CISA Clarifies Criteria for Adding Vulnerabilities to 'Must Patch' List

Some of the vulnerabilities added by CISA to its Must Patch list were discovered more than a decade ago and for some flaws there do not appear to be any public reports describing malicious exploitation.