Skip to main content

CISA adds three known exploited vulnerabilities to catalog

Source Decision Insights Threat Desk Published November 26, 2025 Companies 4
Human View Machine View

4 companies named across 7 categories, one of 191 articles referencing Microsoft. Previous coverage: CISA issues alert on DNS rebinding affecting browser CORS policies (Nov 2025).

Companies mentioned

Best suited for

Persona
Security Operations Leader
Decision stage
How to start
Adoption curve
Early Majority
Industry
Information Technology / Software & Services / IT Services / Data Processing & Outsourced Services

Our classification, not the publisher's statement. Best suited for, not only for.

The Cybersecurity and Infrastructure Security Agency has incorporated three additional vulnerabilities into its Known Exploited Vulnerabilities (KEV) Catalog following verified instances of exploitation. These vulnerabilities affect WatchGuard Firebox, Gladinet Triofox, and Microsoft Windows systems and involve out-of-bounds write, improper access control, and race condition flaws respectively, with potential impacts on enterprise security.

The vulnerabilities added include CVE-2025-9242, an out-of-bounds write issue in WatchGuard Firebox; CVE-2025-12480, an improper access control vulnerability in Gladinet Triofox; and CVE-2025-62215, a race condition vulnerability impacting Microsoft Windows. These flaws have been observed to be actively exploited. The catalog functions as a dynamic list documenting Common Vulnerabilities and Exposures (CVE) that pose notable threats to federal systems.

The consequences associated with these vulnerabilities consist of unauthorized actions or disruption of affected services. Active exploitation details confirm risks to network integrity and information security for federal agencies and potentially other entities utilizing the impacted products.

Remediation directives under Binding Operational Directive (BOD) 22-01 mandate federal agencies to address cataloged vulnerabilities within prescribed deadlines to safeguard their networks. The directive establishes procedures for vulnerability management focused on reducing exposure to identified threats. Updates such as these are incorporated as criteria for known exploitation are satisfied.

While BOD 22-01 applies solely to the Federal Civilian Executive Branch, organizations are encouraged to incorporate prioritization of catalog vulnerabilities into their security protocols. Continuous additions to the KEV Catalog will be made as new vulnerabilities meeting established guidelines are identified.

Blog post, originally published by CISA at cisa.gov.

Mentions

Structured data (JSON-LD)

The schema.org markup this page publishes for search engines and AI agents, exactly as they read it.

[
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#website",
    "@type": "WebSite",
    "name": "Decision Insights",
    "potentialAction": {
      "@type": "SearchAction",
      "target": {
        "@type": "EntryPoint",
        "urlTemplate": "https://decisioninsights.ai/search/?q={search_term_string}&submit=1"
      }
    },
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    },
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#organization",
    "@type": "Organization",
    "contactPoint": {
      "@type": "ContactPoint",
      "contactType": "customer support",
      "email": "[email protected]"
    },
    "description": "Decision Insights is a Registry of technology companies, open source projects, and industry terms, built for people and for AI agents that need sourced, structured information.",
    "logo": {
      "@type": "ImageObject",
      "url": "https://wiretap-cdn-assets.nyc3.cdn.digitaloceanspaces.com/decision-insights/[email protected]"
    },
    "name": "Decision Insights",
    "parentOrganization": {
      "@type": "Organization",
      "name": "Wiretap Labs",
      "sameAs": [
        "https://www.linkedin.com/company/wiretap-labs",
        "https://www.crunchbase.com/organization/wiretap-labs"
      ],
      "url": "https://wiretaplabs.com"
    },
    "publishingPrinciples": "https://decisioninsights.ai/standards/",
    "sameAs": [
      "https://www.linkedin.com/company/decisioninsights"
    ],
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@type": "BreadcrumbList",
    "itemListElement": [
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai",
        "name": "Decision Insights",
        "position": 1
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/records/",
        "name": "Records",
        "position": 2
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/cisa-adds-three-known-exploited-vulnerabilities-to-catalog-3/",
        "name": "CISA adds three known exploited vulnerabilities to catalog",
        "position": 3
      }
    ]
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/cisa-adds-three-known-exploited-vulnerabilities-to-catalog-3/#blogposting",
    "@type": "BlogPosting",
    "about": {
      "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/#organization",
      "@type": "Organization",
      "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/",
      "name": "Department of Homeland Security"
    },
    "articleSection": [
      "Cybersecurity"
    ],
    "audience": [
      {
        "@type": "Audience",
        "additionalType": "Persona",
        "audienceType": "Security Operations Leader"
      },
      {
        "@type": "Audience",
        "additionalType": "Adoption curve",
        "audienceType": "Early Majority"
      },
      {
        "@type": "Audience",
        "additionalType": "Industry",
        "audienceType": "Information Technology / Software & Services / IT Services / Data Processing & Outsourced Services"
      }
    ],
    "author": {
      "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
      "@type": "Person",
      "name": "Decision Insights Threat Desk",
      "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
    },
    "dateModified": "2026-08-23T13:02:45-06:00",
    "datePublished": "2025-11-26T10:50:01-07:00",
    "description": "CISA adds three vulnerabilities to Known Exploited Vulnerabilities Catalog affecting WatchGuard Firebox, Gladinet Triofox, and Microsoft Windows requiring remediation.",
    "headline": "CISA adds three known exploited vulnerabilities to catalog",
    "isBasedOn": {
      "@type": "CreativeWork",
      "author": {
        "@type": "Person",
        "name": "CISA"
      },
      "sourceOrganization": {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/",
        "name": "Department of Homeland Security"
      },
      "url": "https://www.cisa.gov/news-events/alerts/2025/11/12/cisa-adds-three-known-exploited-vulnerabilities-catalog"
    },
    "keywords": [
      "Access Control",
      "Binding Operational Directive",
      "Common Vulnerabilities and Exposures",
      "Known Exploited Vulnerabilities",
      "Threats",
      "Vulnerabilities"
    ],
    "mainEntityOfPage": {
      "@id": "https://decisioninsights.ai/cisa-adds-three-known-exploited-vulnerabilities-to-catalog-3/",
      "@type": "WebPage",
      "sdDatePublished": "2026-08-23",
      "sdPublisher": {
        "@id": "https://decisioninsights.ai/#organization"
      }
    },
    "mentions": [
      {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/",
        "name": "Cybersecurity and Infrastructure Security Agency (CISA)"
      },
      {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/",
        "name": "Department of Homeland Security"
      },
      {
        "@id": "https://decisioninsights.ai/registry/microsoft/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/microsoft/",
        "name": "Microsoft"
      },
      {
        "@id": "https://decisioninsights.ai/registry/watchguard/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/watchguard/",
        "name": "WatchGuard Technologies"
      }
    ],
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    }
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
    "@type": "Person",
    "description": "CISA advisories, vendor security bulletins, and CVE disclosures, summarized into sourced briefs. Produced under our Standards & Methodology.",
    "name": "Decision Insights Threat Desk",
    "sameAs": [
      "https://www.linkedin.com/showcase/decisioninsights/"
    ],
    "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
  }
]

Is this your company? Get structured data for your own pages