CISA is known for publishing various reports and remediations for cyberattacks. They release a list of many known exploited vulnerabilities which are exploited by hackers frequently. They have added a list of 15 new exploited vulnerabilities to their list.
The recent list contains almost all of the recent Windows Privilege Escalation vulnerabilities.
| CVE ID | Vulnerability Name | Due Date |
| CVE-2020-5135 | SonicWall SonicOS Buffer Overflow Vulnerability | 4/5/2022 |
| CVE-2019-1405 | Microsoft Windows UPnP Service Privilege Escalation Vulnerability | 4/5/2022 |
| CVE-2019-1322 | Microsoft Windows Privilege Escalation Vulnerability | 4/5/2022 |
| CVE-2019-1315 | Microsoft Windows Error Reporting Manager Privilege Escalation Vulnerability | 4/5/2022 |
| CVE-2019-1253 | Microsoft Windows AppX Deployment Server Privilege Escalation Vulnerability | 4/5/2022 |
| CVE-2019-1129 | Microsoft Windows AppXSVC Privilege Escalation Vulnerability | 4/5/2022 |
| CVE-2019-1069 | Microsoft Task Scheduler Privilege Escalation Vulnerability | 4/5/2022 |
| CVE-2019-1064 | Microsoft Windows AppXSVC Privilege Escalation Vulnerability | 4/5/2022 |
| CVE-2019-0841 | Microsoft Windows AppXSVC Privilege Escalation Vulnerability | 4/5/2022 |
| CVE-2019-0543 | Microsoft Windows Privilege Escalation Vulnerability | 4/5/2022 |
| CVE-2018-8120 | Microsoft Win32k Privilege Escalation Vulnerability | 4/5/2022 |
| CVE-2017-0101 | Microsoft Windows Transaction Manager Privilege Escalation Vulnerability | 4/5/2022 |
| CVE-2016-3309 | Microsoft Windows Kernel Privilege Escalation Vulnerability | 4/5/2022 |
| CVE-2015-2546 | Microsoft Win32k Memory Corruption Vulnerability | 4/5/2022 |
| CVE-2019-1132 | Microsoft Win32k Privilege Escalation Vulnerability | 4/5/2022 |
The list was based on the Binding Operational Directive (BOD) 22-01 which states as “Reducing the Significant Risk of Known Exploited Vulnerabilities“. This directive was established to list the exploited vulnerabilities which has potential risk to Federal agencies and network. The directive importantly denoted that FCEB agencies must mitigate and remediate the list of identified vulnerabilities before the due date given.
Although the directive mentions FCEB agencies specifically, CISA instructs all organizations to use the list of known vulnerabilities and reduce the risk of cyberattacks.
