Week of August 12, 2024: CISA Adds SolarWinds Flaw to KEV, Microsoft Ships August Patches

Security leaders tracked CISA's addition of an actively exploited SolarWinds Web Help Desk flaw and six Microsoft vulnerabilities to the Known Exploited Vulnerabilities Catalog, alongside Microsoft's August Patch Tuesday, Ivanti fixes for Avalanche, Neurons for ITSM and Virtual Traffic Manager, eleven Siemens, AVEVA and PTC industrial control system advisories, and a joint FBI-CISA public service announcement assuring voters that ransomware would not affect vote counting. The week also brought new technology leadership moves at Skyhigh Security and Tenable as vendors and agencies pushed out patch guidance across enterprise, cloud and industrial systems.

Skyhigh Security Names New CTO, Tenable Appoints Chief Product Officer

SecurityWeek's industry moves column reported that Skyhigh Security appointed Stephen Tait as its new Chief Technology Officer, moving from the same role at Snow Software after earlier leadership positions at Calyx, BAE Systems, Capita, Cybit, and Telematix. The same column noted that Shai Morag became Chief Product Officer at Tenable, a role that followed Tenable's 2023 acquisition of Ermetic, where Morag had served as chief executive and co-founder; he previously co-founded and led Secdo and served as chief executive of Integrity-Project. (SecurityWeek)

CISA Adds Six Actively Exploited Microsoft Vulnerabilities to KEV Catalog

CISA added six vulnerabilities to its Known Exploited Vulnerabilities Catalog on August 13, 2024, citing evidence of active exploitation. The list covered CVE-2024-38189 in Microsoft Project, CVE-2024-38178 in the Windows Scripting Engine, CVE-2024-38213 affecting Windows SmartScreen, CVE-2024-38193 in the Windows Ancillary Function Driver for WinSock, and two Windows privilege escalation flaws, CVE-2024-38106 and CVE-2024-38107. Under Binding Operational Directive 22-01, federal civilian agencies faced remediation deadlines, and CISA urged all organizations to prioritize the fixes. (CISA)

SolarWinds Web Help Desk Flaw Added to CISA's Exploited Vulnerabilities List

CISA added CVE-2024-28986, a deserialization of untrusted data vulnerability in SolarWinds Web Help Desk, to its Known Exploited Vulnerabilities Catalog on August 15, 2024, based on evidence of active exploitation. The addition triggered remediation timelines for federal civilian executive branch agencies under Binding Operational Directive 22-01, and CISA again encouraged all organizations to factor catalog entries into their vulnerability management prioritization practices. (CISA)

Microsoft Ships August 2024 Security Updates Across Multiple Products

Microsoft released its August 2024 security updates on August 13, 2024, addressing vulnerabilities across multiple products that CISA warned could let a cyber threat actor take control of an affected system. CISA directed users and administrators to the Microsoft Security Update Guide for August to review the fixes and apply them, and the updates coincided with the same week's Known Exploited Vulnerabilities Catalog additions for six separately tracked Windows and Project flaws. (CISA)

Ivanti Patches Avalanche, Neurons for ITSM, and Virtual Traffic Manager

Ivanti released security updates on August 13, 2024 for Avalanche, Neurons for ITSM, and Virtual Traffic Manager, covering multiple vulnerabilities that CISA said a cyber threat actor could exploit to take control of an affected system. Ivanti advised customers to reduce their attack surface by following its network configuration guidance restricting access to management interfaces, and CISA pointed administrators to the vendor's three separate security advisories for technical detail and patching guidance. (CISA)

CISA Issues Eleven Industrial Control Systems Advisories

CISA published eleven Industrial Control Systems advisories on August 15, 2024, covering products from Siemens, AVEVA, and PTC. The Siemens advisories spanned SCALANCE M-800 and RUGGEDCOM RM1224 devices, INTRALOG WMS, Teamcenter Visualization and JT2Go, SINEC Traffic Analyzer, LOGO! V8.3 BM devices, SINEC NMS, Location Intelligence, COMOS, and NX, while separate advisories addressed AVEVA Historian Web Server and PTC Kepware ThingWorx Kepware Server. CISA encouraged operators to review each advisory for technical details and mitigations. (CISA)

FBI and CISA Reassure Public That Ransomware Won't Disrupt Vote Counting

FBI and CISA jointly released a public service announcement on August 15, 2024, titled Just So You Know, intended to reassure the public ahead of the 2024 election cycle that ransomware attacks against state or local government networks or election infrastructure could cause localized delays but would not compromise the security or accuracy of vote casting or counting. CISA Senior Advisor Cait Conley said "ransomware continues to be a significant cybersecurity concern," while FBI Cyber Division Deputy Assistant Director Cynthia Kaiser said combating such attacks remained a top priority during elections. (CISA)