{ "metadata": { "generated_at": "2026-06-04T09:50:37.826209+00:00", "site_url": "https://patchnow.workshop1.net", "site_name": "PatchNow", "total_analyses": 373, "displayed_on_website": 9, "filtering_stats": { "total": 373, "skipped_old_cve": 8, "expired_kev": 348, "new_kev": 2, "active_kev": 14, "non_kev": 1 }, "thresholds": { "kev_skip_threshold": 60, "kev_expire_threshold": 30, "kev_new_threshold": 3 } }, "vulnerabilities": [ { "cve_id": "CVE-2026-9082", "cvss_score": "9.1", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2026-05-20T18:20:52.863Z", "cve_published_date_formatted": "2026-05-20", "kev_date_added": "2026-05-22", "kev_date_added_formatted": "2026-05-22", "kev_due_date": "2026-05-27", "days_to_kev": 2, "days_since_kev": 13, "is_new_kev": false, "summary": "Critical unauthenticated SQL injection vulnerability in Drupal core affecting installations using PostgreSQL databases. Allows direct remote exploitation of internet-facing Drupal websites for full database access and potential remote code execution.", "detailed_analysis": { "vulnerability_type": "SQL Injection (CWE-89) in Drupal core Database Abstraction API", "affected_products": [ "Drupal 8.9.0 through 10.4.9", "Drupal 10.5.0 through 10.5.9", "Drupal 10.6.0 through 10.6.8", "Drupal 11.0.0 through 11.1.9", "Drupal 11.2.0 through 11.2.11", "Drupal 11.3.0 through 11.3.9" ], "exploitation_requirements": [ "Network access to vulnerable Drupal website", "PostgreSQL database backend (MySQL/MariaDB/SQLite not affected)", "No authentication required", "No user interaction required" ], "internet_facing_likelihood": "Drupal is a web content management system designed specifically to run as internet-facing web applications. Nearly 100% of Drupal deployments are internet-accessible as public websites, making this vulnerability extremely dangerous for direct internet exploitation.", "typical_deployment": "Drupal is server software that runs as web applications on web servers, specifically designed to serve public-facing websites and web applications over HTTP/HTTPS", "deployment_statistics": "Approximately 95-99% of Drupal installations are internet-facing as it's primarily used for public websites, blogs, e-commerce sites, and web applications that require internet accessibility", "active_exploitation": "No current evidence of active exploitation in the wild as of May 2026, and not listed in CISA KEV catalog", "severity_factors": [ "Unauthenticated remote exploitation possible", "CVSS 9.1 Critical severity", "Affects core Drupal functionality", "Can lead to full database compromise", "Potential for remote code execution", "Widely deployed internet-facing software", "Affects multiple major Drupal versions" ] }, "recommendations": [ "URGENT: Immediately update all Drupal installations to patched versions (10.4.10+, 10.5.10+, 10.6.9+, 11.1.10+, 11.2.12+, 11.3.10+)", "Prioritize Drupal sites using PostgreSQL databases as they are specifically vulnerable", "Review web server logs for suspicious SQL injection attempts or unusual database queries", "Consider temporarily taking sites offline if immediate patching is not possible", "Implement web application firewall (WAF) rules to block SQL injection attempts as temporary mitigation", "Audit database contents for unauthorized modifications or data exfiltration", "This is a CRITICAL priority patch due to unauthenticated remote exploitation potential" ], "risk_assessment": { "exploit_likelihood": "Very High - Unauthenticated remote SQL injection in widely deployed internet-facing web application platform with clear attack vectors", "impact_assessment": "Critical - Full database compromise, potential remote code execution, complete website takeover, and sensitive data exposure", "exposure_scope": "Extensive - Millions of Drupal websites globally are potentially vulnerable, with the vast majority being internet-accessible" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "CVE-2026-9082 is a highly critical SQL injection (SQLi) vulnerability affecting the Drupal core, specifically within its Database Abstraction API 【2】 【6】.\n\nBelow is the current understanding of the vulnerability based on available information as of May 22, 2026:\n\n### Vulnerability Overview\n* **Nature of Flaw:** The vulnerability is an improper neutralization of special elements used in an SQL command (CWE-89), caused by a failure to properly sanitize external input before it reaches the database abstraction layer 【1】 【4】.\n* **Affected Systems:** It specifically impacts Drupal installations that utilize a **PostgreSQL** database backend 【3】. Deployments using MySQL, MariaDB, or SQLite are not affected by this specific vector 【3】.\n* **Internet-Facing Impact:** Because it resides in the Drupal core and can be triggered via web requests, it directly affects internet-facing applications and services running vulnerable versions of Drupal on PostgreSQL 【2】.\n\n### Exploitation Details\n* **Attack Vector:** The vulnerability allows for **unauthenticated** exploitation 【2】 【3】. Attackers can execute arbitrary SQL commands by sending specially crafted requests, specifically utilizing crafted array keys in filter parameters 【3】 【6】.\n* **Potential Impact:** Successful exploitation can lead to full data disclosure, data modification, denial of service, privilege escalation, and potentially remote code execution 【4】 【7】.\n* **Active Exploitation & Targeted Attacks:** As of May 22, 2026, there is no widely reported evidence of active exploitation in the wild or specific attribution to targeted campaigns in the provided search results.\n* **CISA KEV Status:** CVE-2026-9082 is **not** currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog 【5】.\n\n### Mitigation\nSite administrators are advised to cross-reference their deployments with the official Drupal security advisory (**SA-CORE-2026-004**) and update their core installations to the designated patch releases for all supported branches (Drupal 10 and 11) immediately 【1】.\n\nSources:\n- CVE-2026-9082: Mitigating a Critical SQL Injection Vulnerability in...: https://www.akamai.com/blog/security-research/cve-2026-9082-mitigating-critical-sql-injection-drupal\n- CVE-2026-9082 | Tenable®: https://www.tenable.com/cve/CVE-2026-9082\n- CVE-2026-9082: CVE-2026-9082: Unauthenticated SQL Injection in Drupal ...: https://cvereports.com/reports/CVE-2026-9082\n- CVE-2026-9082 - Vulnerability Details - OpenCVE: https://app.opencve.io/cve/CVE-2026-9082\n- Known Exploited Vulnerabilities Catalog | CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "references": [ { "title": "CVE-2026-9082: Mitigating a Critical SQL Injection Vulnerability in...", "url": "https://www.akamai.com/blog/security-research/cve-2026-9082-mitigating-critical-sql-injection-drupal", "citation_contribution": 492, "snippet": "Vulnerability details. At the core of CVE-2026-9082 is a breakdown in how external input is sanitized before reaching the database abstraction layer.Site administrators should immediately cross-reference their current deployments with the official Drupal security advisory (SA-CORE-2026-004) and update their core installations to the designated patch releases across all supported branches (Drupal 10 and 11). The vulnerable versions include ... Learn how the complex Drupal SQLi vulnerability (CVE-2026-9082) exploits PostgreSQL environments and its data theft risks — and how to ... ... Details have emerged regarding a highly complex SQL injection (SQLi) vulnerability that is impacting Drupal core. It is officially tracked as CVE-2026-9082 and detailed in the vendor advisory SA-CORE-2026-004.", "is_search_result": true }, { "title": "CVE-2026-9082 | Tenable®", "url": "https://www.tenable.com/cve/CVE-2026-9082", "citation_contribution": 454, "snippet": "CVE-2026-9082 is a highly critical SQL injection in Drupal core affecting PostgreSQL sites. Patches available. Unauthenticated exploitation ... ... CVE-2026-9082: Critical Drupal Core SQL Injection Vulnerability | Tenable® Published: 2026-05-21 CVE-2026-9082 is a highly critical SQL injection in Drupal core affecting PostgreSQL sites. Patches available. Unauthenticated exploitation possible.", "is_search_result": true }, { "title": "CVE-2026-9082: CVE-2026-9082: Unauthenticated SQL Injection in Drupal ...", "url": "https://cvereports.com/reports/CVE-2026-9082", "citation_contribution": 350, "snippet": "Drupal Core contains a highly critical SQL injection vulnerability (CVE-2026-9082) within its Database Abstraction API. The flaw specifically affects installations using the PostgreSQL database backend, allowing unauthenticated attackers to execute arbitrary SQL commands via crafted array keys in filter parameters. ... CVE-2026-9082 is an unauthenticated SQL Injection (CWE-89) vulnerability residing within the core architecture of Drupal. It specifically affects installations utilizing the PostgreSQL database backend. Deployments running MySQL, MariaDB, and SQLite remain unaffected by this specific attack vector due to differences in database driver implementation and syntax handling.", "is_search_result": true }, { "title": "CVE-2026-9082 - Vulnerability Details - OpenCVE", "url": "https://app.opencve.io/cve/CVE-2026-9082", "citation_contribution": 182, "snippet": "The vulnerability is an improper neutralization of special elements used in an SQL command, commonly known as SQL injection, in Drupal core. The flaw allows an attacker to inject arbitrary SQL statements into database queries, potentially leading to full data disclosure, data modification, or denial of service. It is identified as CWE‑89, reflecting a failure to properly validate or encode ...", "is_search_result": true }, { "title": "Known Exploited Vulnerabilities Catalog | CISA", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "citation_contribution": 125, "snippet": "Microsoft Windows Buffer Overflow Vulnerability: Microsoft Windows contains a buffer overflow vulnerability in the Windows Server Service that allows remote ...", "is_search_result": true } ], "timestamp": "2026-05-22T18:25:16.488223" }, "cache_timestamp": "2026-05-22T18:25:36.872138", "displayed_on_website": true }, { "cve_id": "CVE-2026-8398", "cvss_score": "9.8", "attack_vector": "LOCAL", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1195", "deployment_likelihood": "VERY_LOW", "cve_published_date": "2026-05-15T07:30:29.287Z", "cve_published_date_formatted": "2026-05-15", "kev_date_added": "2026-05-27", "kev_date_added_formatted": "2026-05-27", "kev_due_date": "2026-05-30", "days_to_kev": 12, "days_since_kev": 8, "is_new_kev": false, "summary": "CVE-2026-8398 is a supply chain attack that compromised DAEMON Tools Lite installation packages with embedded malicious code. This is not a traditional network vulnerability but rather a software integrity issue requiring user download and installation of trojanized software.", "detailed_analysis": { "vulnerability_type": "Supply chain attack - embedded malicious code in legitimate software distribution", "affected_products": [ "DAEMON Tools Lite" ], "exploitation_requirements": [ "User must download compromised installer", "User must execute the installation", "No network services exposed" ], "internet_facing_likelihood": "DAEMON Tools Lite is desktop client software for mounting disc images. It does not operate as a server application and has no listening network services. 0% of deployments are internet-facing as this is purely client-side software.", "typical_deployment": "Desktop client application installed on end-user workstations for mounting virtual disc images (ISO, VHD, etc.). No server components or network services.", "deployment_statistics": "0% internet-facing - This is client software that runs locally on user desktops/laptops with no network listening services or server functionality", "active_exploitation": "Supply chain compromise occurred between April 8-May 5, 2026, with trojanized installers distributed from the legitimate website", "severity_factors": [ "High impact due to code signing bypass", "Wide distribution through legitimate channels", "No network attack vector", "Requires user installation", "Client-side only impact" ] }, "recommendations": [ "Immediately uninstall affected DAEMON Tools Lite versions (12.5.0.2421 through 12.5.0.2434)", "Run full system antivirus scan with updated definitions to detect and remove malicious components", "Install clean version 12.6 or newer from official website daemon-tools.cc", "Monitor systems that had compromised versions installed for signs of persistent threats or lateral movement", "Review network logs for any suspicious outbound connections from affected systems" ], "risk_assessment": { "exploit_likelihood": "Not applicable for direct network exploitation - this requires social engineering to trick users into downloading/installing compromised software", "impact_assessment": "High impact on individual systems that installed the compromised software, with potential for data theft and system compromise", "exposure_scope": "No internet-facing systems affected - impact limited to desktop clients that downloaded and installed the trojanized software" }, "exploitation_method": "USER_INTERACTION", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "CVE-2026-8398 refers to a **supply chain attack** rather than a traditional software vulnerability exploitable via remote network vectors 【2】 【1】.