CISA catalogued nine exploited vulnerabilities in ten days. The ransomware campaign used older ones.

In brief

CISA added nine vulnerabilities to its Known Exploited Vulnerabilities catalog in ten days this August, across three separate batches. Six carry a CVSS base score of 9.0 or higher and one is a perfect 10.0. But the more useful finding for a security leader is in a different advisory published in the same window: the ransomware campaign CISA and the FBI warned about that week gained initial access through vulnerabilities disclosed in 2024 and 2025 — not through any of the new ones. The exploited edge is old.

What was added

Cross-referencing each catalogued CVE against the National Vulnerability Database gives the severity the KEV catalog itself does not carry:

Read the affected column rather than the scores. These nine span the perimeter firewall, the operating-system network stack, the virtualisation control plane, collaboration servers, the endpoint OS and a business-intelligence tool. No single vendor relationship, patch cycle or asset owner covers that list.

Why it matters

Two observations that no individual advisory states.

The severity is concentrated where authentication is. Of the six scored at 9.0 or above, four are authentication or authorisation failures rather than memory corruption — weak authentication, missing authentication, improper authentication, unauthenticated injection. The distinguishing feature is not exploit sophistication. It is that the affected service accepted an unauthenticated request it should have refused.

The campaign used old vulnerabilities. In the same ten-day window, CISA, the FBI and partner agencies warned about Gunra ransomware actors targeting multiple critical-infrastructure sectors. Initial access came through CVE-2024-55591 (CVSS 9.8) and CVE-2025-24472 (CVSS 8.1) — both authentication bypasses in internet-facing Fortinet devices, both disclosed well before this month's catalogue additions.

That gap is the operational point. Attention follows new CVEs; the actors in the advisory walked through doors that had been open, and patchable, for a year or more. A remediation programme optimised for this week's disclosures and a programme that closes a year-old internet-facing authentication bypass are not the same programme, and only the second one stopped this campaign.

What leaders should do next

1. Ask which of your internet-facing services would accept an unauthenticated request. That is the shared property of the highest-severity additions, and it is answerable from an external scan rather than a vendor bulletin.
2. Check remediation age, not just remediation rate. A 95% patch rate that consistently leaves the same internet-facing appliance unpatched is the exact profile the Gunra advisory describes.
3. Note where two flaws share one door. Both TrueConf entries are reachable on port 4307/TCP. Closing a single exposed service can retire more than one catalogued vulnerability, which is a better use of a change window than treating each CVE as separate work.

Sources and scope

Catalogue additions are from CISA's Known Exploited Vulnerabilities catalog, added on 11 August, 18 August and 20 August. The ransomware campaign and its initial-access vulnerabilities are from the joint advisory AA26-222A.

CVSS base scores and affected-product descriptions were retrieved independently from the NIST National Vulnerability Database and are not stated in the CISA catalogue entries. Three of the nine additions carried no CVSS base score in NVD at the time of writing and are shown with a dash rather than an estimate.

The severity pattern, the observation about authentication failures, the contrast between catalogued additions and the vulnerabilities actually used for initial access, and the recommendations are ByteNib editorial analysis.

ByteNib previously covered internet-facing control-system exposure in Internet-exposed PLCs are a control-system risk. This month's additions extend that argument from operational technology into ordinary enterprise infrastructure.

Continue exploring: Cybersecurity analysis, the related implementation tutorial, and the structured learning path.