Week of July 11, 2022: July Patch Tuesday Lands; CISA Adds New KEV Entry

CISOs tracking the week of July 11, 2022 faced a dense mid-July Patch Tuesday cycle, with CISA issuing advisories for Microsoft, Adobe, SAP, Citrix Hypervisor, and Juniper Networks products, all pointing to vulnerabilities that could let attackers take control of affected systems. The same week, CISA added a newly identified vulnerability to its Known Exploited Vulnerabilities Catalog, citing evidence of active exploitation and reinforcing the remediation deadlines set under Binding Operational Directive 22-01 for federal agencies.

CISA Adds New Entry to Known Exploited Vulnerabilities Catalog

CISA added a new entry to its Known Exploited Vulnerabilities Catalog on July 12, 2022, citing evidence that the flaw was being actively exploited. The addition falls under Binding Operational Directive 22-01, which requires federal civilian executive branch agencies to remediate catalog vulnerabilities by set deadlines to limit exposure to active threats. CISA urged all organizations, not just federal agencies, to treat the catalog as a prioritization tool for vulnerability management and apply fixes promptly to reduce the risk of exploitation across enterprise networks. (CISA)

Microsoft Ships July 2022 Security Updates

Microsoft issued its July 2022 round of security updates addressing multiple vulnerabilities across its software portfolio. CISA flagged the release on July 12, 2022, warning that attackers could exploit several of the flaws to take control of affected systems. The agency directed administrators to consult Microsoft's security update and deployment guidance and apply the available patches, underscoring the routine but critical nature of keeping Windows and other Microsoft products current against disclosed vulnerabilities during the monthly Patch Tuesday cycle. (CISA)

Adobe Patches RoboHelp, Acrobat, Character and Animator, Photoshop

Adobe released security updates on July 12, 2022 covering RoboHelp, Acrobat and Reader, Character and Animator, and Photoshop, according to a CISA alert issued the same day. CISA warned that some of the vulnerabilities could let an attacker take control of an affected system and pointed administrators to four separate Adobe security bulletins covering the affected products. The agency recommended reviewing each bulletin and applying the necessary updates without delay to limit exposure. (CISA)

SAP Issues July 2022 Security Patch Day Updates

SAP published its July 2022 Security Patch Day updates addressing vulnerabilities across multiple products, prompting a CISA alert on July 12, 2022. CISA cautioned that some of the flaws could allow an attacker to take control of an affected system and directed administrators to SAP's patch day bulletin for details. The advisory added to a heavy mid-July patch cycle that also touched Microsoft, Adobe, Citrix, and Juniper products. (CISA)

Citrix Patches Hypervisor Vulnerabilities

Citrix released security updates for its Hypervisor product on July 12, 2022, which CISA highlighted the same day. The agency said an attacker could exploit the vulnerabilities to take control of an affected system and pointed administrators to Citrix's own advisory, CTX461397, for update details. The alert formed part of a cluster of vendor patches CISA flagged that week, reflecting the steady cadence of virtualization-platform fixes security teams had to track. (CISA)

Juniper Networks Releases Security Updates for Multiple Products

Juniper Networks released security updates covering multiple products, an advisory CISA last revised on July 13, 2022. CISA warned that an attacker could exploit some of the flaws to take control of an affected system and directed users to Juniper's own security advisories page for the full list of fixes. The alert capped a week in which CISA pushed out advisories for several major vendors in quick succession. (CISA)