Week of September 16, 2024: CISA's FOCAL Plan and Ivanti CSA Exploitation

Security leaders tracked CISA's release of its FOCAL Plan for federal cybersecurity alignment, an actively exploited Ivanti Cloud Services Appliance flaw added to the Known Exploited Vulnerabilities Catalog, and new CISO appointments at Penn State University and V2X. Vendor advisories from VMware and Versa Networks, plus additional KEV catalog entries covering Microsoft, Progress, and Adobe Flash Player vulnerabilities, kept patching teams busy through September 22, 2024.

CISA Publishes FOCAL Plan for Federal Cyber Alignment

CISA published its Federal Civilian Executive Branch (FCEB) Operational Cybersecurity Alignment (FOCAL) Plan on September 16, 2024, aiming to standardize operational cybersecurity practices across more than 100 FCEB agencies. Developed with input from federal agencies, the plan organized guidance into five priority areas: asset management, vulnerability management, defensible architecture, cyber supply chain risk management, and incident detection and response, intended to align collective defense capabilities across the federal enterprise. (CISA)

CISA Adds Microsoft and Progress Flaws to KEV Catalog

CISA added two vulnerabilities to its Known Exploited Vulnerabilities Catalog on September 16, 2024, based on evidence of active exploitation. The additions included CVE-2024-43461, a Microsoft Windows MSHTML Platform spoofing vulnerability, and CVE-2024-6670, a SQL injection vulnerability in Progress WhatsUp Gold. Under Binding Operational Directive 22-01, Federal Civilian Executive Branch agencies were required to remediate the flaws by a specified due date, and CISA urged all organizations to prioritize timely patching of catalog vulnerabilities as part of routine vulnerability management. (CISA)

Legacy Adobe Flash Flaws Added to KEV Catalog

CISA added four vulnerabilities affecting older Adobe Flash Player versions to its Known Exploited Vulnerabilities Catalog on September 17, 2024, citing evidence of active exploitation. The entries covered CVE-2014-0497, CVE-2013-0643, CVE-2013-0648, and CVE-2014-0502, spanning integer underflow, incorrect default permissions, code execution, and double free flaws. CISA noted that such vulnerability types remained frequent attack vectors for malicious cyber actors and posed significant risk to the federal enterprise, and it continued urging organizations to prioritize remediation of catalog entries. (CISA)

Ivanti Patches Exploited Cloud Services Appliance Bypass

Ivanti released a security update on September 19, 2024 for an admin bypass vulnerability, CVE-2024-8963, affecting Cloud Services Appliance version 4.6, which a threat actor could exploit alongside CVE-2024-8190 to take control of an affected system. Ivanti confirmed limited exploitation and urged customers to move to CSA 5.0 since version 4.6 had reached end of life. CISA added CVE-2024-8963 to its Known Exploited Vulnerabilities Catalog the same day, triggering a federal remediation deadline under Binding Operational Directive 22-01. (CISA)

VMware Advisory Covers Cloud Foundation and vCenter Flaws

VMware issued a security advisory on September 19, 2024 covering vulnerabilities in VMware Cloud Foundation and vCenter Server that a threat actor could exploit to take control of an affected system. CISA flagged the advisory, tracked under VCDSA24968, and encouraged users and administrators to apply the vendor's updates. The disclosure added to a run of virtualization-platform patches that security teams running VMware infrastructure needed to track during the week. (CISA)

Versa Director REST API Flaw Disclosed

Versa Networks published an advisory on September 20, 2024 for CVE-2024-45229, a vulnerability in Versa Director that a threat actor could exploit to exercise unauthorized REST APIs. CISA republished the advisory the same day, urging organizations to apply updates, hunt for malicious activity, and report any findings. The alert added another network-management product to the week's list of vendor disclosures requiring prompt attention from infrastructure teams. (CISA)

Penn State and V2X Name New CISOs

Penn State University named Bob Turner as its chief information security officer, effective September 23, after he previously served as CISO at the University of Wisconsin-Madison and as a senior manager of cybersecurity teams at Booz Allen Hamilton. Defense contractor V2X named Christopher Carter as CISO, a role focused on improving threat management and defense mechanisms. The same roundup noted former CISA Executive Director Brandon Wales joined SentinelOne as Vice President of Cybersecurity Strategy, following his departure from the agency in July. (SecurityWeek)