CISA adds four exploited vulnerabilities to the KEV catalog

CISA has added two high and two critical vulnerabilities to its Known Exploited Vulnerabilities catalog. The oldest dates back to 2019, while the newest was published just a week earlier. They are CVE-2019-19006 (CVSS 9.8) in Sangoma FreePBX, allowing an attacker to bypass password authentication and reach the FreePBX admin; CVE-2021-39935 (CVSS 7.5) in GitLab Community and Enterprise Edition, which could let an external attacker perform server-side requests via the CI Lint API; CVE-2025-40551 (CVSS 9.8) in SolarWinds Web Help Desk, which could give an unauthenticated attacker remote code execution on the host; and CVE-2025-64328 (CVSS 8.6) in Sangoma FreePBX, enabling post-authentication command injection and potential access as the asterisk user.

What this means for your organisation

The KEV catalog separates the vulnerabilities actually used in attacks from the much larger set that merely could be. A 2019 flaw surfacing now says something about how long unpatched equipment stays in place, particularly telephony and support systems nobody looks at day to day. That is where a patching process covering systems, not just clients, pays off most.

Berigo recommends

• Check whether you run FreePBX, GitLab or SolarWinds Web Help Desk, including installations set up by suppliers.
• Prioritise the two critical flaws, and verify whether the systems are reachable from the internet.
• Use the KEV catalog as a standing prioritisation input in vulnerability management, not CVSS scores alone.
• Bring telephony and support systems into the regular patching cycle, with a named owner.

Source

• cisa.gov