CISA’s Latest KEV Update: 6 Vulnerabilities Added Under Active Exploitation
The Cybersecurity and Infrastructure Security Agency (CISA) has expanded its known exploited vulnerabilities (KEV) catalog with six new entries, reinforcing the urgency for organizations to patch actively weaponized security flaws. The February 10, 2025 update, mandated by Binding Operational Directive (BOD) 22-01, requires all Federal Civilian Executive Branch (FCEB) agencies to remediate these vulnerabilities within a three-week deadline, though private sector critical infrastructure entities are strongly encouraged to follow suit immediately. This latest batch includes two long-standing Progress Telerik Report Server bugs, a PHP CGI argument injection flaw, and three other high-impact vulnerabilities spanning software from SolarWinds, Microsoft, and Paessler. Each addition is a direct response to confirmed in-the-wild exploitation, signaling that threat actors are rapidly leveraging these weaknesses to breach networks, deploy ransomware, or exfiltrate sensitive data.
Breakdown of the Six Newly Added Exploited Vulnerabilities
The six vulnerabilities span a range of products and severity levels, but all share the common thread of active exploitation. CISA’s KEV catalog, now numbering over 1,100 entries, prioritizes vulnerabilities that are being actively used in attacks, moving beyond CVSS scores to reflect real-world risk. The newly added CVEs are:
1. CVE-2024-4358 – Progress Telerik Report Server Authentication Bypass (CVSS 9.8) 2. CVE-2024-1800 – Progress Telerik Report Server Deserialization of Untrusted Data (CVSS 8.8) 3. CVE-2024-4577 – PHP CGI Argument Injection (CVSS 9.8) 4. CVE-2024-28987 – SolarWinds Web Help Desk Hardcoded Credential Vulnerability (CVSS 9.1) 5. CVE-2024-38193 – Microsoft Windows Ancillary Function Driver for WinSock Privilege Escalation (CVSS 7.8) 6. CVE-2024-55057 – Paessler PRTG Network Monitor Server-Side Request Forgery (SSRF) (CVSS 9.3)
Each is accompanied by a due date of March 3, 2025 for FCEB agencies to complete remediation, per the directive’s standard 21-day window from catalog inclusion.
Critical Progress Telerik Report Server Flaws Demand Immediate Attention
Two of the six additions target Progress Telerik Report Server, a widely used reporting and business intelligence platform. CVE-2024-4358, an authentication bypass vulnerability with a CVSS score of 9.8, enables unauthenticated attackers to access restricted functionality without credentials. The flaw resides in the report viewing component, allowing remote code execution by chaining with other weaknesses. This vulnerability was patched by Progress Software in May 2024, yet evidence of active exploitation continues to mount, particularly in campaigns linked to ransomware affiliates.
CVE-2024-1800 is a critical deserialization of untrusted data issue (CVSS 8.8) in the same product. An attacker with network access to the Report Server can send a specially crafted request to execute arbitrary code in the context of the service account. The attack complexity is low, and no user interaction is required, making it an attractive chain with CVE-2024-4358. In the wild, threat actors combine these two CVEs to bypass authentication, then drop web shells or deploy Cobalt Strike beacons for persistent access. Organizations using Progress Telerik Report Server versions prior to 2024 Q1 (10.1.24.514) remain vulnerable and should upgrade immediately. Indicators of compromise include unusual process execution from the Report Server service account, unexpected outbound connections, and modifications to configuration files.
PHP CGI Argument Injection (CVE-2024-4577) Exploited Globally
CVE-2024-4577 is a critical argument injection vulnerability affecting PHP installations on Windows systems when configured to run in CGI mode. With a CVSS of 9.8, the flaw allows an unauthenticated attacker to pass arbitrary command-line arguments to the PHP interpreter, leading to remote code execution. The vulnerability arises from improper handling of Unicode characters when PHP processes CGI requests, specifically affecting installations where the system locale is set to certain East Asian languages (e.g., Chinese Traditional, Japanese, Korean). Exploitation is trivial if PHP is exposed to the internet, and multiple proof-of-concept exploits emerged shortly after disclosure in June 2024.
Active exploitation has been linked to nation-state threat actors and cybercrime groups deploying the DarkGate and AsyncRAT malware families. Web servers running vulnerable PHP versions, especially those using XAMPP or WAMP stacks with default configurations, are primary targets. Mitigation requires updating PHP to versions 8.3.8, 8.2.20, or 8.1.29 and above, or applying the Apache HTTP Server rewrite rules provided in the official PHP advisory. For many legacy applications, a full CGI reconfiguration to a more secure handler (such as FastCGI or mod_php) is the recommended long-term solution.
