Week of May 13, 2024: CISA's Eric Goldstein Departs, KEV Catalog Expands

Security leaders watched CISA Executive Assistant Director for Cybersecurity Eric Goldstein announce his departure for the private sector the same week CISA added five actively exploited vulnerabilities to its Known Exploited Vulnerabilities Catalog, spanning Chromium, D-Link routers, and Windows components, while Microsoft, Apple, and seventeen industrial-control-system advisories demanded patch attention. CISA also published encrypted DNS implementation guidance for federal agencies, closing out a week focused on active-exploitation response and infrastructure hardening.

CISA's Eric Goldstein to Leave for Private Sector Role

Eric Goldstein, the Executive Assistant Director for Cybersecurity at CISA, announced during the week of May 13, 2024 that he was leaving the agency for a private sector role. Goldstein had joined CISA in 2021 after serving as global head of cybersecurity policy, strategy, and regulation at Goldman Sachs, and he previously held roles at CISA's precursor, the National Protection and Programs Directorate. His exit removed one of the agency's most prominent public voices on federal cybersecurity policy and zero trust implementation. (SecurityWeek)

CISA Adds Chromium and Two D-Link Router Flaws to Exploited Vulnerabilities List

CISA added three vulnerabilities to its Known Exploited Vulnerabilities Catalog on May 16, 2024, citing evidence of active exploitation. The additions were CVE-2024-4761, a Google Chromium V8 out-of-bounds memory write flaw; CVE-2021-40655, a D-Link DIR-605 router information disclosure vulnerability; and CVE-2014-100005, a D-Link DIR-600 router cross-site request forgery flaw. Federal Civilian Executive Branch agencies faced Binding Operational Directive 22-01 remediation deadlines, and CISA urged all organizations to prioritize patching given the frequency of these vulnerability types as attack vectors. (CISA)

CISA Flags Two Actively Exploited Windows Vulnerabilities

On May 14, 2024, CISA added two Microsoft vulnerabilities to its Known Exploited Vulnerabilities Catalog after confirming active exploitation. The entries were CVE-2024-30051, a DWM Core Library privilege escalation flaw, and CVE-2024-30040, a Windows MSHTML Platform security feature bypass. Both vulnerabilities fell under Binding Operational Directive 22-01's remediation timelines for Federal Civilian Executive Branch agencies, and CISA again urged broader organizations to prioritize remediation given the risk such flaws pose as frequent attack vectors against enterprise networks. (CISA)

CISA Adds Actively Exploited Chromium Bug to KEV Catalog

CISA added a single new vulnerability to its Known Exploited Vulnerabilities Catalog on May 13, 2024: CVE-2024-4671, a Google Chromium use-after-free flaw in the Visuals component, based on evidence of active exploitation. The addition triggered Binding Operational Directive 22-01 remediation timelines for Federal Civilian Executive Branch agencies, and CISA reiterated its standing guidance that all organizations, not only federal agencies, treat catalog entries as a baseline for vulnerability management prioritization. (CISA)

Microsoft Ships May 2024 Patch Tuesday Updates

Microsoft released its May 2024 security updates on May 14, 2024, addressing vulnerabilities across multiple products that CISA warned could let a cyber threat actor take control of an affected system. CISA pointed administrators to Microsoft's Security Update Guide for the month and urged prompt review and deployment. The release landed the same day CISA added two actively exploited Microsoft vulnerabilities to its Known Exploited Vulnerabilities Catalog, underscoring the urgency facing enterprise patch teams during the week. (CISA)

Apple Patches Safari, iOS, macOS and Other Platforms

Apple released security updates on May 14, 2024 covering Safari 17.5, iOS 17.5 and iPadOS 17.5, iOS 16.7.8 and iPadOS 16.7.8, macOS Sonoma 14.5, macOS Ventura 13.6.7, macOS Monterey 12.7.5, watchOS 10.5, and tvOS 17.5. CISA advised users and administrators to review the associated advisories and apply the updates promptly, noting that a cyber threat actor could exploit some of the addressed vulnerabilities to take control of an affected system across Apple's device fleet. (CISA)

CISA Issues Seventeen Industrial Control Systems Advisories

CISA released seventeen Industrial Control Systems advisories on May 16, 2024, with most covering Siemens products including Parasolid, SICAM, Teamcenter Visualization, Polarion ALM, Simcenter Nastran, SIMATIC CN 4100, and RUGGEDCOM lines, alongside advisories for Rockwell Automation FactoryTalk View SE, Mitsubishi Electric MELSEC products, and GE Healthcare Ultrasound Products. CISA encouraged operators of industrial environments to review the advisories for technical details and mitigations as part of ongoing critical infrastructure protection efforts across multiple vendors. (CISA)

CISA Publishes Encrypted DNS Guidance for Federal Agencies

CISA published Encrypted Domain Name System Implementation Guidance on May 16, 2024, directing federal civilian agencies on encrypting DNS traffic to align with OMB Memorandum M-22-09 and the National Cybersecurity Strategy's zero trust requirements. The guidance offered agencies an implementation checklist, phased rollout recommendations, and technical references covering on-premises, cloud, and mobile endpoints. CISA said organizations outside the federal government could also use the document as a benchmark for advancing their own zero trust efforts. (CISA)