The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning to all U.S. federal agencies, urging them to secure their systems against actively exploited vulnerabilities in Cisco and Windows systems. The first vulnerability, tracked as CVE-2023-20118, affects various Cisco VPN routers and allows attackers to execute arbitrary commands, especially when combined with another flaw (CVE-2023-20025) that bypasses authentication. The second flaw, tracked as CVE-2018-8639, is a Windows elevation of privilege vulnerability that enables local attackers to gain kernel-level access and potentially take over affected systems. Both vulnerabilities have been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog, requiring all Federal Civilian Executive Branch (FCEB) agencies to patch their systems by no later than March 23, 2024. While CISA has not disclosed specific details about the attacks, it emphasized the critical threat these vulnerabilities pose. Microsoft and Cisco have yet to update their advisories following CISA’s announcement. CTIX analysts recommend that any affected entities ensure that their system administrators have applied all patches, workarounds, and mitigations listed in the CISA advisories to prevent exploitation.