CISA has added a new vulnerability, CVE-2023-22527, to its Known Exploited Vulnerabilities Catalog, signaling evidence of active exploitation. The vulnerability specifically targets Atlassian Confluence Data Center and Server through Template Injection. Such vulnerabilities serve as common attack vectors for malicious cyber actors, posing significant threats to federal enterprises. The Binding Operational Directive (BOD) 22-01, aimed at reducing the risk of known exploited vulnerabilities, establishes the Known Exploited Vulnerabilities Catalog as a dynamic list of Common Vulnerabilities and Exposures (CVEs) that carry substantial risk for the federal enterprise. BOD 22-01 mandates Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities promptly to safeguard FCEB networks against active threats.
While BOD 22-01 is specific to FCEB agencies, CISA strongly encourages all organizations to prioritize timely remediation of vulnerabilities listed in the Catalog, enhancing their overall cybersecurity posture. CISA will continue to update the catalog with vulnerabilities meeting specified criteria, urging a proactive approach to vulnerability management across diverse organizations.
