Managing CISA Known Exploited Vulnerabilities with Qualys VMDR | Qualys
Summary: CISA released Binding Operational Directive 22-01 in November 2021, requiring federal agencies to remediate vulnerabilities in its Known Exploited Vulnerabilities catalog on set timelines, and CISA has released 654 CVEs in total, with its most recent update on April 25, 2022. Qualys says its VMDR product tags these CVEs with a "CISA Exploited" RTI field and a CISA Known Exploited Vulnerabilities RTI category, and that its patch content covers many Microsoft, Linux and third-party applications while unsupported CVEs require custom patches.
What you should know: The directive binds federal agencies to CISA's remediation timelines, and CISA recommends that private businesses and state, local, tribal and territorial governments prioritize the same catalog - so the 654 listed CVEs set an external clock that any organization's patching process can be measured against.
Read the original at Qualys Blog ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026