\n\nThe following details summarize the nature of this incident:\n\n* **Nature of the Incident:** The vulnerability involved the compromise of official installation packages for **DAEMON Tools Lite** (Windows versions 12.5.0.2421 through 12.5.0.2434) 【2】 【1】.\n* **Attack Vectors and Methods:** Attackers gained unauthorized access to the vendor's (AVB Disc Soft) build or distribution infrastructure, allowing them to inject malicious code into three binaries distributed through the legitimate website `daemon-tools.cc` 【1】.\n* **Internet-Facing Applications/Services:** This is not a vulnerability in an internet-facing service that can be exploited remotely by an attacker. Instead, it was a supply chain compromise where users were infected by downloading and installing trojanized software from the vendor's official distribution channel 【1】.\n* **Active Exploitation:** The malicious packages were distributed between approximately April 8, 2026, and May 5, 2026 【1】.\n* **Targeted Attacks:** The incident is categorized as a supply chain attack, which typically aims to compromise a broad user base by poisoning legitimate software updates or installers.\n* **CISA Known Exploited Vulnerabilities (KEV) Status:** As of May 27, 2026, there is no indication that this specific supply chain incident is listed in the CISA Known Exploited Vulnerabilities Catalog, which generally tracks vulnerabilities actively exploited in the wild against specific software or hardware products.\n\nSources:\n- CVE-2026-8398 - Vulnerability Details - OpenCVE: https://app.opencve.io/cve/CVE-2026-8398\n- CVE-2026-8398 Detail - NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-8398", "references": [ { "title": "CVE-2026-8398 - Vulnerability Details - OpenCVE", "url": "https://app.opencve.io/cve/CVE-2026-8398", "citation_contribution": 704, "snippet": "A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.2421 through 12.5.0.2434), distributed from the legitimate website daemon-tools.cc between approximately April 8, 2026, and May 5, 2026. Attackers gained unauthorized access to the vendor's (AVB Disc Soft) build or distribution infrastructure and trojanized three binaries ...", "is_search_result": true }, { "title": "CVE-2026-8398 Detail - NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8398", "citation_contribution": 323, "snippet": "A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.2421 through 12.5.0.2434), ... ... A vulnerability has been identified, and possibly a CVE has been assigned, why is it not in your database? Although a CVE ID may have been assigned by either CVE or a CNA, it will not be available in the NVD if it has a status of RESERVED by CVE.", "is_search_result": true } ], "timestamp": "2026-05-27T17:15:46.813067" }, "cache_timestamp": "2026-05-27T17:16:03.101631", "displayed_on_website": false }, { "cve_id": "CVE-2026-6973", "cvss_score": "7.2", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2026-05-07T15:21:24.849Z", "cve_published_date_formatted": "2026-05-07", "kev_date_added": "2026-05-07", "kev_date_added_formatted": "2026-05-07", "kev_due_date": "2026-05-10", "days_to_kev": 0, "days_since_kev": 28, "is_new_kev": false, "summary": "CVE-2026-6973 is an OS command injection vulnerability in Ivanti Endpoint Manager Mobile (EPMM) that allows authenticated administrators to achieve remote code execution. EPMM is typically deployed as an internet-facing mobile device management server, making this a direct network exploitation risk.", "detailed_analysis": { "vulnerability_type": "OS Command Injection via Improper Input Validation (CWE-20, CAPEC-88)", "affected_products": [ "Ivanti Endpoint Manager Mobile (EPMM)" ], "exploitation_requirements": [ "Network access to EPMM server", "Administrative authentication", "No user interaction required" ], "internet_facing_likelihood": "Ivanti EPMM is a Mobile Device Management (MDM) server solution that is commonly deployed as internet-facing infrastructure. MDM servers must be accessible from the internet to manage mobile devices across various networks including cellular, WiFi, and remote locations. Estimated 70-80% of EPMM deployments are internet-accessible to fulfill their core function of managing mobile devices regardless of location.", "typical_deployment": "EPMM is server software that functions as a centralized mobile device management platform, typically deployed in enterprise data centers or cloud environments with internet connectivity", "deployment_statistics": "Approximately 70-80% of EPMM deployments are internet-facing, as the primary purpose of MDM solutions is to manage mobile devices that connect from various external networks including cellular and public WiFi", "active_exploitation": "No evidence found in CISA KEV catalog or current threat intelligence, but this is a recent CVE (May 2026) and may not yet have widespread exploitation data", "severity_factors": [ "Network attack vector enables internet exploitation", "OS command injection allows full system compromise", "Affects critical enterprise mobile management infrastructure", "Authenticated exploitation reduces attack complexity", "High privileges required limits attack surface" ] }, "recommendations": [ "IMMEDIATE: Update to patched versions 12.6.1.1, 12.7.0.1, or 12.8.0.1 depending on your current branch", "Audit administrative accounts with access to EPMM console for unauthorized access or suspicious activity", "Review EPMM server logs for evidence of command injection attempts or unusual administrative activity", "Consider implementing additional network segmentation or WAF protection for EPMM servers", "HIGH PRIORITY patching due to internet-facing deployment pattern and RCE impact" ], "risk_assessment": { "exploit_likelihood": "High - Network attack vector combined with common internet-facing deployment of MDM infrastructure creates significant exposure. Authentication requirement provides some protection but administrative accounts are high-value targets.", "impact_assessment": "High - OS command injection leads to complete system compromise, potentially affecting mobile device management for entire organizations and exposing managed device data.", "exposure_scope": "Significant - Enterprise MDM solutions like EPMM are widely deployed across organizations and typically require internet accessibility, creating substantial attack surface." }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "There is no information available regarding CVE-2026-6973. The provided search results do not contain any details about this specific CVE, its exploitation, or its presence in the CISA Known Exploited Vulnerabilities (KEV) catalog.\n\nCISA maintains the Known Exploited Vulnerabilities (KEV) Catalog as an authoritative source of vulnerabilities that have been exploited in the wild 【1】【4】. Organizations are advised to use this catalog to prioritize their vulnerability management efforts 【1】【6】. CISA adds vulnerabilities to the KEV catalog based on evidence of active exploitation 【5】【7】. The catalog is updated within 24 hours of known exploitation evidence 【2】. Information on the KEV catalog is available in CSV and JSON formats 【3】.\n\nSources:\n- Known Exploited Vulnerabilities Catalog - CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog\n- BOD 22-01: Reducing the Significant Risk of Known Exploited... | CISA: https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities\n- The Kev Catalog: https://www.cisa.gov/resources-tools/resources/kev-catalog\n- Reducing the Significant Risk of Known Exploited Vulnerabilities - CISA: https://www.cisa.gov/known-exploited-vulnerabilities\n- CISA Adds Six Known Exploited Vulnerabilities to Catalog: https://www.cisa.gov/news-events/alerts/2026/02/10/cisa-adds-six-known-exploited-vulnerabilities-catalog", "references": [ { "title": "Known Exploited Vulnerabilities Catalog - CISA", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "citation_contribution": 158, "snippet": "For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild. Organizations should use the KEV catalog as an input to their vulnerability management prioritization framework.How to use the KEV ... ... CISA’s catalogue of known exploited vulnerabilities (KEV). ... Android Kernel contains a use-after-free vulnerability in binder.c that allows for privilege escalation from an application to the Linux Kernel. This vulnerability was observed chained with CVE-2020-0041 and CVE-2020-0069 under exploit chain \"AbstractEmu.\" Apply updates per vendor instructions. ... EXTERNAL Known Exploited Vulnerabilities Catalog KEV Catalog Return to top Topics Spotlight Resources & Tools News & Events Careers About Cybersecurity & Infrastructure Security Agency", "is_search_result": true }, { "title": "BOD 22-01: Reducing the Significant Risk of Known Exploited... | CISA", "url": "https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities", "citation_contribution": 70, "snippet": "CISA adds the reported actively exploited vulnerabilities to the KEV catalog, provided they meet BOD 22-01 requirements. Exploited vulnerabilities CISA uncovers through incident response efforts are also added to the KEV catalog. CISA analysts perform daily open-source searches for vulnerabilities.How quickly does CISA update the KEV catalog after a new in-scope vulnerability is identified? CISA updates the KEV catalog within 24 hours of known exploitation evidence. There is an older CVE being added to the KEV catalog. Is CISA seeing an active exploitation for it?", "is_search_result": true }, { "title": "The Kev Catalog", "url": "https://www.cisa.gov/resources-tools/resources/kev-catalog", "citation_contribution": 68, "snippet": "A detailed list of Known Exploited Vulnerabilities. Available as CSV and JSON files.", "is_search_result": true }, { "title": "Reducing the Significant Risk of Known Exploited Vulnerabilities - CISA", "url": "https://www.cisa.gov/known-exploited-vulnerabilities", "citation_contribution": 47, "snippet": "Learn about the importance of CISA's Known Exploited Vulnerability (KEV) catalog and how to use it to help build a collective resilience across the cybersecurity community.", "is_search_result": true }, { "title": "CISA Adds Six Known Exploited Vulnerabilities to Catalog", "url": "https://www.cisa.gov/news-events/alerts/2026/02/10/cisa-adds-six-known-exploited-vulnerabilities-catalog", "citation_contribution": 42, "snippet": "CISA has added six new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.", "is_search_result": true } ], "timestamp": "2026-05-07T16:25:18.229845" }, "cache_timestamp": "2026-05-07T16:25:37.417049", "displayed_on_website": true }, { "cve_id": "CVE-2026-5281", "cvss_score": "8.8", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1189", "deployment_likelihood": "VERY_LOW", "cve_published_date": "2026-04-01T04:41:32.723Z", "cve_published_date_formatted": "2026-04-01", "kev_date_added": "2026-04-01", "kev_date_added_formatted": "2026-04-01", "kev_due_date": "2026-04-15", "days_to_kev": 0, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2026-5281 is a use-after-free vulnerability in Google Chrome's Dawn component that allows arbitrary code execution via crafted HTML pages. While actively exploited in the wild, this affects client-side browser software, not internet-facing servers, making it a phishing/social engineering attack vector rather than direct internet exploitation.", "detailed_analysis": { "vulnerability_type": "Use-after-free (CWE-416) in Dawn WebGPU implementation allowing arbitrary code