CISA Closes 10 Emergency Directives as Vulnerability Catalog Takes Over

According to CISA, the US cyber security agency, 10 Emergency Directives issued between 2019 and 2024 have been closed as their objectives were achieved or the targeted vulnerabilities have moved into the Known Exploited Vulnerabilities (KEV) catalog.

Three of the directives—ED 19-01: Mitigate DNS Infrastructure Tampering, ED 21-01: Mitigate SolarWinds Orion Code Compromise, and ED 24-02: Mitigating the Significant Risk from Nation-State Compromise of Microsoft Corporate Email System—are deemed obsolete because their objectives have been achieved. The remaining seven directives—ED 20-02, ED 20-03, ED 20-04, ED 21-02, ED 21-03, ED 21-04 and ED 22-03—focused on vulnerabilities in Microsoft, Pulse Connect and VMware products.

The targeted flaws included a Windows bug, a wormable Windows DNS server defect, Zerologon, Exchange zero-days, a Windows Print Spooler issue, and two VMware flaws, with Pulse Connect Secure vulnerabilities CVE-2021-22893 and CVE-2021-22900 cited in one directive. All targeted vulnerabilities are now in KEV, and actions are defined in Binding Operational Directive 22-01 requiring federal agencies to remediate flaws added to KEV within weeks, according to CISA.

Madhu Gottumukkala, CISA Acting Director, said the closure reflects ongoing collaboration and a move towards Secure by Design principles to help organisations defend diverse environments.