Linux kernel netfilter) highlights the enduring danger of local privilege escalation (LPE) flaws. While LPEs require an initial foothold, they are the linchpin of almost every sophisticated attack chain. An attacker with low-privileged web shell access or a compromised container can leverage this kernel flaw to break out to root, effectively owning the host and potentially escaping containerized environments.

Similarly, CVE-2024-20699 targeting Microsoft SQL Server reminds us that database layers are high-value targets. Exploitation here can lead to data exfiltration, lateral movement via linked servers, or deployment of malicious CLR assemblies. Patching SQL Server often involves application compatibility testing, but the KEV listing mandates that this testing be accelerated or mitigated via virtual patching (WAF/IPS rules) immediately.

Operational Imperatives for Federal and Private Sectors

BOD 22-01 establishes a clear framework: FCEB agencies must remediate critical vulnerabilities within 14 days of addition to the KEV catalog (or 6 months for older CVEs added retroactively, though specific deadlines vary by CVE severity and age). For the private sector, while not legally binding, the KEV catalog represents the gold standard for "must-patch-now" intelligence.

Effective response requires moving beyond simple vulnerability scanning. Teams need:

• Asset Context: Knowing *where* the vulnerable asset sits (DMZ, internal, cloud, OT) dictates priority.
• Exploit Maturity: KEV confirmation is the highest maturity signal; treat these as "assumed breached" if unpatched.
• Compensating Controls: If patching exceeds the 14-day window, implement network segmentation, WAF rules, EDR behavioral blocking, and enhanced logging immediately.

Conclusion

The latest CISA KEV update serves as a urgent reminder that the window between vulnerability disclosure and mass exploitation has effectively closed. The six flaws added—spanning edge networking, operating system kernels, collaboration platforms, and data layers—represent a full-stack compromise opportunity for adversaries. Organizations must treat the KEV catalog not as a reference list, but as an operational trigger for immediate action. Prioritize the NetScaler RCE and Linux kernel LPE due to their high exploitability and impact potential. Grivyonx Cloud stands ready to help security teams automate the correlation of these threats against their unique attack surface, enabling rapid, intelligent remediation that keeps pace with the adversary.