Today's threat landscape delivers a sobering double message: attackers are actively exploiting vulnerabilities that organizations have had years — in some cases over a decade — to patch, and many defenders still lack the visibility to know when they have been compromised. Two separate CISA publications released this week reinforce each other in uncomfortable ways, and together they form a clear call to action for SOC teams, IT operations, and security leadership alike.

The CISA red team assessment story is the most instructive. CISA conducted simultaneous adversary simulation exercises against two critical infrastructure organizations using comparable tradecraft and attack techniques. The results were dramatically different: one organization detected and responded to the simulated intrusion, while the other recorded nothing — zero alerts, zero detections, zero awareness that a skilled team had moved through its environment. This is not a theoretical gap. It is a documented, real-world demonstration that two organizations operating in the same sector, facing the same threat model, can have wildly divergent security outcomes based almost entirely on the maturity of their detection and response capabilities. The organization that detected nothing did not necessarily have weaker perimeter controls; it had weaker visibility into what was happening inside its own network.

This finding should prompt every security leader to ask a direct question: if a red team operated in our environment for days or weeks using living-off-the-land techniques, lateral movement, and credential abuse, would we know? The honest answer for many organizations is uncertain at best.

Layered on top of this detection story is CISA's addition of six vulnerabilities to its Known Exploited Vulnerabilities catalog, confirming that threat actors are actively leveraging these flaws in the wild. Four deserve particular attention.

CVE-2021-23758 affects Ajax.NET Professional, a library used to expose server-side .NET methods to client-side JavaScript. The vulnerability involves deserialization of untrusted data, a class of flaw that has repeatedly enabled remote code execution across the industry. If your web applications or internal tools use Ajax.NET Professional and have not been updated or replaced, this is an active exploitation risk, not a theoretical one.

CVE-2015-3246 is a race condition vulnerability in Red Hat Libuser, a library used for managing user and group account information on Linux systems. Despite being over a decade old, its presence in the KEV catalog means attackers are still finding and exploiting unpatched instances. Legacy Linux environments, long-running servers, and systems that have drifted from patch cycles are the likely targets.

CVE-2015-5287 affects the Red Hat Automatic Bug Reporting Tool and allows local privilege escalation. Again, the age of this vulnerability is striking. Its active exploitation suggests attackers are using it as a post-access escalation step — gaining a foothold through another means and then leveraging this flaw to elevate privileges on Red Hat-based systems.

CVE-2022-0995 is an out-of-bounds write vulnerability in the Linux kernel's watch queue subsystem. This is more recent and more broadly applicable across Linux distributions. Out-of-bounds write flaws in the kernel are serious because they can be chained with initial access techniques to achieve full system compromise. Any Linux system running a kernel version prior to the fix for this CVE should be treated as a priority patching target.

Defensive priorities for teams responding to today's briefing:

- Audit your detection coverage immediately. Use the CISA red team findings as a forcing function to evaluate whether your SIEM, EDR, and network monitoring tools would surface credential dumping, lateral movement via legitimate admin tools, and internal reconnaissance. If you cannot answer confidently, schedule a tabletop or purple team exercise.

- Cross-reference your asset inventory against all six KEV additions. Prioritize CVE-2022-0995 for Linux kernel patching across your server fleet, and hunt for any Ajax.NET Professional usage in web-facing or internal applications for CVE-2021-23758.

- For Red Hat environments, verify patch status against CVE-2015-3246 and CVE-2015-5287 on all RHEL-based systems, particularly those that have not been through a recent patch cycle. Legacy servers in OT-adjacent or air-gapped environments are especially at risk of carrying these old vulnerabilities.

- Implement or review alerting for local privilege escalation attempts on Linux hosts. Behavioral detections around unexpected setuid execution, unusual process ancestry, and kernel exploit indicators can surface exploitation attempts for both the Libuser and Linux kernel CVEs.

- Treat deserialization inputs as untrusted by default. For applications using Ajax.NET Professional or similar frameworks, review input validation controls and consider web application firewall rules that flag anomalous serialized data patterns.

- Review your incident response runbooks for critical infrastructure-specific scenarios. The CISA assessment underscores that detection alone is insufficient — the organization that detected the intrusion succeeded because it also had a practiced response process.

The convergence of a documented detection failure in critical infrastructure and six actively exploited vulnerabilities — some embarrassingly old — is a reminder that security debt compounds. Attackers are patient, and they are still finding success with tools and techniques that defenders have had years to address.

This briefing is informational and intended to support defensive awareness; always consult official vendor advisories and the CISA KEV catalog directly for authoritative remediation guidance.