SolarWinds Web Help Desk Hardcoded Credentials (CVE-2024-28987)
CVE-2024-28987 is a high-severity hardcoded credential vulnerability in SolarWinds Web Help Desk (WHD) software, versions 12.8.3 and prior. The flaw, rated CVSS 9.1, stems from static credentials embedded in the product’s code that allow remote, unauthenticated attackers to access internal functionality and manipulate help desk data. SolarWinds disclosed the issue in August 2024 and released a hotfix. However, delayed patching has left many on-premises deployments exposed. Active exploitation involves unauthorized access to ticketing systems, data theft, and lateral movement by piggybacking on ticketed asset information linked to IT management tools. Organizations should immediately update to WHD 12.8.3 Hotfix 1 or later, audit user accounts for anomalies, and monitor for spikes in API calls from unrecognized IPs.
Microsoft WinSock Privilege Escalation (CVE-2024-38193)
CVE-2024-38193 is a privilege escalation vulnerability in the Windows Ancillary Function Driver for WinSock (afd.sys). With a CVSS of 7.8, this local privilege escalation enables attackers with low-level access to gain SYSTEM privileges. The bug was patched in Microsoft’s August 2024 Patch Tuesday, and is known to have been exploited in the wild as a zero-day prior to the patch release. Attackers often leverage this flaw post-compromise to disable security products, extract credentials, or deploy kernel-level malware. The exploitation pattern suggests its use in advanced persistent threat (APT) campaigns as well as by ransomware groups seeking to escalate privileges quickly after initial access via phishing. Patching the August 2024 cumulative update for all supported Windows versions is the only effective mitigation. Security teams should also enforce the principle of least privilege and monitor for unusual afd.sys interactions.
Paessler PRTG Network Monitor SSRF Vulnerability (CVE-2024-55057)
The sixth addition, CVE-2024-55057, is a server-side request forgery vulnerability in Paessler PRTG Network Monitor, a popular infrastructure monitoring solution. CVSS 9.3 severity reflects the potential for remote attackers to bypass authentication and send crafted requests to internal services, leading to sensitive data exposure or further compromise of internal systems. PRTG instances are often deployed with high privilege access across networks, making SSRF exploitation particularly dangerous for lateral movement into otherwise segmented environments. Published in December 2024, the vulnerability has been observed in active reconnaissance and exploitation campaigns targeting unpatched PRTG servers exposed to the internet. Paessler released patched versions to address this issue; administrators must upgrade to the latest PRTG release and restrict external access where possible. Additional hardening measures include disabling unnecessary sensor types and applying network segmentation to monitor-inaccessible zones.
Why CISA’s KEV Additions Signal a Growing Threat Landscape
CISA’s latest KEV expansion underscores a troubling trend: threat actors are increasingly targeting edge services, reporting platforms, and network monitoring tools as initial access vectors. The inclusion of two Telerik Report Server vulnerabilities highlights the persistent risk posed by business intelligence and analytics interfaces, which often fly under the radar of traditional vulnerability management programs. The PHP CGI flaw, while older in disclosure, still permeates countless web applications, demonstrating that even well-publicized vulnerabilities remain rife for exploitation when patch management lags. Hardcoded credentials in SolarWinds WHD and SSRF in PRTG further exemplify the dangers of overlooked IT management and monitoring systems, which can provide attackers with a direct pathway to core infrastructure once breached.
The Binding Operational Directive 22-01 mandates a risk-based prioritization approach. The 21-day remediation window forces agencies to allocate resources toward vulnerabilities that present clear and present danger, rather than merely those with the highest CVSS scores on paper. For non-federal organizations, mirroring this prioritization is a security best practice. Integrating the KEV catalog into vulnerability scanning workflows, using tools such as Tenable, Qualys, or Rapid7 with CISA’s KEV feeds, enables security operations centers to cut through the noise and patch what matters most. Given that exploitation of all six flaws has been confirmed in the wild, any delay invites immediate compromise. Organizations should not only apply the relevant patches but also hunt for indicators of compromise associated with these CVEs, such as suspicious Telerik process creation, anomalous PHP command line arguments, or unexpected outbound connections from PRTG hosts.