Week of June 27, 2022: CISA Expands KEV Catalog, Warns on MedusaLocker Ransomware

Security leaders tracked CISA's addition of eight actively exploited vulnerabilities to its Known Exploited Vulnerabilities Catalog, a joint advisory on MedusaLocker ransomware from CISA, the FBI, Treasury, and FinCEN, and CISA's 2022 CWE Top 25 release during the week of June 27, 2022. The week also brought Mozilla security updates for Firefox and Thunderbird, CISA guidance on retiring Basic Authentication in Exchange Online ahead of its October 2022 deprecation, and the reinstatement of a Windows certificate-authentication vulnerability to the KEV catalog.

CISA Adds Eight Vulnerabilities to Known Exploited Vulnerabilities Catalog

CISA added eight vulnerabilities to its Known Exploited Vulnerabilities Catalog on June 27, 2022, citing evidence of active exploitation. The agency said such vulnerabilities are a frequent attack vector against federal systems and pose significant risk to the federal enterprise. Binding Operational Directive 22-01 requires Federal Civilian Executive Branch agencies to remediate catalog entries by set deadlines, while CISA urged all organizations, not just federal agencies, to prioritize timely remediation of these vulnerabilities as part of routine vulnerability management practice. (CISA)

CISA and MITRE Publish 2022 CWE Top 25 Most Dangerous Software Weaknesses

The Homeland Security Systems Engineering and Development Institute, sponsored by CISA and operated by MITRE, published the 2022 Common Weakness Enumeration Top 25 Most Dangerous Software Weaknesses list on June 28, 2022. The ranking drew on National Vulnerability Database data to identify the most frequent and critical coding errors behind serious vulnerabilities, incorporating updated weakness data tied to CVEs already listed in CISA's Known Exploited Vulnerabilities Catalog. CISA urged administrators to review the list and evaluate recommended mitigations suited to their environments. (CISA)

CISA Urges Switch to Modern Auth in Exchange Online Before October Deadline

CISA issued guidance on June 28, 2022, urging organizations to move from legacy Basic Authentication in Microsoft Exchange Online to Modern Authentication before Microsoft permanently disables Basic Auth on October 1, 2022. Basic Auth does not support multifactor authentication, which Executive Order 14028 requires for Federal Civilian Executive Branch agencies. While the guidance was tailored to federal agencies, CISA encouraged all organizations to complete the switch and enable MFA ahead of the October deadline to avoid authentication disruptions. (CISA)

Mozilla Patches Firefox, Firefox ESR, and Thunderbird

Mozilla released security updates on June 29, 2022, covering Firefox, Firefox ESR, and Thunderbird to patch multiple vulnerabilities, some of which could let an attacker take control of an affected system. CISA advised users and administrators to consult the Mozilla security advisories for Firefox 102, Firefox ESR 91.11, and Thunderbird 91.11 and 102, and to apply the necessary updates promptly to reduce exposure for both enterprise and individual endpoints running the affected browser and email client. (CISA)

CISA, FBI, Treasury, and FinCEN Issue Joint Advisory on MedusaLocker Ransomware

CISA, the FBI, the Treasury Department, and FinCEN released a joint advisory on June 30, 2022, detailing MedusaLocker ransomware, which actors used to access victim networks chiefly through vulnerable Remote Desktop Protocol configurations. The advisory recommended network defenders prioritize remediating known exploited vulnerabilities, train staff to recognize phishing attempts, and enable multifactor authentication. Agencies pointed organizations to StopRansomware.gov for further detection, protection, and response guidance tied to this and other ransomware families. (CISA)

CISA Reinstates Windows Certificate-Authentication Flaw to KEV Catalog

CISA added CVE-2022-26925, a Microsoft Windows vulnerability, back to its Known Exploited Vulnerabilities Catalog on July 1, 2022, after previously removing it when remediation steps were found to break certificate authentication for many federal agencies. The flaw was mitigated by Microsoft's June 2022 Patch Tuesday update, which also addressed CVE-2022-26923 and CVE-2022-26931 affecting how certificates map to Active Directory accounts. CISA published a companion knowledge article outlining steps agencies needed to follow to avoid service outages during remediation. (CISA)