Week of May 16, 2022: CISA's VMware Emergency Directive and F5 BIG-IP Alert

The week of May 16, 2022 brought an unusually heavy run of CISA activity, led by Emergency Directive 22-03 ordering agencies to patch or remove vulnerable VMware software and a joint alert on active F5 BIG-IP exploitation, alongside two new additions to the Known Exploited Vulnerabilities Catalog. Apple, Apache, and ISC also shipped patches for actively exploited or high-risk flaws, while a five-nation advisory detailed the weak security practices attackers routinely use to gain initial access.

CISA and MS-ISAC Warn of Active F5 BIG-IP Exploitation

On May 18, 2022, CISA and the Multi-State Information Sharing and Analysis Center issued a joint advisory covering active exploitation of CVE-2022-1388, a critical authentication-bypass flaw in F5 BIG-IP that let unauthenticated attackers take control of devices through the management port or self-IP addresses. F5 had patched the flaw on May 4, 2022, but proof-of-concept exploit code had already circulated publicly, prompting the agencies to expect widespread exploitation of unpatched systems across government and private networks and to urge immediate patching or workaround application. (CISA)

CISA Issues Emergency Directive Over Active VMware Vulnerability Exploitation

On May 18, 2022, CISA issued Emergency Directive 22-03 ordering Federal Civilian Executive Branch agencies to either patch or remove from networks any instance of VMware Workspace ONE Access, Identity Manager, vRealize Automation, Cloud Foundation, or vRealize Suite Lifecycle Manager, citing active exploitation of CVE-2022-22954 and CVE-2022-22960. The directive accompanied advisory AA22-138B, which noted that threat actors reverse engineered VMware's April patches to build a working exploit within 48 hours. CISA also warned it expected rapid exploitation of two newly disclosed VMware flaws, CVE-2022-22972 and CVE-2022-22973, released the same day. (CISA)

CISA Adds Zyxel Firewall and VMware Spring Cloud Gateway Flaws to KEV Catalog

On May 16, 2022, CISA added CVE-2022-30525, affecting multiple Zyxel firewalls, and CVE-2022-22947, affecting VMware Spring Cloud Gateway, to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. Under Binding Operational Directive 22-01, Federal Civilian Executive Branch agencies were required to remediate catalog entries by the specified due date. CISA stated these vulnerability types are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise, while also urging all organizations to prioritize timely remediation as part of routine vulnerability management. (CISA)

Five-Nation Advisory Flags Weak Security Controls Exploited for Initial Access

On May 17, 2022, CISA, joined by cybersecurity authorities from Canada, New Zealand, the Netherlands, and the United Kingdom, published a joint advisory describing how threat actors routinely gain initial access through weak multi-factor authentication enforcement, unpatched software, default vendor credentials, unsecured remote services, and poor password policies. The advisory identified commonly exploited techniques including exploitation of public-facing applications, external remote services, phishing, and valid account abuse, and offered mitigations such as adopting zero-trust access controls and centralized log management for network defenders. (CISA)

Apple Patches Actively Exploited Zero-Day Across macOS, watchOS, tvOS

On May 17, 2022, Apple released security updates for watchOS 8.6, tvOS 15.3, macOS Catalina, macOS Big Sur 11.6.6, macOS Monterey 12.4, iOS 15.5, iPadOS 15.5, and Xcode 13.4, addressing vulnerabilities that could let an attacker take control of an affected system. CISA noted Apple's acknowledgment of a report indicating CVE-2022-22675, affecting watchOS, tvOS, and macOS Big Sur, may have been actively exploited, and urged administrators to apply the available updates promptly. (CISA)

ISC Patches Denial-of-Service Flaw in BIND DNS Software

On May 19, 2022, the Internet Systems Consortium released a security advisory addressing CVE-2022-1183, a vulnerability in version 9.18.0 of ISC BIND that a remote attacker could exploit to cause a denial-of-service condition. CISA encouraged users and administrators running the affected BIND release to review the ISC advisory and apply the necessary update to protect domain name system infrastructure from disruption. (CISA)

Apache Issues Security Advisory for Tomcat Information-Disclosure Flaw

On May 16, 2022, the Apache Software Foundation released a security advisory addressing a vulnerability affecting multiple versions of Tomcat that an attacker could exploit to obtain sensitive information. CISA encouraged users and administrators to review the Apache advisory and apply the necessary updates to reduce exposure for organizations running the affected application server versions. (CISA)

CISA Publishes FY21 Risk and Vulnerability Assessment Findings

On May 19, 2022, CISA released an analysis and infographic summarizing findings from 112 Risk and Vulnerability Assessments it conducted across multiple sectors during Fiscal Year 2021. The analysis mapped an 11-step sample attack path a threat actor could follow to compromise an organization with weaknesses typical of those CISA observed, and highlighted the three most successful techniques for each tactic, tying threat actor behavior to the MITRE ATT&CK framework for network defenders. (CISA)