execution", "affected_products": [ "Chrome" ], "exploitation_requirements": [ "User must visit malicious website", "Attacker must first compromise renderer process", "Specially crafted HTML page required", "User interaction required (UI:R in CVSS)" ], "internet_facing_likelihood": "Google Chrome is client-side browser software, not server software. While Chrome connects to the internet, it is not deployed as an internet-facing service that accepts incoming connections. Chrome runs on end-user devices and initiates outbound connections to web servers. Approximately 0% of Chrome deployments function as internet-facing servers since this is fundamentally client software.", "typical_deployment": "Chrome is client-side application software installed on end-user workstations, laptops, and mobile devices. It functions as a web browser that makes outbound HTTP/HTTPS requests to web servers but does not listen for or accept incoming network connections.", "deployment_statistics": "0% of Chrome deployments are internet-facing servers. Chrome is exclusively client software that runs on user devices behind firewalls and NAT, not exposed to incoming internet traffic.", "active_exploitation": "Confirmed active exploitation in the wild according to Google. This is the fourth Chrome zero-day in 2026. Threat actors are leveraging it in targeted attack campaigns.", "severity_factors": [ "High CVSS score of 8.8", "Active exploitation confirmed", "Arbitrary code execution possible", "Requires user interaction", "Client-side vulnerability only", "Not directly internet-exploitable" ] }, "recommendations": [ "CRITICAL: Update Google Chrome immediately to version 146.0.7680.178 or later", "Deploy Chrome updates via enterprise management tools if available", "Educate users about avoiding suspicious websites and links", "Monitor for indicators of compromise on endpoints", "Consider implementing web filtering to block known malicious domains", "HIGH patch priority due to active exploitation, but this is not a T1190 vulnerability" ], "risk_assessment": { "exploit_likelihood": "Low for direct internet exploitation since Chrome is client software. High likelihood of exploitation through phishing/malicious websites targeting end users.", "impact_assessment": "High impact on individual endpoints if successfully exploited - arbitrary code execution possible. However, requires social engineering to deliver malicious content to users.", "exposure_scope": "No internet-facing Chrome servers to exploit directly. Risk is to end-user devices through malicious websites, not direct network exploitation of services." }, "exploitation_method": "USER_INTERACTION", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "**CVE-2026-5281** is a **use-after-free vulnerability** in **Dawn**, an open-source implementation of the **WebGPU standard** used in **Google Chrome** 【3】 【5】 【11】 【4】. This vulnerability affects Chrome versions prior to 146.0.7680.177/178 for Windows/Mac and prior to 146.0.7680.177 for Linux 【5】.\n\nRegarding its exploitation:\n\n- **Internet-facing applications or services:** The vulnerability is within Google Chrome, a web browser, which is inherently used to access internet-facing services. The exploit allows a remote attacker who has compromised the renderer process to execute arbitrary code via a crafted HTML page 【1】 【1】 【10】.\n\n- **Evidence of active exploitation in the wild:** **Yes, there is evidence of active exploitation** 【2】 【10】 【9】 【11】 【12】 【7】 【13】 【4】. Google has confirmed that an exploit for this vulnerability exists in the wild 【2】 【10】 【7】. This marks it as the fourth zero-day vulnerability addressed by Google in Chrome in 2026 【2】 【9】 【13】.\n\n- **Attack vectors and exploitation methods:** The vulnerability is a **use-after-free (UAF)** bug 【3】 【5】 【11】 【12】 【7】 【4】. A remote attacker, after compromising the renderer process, can execute arbitrary code by presenting a specially crafted HTML page 【1】 【1】 【10】. Specific details about the exploit and how it is being used by attackers are limited 【5】 【11】.\n\n- **Use in targeted attacks:** While Google has confirmed active exploitation, they have not shared details about the specific incidents or who might be behind the attacks 【2】 【3】. However, one source indicates that threat actors are actively leveraging it in **targeted attack campaigns** 【7】.\n\n- **CISA Known Exploited Vulnerabilities status:** As of the provided information, **CVE-2026-5281 is not listed on the CISA Known Exploited Vulnerabilities (KEV) Catalog** 【6】 【14】 【15】. However, CISA has added other vulnerabilities to the KEV catalog that have been actively exploited 【8】 【16】 【17】 【18】 【19】 【20】 【21】 【22】.\n\n- **Technical details about internet exploitability:** The vulnerability allows for **arbitrary code execution** 【1】 【1】 【10】. This is achieved through a use-after-free flaw in the Dawn component, which is part of the WebGPU standard implementation in Chrome. This type of memory corruption occurs when an application attempts to use memory after it has been deallocated 【4】. The exploit requires the attacker to have already compromised the renderer process, and the attack is delivered via a crafted HTML page 【1】 【1】.\n\nSources:\n- NVD - CVE-2026-5281: https://nvd.nist.gov/vuln/detail/CVE-2026-5281\n- Google fixes fourth Chrome zero-day exploited in attacks in 2026: https://www.bleepingcomputer.com/news/security/google-fixes-fourth-chrome-zero-day-exploited-in-attacks-in-2026/\n- New Chrome Zero-Day CVE-2026-5281 Under Active Exploitation — Patch ...: https://thehackernews.com/2026/04/new-chrome-zero-day-cve-2026-5281-under.html\n- Google Addresses Zero-day Vulnerability Exploited in the Wild (CVE-2026 ...: https://threatprotect.qualys.com/2026/04/01/google-addresses-zero-day-vulnerability-exploited-in-the-wild-cve-2026-5281/\n- Google fixes Chrome zero-day with in-the-wild exploit (CVE-2026-5281): https://www.helpnetsecurity.com/2026/04/01/google-chrome-zero-day-cve-2026-5281/", "references": [ { "title": "NVD - CVE-2026-5281", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5281", "citation_contribution": 679, "snippet": "CVE-2026-5281 Detail. Description. Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page.Quick Info. CVE Dictionary Entry: CVE-2026-5281 NVD Published Date: 04/01/2026 NVD Last Modified: 04/01/2026 Source: Chrome.", "is_search_result": true }, { "title": "Google fixes fourth Chrome zero-day exploited in attacks in 2026", "url": "https://www.bleepingcomputer.com/news/security/google-fixes-fourth-chrome-zero-day-exploited-in-attacks-in-2026/", "citation_contribution": 445, "snippet": "Google is aware that an exploit for CVE-2026-5281 exists in the wild,\" Google said in a security advisory issued on Tuesday. ... exploiting this zero-day flaw in the wild, it did not share ... Google patched two other Chrome zero-day bugs exploited in attacks earlier this month: the first is an out-of-bounds write weakness in the Skia 2D graphics library (CVE-2026-3909), and the second is an inappropriate implementation vulnerability in the V8 JavaScript and WebAssembly engine (CVE-2026-3910).", "is_search_result": true }, { "title": "New Chrome Zero-Day CVE-2026-5281 Under Active Exploitation — Patch ...", "url": "https://thehackernews.com/2026/04/new-chrome-zero-day-cve-2026-5281-under.html", "citation_contribution": 253, "snippet": "The high-severity vulnerability, CVE-2026-5281 (CVSS score: N/A), concerns a use-after-free bug in Dawn, an open-source and cross-platform implementation of the WebGPU standard.As is customary for these alerts, Google did not provide any further details on how the shortcoming is being exploited and who may be behind the effort. This is typically done so as to ensure that a majority of users are updated with a fix and prevent other actors from joining the exploitation bandwagon.", "is_search_result": true }, { "title": "Google Addresses Zero-day Vulnerability Exploited in the Wild (CVE-2026 ...", "url": "https://threatprotect.qualys.com/2026/04/01/google-addresses-zero-day-vulnerability-exploited-in-the-wild-cve-2026-5281/", "citation_contribution": 244, "snippet": "CVE-2026-5281 is a use-after-free vulnerability in Dawn, the open-source implementation of the WebGPU standard. This type of memory corruption flaw occurs when an application continues to use a pointer after the memory it points to has been cleared.", "is_search_result": true }, { "title": "Google fixes Chrome zero-day with in-the-wild exploit (CVE-2026-5281)", "url": "https://www.helpnetsecurity.com/2026/04/01/google-chrome-zero-day-cve-2026-5281/", "citation_contribution": 210, "snippet": "About CVE-2026-5281. As per usual, information about the fixed zero-day is limited, and there’s no details about the exploit (or how/if it’s being used by attackers). CVE-2026-5281’s official description says it’s a use-after-free (UAF) vulnerability in Dawn, an open-source and cross-platform implementation of the WebGPU standard that’s used in Chromium and Chromium-based browsers. The vulnerability affects Chrome versions before v146.0.7680.177/178 for Windows/Mac, and before v146.0.7680.177 for Linux.", "is_search_result": true } ], "timestamp": "2026-04-01T19:50:22.609137" }, "cache_timestamp": "2026-04-01T19:50:41.313465", "displayed_on_website": false }, { "cve_id": "CVE-2026-48172", "cvss_score": "10.0", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2026-05-21T00:38:04.489Z", "cve_published_date_formatted": "2026-05-21", "kev_date_added": "2026-05-26", "kev_date_added_formatted": "2026-05-26", "kev_due_date": "2026-05-29", "days_to_kev": 5, "days_since_kev": 9, "is_new_kev": false, "summary": "Critical privilege escalation vulnerability in LiteSpeed cPanel/WHM plugins allowing attackers to potentially gain root access via network exploitation. This vulnerability is actively exploited in the wild and affects widely deployed web hosting control panel systems.", "detailed_analysis": { "vulnerability_type": "Privilege escalation through incorrect privilege assignment (CWE-266) in Redis enable/disable functionality", "affected_products": [ "LiteSpeed cPanel Plugin (versions 2.3 to < 2.4.7)", "LiteSpeed WHM Plugin (versions < 5.3.1.0)" ], "exploitation_requirements": [ "Network access to cPanel/WHM interface", "No authentication required (CVSS PR:N)", "No user interaction required", "Low attack complexity" ], "internet_facing_likelihood": "cPanel and WHM are web hosting control panel systems that are typically deployed on internet-facing web servers. These plugins integrate with LiteSpeed web server technology and are commonly accessible via web interfaces on hosting providers and dedicated servers.", "typical_deployment": "Server-side plugins for web hosting control panels that manage LiteSpeed web server configurations. cPanel/WHM systems are predominantly deployed as internet-accessible management interfaces for web hosting services.", "deployment_statistics": "Estimated 85-95% of cPanel/WHM deployments are internet-facing, as these are primarily used by hosting providers and website administrators who require remote access to server management functions. The web-based nature of these control panels necessitates network accessibility.", "active_exploitation": "Confirmed active exploitation in the wild as of May 2026. CISA has added this to the Known Exploited Vulnerabilities catalog. Detection command provided in CVE description indicates real-world exploitation attempts.", "severity_factors": [ "CVSS 10.0 - Maximum severity score", "Network attack vector with no authentication required", "Potential privilege escalation to root", "Active exploitation in the wild", "Affects widely deployed hosting infrastructure", "High impact on confidentiality, integrity, and availability" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Run detection command: grep -rE \"cpanel_jsonapi_func=redisAble\" /var/cpanel/logs /usr/local/cpanel/logs/ 2>/dev/null", "IMMEDIATE: Update LiteSpeed WHM Plugin to version 5.3.1.0 and cPanel Plugin to version 2.4.7", "URGENT: Examine system logs for suspicious IP addresses and block any unauthorized access attempts", "HIGH PRIORITY: Verify system integrity and check for signs of unauthorized privilege escalation", "Monitor Redis enable/disable function usage and review access logs for anomalous activity" ], "risk_assessment": { "exploit_likelihood": "VERY HIGH - Active exploitation confirmed with CVSS 10.0, network vector, no authentication required, and low complexity", "impact_assessment": "CRITICAL - Privilege escalation to root level access allows complete system compromise, data theft, service disruption, and lateral movement", "exposure_scope": "HIGH - Affects internet-facing web hosting infrastructure with LiteSpeed cPanel/WHM plugins, potentially impacting thousands of hosting providers and their customers" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "CVE-2026-48172 is a critical security vulnerability affecting the **LiteSpeed User-End cPanel Plugin** (versions prior to 2.4.5) 【2】 【1】.