Skip to main content

CISA adds two known exploited vulnerabilities to catalog

Source Decision Insights Threat Desk Published November 25, 2025 Companies 4
Human View Machine View

4 companies named across 5 categories, one of 60 articles referencing Broadcom. Previous coverage: Dell’Oro Group reports on overlapping AI data center buildout announcements and capacity challenges (Nov 2025).

Companies mentioned

Best suited for

Persona
Security Operations Leader
Decision stage
Which to buy
Industry
Information Technology / Software & Services / IT Services / Data Processing & Outsourced Services

Our classification, not the publisher's statement. Best suited for, not only for.

The Cybersecurity and Infrastructure Security Agency (CISA) has incorporated two vulnerabilities into its Known Exploited Vulnerabilities (KEV) Catalog following confirmation of active exploitation. The affected products include the XWiki Platform and VMware Aria Operations alongside VMware Tools by Broadcom. The reported weaknesses involve an eval injection and privilege definition with unsafe actions, respectively, which threaten system security.

The first vulnerability, identified as CVE-2025-24893, affects the XWiki Platform through an eval injection flaw. The second, CVE-2025-41244, pertains to Broadcom's VMware Aria Operations and VMware Tools, where privilege definitions include unsafe actions. Specific affected versions or component details were not provided beyond these designations. Both vulnerabilities have been verified as actively exploited and are cataloged accordingly.

The presence of these vulnerabilities creates opportunities for malicious actors to compromise federal enterprise systems and networks. The consequences underscore the importance of addressing these security weaknesses to maintain operational integrity.

Under Binding Operational Directive (BOD) 22-01 (BOD 22-01), Federal Civilian Executive Branch agencies are required to remediate such vulnerabilities by designated deadlines to safeguard their networks. This directive established the KEV Catalog as a resource listing CVEs that pose substantial risks. While the directive mandates remediation within federal agencies, CISA suggests all organizations prioritize these vulnerabilities within their security management strategies.

CISA's guidance recommends organizations focus on timely remediation of vulnerabilities listed in the KEV Catalog to reduce exposure to cyberattacks. The agency will continue updating the catalog with vulnerabilities meeting set criteria to support vulnerability management efforts across sectors.

Blog post, originally published by CISA at cisa.gov.

Mentions

Structured data (JSON-LD)

The schema.org markup this page publishes for search engines and AI agents, exactly as they read it.

[
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#website",
    "@type": "WebSite",
    "name": "Decision Insights",
    "potentialAction": {
      "@type": "SearchAction",
      "target": {
        "@type": "EntryPoint",
        "urlTemplate": "https://decisioninsights.ai/search/?q={search_term_string}&submit=1"
      }
    },
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    },
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#organization",
    "@type": "Organization",
    "contactPoint": {
      "@type": "ContactPoint",
      "contactType": "customer support",
      "email": "[email protected]"
    },
    "description": "Decision Insights is a Registry of technology companies, open source projects, and industry terms, built for people and for AI agents that need sourced, structured information.",
    "logo": {
      "@type": "ImageObject",
      "url": "https://wiretap-cdn-assets.nyc3.cdn.digitaloceanspaces.com/decision-insights/[email protected]"
    },
    "name": "Decision Insights",
    "parentOrganization": {
      "@type": "Organization",
      "name": "Wiretap Labs",
      "sameAs": [
        "https://www.linkedin.com/company/wiretap-labs",
        "https://www.crunchbase.com/organization/wiretap-labs"
      ],
      "url": "https://wiretaplabs.com"
    },
    "publishingPrinciples": "https://decisioninsights.ai/standards/",
    "sameAs": [
      "https://www.linkedin.com/company/decisioninsights"
    ],
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@type": "BreadcrumbList",
    "itemListElement": [
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai",
        "name": "Decision Insights",
        "position": 1
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/records/",
        "name": "Records",
        "position": 2
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/cisa-adds-two-known-exploited-vulnerabilities-to-catalog-4/",
        "name": "CISA adds two known exploited vulnerabilities to catalog",
        "position": 3
      }
    ]
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/cisa-adds-two-known-exploited-vulnerabilities-to-catalog-4/#blogposting",
    "@type": "BlogPosting",
    "about": {
      "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/#organization",
      "@type": "Organization",
      "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/",
      "name": "Department of Homeland Security"
    },
    "articleSection": [
      "Cybersecurity"
    ],
    "audience": [
      {
        "@type": "Audience",
        "additionalType": "Persona",
        "audienceType": "Security Operations Leader"
      },
      {
        "@type": "Audience",
        "additionalType": "Industry",
        "audienceType": "Information Technology / Software & Services / IT Services / Data Processing & Outsourced Services"
      }
    ],
    "author": {
      "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
      "@type": "Person",
      "name": "Decision Insights Threat Desk",
      "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
    },
    "dateModified": "2026-08-23T13:07:08-06:00",
    "datePublished": "2025-11-25T20:16:36-07:00",
    "description": "CISA adds two vulnerabilities to its Known Exploited Vulnerabilities Catalog affecting XWiki Platform and Broadcom VMware products, requiring federal remediation.",
    "headline": "CISA adds two known exploited vulnerabilities to catalog",
    "isBasedOn": {
      "@type": "CreativeWork",
      "author": {
        "@type": "Person",
        "name": "CISA"
      },
      "sourceOrganization": {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/",
        "name": "Department of Homeland Security"
      },
      "url": "https://www.cisa.gov/news-events/alerts/2025/10/30/cisa-adds-two-known-exploited-vulnerabilities-catalog"
    },
    "keywords": [
      "Binding Operational Directive",
      "Known Exploited Vulnerabilities",
      "Remediation",
      "Vulnerabilities"
    ],
    "mainEntityOfPage": {
      "@id": "https://decisioninsights.ai/cisa-adds-two-known-exploited-vulnerabilities-to-catalog-4/",
      "@type": "WebPage",
      "sdDatePublished": "2026-08-23",
      "sdPublisher": {
        "@id": "https://decisioninsights.ai/#organization"
      }
    },
    "mentions": [
      {
        "@id": "https://decisioninsights.ai/registry/broadcom/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/broadcom/",
        "name": "Broadcom"
      },
      {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/",
        "name": "Cybersecurity and Infrastructure Security Agency (CISA)"
      },
      {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/",
        "name": "Department of Homeland Security"
      },
      {
        "@id": "https://decisioninsights.ai/registry/broadcom/vmware/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/broadcom/vmware/",
        "name": "VMware by Broadcom"
      }
    ],
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    }
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
    "@type": "Person",
    "description": "CISA advisories, vendor security bulletins, and CVE disclosures, summarized into sourced briefs. Produced under our Standards & Methodology.",
    "name": "Decision Insights Threat Desk",
    "sameAs": [
      "https://www.linkedin.com/showcase/decisioninsights/"
    ],
    "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
  }
]

Is this your company? Get structured data for your own pages