US Security Agency Mandates New Software Patches
The US Cybersecurity and Infrastructure Security Agency (CISA) has added four actively exploited vulnerabilities to its KEV catalog, affecting Google Chrome, Microsoft Windows, Zimbra, and ThreatSonar. The agency has set strict patching deadlines for federal agencies, a move widely monitored as a best practice by European public sector IT departments.
- The KEV catalog, or Known Exploited Vulnerabilities catalog, was established by CISA under Binding Operational Directive 22-01 to provide an authoritative list of vulnerabilities that are being actively exploited in the wild, helping organizations prioritize remediation efforts. - The Microsoft Windows vulnerability (CVE-2008-0015) is a critical remote code execution flaw in the Video ActiveX Control that dates back nearly two decades but is still being actively used in attacks. - The Google Chrome vulnerability (CVE-2026-2441) is classified as a zero-day, use-after-free flaw, which can lead to heap corruption through a specially crafted HTML page, allowing for remote code execution. - The mandate requires U.S. Federal Civilian Executive Branch agencies to apply patches for these vulnerabilities by March 10, 2026, to protect federal networks from active threats. - In December 2023, CISA and the European Union Agency for Cybersecurity (ENISA) signed a formal Working Arrangement to enhance cooperation, including the exchange of best practices in vulnerability management and incident reporting. - The Zimbra vulnerability is a critical server-side request forgery (SSRF) defect (CVE-2020-7796), which has been exploited by nearly 400 IP addresses across multiple countries to permit unauthorized data access. - A recent study of 75 EU government institutions revealed significant cybersecurity weaknesses, classifying 67% as high-risk or critical-risk and finding that every institution had experienced at least one data breach. - The directive is part of a broader U.S. government strategy to improve digital infrastructure resilience, which also includes directives like BOD 26-02, compelling agencies to decommission hardware and software that no longer receive manufacturer support.