\n\nBelow is the current understanding of the vulnerability based on available reports:\n\n### Vulnerability Overview\n* **Nature of Flaw:** The vulnerability is an instance of incorrect privilege assignment that allows for privilege escalation, potentially granting an attacker root-level access 【1】.\n* **CVSS Score:** 10.0 (Maximum Severity) 【1】.\n\n### Exploitation Details\n* **Active Exploitation:** The vulnerability is confirmed to be under **active exploitation in the wild** as of May 2026 【2】 【1】.\n* **Attack Vector:** Any cPanel user—including an attacker who has already compromised a standard user account—can exploit the `lsws.redisAble` function to execute arbitrary scripts with root privileges 【1】.\n* **Internet-Facing Applications:** Because the vulnerability resides in a cPanel plugin, it directly affects internet-facing web hosting servers that utilize this specific plugin configuration.\n* **Targeted Attacks:** While LiteSpeed has confirmed active exploitation, specific details regarding whether this is being used in highly targeted campaigns versus opportunistic mass exploitation have not been publicly detailed by the vendor 【1】.\n\n### CISA Known Exploited Vulnerabilities (KEV) Status\nAs of May 27, 2026, there is no explicit mention in the provided search results confirming its addition to the CISA Known Exploited Vulnerabilities (KEV) catalog. However, given its active exploitation status and high severity, users should monitor official CISA channels for updates.\n\n### Mitigation and Detection\n* **Patching:** Users are urged to update the LiteSpeed User-End cPanel Plugin to version **2.4.5 or later** 【2】.\n* **Detection:** Administrators can examine system logs for suspicious activity associated with the `lsws.redisAble` function. If logs indicate unauthorized use or unexpected output, it is recommended to identify the source IP addresses and block them accordingly 【2】 【3】.\n\nSources:\n- LiteSpeed cPanel Plugin CVE-2026-48172 Exploited to Run Scripts ...: https://thehackernews.com/2026/05/litespeed-cpanel-plugin-cve-2026-48172.html\n- CVE-2026-48172 | Tenable®: https://www.tenable.com/cve/CVE-2026-48172\n- NVD - CVE-2026-48172: https://nvd.nist.gov/vuln/detail/CVE-2026-48172", "references": [ { "title": "LiteSpeed cPanel Plugin CVE-2026-48172 Exploited to Run Scripts ...", "url": "https://thehackernews.com/2026/05/litespeed-cpanel-plugin-cve-2026-48172.html", "citation_contribution": 674, "snippet": "CVE-2026-48172 lets cPanel users run scripts as root, affecting LiteSpeed plugin 2.3–2.4.4 and exposing servers. ... A maximum-severity security vulnerability impacting LiteSpeed User-End cPanel Plugin has come under active exploitation in the wild. The flaw, tracked as CVE-2026-48172 (CVSS score: 10.0), relates to an instance of incorrect privilege assignment that an attacker could abuse to run arbitrary scripts with elevated permissions. ... The flaw, tracked as CVE-2026-48172 (CVSS score: 10.0), relates to an instance of incorrect privilege assignment that an attacker could abuse ... LiteSpeed noted that the \"vulnerability is being actively exploited,\" but refrained from sharing additional details. ... The development comes weeks after a critical cPanel vulnerability ( CVE-2026-41940 , CVSS score: 9.8) was identified as actively exploited by unknown threat actors to deploy Mirai botnet variants and a ransomware strain called Sorry. ... The flaw, tracked as CVE-2026-48172 (CVSS score: 10.0), relates to an instance of incorrect privilege assignment that an attacker could abuse to run arbitrary scripts with elevated permissions. \"Any cPanel user (including an attacker or a compromised account) may exploit the lsws.redisAble function to execute arbitrary scripts as root,\" LiteSpeed said.", "is_search_result": true }, { "title": "CVE-2026-48172 | Tenable®", "url": "https://www.tenable.com/cve/CVE-2026-48172", "citation_contribution": 629, "snippet": "LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in the wild in May 2026. ... If you get no output, you have not been hit with exploitation of the vulnerability. If there is output, we recommend you examine the IP addresses in the list, determine if they are valid IP addresses, and if not, block them. To determine damage done, examine the system logs for use by the detected IP addresses.", "is_search_result": true }, { "title": "NVD - CVE-2026-48172", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48172", "citation_contribution": 0, "snippet": "CVE-2026-48172 Detail. Description. LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in the wild in May 2026.If you get no output, you have not been hit with exploitation of the vulnerability. If there is output, we recommend you examine the IP addresses in the list, determine if they are valid IP addresses, and if not, block them.", "is_search_result": true } ], "timestamp": "2026-05-27T18:00:15.757716" }, "cache_timestamp": "2026-05-27T18:00:41.259204", "displayed_on_website": true }, { "cve_id": "CVE-2026-48027", "cvss_score": "9.3", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1176", "deployment_likelihood": "VERY_LOW", "cve_published_date": "2026-05-27T15:50:01.143Z", "cve_published_date_formatted": "2026-05-27", "kev_date_added": "2026-05-27", "kev_date_added_formatted": "2026-05-27", "kev_due_date": "2026-06-10", "days_to_kev": 0, "days_since_kev": 8, "is_new_kev": false, "summary": "A compromised version of the Nx Console VS Code extension contained embedded malicious code. This is a supply chain attack targeting developer workstations, not internet-facing servers.", "detailed_analysis": { "vulnerability_type": "Supply chain compromise with embedded malicious code (CWE-506) in a VS Code extension", "affected_products": [ "Nx Console VS Code Extension" ], "exploitation_requirements": [ "User must install or update to compromised version 18.95.0", "Requires VS Code environment", "Developer workstation with extension marketplace access" ], "internet_facing_likelihood": "Nx Console is a VS Code extension that runs on developer workstations as a client-side application. It is NOT server software and is never deployed as an internet-facing service. This is 100% a client-side developer tool that assists with managing Nx and Lerna projects within the VS Code IDE environment.", "typical_deployment": "Client-side developer tool - VS Code extension installed on individual developer machines for project management and development workflows", "deployment_statistics": "0% of deployments are internet-facing. This is exclusively a client-side development tool that runs locally on developer workstations within VS Code", "active_exploitation": "Confirmed active exploitation in the wild, added to CISA KEV catalog. However, exploitation targets developer workstations, not internet-facing infrastructure", "severity_factors": [ "Supply chain attack vector", "Targets development environments", "Brief exposure window (18-36 minutes)", "High CVSS score due to complete compromise of affected systems", "Client-side execution with developer privileges" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity on developer workstations", "Immediately audit all developer machines for Nx Console version 18.95.0 and upgrade to version 18.100.0 or later", "Review developer workstation logs for suspicious activity during the compromise window (May 19, 2026 12:30-13:09 UTC)", "Implement extension vetting processes and consider enterprise extension management policies", "Monitor for data exfiltration from compromised developer environments", "HIGH priority for developer environment security, but not infrastructure patching priority" ], "risk_assessment": { "exploit_likelihood": "Not applicable for direct internet exploitation - this is a client-side supply chain compromise requiring user installation of malicious extension", "impact_assessment": "High impact on affected developer workstations including potential access to source code, credentials, and development secrets, but does not directly compromise internet-facing infrastructure", "exposure_scope": "Zero internet-facing systems affected - this vulnerability only impacts developer workstations running the compromised VS Code extension" }, "exploitation_method": "USER_INTERACTION", "data_source": "CIRCL", "known_ransomware_use": "Known", "ransomware_first_seen_date": "2026-05-28", "ransomware_days_after_kev": 1, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "CVE-2026-48027 is a critical vulnerability involving embedded malicious code within the Nx Console extension for Visual Studio Code 【1】. It was officially added to the CISA Known Exploited Vulnerabilities (KEV) Catalog on May 27, 2026, due to evidence of active exploitation in the wild 【2】 【4】.\n\n### Key Details\n\n| Feature | Status/Description |\n| :--- | :--- |\n| **CISA KEV Status** | Included (Added May 27, 2026) 【2】 |\n| **Active Exploitation** | Yes, confirmed in the wild 【2】 |\n| **Affected Software** | Nx Console extension for Visual Studio Code (specifically version 18.95.0) 【1】 |\n| **Internet-Facing** | No (Client-side/Developer environment) 【1】 |\n\n### Exploitation and Technical Details\n* **Attack Vector:** The vulnerability is not an internet-facing service exploit in the traditional sense. Instead, it relies on developers installing or updating to the compromised version (18.95.0) of the Nx Console extension 【1】.\n* **Exploitation Method:** Once installed, the malicious extension executes arbitrary code with the same permissions as the Visual Studio Code process 【1】. This allows attackers to potentially access sensitive information on the developer's machine, including source code, credentials, and environment variables 【1】.\n* **Targeted Attacks:** While the vulnerability is confirmed to be exploited in the wild, it is primarily categorized as a supply chain-style compromise affecting developer environments rather than a direct attack on internet-facing infrastructure 【1】. Proof-of-concept material has been identified in security research contexts 【1】.\n\nOrganizations and individual developers are advised to review the official security advisory from the Nx Console project for remediation steps and to ensure they are not running the compromised version 【3】.