U.S. CISA adds SKYSEA Client View, Rapid7 Velociraptor, Microsoft Windows, and IGEL OS flaws to its Known Exploited Vulnerabilities catalog

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added SKYSEA Client View, Rapid7 Velociraptor, Microsoft Windows, and IGEL OS flaws to its Known Exploited Vulnerabilities (KEV) catalog. According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies must address the identified flaws by the due date to protect their networks.

The entry lists CVE-2016-7836 for SKYSEA Client View, CVE-2025-6264 for Velociraptor, CVE-2025-24990 for Microsoft Windows, CVE-2025-47827 for IGEL OS, and CVE-2025-59230 for Microsoft Windows, with descriptions noting remote code execution or privilege escalation risks where applicable.

The article notes that Velociraptor’s flaw could allow arbitrary command execution after artifacts are collected, while the IGEL OS issue involves a Secure Boot bypass disclosed publicly in June 2025 and may require physical access for exploitation. CISA urges private organisations to review the KEV Catalog and address the vulnerabilities, and federal agencies have a fix-by date set for 4 November 2025. Follow securityaffairs for further updates on this evolving KEV list.