3 New Actively Exploited Flaws to Patch

Why It Matters

These actively exploited flaws pose immediate risk of data loss and system compromise, making rapid patching essential for any enterprise using the affected products.

Key Takeaways

• CISA added three actively exploited flaws to KEV catalog
• Vulnerability in VMware Workspace ONE UEM permits unauthenticated data extraction
• SolarWinds Help Desk AJAX proxy allows remote command execution
• Ivanti Endpoint Manager flaw leaks stored credentials via alternate channel
• Immediate patching required for any organization using these products

Summary

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) announced on Monday that three new vulnerabilities have been added to its Known Exploited Vulnerabilities (KEV) catalog, confirming that threat actors are actively exploiting these flaws in the wild. The inclusion in the KEV list signals that the agency has concrete evidence of ongoing attacks and urges immediate remediation.

The first vulnerability affects VMware Workspace ONE UEM (formerly Omnisa Workspace ONE UEM), allowing an attacker with network access to send unauthenticated requests to the UEM module and harvest information. The second flaw is a deserialization issue in the Ajax proxy component of SolarWinds Help Desk, which can be leveraged to execute arbitrary commands on the host system. The third vulnerability involves an alternate‑path channel bypass in Ivanti Endpoint Manager, enabling an unauthenticated remote actor to exfiltrate stored credential data.

CISA’s statement underscores that these weaknesses are not theoretical; they have been observed in active campaigns targeting enterprises worldwide. By naming the specific products and attack vectors, the agency provides clear indicators for defenders to prioritize detection and mitigation efforts.

For organizations that deploy any of these solutions, the directive is unequivocal: apply vendor patches immediately, verify that mitigation controls are in place, and monitor for signs of exploitation. Failure to act could result in data breaches, credential theft, and broader operational disruption.

Original Description

CISA recently added three new vulnerabilities to the Known Exploited Vulnerabilities catalog (KEV), signaling active exploitation in the wild.

These flaws impact critical software including Workspace ONE UEM, SolarWinds help desk, and Ivanti Endpoint Manager, allowing remote attackers to execute commands or leak credentials.

How prepared is your organization to patch fast when critical vulnerabilities are publicly flagged?

Subscribe to our podcasts: https://securityweekly.com/subscribe

#CISA #VulnerabilityManagement #SecurityWeekly #Cybersecurity #InformationSecurity #AI #InfoSec