\n\nSources:\n- CVE-2026-48027 - Exploits & Severity - Feedly: https://feedly.com/cve/CVE-2026-48027\n- CISA Adds Three Known Exploited Vulnerabilities to Catalog: https://www.cisa.gov/news-events/alerts/2026/05/27/cisa-adds-three-known-exploited-vulnerabilities-catalog\n- Known Exploited Vulnerabilities Catalog | CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog\n- CVE-2026-48027 Detail - NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-48027", "references": [ { "title": "CVE-2026-48027 - Exploits & Severity - Feedly", "url": "https://feedly.com/cve/CVE-2026-48027", "citation_contribution": 1161, "snippet": "Any developer who installed or updated to Nx Console version 18.95.0 during the compromised window can have their system compromised; the malicious extension executes arbitrary code with the permissions of the Visual Studio Code process, potentially allowing access to source code, credentials, and environment variables on the developer's machine. Exploitation. One proof-of-concept exploit is available on stepsecurity.io.CVE-2026-48027: Compromised Nx Console version 18.95.0 [CRITICAL]. Exploit Intelligence — Recent CVEs / 6h.", "is_search_result": true }, { "title": "CISA Adds Three Known Exploited Vulnerabilities to Catalog", "url": "https://www.cisa.gov/news-events/alerts/2026/05/27/cisa-adds-three-known-exploited-vulnerabilities-catalog", "citation_contribution": 259, "snippet": "CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.", "is_search_result": true }, { "title": "Known Exploited Vulnerabilities Catalog | CISA", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "citation_contribution": 202, "snippet": "CVE-2026-48027. Nx Console Embedded Malicious Code Vulnerability: Nx Console contains an embedded malicious code vulnerability that allowed a malicious version ... ... For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild. ... Are you aware of an actively exploited vulnerability not included ... For more information, please see: https://github.com/nrwl/nx-console/security/advisories/GHSA-c9j4-9m59-847w ; https://nvd.nist.gov/vuln/detail/CVE-2026-48027", "is_search_result": true }, { "title": "CVE-2026-48027 Detail - NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48027", "citation_contribution": 1, "snippet": "This CVE is in CISA's Known Exploited Vulnerabilities Catalog ; Nx Console Embedded Malicious Code Vulnerability, 05/27/2026, 06/10/2026 ... ... NVD MENU Information Technology Laboratory National Vulnerability Database Vulnerabilities", "is_search_result": true } ], "timestamp": "2026-05-28T17:25:13.303488" }, "cache_timestamp": "2026-05-28T17:25:37.277981", "displayed_on_website": false }, { "cve_id": "CVE-2026-45498", "cvss_score": "4.0", "attack_vector": "LOCAL", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1687", "deployment_likelihood": "VERY_LOW", "cve_published_date": "2026-05-20T13:09:12.903Z", "cve_published_date_formatted": "2026-05-20", "kev_date_added": "2026-05-20", "kev_date_added_formatted": "2026-05-20", "kev_due_date": "2026-06-03", "days_to_kev": 0, "days_since_kev": 15, "is_new_kev": false, "summary": "CVE-2026-45498 is a denial of service vulnerability in Microsoft Defender Antimalware Platform with local attack vector (CVSS AV:L). Despite being on CISA KEV, this is likely being exploited as part of ransomware attacks to disable endpoint protection rather than for initial access.", "detailed_analysis": { "vulnerability_type": "Denial of Service vulnerability (CWE-400: Uncontrolled Resource Consumption)", "affected_products": [ "Microsoft Defender Antimalware Platform" ], "exploitation_requirements": [ "Local system access", "No authentication required", "No user interaction required" ], "internet_facing_likelihood": "Microsoft Defender Antimalware Platform is endpoint security software that runs on client workstations and servers as a local service. It is not designed to be internet-facing and does not typically expose network services to the internet. Estimated 0-1% of deployments would be directly accessible from the internet.", "typical_deployment": "Client-side endpoint protection software that runs as a local service on Windows workstations and servers", "deployment_statistics": "Less than 1% of deployments are internet-facing. This is endpoint security software designed to run locally on protected systems, not as an internet-facing service", "active_exploitation": "Listed in CISA KEV indicating active exploitation in the wild, likely by ransomware groups to disable endpoint protection", "severity_factors": [ "Local attack vector limits initial exploitation", "No authentication required once local access gained", "DoS against security software enables further attacks", "Active exploitation confirmed by CISA KEV listing" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Update Microsoft Defender Antimalware Platform to version 4.18.26040.7 or later immediately", "Monitor for unusual Microsoft Defender service crashes or performance issues", "Implement backup endpoint protection solutions as redundancy", "Review system logs for evidence of DoS attacks against antimalware services", "Patch priority: HIGH due to CISA KEV listing and potential use in ransomware attacks" ], "risk_assessment": { "exploit_likelihood": "High likelihood of exploitation by attackers who have already gained local system access, particularly ransomware operators", "impact_assessment": "Denial of service against endpoint protection, potentially disabling security defenses and enabling further malicious activity", "exposure_scope": "Limited direct internet exposure, but high impact on organizations where attackers have gained initial access through other means" }, "exploitation_method": "OTHER", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:47:29.109597", "displayed_on_website": false }, { "cve_id": "CVE-2026-45321", "cvss_score": "9.6", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1195", "deployment_likelihood": "LOW", "cve_published_date": "2026-05-12T00:12:35.452Z", "cve_published_date_formatted": "2026-05-12", "kev_date_added": "2026-05-27", "kev_date_added_formatted": "2026-05-27", "kev_due_date": "2026-06-10", "days_to_kev": 15, "days_since_kev": 8, "is_new_kev": false, "summary": "This is a supply chain compromise where malicious versions of npm packages were published, not a vulnerability in internet-facing applications. The threat is to development environments and CI/CD pipelines that download these packages, not to production servers.", "detailed_analysis": { "vulnerability_type": "Supply chain compromise - malicious code embedded in npm packages (CWE-506: Embedded Malicious Code)", "affected_products": [ "TanStack Router Development Tools", "TanStack React Router", "TanStack Vue Router", "TanStack Solid Router", "TanStack Start Framework", "TanStack Vite Plugins", "TanStack ESLint Plugins", "Various TanStack Development Utilities" ], "exploitation_requirements": [ "Developer or CI/CD system must download and install affected package versions", "Package installation triggers malicious code execution", "No authentication bypass - this is embedded malware" ], "internet_facing_likelihood": "These are primarily development-time dependencies, build tools, and client-side frameworks. While some server-side rendering components exist, they are not typically exposed as internet-facing services themselves. The malware targets development environments to steal credentials, not production servers.", "typical_deployment": "Development dependencies installed via npm during build processes, client-side framework components, and development tooling. Not internet-facing server applications.", "deployment_statistics": "Less than 5% of installations would result in internet-facing services. These are primarily build-time dependencies and client-side libraries used in development environments.", "active_exploitation": "Confirmed active exploitation - malicious packages were published between May 11-12, 2026, containing credential-stealing malware", "severity_factors": [ "HIGH: Embedded malware exfiltrates cloud credentials, GitHub tokens, SSH keys", "HIGH: Supply chain attack affects legitimate package ecosystem", "MEDIUM: Requires package installation to trigger", "LOW: Does not directly compromise internet-facing servers" ] }, "recommendations": [ "IMMEDIATE: Audit all npm package installations from May 11-12, 2026 for affected @tanstack packages", "Rotate all cloud credentials, GitHub tokens, and SSH keys on systems that may have installed these packages", "Review build logs and CI/CD systems for evidence of malicious package downloads", "Implement package integrity verification and supply chain security controls", "Monitor for unauthorized access using potentially compromised credentials" ], "risk_assessment": { "exploit_likelihood": "This is not a traditional exploitation scenario - it's a supply chain compromise that affects development environments rather than internet-facing applications", "impact_assessment": "Critical impact to development security and credential theft, but does not directly compromise production internet-facing services", "exposure_scope": "Primarily affects development environments, CI/CD pipelines, and build systems rather than internet-facing production servers" }, "exploitation_method": "OTHER", "data_source": "CIRCL", "known_ransomware_use": "Known", "ransomware_first_seen_date": "2026-05-28", "ransomware_days_after_kev": 1, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "CVE-2026-45321 is a critical supply chain vulnerability (CVSS 9.6) associated with a campaign identified as \"Mini Shai-Hulud,\" which involved the unauthorized publication of malicious packages to the npm and PyPI registries in May 2026 【1】.\n\nHere is the breakdown of the requested information:\n\n### **Nature of the Vulnerability and Exploitation**\n* **Attack Vectors and Methods:** The vulnerability stems from a supply chain compromise rather than a traditional software flaw in an internet-facing application. Attackers exploited a `pull_request_target` misconfiguration within GitHub Actions to poison build caches and extract OIDC (OpenID Connect) tokens from memory 【2】. These stolen tokens were then used to authenticate as legitimate maintainers, allowing the attackers to publish malicious versions of packages to public registries 【3】.\n* **Active Exploitation:** Yes, there is clear evidence of active exploitation in the wild. Between May 11 and May 12, 2026, threat actors published over 400 malicious versions of 170 different packages across npm and PyPI, including the `mistralai` package (v2.4.6) 【1】.\n* **Targeted Attacks:** The campaign appears to be a broad, automated supply chain attack targeting the software ecosystem (specifically the `@tanstack` and `mistralai` ecosystems) rather than a single targeted organization 【1】 【2】. The malicious packages contained credential-stealing malware intended to compromise the systems of developers or CI/CD pipelines that downloaded them 【2】.\n\n### **Internet-Facing Applications and Technical Details**\n* **Internet-Facing Applications:** This vulnerability does not refer to a flaw in a specific internet-facing application that can be exploited by remote users via HTTP requests. Instead, it is an **infrastructure-level supply chain vulnerability**. It affects the security of the software development lifecycle (SDLC) and the integrity of packages hosted on public registries.\n* **Technical Internet Exploitability:** Because this is a supply chain attack, it is not \"exploitable\" in the sense of sending a crafted packet to a server to gain control. The \"exploit\" occurred at the CI/CD level (GitHub Actions), which then resulted in the distribution of malicious code to anyone who installed the compromised packages.\n\n### **CISA Known Exploited Vulnerabilities (KEV) Status**\nAs of May 27, 2026, there is no information indicating that CVE-2026-45321 has been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. The KEV catalog typically focuses on vulnerabilities that are being actively exploited in the wild against enterprise software and hardware, whereas this CVE represents a compromise of the software supply chain itself.