CISA adds three vulnerabilities to its catalog
4 companies named across 6 categories, one of 7 articles referencing Citrix. Previous coverage: CISA Adds Three Known Exploited Vulnerabilities to Catalog (Aug 2025).
Companies mentioned
Best suited for
- Persona
- Security Operations Leader
- Decision stage
- Which to buy
- Adoption curve
- Early Majority
Our classification, not the publisher's statement. Best suited for, not only for.
CISA has included three new vulnerabilities in its Known Exploited Vulnerabilities (KEV) Catalog, highlighting threats to various software environments.
Vulnerability Details
The newly added vulnerabilities are as follows:
- CVE-2024-8069: Citrix Session Recording Deserialization of Untrusted Data Vulnerability.
- CVE-2024-8068: Citrix Session Recording Improper Privilege Management Vulnerability.
- CVE-2025-48384: Git Link Following Vulnerability.
These vulnerabilities are known attack vectors and present risk to federal enterprise systems. CISA notes that vulnerabilities such as these must be addressed to mitigate risks.
Binding Operational Directive Insights
The Binding Operational Directive (BOD) 22-01 establishes the KEV Catalog as a comprehensive list of Common Vulnerabilities and Exposures (CVE) (CVEs) posing notable risks to federal agencies. According to BOD 22-01, Federal Civilian Executive Branch (FCEB) agencies are required to remediate any identified vulnerabilities by the specified deadline.
While BOD 22-01 is directed at FCEB organizations, CISA recommends that all entities prioritize the remediation of KEV Catalog vulnerabilities to enhance their security posture. CISA will continue to update the catalog as new vulnerabilities are identified.
Conclusion
This update from CISA emphasizes the importance of addressing known vulnerabilities to safeguard against cyber threats. The inclusion of these vulnerabilities serves as a reminder for organizations to maintain vigilant cybersecurity practices. This summary reflects a timely review of the original blog post.
Blog post, originally published by Summary by StringerAI - Source: Cybersecurity and Infrastructure Security Agency (CISA) at decisioninsights.ai.