Pierluigi Paganini
December 11, 2023
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added two Qlik Sense vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog.
Below is the list of the issues added to the catalog:
Researchers at cybersecurity firm Praetorian discovered the two vulnerabilities in August 2023. The popular researcher Kevin Beaumont pointed out threat actors started exploiting a full exploit chain published by Praetorian.
Researchers from Arctic Wolf also observed threat actors exploiting both flaws in attacks carried out by the Cactus ransomware gang.
According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.
Experts recommend also private organizations review the Catalog and address the vulnerabilities in their infrastructure.
CISA orders federal agencies to fix these vulnerabilities by December 28, 2023.
Last week the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Qualcomm vulnerabilities to its KEV catalog.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, CISA)