\n\nSources:\n- Mistral AI PyPI Compromised: Supply Chain Attack |: https://raven.io/blog/the-mistral-compromise\n- CVE-2026-45321: CVE-2026-45321: Critical Supply Chain Compromise in ...: https://cvereports.com/reports/CVE-2026-45321\n- CVE-2026-45321 Details - NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-45321", "references": [ { "title": "Mistral AI PyPI Compromised: Supply Chain Attack |", "url": "https://raven.io/blog/the-mistral-compromise", "citation_contribution": 731, "snippet": "Microsoft Threat Intelligence confirmed on May 12, 2026 that mistralai PyPI package v2.4.6 had been compromised as part of the Mini Shai-Hulud supply chain campaign. The campaign entry point has been assigned CVE-2026-45321 (CVSS 9.6). ... Between May 11 and 12, 2026, threat actors published over 400 malicious versions of 170 packages across npm and PyPI.", "is_search_result": true }, { "title": "CVE-2026-45321: CVE-2026-45321: Critical Supply Chain Compromise in ...", "url": "https://cvereports.com/reports/CVE-2026-45321", "citation_contribution": 476, "snippet": "On May 11, 2026, threat actors executed a multi-stage supply chain attack against the @tanstack ecosystem. By exploiting a pull_request_target misconfiguration in GitHub Actions, attackers poisoned build caches and extracted OIDC tokens from memory. This allowed the unauthorized publication of 84 malicious package versions containing credential-stealing malware.", "is_search_result": true }, { "title": "CVE-2026-45321 Details - NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45321", "citation_contribution": 164, "snippet": "The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/router, but the publish workflow ... ... Information Technology Laboratory National Vulnerability Database Vulnerabilities ... National Vulnerability Database. Vulnerabilities. CVE-2026-45321 Detail. Description. On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/router, but the publish workflow itself was not modified.", "is_search_result": true } ], "timestamp": "2026-05-27T17:15:21.290593" }, "cache_timestamp": "2026-05-27T17:15:40.802836", "displayed_on_website": false }, { "cve_id": "CVE-2026-45247", "cvss_score": "9.8", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2026-05-26T14:15:33.596Z", "cve_published_date_formatted": "2026-05-26", "kev_date_added": "2026-06-03", "kev_date_added_formatted": "2026-06-03", "kev_due_date": "2026-06-06", "days_to_kev": 8, "days_since_kev": 1, "is_new_kev": true, "summary": "Critical PHP object injection vulnerability in Mirasvit Cache Warmer for Magento 2 allows unauthenticated remote code execution via crafted cookie data. Affects e-commerce platforms that are inherently internet-facing by design. CISA KEV listing confirms active exploitation.", "detailed_analysis": { "vulnerability_type": "PHP Object Injection leading to Remote Code Execution (CWE-502)", "affected_products": [ "Magento 2 with Mirasvit Cache Warmer" ], "exploitation_requirements": [ "Network access to Magento storefront", "No authentication required", "Ability to send HTTP requests with crafted cookies" ], "internet_facing_likelihood": "Magento 2 is an e-commerce platform designed specifically for online stores, making internet exposure mandatory for business operations. Virtually 100% of Magento deployments are internet-facing as they serve customer-facing web storefronts.", "typical_deployment": "Magento 2 is deployed as a web application server hosting e-commerce websites that must be accessible to customers over the internet", "deployment_statistics": "Estimated 95-100% of Magento deployments are internet-facing, as the primary purpose is to serve online retail customers. Internal-only Magento instances would be extremely rare and defeat the platform's commercial purpose.", "active_exploitation": "Listed in CISA KEV catalog as of 2026-06-03, indicating confirmed active exploitation in the wild", "severity_factors": [ "Unauthenticated exploitation", "Remote code execution capability", "Critical CVSS score of 9.8", "Affects widely-deployed e-commerce platform", "Active exploitation confirmed by CISA KEV listing", "Simple exploitation via HTTP cookies" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately update Mirasvit Full Page Cache Warmer to version 1.11.12 or later", "Review web server access logs for suspicious cookie values or serialized PHP objects in CacheWarmer cookies", "Implement Web Application Firewall rules to detect and block malicious serialized objects in cookies", "Monitor for unexpected PHP processes or file modifications on Magento servers", "Verify no unauthorized admin accounts or backdoors have been created", "PATCH PRIORITY: CRITICAL - Immediate patching required due to RCE and active exploitation" ], "risk_assessment": { "exploit_likelihood": "Very High - Simple unauthenticated exploitation via HTTP cookies with confirmed active attacks", "impact_assessment": "Critical - Full server compromise enabling data theft, site defacement, payment card data access, and potential pivot to internal networks", "exposure_scope": "All internet-facing Magento 2 installations using vulnerable Mirasvit Cache Warmer versions - potentially thousands of e-commerce sites globally" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-04T06:53:20.330815", "displayed_on_website": true }, { "cve_id": "CVE-2026-42897", "cvss_score": "8.1", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2026-05-14T17:00:36.515Z", "cve_published_date_formatted": "2026-05-14", "kev_date_added": "2026-05-15", "kev_date_added_formatted": "2026-05-15", "kev_due_date": "2026-05-29", "days_to_kev": 1, "days_since_kev": 20, "is_new_kev": false, "summary": "CVE-2026-42897 is a cross-site scripting vulnerability in Microsoft Exchange Server that enables spoofing attacks. This vulnerability is actively exploited in the wild and affects widely deployed internet-facing email servers through crafted network requests.", "detailed_analysis": { "vulnerability_type": "Cross-Site Scripting (XSS) leading to spoofing - improper neutralization of input during web page generation (CWE-79)", "affected_products": [ "Exchange Server 2019", "Exchange Server 2016", "Exchange Server Subscription Edition" ], "exploitation_requirements": [ "Network access to Exchange server", "Ability to send crafted requests to Exchange web interface", "User interaction required (UI:R in CVSS)" ], "internet_facing_likelihood": "Exchange servers are predominantly internet-facing by design and business necessity. Approximately 85-95% of Exchange deployments require internet accessibility to provide email services, webmail access (OWA), and mobile device connectivity (ActiveSync/EAS). Even organizations following security best practices typically expose Exchange servers to the internet through reverse proxies or direct exposure.", "typical_deployment": "Microsoft Exchange Server is enterprise server software specifically designed to provide email services, requiring internet connectivity for core functionality including SMTP mail relay, webmail access, and mobile device synchronization.", "deployment_statistics": "An estimated 85-95% of Exchange Server deployments are internet-accessible, as email services fundamentally require internet connectivity. Organizations deploy Exchange with internet-facing components for: external email delivery/receipt, Outlook Web Access (OWA), mobile device connectivity, and federated services.", "active_exploitation": "Confirmed active exploitation in the wild with CISA KEV listing on May 7, 2026. Attackers are using crafted requests to exploit the XSS vulnerability for spoofing attacks.", "severity_factors": [ "Active exploitation confirmed (CISA KEV listed)", "High CVSS score of 8.1", "Network attack vector with low complexity", "No authentication required (PR:N)", "Affects widely deployed internet-facing email infrastructure", "High confidentiality and integrity impact", "User interaction required limits automated exploitation" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review Exchange server logs, check for unauthorized access, verify system integrity, and examine web access logs for suspicious crafted requests", "Apply Microsoft security updates immediately for all affected Exchange Server versions (2016 CU23, 2019 CU14/CU15, Subscription Edition RTM)", "Monitor Exchange server web traffic for malicious requests and implement web application firewall rules to detect XSS attempts", "EMERGENCY patch priority - apply updates within 72 hours due to active exploitation" ], "risk_assessment": { "exploit_likelihood": "Very High - Active exploitation confirmed with CISA KEV listing, affecting widely deployed internet-facing email servers accessible via network requests", "impact_assessment": "High impact with spoofing capabilities enabling credential theft, session hijacking, and email system compromise affecting organizational communications", "exposure_scope": "Extensive - affects thousands of internet-facing Exchange servers globally, with most enterprise email infrastructures potentially vulnerable" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "**CVE-2026-42897** is a critical security vulnerability affecting on-premise versions of **Microsoft Exchange Server** 【3】 【1】.\n\nThe following details summarize the current understanding of this vulnerability:\n\n- **Internet-Facing Status**: As this vulnerability affects **Microsoft Exchange Server**, it is highly relevant to internet-facing applications. Exchange servers are frequently exposed to the internet to facilitate email services, making them primary targets for remote exploitation 【1】.\n- **Active Exploitation**: There is confirmed evidence of **active exploitation in the wild** 【1】. Due to this activity, the **Cybersecurity and Infrastructure Security Agency (CISA)** officially added this vulnerability to its **Known Exploited Vulnerabilities (KEV) Catalog** on May 7, 2026 【2】.\n- **Attack Vectors and Technical Details**:\n - The vulnerability is classified as a **spoofing bug** resulting from a **cross-site scripting (XSS)** flaw 【1】.\n - Technically, it involves the **improper neutralization of input during web page generation**, which allows attackers to execute malicious scripts within the context of the user's session 【3】.\n - Exploitation is achieved via **crafted requests** sent to the targeted Exchange server 【1】.\n- **Targeted Attacks**: While the vulnerability is being actively exploited, specific details regarding whether it is being used in highly targeted, advanced persistent threat (APT) campaigns versus opportunistic mass exploitation have not been explicitly detailed in public reports beyond the confirmation of its inclusion in the CISA KEV catalog 【2】.\n\nSources:\n- On-Prem Microsoft Exchange Server CVE-2026-42897 Exploited via Crafted ...: https://thehackernews.com/2026/05/on-prem-microsoft-exchange-server-cve.html\n- CISA Adds One Known Exploited Vulnerability to Catalog | CISA: https://www.cisa.gov/news-events/alerts/2026/05/07/cisa-adds-one-known-exploited-vulnerability-catalog\n- CVE-2026-42897 Detail - NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-42897", "references": [ { "title": "On-Prem Microsoft Exchange Server CVE-2026-42897 Exploited via Crafted ...", "url": "https://thehackernews.com/2026/05/on-prem-microsoft-exchange-server-cve.html", "citation_contribution": 585, "snippet": "Microsoft has disclosed a new security vulnerability impacting on-premise versions of Exchange Server that it said has come under active exploitation in the wild. The vulnerability, tracked as CVE-2026-42897 (CVSS score: 8.1), has been described as a spoofing bug stemming from a cross-site scripting flaw.", "is_search_result": true }, { "title": "CISA Adds One Known Exploited Vulnerability to Catalog | CISA", "url": "https://www.cisa.gov/news-events/alerts/2026/05/07/cisa-adds-one-known-exploited-vulnerability-catalog", "citation_contribution": 542, "snippet": "CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.", "is_search_result": true }, { "title": "CVE-2026-42897 Detail - NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42897", "citation_contribution": 312, "snippet": "Description. Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an ...", "is_search_result": true } ], "timestamp": "2026-05-15T17:30:23.824037" }, "cache_timestamp": "2026-05-15T17:30:43.317078", "displayed_on_website": true }, { "cve_id": "CVE-2026-42208", "cvss_score": "9.3", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2026-05-08T03:38:14.124Z", "cve_published_date_formatted": "2026-05-08", "kev_date_added": "2026-05-08", "kev_date_added_formatted": "2026-05-08", "kev_due_date": "2026-05-11", "days_to_kev": 0, "days_since_kev": 27, "is_new_kev": false, "summary": "Critical SQL injection vulnerability in LiteLLM proxy server allowing unauthenticated attackers to read/modify database contents including API keys and credentials. Actively exploited within 36 hours of disclosure and added to CISA KEV catalog.", "detailed_analysis": { "vulnerability_type": "Pre-authentication SQL injection in proxy API key verification process", "affected_products": [ "LiteLLM Proxy Server (versions 1.81.16 to 1.83.6)" ], "exploitation_requirements": [ "Network access to LiteLLM proxy API endpoints", "No authentication required", "No user interaction required" ], "internet_facing_likelihood": "LiteLLM is specifically designed as an AI Gateway/proxy server that sits between applications and LLM APIs (OpenAI, etc.). As a proxy service that needs to handle API requests from clients, it is typically deployed as an internet-facing service. Estimated 70-80% of deployments would be internet-accessible to serve as the intermediary between applications and AI services.", "typical_deployment": "Server software deployed as an API gateway/proxy service that requires network connectivity to serve clients making LLM API requests", "deployment_statistics": "Approximately 70-80% of LiteLLM deployments are likely internet-facing since its primary function is to act as a proxy/gateway for AI API calls, requiring accessibility from client applications", "active_exploitation": "Confirmed active exploitation within 36 hours of disclosure. Added to CISA KEV catalog on 2026-05-08. Targeted exploitation campaigns identified by security researchers.", "severity_factors": [ "No authentication required", "Network-accessible attack vector", "High CVSS score of 9.3", "Allows reading/modification of sensitive credentials", "Confirmed active exploitation", "CISA KEV listed" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately upgrade to LiteLLM version 1.83.7 or later", "Review database logs for suspicious SQL queries or unauthorized data access", "Rotate all API keys and credentials managed by the LiteLLM proxy", "Implement network-level protections if immediate patching is not possible", "Monitor for malicious Authorization headers in proxy logs" ], "risk_assessment": { "exploit_likelihood": "Very high - vulnerability is actively being exploited in targeted campaigns with no authentication barriers", "impact_assessment": "Critical - full database compromise allowing theft of API keys, credentials, and potential unauthorized access to downstream LLM services", "exposure_scope": "All internet-facing LiteLLM proxy deployments running vulnerable versions (1.81.16 to 1.83.6) are at immediate risk" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "The **CVE-2026-42208** vulnerability, a **SQL injection** affecting **BerriAI LiteLLM**, has been actively exploited in the wild shortly after its disclosure 【1】【2】.