CISA adds Chrome and Magento zero-days to its urgent patching list

US authorities have added nine more exploited vulnerabilities for federal agencies to patch, including a zero-day bug used to compromise e-commerce websites.

The US Cybersecurity and Infrastructure Security Agency (CISA) updated its Known Exploited Vulnerabilities Catalog yesterday.

The most urgent patches must be applied by 1 March. They concern two zero-day vulnerabilities: an improper input-validation flaw in Adobe Commerce and Magento Open Source, and a use-after-free vulnerability in Google Chrome.

Adobe's bug, CVE-2022-24086, was patched by the company on Sunday and received a CVSS score of 9.8.

This critical vulnerability can be exploited without credentials and may allow a remote attacker to execute arbitrary code on an affected system, potentially enabling digital-skimming attacks on e-commerce websites running the CMS software.

Although Adobe said it had seen only very limited attacks, its unusual decision to issue an out-of-band patch underlines the potential impact of exploitation.

The Chrome vulnerability, CVE-2022-0609, is the browser's first zero-day bug of the year and is rated high severity.

It could let a remote attacker create a specially crafted webpage, trick a user into visiting it through a phishing attack, and then execute arbitrary code on their computer. Google said the fix would be included in version 98.0.4758.102 and rolled out over the following days or weeks.

The catalogue launched in November 2021 as part of Binding Operational Directive (BOD) 22-01, designed to make civilian federal government agencies more cyber-resilient.

However, all organisations are also encouraged to use the list as a best-practice basis for patching priorities, because every bug on it has already been exploited.

The remaining seven vulnerabilities in this latest update must be patched by 15 August 2022, according to CISA. They include another use-after-free flaw in Adobe Flash Player and bugs affecting four Microsoft products: Word, Internet Explorer, Windows and Microsoft Graphics Component.