The advisory is the story

What happened

CISA keeps a Known Exploited Vulnerabilities catalog: flaws it has evidence are being used against real systems, not flaws that are merely theoretical. Binding operational directive 22-01, issued in November 2021 and still the rule federal civilian agencies patch against, tells those agencies to remediate catalog entries on a deadline. The identifier underneath both is a CVE, the numbering program at cve.org. None of that is a single week's breach. It is the public apparatus a reader uses when a headline says something was hacked. This brief files that apparatus. The front of the paper is Futureweb.

Product, versions, reach

An advisory becomes a story on this desk when it names three things. The product, so a reader knows whether the thing is in their stack. The versions, so they know whether the install they have is in the range. The reach, so they know whether an attacker has to already be on the machine, or can send a packet, or can trick a person into opening a file. A vendor post that says "update immediately" and withholds the version range has not finished the advisory. A news headline that names a gang and not the product has not started it. The desk leads with the advisory, then with the outlets that reported around it.

The catalog is not the whole CVE list

Thousands of CVEs are published. The catalog is the short list CISA says are known to be exploited. A high score on a severity scale is not the same fact as "someone is using this." BOD 22-01 is explicit that agencies must treat catalog addition as the trigger for a required fix, on a shorter clock for vulnerabilities added after the directive. A reader outside the federal government can still use the same trigger: if it is on the catalog, the exploitation claim is CISA's, and the deadline in the entry is the urgency they assigned. If it is not on the catalog, the advisory may still matter, and the brief has to say the exploitation status is not established by that list.

Why it matters on this desk

The security desk exists to file advisories, break-ins, and supply-chain failures without turning them into instructions. The useful sentence is who must act, on which versions, by which date. Restating the exploit steps would make this page a copy of the attack, which the paper does not publish. Later advisories stay on Security.

Parsers are a neighbor, not this page

Many catalog entries are memory safety bugs in code that reads untrusted bytes: a file, a packet, a document. That class, and what a release note must say if it claims to close the class, is filed on the software desk as memory safety in the release notes.

Where the writeups disagree

Outlets often disagree on severity, on whether exploitation is widespread or targeted, and on whether a workaround is enough until a patch. The disagreement is the story when it is real. Name the scale each outlet used. A CVSS number, a vendor's own rating, and CISA's catalog decision are three different instruments. Quoting only the largest number is how a brief becomes an advertisement for panic. If the vendor says the bug needs local access and a reporter says it is remote, both claims stay in the piece, with the advisory linked so the reader can see the precondition in the original wording.

What to watch next

Watch the catalog date and the vendor's fixed version, not the nickname of the campaign. A flaw that stays on the catalog after the vendor's note claims a fix is a different story from a flaw that was never catalogued. The next check is mechanical: open the advisory, read the version range, and see whether the software you run is inside it. Repeat that check when the catalog adds an entry, because the list is the repeatable record and the nickname in a headline is not. The desk will keep filing that check again from the primary note. It will not file a reconstructed copy of someone else's article with a new headline on it.

What the reader still cannot see

An advisory does not say whether your particular deploy applied the fix. It does not say whether a hosted service patched the parser behind an account you do not control. Those are questions for the operator of that system. This page can say what the public record says. It cannot audit a network from a headline. When the same flaw is also a question of which data left a machine, that part of the story is the privacy desk, Privacy.

What is still unknown

CISA's evidence standard for the catalog is not a full incident report. Addition means they have credible evidence of exploitation, not a census of every victim. A brief that upgrades "known exploited" into "everyone is breached" is overclaiming the catalog. Until a vendor or an agency publishes victim counts, the unknown stays unknown. The software desk's view of the same class of bug, when the question is the language rather than the advisory, starts at Software.