Four Actively Exploited Vulnerabilities Added to CISA's Must-Patch List

What Happened

CISA added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on confirmed active exploitation. The list includes flaws in Check Point security products (improper certificate validation and path traversal), Arista VeloCloud Orchestrator (input validation), and F5 BIG-IP APM (heap-based buffer overflow). These aren't theoretical risks—threat actors are actively using them to compromise networks right now.

Why SMBs Should Care

While CISA's Binding Operational Directive targets federal agencies, the KEV Catalog is a critical resource for any organization. If your infrastructure includes Check Point firewalls, Arista SD-WAN, or F5 load balancers, these vulnerabilities represent immediate risk. Attackers often pivot from federal targets to private sector organizations using the same products. For SMBs with limited security staff, the KEV Catalog acts as a prioritized patch list—focus here first. Unpatched vulnerabilities in perimeter devices like these are common entry points for ransomware gangs and data theft operations.

Don't wait for your vendor to notify you. Check your asset inventory against the KEV Catalog regularly, ensure patches are applied within days (not weeks), and verify that publicly exposed systems are protected. If patching isn't immediately possible, consider temporary mitigations like restricting access or placing affected systems behind additional controls.

Read the full CISA alert

Need help prioritizing patches or assessing your exposure? O-Cyrus helps SMBs build practical vulnerability management programs that focus on real-world risk. Contact our security team or learn more at o-cyrus.com.