b2b-daily
Home | IT | Cyber Security

CISA Adds Sophos, Oracle, and Microsoft Flaws to Known Exploited Vulnerabilities Catalog

Avatar photo
by Dwaine Evans
November 21, 2023
Image Credit: Other
CISA Adds Sophos, Oracle, and Microsoft Flaws to Known Exploited Vulnerabilities Catalog
Table of Contents
  1. Exploited Flaw: Sophos CVE-2023-1671
  2. Exploited Flaw: Oracle CVE-2020-2551
  3. Exploited Flaw: Windows CVE-2023-36584
  4. Update from Sophos

In a recent development, the United States Cybersecurity and Infrastructure Security Agency (CISA) has added product flaws from leading cybersecurity firms Sophos, Oracle, and Microsoft to its Known Exploited Vulnerabilities (KEV) catalog. These vulnerabilities have been identified as potential entry points for cybercriminals, highlighting the importance of promptly addressing them to mitigate the risk of exploitation.

Exploited Flaw: Sophos CVE-2023-1671

One of the flaws listed by CISA is the critical Sophos Web Appliance vulnerability, identified as CVE-2023-1671. This vulnerability allows an unauthenticated attacker to execute arbitrary code, posing a significant threat to affected systems. Sophos had issued patches for this flaw in April, raising awareness among customers that the impacted appliance would reach its end of life on July 20, 2023. Disturbingly, some of the cyberattacks linked to CVE-2023-1671 have been attributed to a Chinese APT group, specifically targeting government and other organizations in South Asia. These attacks underscore the urgent need for organizations to address this vulnerability to prevent unauthorized access to their systems.

Exploited Flaw: Oracle CVE-2020-2551

CISA has also identified CVE-2020-2551, an Oracle WebLogic Server vulnerability, as actively exploited by cybercriminals. This flaw enables unauthenticated attackers to gain control over affected servers. The inclusion of this vulnerability in the CVE catalog serves as a wake-up call for Oracle users to apply patches and secure their systems against potential exploitation.

Exploited Flaw: Windows CVE-2023-36584

CISA’s KEV catalog also includes CVE-2023-36584, a flaw that allows attackers to bypass the Mark of the Web (MotW) security feature in Windows. The MotW feature acts as a safeguard against running potentially harmful files from the internet, making the vulnerability particularly concerning. It is worth noting that while Palo Alto Networks disclosed the flaw, it does not explicitly state whether CVE-2023-36584 has been exploited. Additionally, Microsoft’s advisory released on October 10 clarified that no exploitation of this vulnerability had been observed. Nevertheless, it is crucial to remain cautious and address potential security loopholes to maintain robust defenses.

Update from Sophos

In response to the inclusion of CVE-2023-1671 in the CVE catalog, Sophos has released a statement emphasizing their proactive approach. They revealed that over six months ago, on April 4, 2023, they had already issued an automatic patch to all Sophos Web Appliances. This swift action demonstrates the company’s commitment to enhancing their customers’ security posture and minimizing the risk of exploitation stemming from known vulnerabilities.

The addition of these flaws to CISA’s KEV catalog serves as a stark reminder of the ever-present threat cybercriminals pose to organizations. It highlights the importance of promptly addressing and remedying identified vulnerabilities to prevent unauthorized access, data breaches, or other malicious activities. With cyber threats becoming increasingly sophisticated, it is crucial for organizations to adopt a proactive approach by staying abreast of best practices, promptly applying software patches, and maintaining up-to-date security measures. By mitigating the risk of exploited vulnerabilities, organizations can fortify their defenses and safeguard sensitive data and critical systems from cyber threats.

Information SecurityMicrosoft

Explore more

Global RPA Market Set for Rapid Growth Through 2033
March 2, 2026

The modern business environment has reached a definitive turning point where the distinction between human administrative effort and automated digital execution is blurring into a singular, cohesive workflow. As organizations navigate the complexities of a post-pandemic economic landscape in 2026, the reliance on Robotic Process Automation (RPA) has transitioned from a competitive advantage to a fundamental requirement for survival. This

US Labor Market Cools Following January Employment Surge
March 2, 2026

The sheer magnitude of the employment surge witnessed during the first month of the year has left economists questioning whether the American economy is truly overheating or simply experiencing a statistical anomaly. While January provided a blowout performance that defied most conservative forecasts, the subsequent data for February suggests that a significant cooling period is finally taking hold. This shift

Trend Analysis: Entry Level Remote Careers
March 2, 2026

The long-standing belief that securing a high-paying professional career requires a decade of office-bound grinding is being systematically dismantled by a digital-first economy that values specific output over physical attendance. For decades, the entry-level designation often implied a physical presence in a cubicle and years of preparatory internships, yet fresh data suggests that high-paying remote opportunities are now accessible to

How to Bridge Skills Gaps by Developing Internal Talent
March 2, 2026

The modern labor market presents a paradoxical challenge where specialized roles remain vacant for months while thousands of capable employees feel their professional growth has hit an impenetrable ceiling. This misalignment is not merely a recruitment issue but a systemic failure to recognize “adjacent-fit” talent—individuals who already possess the vast majority of required competencies but are overlooked due to rigid

Is Physical Disability a Barrier to Executive Leadership?
March 2, 2026

When a seasoned diplomat with a career spanning the United Nations and high-level corporate strategy enters a boardroom, the initial assessment by peers should theoretically rest upon a decade of proven crisis management and multi-million-dollar partnership successes. However, for many leaders who live with visible physical disabilities, the resume often faces an uphill battle against a deeply ingrained societal bias.