Cyb3rius
@cyb3rius
· Sep 25
Why Did CISA Add WSO2 and Adobe Commerce Flaws to KEV?CISA added two already-exploited vulnerabilities to its Known Exploited Vulnerabilities catalog on Thursday, giving federal agencies roughly three weeks to patch before criminal and state-linked attackers widen their campaigns against unpatched servers.What happened: On Thursday, CISA added critical flaws in Adobe Commerce and Magento — including CVE-2025-54253, rated CVSS 10.0 — plus a separately exploited WSO2 flaw to the KEV catalog. Both are confirmed exploited in the wild, so the usual patch-when-convenient math no longer applies. Federal civilian agencies must remediate under Binding Operational Directive 22-01.Key numbers: CVE-2025-54253 carries a CVSS score of 10.0Federal agencies get about 3 weeks to remediateKEV now tracks more than 1,400 exploited flawsWhy it matters: A KEV listing is confirmation of real attacks, not a theoretical risk, so every unpatched Commerce or WSO2 deployment is a live target today.Bottom line: A KEV entry is not a warning shot — it is confirmation that attackers are already inside somebody's network.
0