U.S. CISA adds Smartbedded Meteobridge, Samsung, Juniper ScreenOS, Jenkins, and GNU Bash flaws to its Known Exploited Vulnerabilities catalog

U.S. CISA has added five flaws to its Known Exploited Vulnerabilities (KEV) catalog, spanning Smartbedded Meteobridge, Samsung, Juniper ScreenOS, Jenkins, and GNU Bash.

The catalog now includes CVE-2014-6278 (GNU Bash OS Command Injection Vulnerability), CVE-2015-7755 (Juniper ScreenOS Improper Authentication Vulnerability), CVE-2017-1000353 (Jenkins Remote Code Execution Vulnerability), CVE-2025-4008 (Smartbedded Meteobridge Command Injection Vulnerability), and CVE-2025-21043 (Samsung Mobile Devices Out-of-Bounds Write Vulnerability). The article notes that the Bash bug debate from October 2024 and subsequent patching efforts are part of the context for these additions.

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies must address the identified vulnerabilities by the due date to protect networks from exploitation. CISA also urges private organisations to review the KEV Catalog and address the vulnerabilities in their infrastructure, with a due date of October 23, 2025 for federal agencies.