Week of September 1, 2025: CISA Names New Cyber Chief, Expands KEV Catalog

Security leaders tracked CISA's appointment of Nicholas Andersen as Executive Assistant Director for Cybersecurity, the agency's addition of seven actively exploited vulnerabilities to its Known Exploited Vulnerabilities Catalog, and new industrial-control and software bill of materials guidance, all issued between September 1 and September 7, 2025. Industry moves also saw Mimecast and D-Wave Quantum name new chief information security officers during the same week.

CISA Installs Nicholas Andersen as Cybersecurity Chief

CISA announced that Nicholas Andersen started as Executive Assistant Director for Cybersecurity on September 2, 2025, taking over leadership of the agency's cybersecurity mission. Andersen previously served as Chief Information Security Officer at Lumen Technologies Public Sector and held a cybersecurity role at the Department of Energy from 2019 to 2021. Chris Butera, who had been acting in the position, moved into the role of Acting Deputy Executive Assistant Director following the appointment. (CISA)

Mimecast, D-Wave Quantum Name New CISOs

SecurityWeek's industry moves roundup for the week of September 1, 2025, reported that quantum computing company D-Wave Quantum appointed Stan Black as chief information security officer, while cybersecurity firm Mimecast named Leslie Nielsen as its CISO. Nielsen joined Mimecast from Klaviyo, where he had served as SVP and CISO, after earlier CISO roles at Nuance Communications, SAP Concur, and SuccessFactors. The same roundup also noted Nicholas Andersen's appointment at CISA. (SecurityWeek)

CISA Adds WhatsApp Flaw Exploited in Attacks to KEV Catalog

On September 2, 2025, CISA added two vulnerabilities to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation: CVE-2020-24363, affecting the TP-Link TL-WA855RE, and CVE-2025-55177, an incorrect authorization vulnerability in Meta Platforms' WhatsApp. The catalog addition triggers remediation deadlines for federal civilian agencies under Binding Operational Directive 22-01, and CISA urged all organizations to prioritize patching these flaws as part of standard vulnerability management practice. (CISA)

CISA Flags Two More TP-Link Router Vulnerabilities as Actively Exploited

On September 3, 2025, CISA added two further TP-Link vulnerabilities to its Known Exploited Vulnerabilities Catalog, CVE-2023-50224, an authentication bypass affecting the TL-WR841N, and CVE-2025-9377, an OS command injection flaw in the Archer C7(EU) and TL-WR841N/ND(MS) devices. Both were added based on evidence of active exploitation, and Federal Civilian Executive Branch agencies faced required remediation deadlines under Binding Operational Directive 22-01. (CISA)

Linux Kernel, Android, and Sitecore Flaws Join CISA's Exploited Vulnerabilities List

On September 4, 2025, CISA added three vulnerabilities to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation: a Linux Kernel time-of-check time-of-use race condition, an unspecified Android Runtime vulnerability, and a deserialization of untrusted data flaw affecting multiple Sitecore products. CISA said such vulnerability types remain frequent attack vectors and pose significant risks to the federal enterprise, urging all organizations to prioritize remediation. (CISA)

CISA, NSA, and 19 Partners Issue Joint SBOM Guidance

On September 3, 2025, CISA, the NSA, and 19 international partners released joint guidance titled A Shared Vision of Software Bill of Materials for Cybersecurity, aimed at producers, purchasers, and operators of software. The guide encouraged organizations to integrate SBOM generation, analysis, and sharing into security practices to improve visibility into software dependencies and supply chain risk, and called for aligning technical approaches across countries to support scalable, interoperable adoption worldwide. (CISA)

CISA Publishes Five Industrial Control Systems Advisories

On September 4, 2025, CISA released five Industrial Control Systems advisories covering products from Honeywell, Mitsubishi Electric, ICONICS, and Delta Electronics, including updates to the Honeywell OneWireless Wireless Device Manager and Honeywell Experion PKS. The advisories detailed current security issues, vulnerabilities, and exploits affecting ICS environments and were accompanied by CISA's standing recommendation that users and administrators review the technical mitigations for each affected product. (CISA)