\n\nHere's a breakdown of what is known about its exploitation:\n\n* **Internet-Facing Applications/Services**: The vulnerability exists within the proxy verification step of LiteLLM, which can expose API keys and credentials 【1】. This suggests it can affect internet-facing services that utilize LiteLLM for authentication.\n* **Evidence of Active Exploitation**: There is clear evidence of active exploitation. CISA added this vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog based on this evidence 【4】. Exploitation attempts were recorded as early as April 26, 2026, approximately 26 hours after the advisory was indexed 【2】.\n* **Attack Vectors and Exploitation Methods**: The vulnerability is a **pre-authentication SQL injection** 【1】. Attackers can exploit it by manipulating the \"Bearer\" value in the authentication process. This value is directly concatenated into a SQL query without proper parameter binding, allowing an attacker to escape the string literal and append arbitrary SQL commands 【1】. This enables attackers to read data from the LiteLLM database, potentially extracting API keys and credentials 【1】.\n* **Targeted Attacks**: Evidence suggests that the exploitation has been **targeted** 【1】. Sysdig analysis indicated targeted exploitation within 36 hours of the vulnerability's disclosure 【1】.\n* **CISA Known Exploited Vulnerabilities Status**: **CVE-2026-42208 is listed in CISA's Known Exploited Vulnerabilities (KEV) Catalog** 【3】【5】. This catalog is an authoritative source of vulnerabilities that have been exploited in the wild, and organizations are advised to use it for vulnerability management prioritization 【3】.\n* **Technical Details about Internet Exploitability**: The vulnerability lies in the way the \"Bearer\" token is handled in versions of LiteLLM between `>= 1.81.16` and `< 1.83.7` 【1】. Specifically, the concatenation of the \"Bearer\" value directly into a `SELECT` statement targeting the `LiteLLM_VerificationToken` table, without using parameter binding, creates the SQL injection flaw 【1】. This allows an attacker to inject malicious SQL code, leading to unauthorized data access, such as the extraction of sensitive credentials 【1】. The vulnerability was addressed in version `1.83.7-stable` 【2】.\n\nSources:\n- CVE-2026-42208: Targeted SQL injection against... | Sysdig: https://www.sysdig.com/blog/cve-2026-42208-targeted-sql-injection-against-litellms-authentication-path-discovered-36-hours-following-vulnerability-disclosure\n- LiteLLM CVE-2026-42208 SQL Injection Exploited within 36 Hours of ...: https://thehackernews.com/2026/04/litellm-cve-2026-42208-sql-injection.html\n- Known Exploited Vulnerabilities Catalog | CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog\n- CISA Adds One Known Exploited Vulnerability to Catalog | CISA: https://www.cisa.gov/news-events/alerts/2026/05/06/cisa-adds-one-known-exploited-vulnerability-catalog\n- CVE-2026-42208 Detail - NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-42208", "references": [ { "title": "CVE-2026-42208: Targeted SQL injection against... | Sysdig", "url": "https://www.sysdig.com/blog/cve-2026-42208-targeted-sql-injection-against-litellms-authentication-path-discovered-36-hours-following-vulnerability-disclosure", "citation_contribution": 1393, "snippet": "Critical vulnerability CVE-2026-42208 exposes LiteLLM to pre-auth SQL injection, enabling attackers to extract API keys and credentials.CVE-2026-42208 exists within the proxy verification step. In affected versions (>= 1.81.16, < 1.83.7), the Bearer value is concatenated directly into a SELECT against the LiteLLM_VerificationToken table without parameter binding. A single quote allows an attacker to escape the string literal and append arbitrary SQL. ... Critical vulnerability CVE-2026-42208 exposes LiteLLM to pre-auth SQL injection, enabling attackers to extract API keys and credentials. Sysdig analysis reveals targeted exploitation within 36 hours of disclosure. ... Critical vulnerability CVE-2026-42208 exposes LiteLLM to pre-auth SQL injection, enabling attackers to extract API keys and credentials.", "is_search_result": true }, { "title": "LiteLLM CVE-2026-42208 SQL Injection Exploited within 36 Hours of ...", "url": "https://thehackernews.com/2026/04/litellm-cve-2026-42208-sql-injection.html", "citation_contribution": 291, "snippet": "CVE-2026-42208 exploited within 36 hours of disclosure, exposing LiteLLM credentials, risking cloud account compromise. ... The vulnerability, tracked as CVE-2026-42208 (CVSS score: 9.3), is an SQL injection that could be exploited to modify the underlying LiteLLM proxy database.While the vulnerability was addressed in version 1.83.7-stable released on April 19, 2026, the first exploitation attempt was recorded on April 26 at 16:17 UTC, roughly 26 hours and seven minutes after the GitHub advisory was indexed in the global GitHub Advisory Database. The SQL injection activity, per Sysdig, originated from the IP address 65.111.27[.]132.", "is_search_result": true }, { "title": "Known Exploited Vulnerabilities Catalog | CISA", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "citation_contribution": 274, "snippet": "CVE-2026-42208. BerriAI LiteLLM SQL Injection Vulnerability: BerriAI LiteLLM contains a SQL injection vulnerability that allows an attacker to read data from ... ... For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild. Organizations should use the KEV catalog as an input to their vulnerability management prioritization framework.How to use the KEV ...", "is_search_result": true }, { "title": "CISA Adds One Known Exploited Vulnerability to Catalog | CISA", "url": "https://www.cisa.gov/news-events/alerts/2026/05/06/cisa-adds-one-known-exploited-vulnerability-catalog", "citation_contribution": 195, "snippet": "CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.", "is_search_result": true }, { "title": "CVE-2026-42208 Detail - NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42208", "citation_contribution": 44, "snippet": "This CVE is in CISA's Known Exploited Vulnerabilities Catalog ; BerriAI LiteLLM SQL Injection Vulnerability, 05/08/2026, 05/11/2026 ...", "is_search_result": true } ], "timestamp": "2026-05-09T17:45:38.494483" }, "cache_timestamp": "2026-05-09T17:45:55.247474", "displayed_on_website": true }, { "cve_id": "CVE-2026-41940", "cvss_score": "9.8", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2026-04-29T15:10:37.899Z", "cve_published_date_formatted": "2026-04-29", "kev_date_added": "2026-04-30", "kev_date_added_formatted": "2026-04-30", "kev_due_date": "2026-05-03", "days_to_kev": 1, "days_since_kev": null, "is_new_kev": false, "summary": "Critical authentication bypass vulnerability in cPanel and WHM control panels allowing unauthenticated remote attackers to gain unauthorized access. These web hosting management platforms are almost universally internet-facing by design and widely exploited in the wild.", "detailed_analysis": { "vulnerability_type": "Authentication bypass vulnerability (CWE-306) in the login flow allowing unauthenticated remote access to control panels", "affected_products": [ "cPanel", "WHM (Web Host Manager)", "WP Squared" ], "exploitation_requirements": [ "Network access to cPanel/WHM interface", "No authentication required", "No user interaction required" ], "internet_facing_likelihood": "cPanel and WHM are web hosting control panels that are designed to be internet-accessible by nature. These platforms manage web hosting accounts, domains, email, and server configurations - functions that require internet connectivity for both hosting providers and end users. Estimated 95%+ of deployments are internet-facing as this is their primary operational model.", "typical_deployment": "Server-side web applications providing hosting management interfaces. cPanel runs on web servers to manage hosting accounts, while WHM provides server administration capabilities. Both are designed as internet-accessible control panels for hosting providers and their customers.", "deployment_statistics": "Approximately 95-99% of cPanel/WHM installations are internet-facing. Web search data indicates ~1.5 million cPanel instances exposed to the internet via Shodan scanning. These are fundamentally internet-facing services by design and business necessity.", "active_exploitation": "Confirmed active exploitation in the wild since at least February 2026, prior to public disclosure. Added to CISA KEV catalog. Proof-of-concept exploit publicly available. Evidence suggests months of zero-day exploitation.", "severity_factors": [ "CVSS 9.8 Critical severity", "No authentication required for exploitation", "Complete system compromise possible", "Millions of internet-exposed instances", "Active exploitation confirmed", "Zero-day exploitation for months", "Controls hosting infrastructure affecting multiple websites" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Apply vendor patches immediately for all cPanel/WHM versions after 11.40", "Review authentication logs for suspicious login attempts or bypasses since February 2026", "Implement additional access controls and monitoring for control panel access", "Consider temporarily restricting cPanel/WHM access to known IP ranges if patching cannot be immediate", "Verify integrity of hosted websites and server configurations", "HIGHEST patch priority - actively exploited critical infrastructure" ], "risk_assessment": { "exploit_likelihood": "EXTREMELY HIGH - Active exploitation confirmed in the wild with public PoC available. Authentication bypass against internet-facing services with millions of exposed instances.", "impact_assessment": "CRITICAL - Complete control panel access leading to full server compromise, website defacement, data theft, malware distribution, and hosting infrastructure takeover affecting multiple customers.", "exposure_scope": "Massive - Estimated 1.5+ million internet-facing cPanel instances globally. Affects hosting providers and their customers worldwide, representing critical internet infrastructure." }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Known", "ransomware_first_seen_date": "2026-05-05", "ransomware_days_after_kev": 5, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "**CVE-2026-41940** is a critical authentication bypass vulnerability affecting **cPanel and WHM**, which are widely used control panels for managing web hosting accounts. This vulnerability has been **actively exploited in the wild**, with evidence suggesting exploitation may have begun as early as February 23, 2026, prior to its public disclosure 【1】.\n\n**Key details regarding CVE-2026-41940 exploitation include:**\n\n* **Internet-Facing Applications/Services:** The vulnerability affects cPanel and WHM, which are typically internet-facing services used for web hosting management. A Shodan query indicated approximately 1.5 million cPanel instances exposed to the internet that could be vulnerable 【1】.\n* **Evidence of Active Exploitation:** **Yes, there is clear evidence of active exploitation in the wild** 【1】【3】. Some reports suggest it was exploited as a zero-day vulnerability for months before a patch was released 【5】.