“The passwords for both accounts had not been updated in over eight years and were not enrolled in the organization’s identity management (IDM).”
CISA’s red team got in through an unpatched Oracle Solaris bug rated 9.8, and the agency took over two weeks to patch it after being told. An unknown third party exploited the same hole. A former employee’s password file sat on an open admin share, and the agency spotted nothing for five months. CISA’s director says compliance with patch deadlines is “very high.”