Critical Cybersecurity Threats Added to CISA’s Exploited Vulnerabilities Catalog

The cybersecurity landscape continues to evolve at a staggering pace, with threat actors relentlessly seeking weaknesses in widely used software and systems. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) recently updated its Known Exploited Vulnerabilities (KEV) catalog, spotlighting critical security flaws in popular platforms including OracSKYSEA Client View, Rapid7 Velociraptor, Microsoft Windows, and IGEL OS. These vulnerabilities are not theoretical—they are actively being exploited in the wild, emphasizing the urgent need for both federal agencies and private organizations to tighten their defenses.

Newly Cataloged Vulnerabilities

CISA has listed several high-risk vulnerabilities in its KEV catalog:

SKYSEA Client View (≤ v11.221.03, CVE-2016-7836): This flaw allows remote code execution due to improper authentication handling in TCP connections with the management console, giving attackers a direct path to compromise systems remotely.

Rapid7 Velociraptor (CVE-2025-6264): The platform’s VQL “Artifacts” can run with elevated privileges, and the Admin.Client.UpdateClientConfig artifact fails to enforce EXECVE permissions. This enables users with COLLECT_CLIENT access, often in the Investigator role, to modify client configurations, potentially leading to arbitrary command execution and endpoint takeover. Exploitation requires prior access to artifacts but poses a significant threat to internal network security.

Microsoft Windows Zero-Days (CVE-2025-24990 and CVE-2025-59230): Both vulnerabilities allow privilege escalation. The first affects the Agere Modem Driver, and the second targets RasMan. Microsoft intends to remove the vulnerable driver rather than patch it, leaving affected systems exposed until updates are applied.

IGEL OS (CVE-2025-47827): This Secure Boot bypass impacts IGEL OS versions prior to 11. Publicly disclosed in June 2025, the flaw allows kernel-level rootkits to compromise virtual desktops and capture credentials. Exploitation typically requires physical access, making it ideal for “evil-maid” attacks in sensitive environments.

CISA has mandated that federal agencies address these vulnerabilities by November 4, 2025, in compliance with Binding Operational Directive (BOD) 22-01. Experts also advise private sector organizations to review the KEV catalog and patch their systems to mitigate the associated risks.

What Undercode Say:

The addition of these vulnerabilities to the KEV catalog underscores a shift in how critical infrastructure and enterprise software are being targeted. Attackers are increasingly exploiting both legacy flaws, such as the 2016 SKYSEA vulnerability, and fresh zero-day exploits in modern operating systems. This indicates that even longstanding software components cannot be assumed secure simply because they have been in use for years.

For organizations, the Velociraptor and IGEL OS issues highlight a recurring theme in cybersecurity: privilege escalation and misconfigured access controls are prime targets for attackers. The fact that Velociraptor’s Admin.Client.UpdateClientConfig artifact can be misused without higher EXECVE permissions demonstrates a systemic risk in endpoint monitoring tools. Tools meant to secure systems inadvertently become attack vectors when privilege enforcement is lax.

Microsoft’s decision to remove, rather than patch, the vulnerable Agere Modem Driver signals a growing trend in software remediation strategy. Sometimes, eliminating vulnerable components entirely is more effective than issuing incremental patches, but it places the burden on IT teams to verify compatibility and maintain operational continuity.

The IGEL OS Secure Boot bypass is particularly worrying for organizations relying on virtual desktops. Physical access attacks, often underestimated in risk assessments, can allow attackers to bypass standard authentication and deploy kernel-level malware, making credential theft and session hijacking nearly undetectable. Organizations using thin clients or virtual desktops must reassess their physical and endpoint security protocols immediately.

This catalog update also emphasizes the critical role of compliance frameworks such as BOD 22-01. Federal mandates drive rapid mitigation in government agencies, but private organizations cannot afford to wait. Proactive vulnerability management, patching schedules, and continuous monitoring are now baseline requirements, not optional practices.

From a broader perspective, the KEV catalog serves as both a warning and a roadmap. By highlighting actively exploited vulnerabilities, it provides a clear prioritization scheme for IT security teams. Organizations ignoring these updates risk operational disruptions, financial loss, and reputational damage.

Additionally, this wave of vulnerabilities illustrates the complexity of modern enterprise security. Attackers are no longer solely focused on remote exploits; insider access, misconfigured tools, and physical attack vectors are equally potent. Cybersecurity strategies must evolve to consider multi-layered defenses, combining network security, endpoint protection, user access management, and real-world threat modeling.

In conclusion, the KEV catalog is more than a list—it is a call to action. Whether dealing with legacy software or cutting-edge systems, the emphasis is on rapid detection, swift remediation, and continuous vigilance. Organizations that fail to act proactively will find themselves on the wrong side of increasingly sophisticated cyberattacks.

Fact Checker Results:

✅ CISA has officially added the listed vulnerabilities to its KEV catalog.
✅ The Windows zero-days affect Agere Modem Driver and RasMan, with Microsoft planning removal.
❌ The IGEL OS Secure Boot bypass does not allow remote exploitation; physical access is required.

Prediction:

📊 Over the next 12 months, organizations that fail to patch KEV-listed vulnerabilities will face a surge in targeted attacks exploiting these flaws. Legacy software like SKYSEA Client View may see renewed attention from attackers, while endpoint monitoring tools such as Velociraptor will become primary attack vectors. Expect stricter regulatory compliance mandates and a push toward automated vulnerability management solutions. Physical access risks, highlighted by IGEL OS exploits, will drive increased adoption of endpoint encryption and hardware-based security measures.

🕵️‍📝✔️Let’s dive deep and fact‑check.

References:

Reported By: securityaffairs.com
Extra Source Hub (Possible Sources for article):
https://www.quora.com/topic/Technology
Wikipedia
OpenAi & Undercode AI