What This Alert Means.
This alert means a software flaw, tracked with a CVE number, has public proof-of-concept exploit code or is being used in real attacks. A CVE is a public identifier for one known flaw. Proof-of-concept code is a working example that shows how to exploit it. The alert covers exploit code found on code-sharing sites, paste sites and exploit databases.
CISA keeps the Known Exploited Vulnerabilities (KEV) catalog, which it calls the authoritative source of vulnerabilities exploited in the wild. It advises organizations to use it as an input to their vulnerability management prioritization. CISA also points out that less than 4% of all CVEs have been publicly exploited, so exploitation is a stronger signal than a severity score alone.
First 24 Hours.
Speed matters, but so does order. Find what you run, reduce exposure, then patch.
- SOC analyst Open the alert from the Brandefense vulnerability intelligence module and save the CVE number, the affected product and versions, and where the exploit code was seenNote whether KEV lists it
- IT admin List every system running the affected product, including test systems and systems run by suppliersUse scanners, asset lists and package inventories
- Security lead Rank systems by exposure, with internet-facing ones firstExposure decides the order
- IT admin Apply the vendor mitigation now if no patch exists, such as disabling the feature or blocking accessFollow the vendor advisory
- SOC analyst Before patching, check logs and systems for signs of compromisePatching does not remove an attacker who is already in
- IT admin Patch internet-facing systems first, then critical internal onesRecord the date and version for each
- Incident lead If you find compromise, start your incident process and keep the system's logs and disk imageRebuild rather than clean
- Legal Ask whether a confirmed compromise triggers notice dutiesCheck with your legal counsel
Investigation Checklist.
You need to know both where the flaw is and whether anyone has used it.
- Does the CVE appear in the KEV catalog, and what is its due date?The catalog lists date added and due date
- Which of your systems run the affected versions?Include appliances and embedded software
- Is the vulnerable service reachable from the internet?This sets priority
- Does the flaw need a login, or can it be used by anyone?Unauthenticated flaws are more urgent
- Did the system show odd outbound traffic, config changes or unusual internal connections?NCSC lists these as signs to look for
- Are web server logs showing requests that match the public exploit?Search for the exploit pattern
- Is the product also run by a supplier on your behalf?Ask the supplier for status
- Do EPSS or CVSS scores add information?Use them with KEV, not instead of it
Containment And Removal.
You cannot send a takedown for a flaw in your own software, so containment is mostly internal. If a system is compromised, the NCSC advises that it should be erased or destroyed and rebuilt as new when compromise cannot be ruled out.
- Vendor advisory and support: follow the vendor's patch or workaround, and ask support for indicators of compromise.
- Network controls: block access to the service at the firewall or reverse proxy until it is patched, or allow only known addresses.
- Account resets: if a system was compromised, reset passwords, keys and tokens stored on or used by it.
- Hosting or cloud provider: if the system is run by a provider, ask it for its patch status and any signs of abuse.
- National CERT: in Turkiye, report an attack to USOM (usom.gov.tr). In the US, report to CISA or file with the FBI IC3 where loss occurred. In the UK, use the NCSC.
Longer-Term Hardening.
The NCSC says every hour without the update increases the chance of compromise, so prepare before the next alert.
- Set a rapid response path. The NCSC advises a pathway or policy for applying urgent updates quickly.
- Use KEV as an input. Add its list to your scanner reports and ticket rules.
- Combine signals. FIRST says to combine EPSS with CVSS and KEV. EPSS is a daily estimate of the chance a CVE will be exploited in the next 30 days.
- Keep an accurate asset list. You cannot patch what you do not know you run.
- Cut exposure. Disable features you do not use and restrict network and identity access, as the NCSC advises.
- Plan for repeat flaws. The NCSC warns that more flaws may be found in the same product once attackers focus on it.
- Record lessons. Write down what slowed you down.
How To Measure That It Worked.
Use figures you collect yourself.
- Affected systems found against affected systems patched or mitigated.
- Time from alert to the first mitigation on internet-facing systems.
- KEV-listed flaws still open past their listed due dates.
- Systems checked for compromise before and after patching.
- Unknown or unmanaged installations found during the search.
Common Mistakes.
These cost teams the most.
- Patching first and checking for compromise never.
- Ranking by severity score alone and ignoring exploitation evidence.
- Forgetting suppliers, test systems and shadow IT.
- Rebooting or wiping a system before saving logs.
- Closing the ticket at patch time without testing from outside.
- Deferring a patch without a named senior owner. The NCSC calls that a senior-level risk decision.
Questions.
-
What is the CISA KEV catalog?
CISA describes it as the authoritative source of vulnerabilities exploited in the wild. Each entry lists the CVE, the affected product, the date added and a due date. CISA advises organizations to use it as an input to how they prioritize vulnerability management.
-
Should I patch or check for compromise first?
Do both, and check logs before patching so you keep the evidence. The NCSC advises forensic analysis before patching, looking for odd outbound traffic, configuration changes and unusual internal connections. A patch closes the door but does not remove someone already inside.
-
Does BOD 22-01 apply to my company?
BOD 22-01 applied to federal agencies and has been revoked. CISA replaced it with BOD 26-04, which applies to Federal Civilian Executive Branch agencies. Other organizations are not bound, but CISA advises using the KEV catalog as an input to their own prioritization.
-
What if there is no patch yet?
Use the vendor workaround and cut exposure, for example by disabling the feature or limiting network access. The NCSC says choosing not to patch is a senior-level risk decision. Watch the vendor advisory and check systems for compromise in the meantime.
-
What is EPSS?
FIRST describes EPSS as a model that estimates the probability that a published CVE will be exploited in the wild in the next 30 days. It gives a score between 0 and 1 each day. FIRST says to combine it with CVSS and KEV.
Sources
This page is general security guidance. It is not legal advice. Notification duties and takedown rights depend on your country, your contracts and the facts of the case, so ask your legal counsel before you act on them.