CISA Adds Three KEV Flaws in Git and Citrix, Sets Sept 15 Remediation

The U.S. Cybersecurity and Infrastructure Security Agency on Friday added three actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog and ordered federal civilian agencies to remediate them by September 15, 2025, the agency said. The additions include two medium severity flaws in Citrix Session Recording and a high severity remote code execution flaw in the Git distributed version control system that researchers say is being used in the wild. Reports differ on the precise date CISA posted the entries, with accounts placing the action in late July or late August 2025, but all agree on the September 15 compliance deadline.

CISA identified the Git flaw as CVE-2025-48384, a high severity vulnerability that arises from how Git handles carriage return characters in configuration files and submodule paths. Security researchers and CISA warned that a malicious repository can cause a victim machine to execute attacker-supplied code when a repository is cloned or submodules are initialized. Datadog researchers published proof of concept exploits shortly after Git released fixes on July 8, 2025, and CISA said it has observed exploitation in the wild. Git...