CISA Expands KEV Catalog with Four Newly Identified Vulnerabilities Amid Active Exploitation
On July 8, 2025, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) announced the addition of four critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. This update comes in response to new evidence indicating that these vulnerabilities are currently being actively exploited by threat actors.
The vulnerabilities added to the catalog include CVE-2014-3931, a severe buffer overflow in Multi-Router Looking Glass (MRLG) with a CVSS score of 9.8. This flaw can enable remote attackers to execute arbitrary memory writes and corrupt data, posing significant risks to systems dependent on MRLG. Next is CVE-2016-10033, another critical vulnerability in PHPMailer, which also carries a CVSS score of 9.8. This command injection vulnerability potentially allows attackers to run arbitrary code within the application, resulting in a denial-of-service (DoS) condition that could severely disrupt business operations.
Another entry, CVE-2019-5418, scored at 7.5, relates to a path traversal vulnerability found in Ruby on Rails’ Action View component. This issue could expose contents of arbitrary files from the target system’s file system, leading to potential data breaches. Finally, CVE-2019-9621 refers to a Server-Side Request Forgery (SSRF) vulnerability within the Zimbra Collaboration Suite. Although details regarding the exploitation of this vulnerability remain scarce, it is crucial for organizations using this suite to remain vigilant.
Businesses utilizing systems that are susceptible to these exploits must take immediate action to mitigate potential risks. The active exploitation of these vulnerabilities highlights the urgent necessity for comprehensive cybersecurity measures. Adopting proactive strategies can assist in guarding against potential breaches and maintaining system integrity.
In the context of the MITRE ATT&CK framework, various tactics and techniques may have been employed in exploiting these vulnerabilities. Initial access tactics, such as phishing or exploitation of the aforementioned software flaws, could enable an attacker to gain foothold within the targeted environment. Once access is achieved, adversaries might pursue persistence strategies to maintain their foothold and escalate privileges to exert greater control over systems. Furthermore, techniques associated with data exfiltration may come into play, particularly with vulnerabilities that expose sensitive file contents.
With the relentless evolution of cybersecurity threats, it is imperative for business owners to stay informed about these vulnerabilities. Regular updates from entities like CISA serve as crucial reminders to prioritize system patching and implement robust security protocols. By fostering a culture of cybersecurity awareness, organizations can better shield themselves from the ramifications of potential breaches.
