CISA tags Windows, Cisco vulnerabilities as actively exploited

**Executive summary:** CISA has added two actively exploited vulnerabilities—CVE-2023-20118 impacting Cisco RV-series VPN routers (which can be chained with CVE-2023-20025 for full takeover) and CVE-2018-8639, a Win32k elevation-of-privilege affecting Windows clients and servers—to its Known Exploited Vulnerabilities catalog and directed federal agencies to patch within a mandated timeframe; the advisory notes active exploitation but does not attribute activity or provide exploit details.