Skip to main content

CISA adds two vulnerabilities to known exploited vulnerabilities catalog

Source Decision Insights Threat Desk Published November 25, 2025 Companies 3
Human View Machine View

3 companies named across 8 categories, one of 187 articles referencing Microsoft. Previous coverage: CISA issues update to address Windows Server Update Service remote code execution vulnerability (Nov 2025).

Companies mentioned

Best suited for

Persona
Security Operations Leader
Decision stage
How to start
Adoption curve
Early Majority
Industry
Information Technology / Software & Services / IT Services / Internet Services & Infrastructure

Our classification, not the publisher's statement. Best suited for, not only for.

The Cybersecurity and Infrastructure Security Agency (CISA) has incorporated two new vulnerabilities into its Known Exploited Vulnerabilities (KEV) Catalog, citing proof of active exploitation. The affected products include Adobe Commerce and Magento, and Microsoft Windows Server Update Service (WSUS). These vulnerabilities involve improper input validation and deserialization of untrusted data, respectively, with consequences that impact enterprise network security.

The first vulnerability, identified as CVE-2025-54236, affects Adobe Commerce and Magento through improper input validation. The second, CVE-2025-59287, concerns Microsoft Windows Server Update Service and is related to deserialization of untrusted data. Both vulnerabilities have been added to the KEV Catalog due to evidence of exploitation, with no differentiation noted between them beyond their distinct technical attributes and affected components.

Exploitation of these vulnerabilities poses associated risks to systems by allowing unauthorized manipulation or exploitation, potentially compromising enterprise network integrity. The advisory states that these vulnerabilities serve as frequent vectors for malicious cyber activity and present risks to federal enterprise environments.

Binding Operational Directive (BOD) 22-01, aimed at reducing risk from KEV, mandates that Federal Civilian Executive Branch agencies remediate vulnerabilities listed in the KEV Catalog by specified deadlines to protect their networks from active threats. The directive established the KEV Catalog to list Common Vulnerabilities and Exposures (CVE) identifiers significant to federal enterprise security.

Although compliance with BOD 22-01 is required only for federal agencies, CISA recommends that all organizations prioritize the timely remediation of vulnerabilities listed in the KEV Catalog. CISA will continue to update the catalog with vulnerabilities meeting the established criteria for active exploitation.

Blog post, originally published by CISA at cisa.gov.

Mentions

Structured data (JSON-LD)

The schema.org markup this page publishes for search engines and AI agents, exactly as they read it.

[
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#website",
    "@type": "WebSite",
    "name": "Decision Insights",
    "potentialAction": {
      "@type": "SearchAction",
      "target": {
        "@type": "EntryPoint",
        "urlTemplate": "https://decisioninsights.ai/search/?q={search_term_string}&submit=1"
      }
    },
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    },
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#organization",
    "@type": "Organization",
    "contactPoint": {
      "@type": "ContactPoint",
      "contactType": "customer support",
      "email": "[email protected]"
    },
    "description": "Decision Insights is a Registry of technology companies, open source projects, and industry terms, built for people and for AI agents that need sourced, structured information.",
    "logo": {
      "@type": "ImageObject",
      "url": "https://wiretap-cdn-assets.nyc3.cdn.digitaloceanspaces.com/decision-insights/[email protected]"
    },
    "name": "Decision Insights",
    "parentOrganization": {
      "@type": "Organization",
      "name": "Wiretap Labs",
      "sameAs": [
        "https://www.linkedin.com/company/wiretap-labs",
        "https://www.crunchbase.com/organization/wiretap-labs"
      ],
      "url": "https://wiretaplabs.com"
    },
    "publishingPrinciples": "https://decisioninsights.ai/standards/",
    "sameAs": [
      "https://www.linkedin.com/company/decisioninsights"
    ],
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@type": "BreadcrumbList",
    "itemListElement": [
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai",
        "name": "Decision Insights",
        "position": 1
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/records/",
        "name": "Records",
        "position": 2
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/cisa-adds-two-vulnerabilities-to-known-exploited-vulnerabilities-catalog-4/",
        "name": "CISA adds two vulnerabilities to known exploited vulnerabilities catalog",
        "position": 3
      }
    ]
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/cisa-adds-two-vulnerabilities-to-known-exploited-vulnerabilities-catalog-4/#blogposting",
    "@type": "BlogPosting",
    "about": {
      "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/#organization",
      "@type": "Organization",
      "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/",
      "name": "Department of Homeland Security"
    },
    "articleSection": [
      "Cybersecurity",
      "Data Center"
    ],
    "audience": [
      {
        "@type": "Audience",
        "additionalType": "Persona",
        "audienceType": "Security Operations Leader"
      },
      {
        "@type": "Audience",
        "additionalType": "Adoption curve",
        "audienceType": "Early Majority"
      },
      {
        "@type": "Audience",
        "additionalType": "Industry",
        "audienceType": "Information Technology / Software & Services / IT Services / Internet Services & Infrastructure"
      }
    ],
    "author": {
      "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
      "@type": "Person",
      "name": "Decision Insights Threat Desk",
      "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
    },
    "dateModified": "2026-08-23T13:09:10-06:00",
    "datePublished": "2025-11-25T20:43:58-07:00",
    "description": "CISA updates KEV Catalog adding Adobe Commerce and Microsoft WSUS vulnerabilities linked to active exploitation by threat actors.",
    "headline": "CISA adds two vulnerabilities to known exploited vulnerabilities catalog",
    "isBasedOn": {
      "@type": "CreativeWork",
      "author": {
        "@type": "Person",
        "name": "CISA"
      },
      "sourceOrganization": {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/",
        "name": "Department of Homeland Security"
      },
      "url": "https://www.cisa.gov/news-events/alerts/2025/10/24/cisa-adds-two-known-exploited-vulnerabilities-catalog"
    },
    "keywords": [
      "Binding Operational Directive",
      "Common Vulnerabilities and Exposures",
      "Enterprise",
      "Known Exploited Vulnerabilities",
      "Server",
      "Vulnerabilities"
    ],
    "mainEntityOfPage": {
      "@id": "https://decisioninsights.ai/cisa-adds-two-vulnerabilities-to-known-exploited-vulnerabilities-catalog-4/",
      "@type": "WebPage",
      "sdDatePublished": "2026-08-23",
      "sdPublisher": {
        "@id": "https://decisioninsights.ai/#organization"
      }
    },
    "mentions": [
      {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/",
        "name": "Cybersecurity and Infrastructure Security Agency (CISA)"
      },
      {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/",
        "name": "Department of Homeland Security"
      },
      {
        "@id": "https://decisioninsights.ai/registry/microsoft/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/microsoft/",
        "name": "Microsoft"
      }
    ],
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    }
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
    "@type": "Person",
    "description": "CISA advisories, vendor security bulletins, and CVE disclosures, summarized into sourced briefs. Produced under our Standards & Methodology.",
    "name": "Decision Insights Threat Desk",
    "sameAs": [
      "https://www.linkedin.com/showcase/decisioninsights/"
    ],
    "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
  }
]

Is this your company? Get structured data for your own pages