\n* **Attack Vectors and Exploitation Methods:** The vulnerability lies within the login flow of cPanel and WHM. It allows **unauthenticated remote attackers to bypass authentication checks** (CWE-306) and gain control of the management console 【2】【4】. Successful exploitation grants attackers control over the host system, its configurations, databases, and managed websites 【1】. A proof-of-concept exploit has been published 【1】.\n* **Targeted Attacks:** While not explicitly stated as exclusively targeted, the nature of exploiting a control panel suggests potential for targeted attacks against hosting providers or their clients. The speculation of \"targeted zero-day exploitation\" points towards sophisticated actors 【1】.\n* **CISA Known Exploited Vulnerabilities (KEV) Status:** **CVE-2026-41940 has been added to CISA's Known Exploited Vulnerabilities (KEV) Catalog** 【3】. This addition is based on evidence of active exploitation.\n* **Technical Details about Internet Exploitability:** The vulnerability is an **authentication bypass flaw in the login flow** 【2】【4】. It allows attackers to gain privileged access without valid credentials, impacting the confidentiality, integrity, and availability of hosted services 【2】. The affected versions are those after cPanel and WHM 11.40 【4】.\n\nSources:\n- CVE-2026-41940: cPanel & WHM Authentication Bypass: https://www.rapid7.com/blog/post/etr-cve-2026-41940-cpanel-whm-authentication-bypass/\n- CVE-2026-41940 - Vulnerability Details - OpenCVE: https://app.opencve.io/cve/CVE-2026-41940\n- CISA Adds Two Known Exploited Vulnerabilities to Catalog: https://us-cert.cisa.gov/news-events/alerts/2026/04/28/cisa-adds-two-known-exploited-vulnerabilities-catalog\n- CVE-2026-41940 Detail - NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-41940\n- cPanel zero-day exploited for months before patch release (CVE-2026-41940): https://www.helpnetsecurity.com/2026/04/30/cpanel-zero-day-vulnerability-cve-2026-41940-exploited/", "references": [ { "title": "CVE-2026-41940: cPanel & WHM Authentication Bypass", "url": "https://www.rapid7.com/blog/post/etr-cve-2026-41940-cpanel-whm-authentication-bypass/", "citation_contribution": 1168, "snippet": "Vulnerabilities and Exploits. CVE-2026-41940: cPanel & WHM Authentication Bypass.WHM provides root-level administration, while cPanel acts as the user-facing interface. Successful exploitation of CVE-2026-41940 grants an attacker control over the cPanel host system, its configurations and databases, and websites it manages. A naive Shodan query for potential targets returns approximately 1.5 million cPanel instances exposed to the internet that may be vulnerable. ... A managed cPanel host, KnownHost, stated that CVE-2026-41940 is actively being exploited in the wild, with speculation of targeted zero-day exploitation happening as early as February 23, 2026, prior to the vulnerability’s public disclosure. Security firm watchTowr has published a technical analysis and proof-of-concept exploit for CVE-2026 ...", "is_search_result": true }, { "title": "CVE-2026-41940 - Vulnerability Details - OpenCVE", "url": "https://app.opencve.io/cve/CVE-2026-41940", "citation_contribution": 425, "snippet": "An authentication bypass flaw in the cPanel and WHM login flow allows an unauthenticated remote attacker to gain control of the management console. The vulnerability exploits improper authentication checks (CWE-306), enabling attackers to obtain privileged access without valid credentials, thereby threatening confidentiality, integrity, and availability of the hosted services.", "is_search_result": true }, { "title": "CISA Adds Two Known Exploited Vulnerabilities to Catalog", "url": "https://us-cert.cisa.gov/news-events/alerts/2026/04/28/cisa-adds-two-known-exploited-vulnerabilities-catalog", "citation_contribution": 184, "snippet": "CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.", "is_search_result": true }, { "title": "CVE-2026-41940 Detail - NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41940", "citation_contribution": 159, "snippet": "cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote ...", "is_search_result": true }, { "title": "cPanel zero-day exploited for months before patch release (CVE-2026-41940)", "url": "https://www.helpnetsecurity.com/2026/04/30/cpanel-zero-day-vulnerability-cve-2026-41940-exploited/", "citation_contribution": 105, "snippet": "A critical vulnerability (CVE-2026-41940) in the cPanel control panel for managing web hosting accounts, is being exploited by attackers.", "is_search_result": true } ], "timestamp": "2026-04-30T17:10:31.962638" }, "cache_timestamp": "2026-04-30T17:10:52.157207", "displayed_on_website": false }, { "cve_id": "CVE-2026-41091", "cvss_score": "7.8", "attack_vector": "LOCAL", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1068", "deployment_likelihood": "VERY_LOW", "cve_published_date": "2026-05-20T13:09:13.634Z", "cve_published_date_formatted": "2026-05-20", "kev_date_added": "2026-05-20", "kev_date_added_formatted": "2026-05-20", "kev_due_date": "2026-06-03", "days_to_kev": 0, "days_since_kev": 15, "is_new_kev": false, "summary": "CVE-2026-41091 is a local privilege escalation vulnerability in Microsoft Malware Protection Engine affecting Windows Defender. The vulnerability requires local access and existing low-level privileges to exploit, making it unsuitable for direct internet exploitation despite being in CISA KEV.", "detailed_analysis": { "vulnerability_type": "Improper Link Resolution Before File Access ('Link Following') - CWE-59", "affected_products": [ "Microsoft Defender", "Windows Defender", "Microsoft Malware Protection Engine" ], "exploitation_requirements": [ "Local system access", "Low-level user privileges", "Ability to create symbolic links or junctions" ], "internet_facing_likelihood": "Microsoft Malware Protection Engine is not designed as an internet-facing service. It operates as a client-side security component within Windows systems and enterprise security products. There are virtually no legitimate use cases for exposing this component directly to the internet. The engine processes files locally and communicates with Microsoft's cloud services for updates, but does not listen on network ports or provide internet-accessible interfaces.", "typical_deployment": "Client-side security engine embedded in Windows Defender, Microsoft Security Essentials, System Center Endpoint Protection, and other Microsoft security products. Runs as a local system service.", "deployment_statistics": "Less than 1% of deployments would be directly internet-accessible. The component is designed for local operation and any internet exposure would be through misconfiguration rather than intended design.", "active_exploitation": "Listed in CISA KEV indicating active exploitation, likely used in combination with other techniques for lateral movement or persistence after initial system compromise.", "severity_factors": [ "High CVSS score of 7.8", "Active exploitation confirmed", "Privilege escalation to SYSTEM level", "Affects widely deployed Windows security component", "Requires existing local access limiting initial attack surface" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Apply Microsoft security updates immediately to update Malware Protection Engine to version 1.1.26040.8 or later", "Monitor for suspicious symbolic link creation and unusual file system activity around Windows Defender processes", "Review local user accounts and privileges for signs of unauthorized elevation", "HIGH patch priority due to CISA KEV listing and potential for privilege escalation in compromised environments" ], "risk_assessment": { "exploit_likelihood": "Low for direct internet exploitation, but high for post-compromise privilege escalation. Attackers who have gained initial access to a system can use this to escalate to SYSTEM privileges.", "impact_assessment": "High impact once exploited - allows elevation from low-privileged user to SYSTEM level access, potentially compromising the entire host and disabling security protections.", "exposure_scope": "Minimal direct internet exposure, but affects virtually all Windows systems running Microsoft Defender or other products using the Malware Protection Engine." }, "exploitation_method": "OTHER", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:47:08.871942", "displayed_on_website": false }, { "cve_id": "CVE-2026-39987", "cvss_score": "9.3", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2026-04-09T17:16:55.639Z", "cve_published_date_formatted": "2026-04-09", "kev_date_added": "2026-04-23", "kev_date_added_formatted": "2026-04-23", "kev_due_date": "2026-05-07", "days_to_kev": 14, "days_since_kev": null, "is_new_kev": false, "summary": "Marimo Python notebook server has a critical pre-authentication RCE vulnerability allowing unauthenticated attackers to execute arbitrary system commands via an unprotected terminal WebSocket endpoint. This vulnerability is actively exploited in the wild and was added to CISA KEV catalog after being exploited within 10 hours of disclosure.", "detailed_analysis": { "vulnerability_type": "Pre-Authentication Remote Code Execution via Missing Authentication (CWE-306) in terminal WebSocket endpoint", "affected_products": [ "Marimo Python Notebook Server" ], "exploitation_requirements": [ "Network access to Marimo server", "No authentication required", "No user interaction required", "Low attack complexity" ], "internet_facing_likelihood": "Marimo is a Python notebook server that provides web-based interfaces for data science and development work. Like Jupyter notebooks and similar tools, Marimo servers are commonly exposed to the internet for remote access by developers, data scientists, and teams. Estimated 60-70% of deployments are internet-accessible due to remote work requirements and collaborative development needs.", "typical_deployment": "Marimo is server software that runs as a web application, typically listening on network ports to serve notebook interfaces. It's designed for interactive Python development and data analysis, similar to Jupyter notebooks.", "deployment_statistics": "Approximately 60-70% of Marimo deployments are likely internet-facing, as development teams frequently need remote access to notebook servers for collaboration, cloud-based development, and remote work scenarios.", "active_exploitation": "Confirmed active exploitation - added to CISA KEV catalog on 2026-04-23. Vulnerability was exploited within 10 hours of disclosure according to security researchers.", "severity_factors": [ "Critical CVSS score of 9.3", "Pre-authentication RCE vulnerability", "No user interaction required", "Active exploitation confirmed", "Direct system command execution possible", "WebSocket endpoint completely bypasses authentication" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately upgrade Marimo to version 0.23.0 or later", "Block access to /terminal/ws endpoint at firewall/proxy level if immediate patching is not possible", "Review authentication logs for suspicious WebSocket connections", "Implement network segmentation to limit exposure of Marimo servers", "Monitor for unusual system command execution and process creation", "HIGHEST patch priority due to active exploitation and ease of exploitation" ], "risk_assessment": { "exploit_likelihood": "Very High - vulnerability is being actively exploited, requires no authentication, and has low attack complexity with publicly available technical details", "impact_assessment": "Critical - allows complete system compromise with arbitrary command execution, potentially leading to data theft, system manipulation, and lateral movement", "exposure_scope": "High - significant number of internet-facing Marimo notebook servers used by development teams and data scientists globally" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "**CVE-2026-39987** is a critical vulnerability affecting the open-source Python notebook tool **Marimo** 【1】. This vulnerability has been **actively exploited in the wild** 【4】 and was added to the **CISA Known Exploited Vulnerabilities (KEV) Catalog** 【3】.\n\nHere's a breakdown of what is known about its exploitation:\n\n* **Internet-facing applications or services:** The vulnerability exists in Marimo, which is described as a \"reactive Python notebook\" 【1】. While not explicitly stated as internet-facing, the nature of notebook tools can often involve web interfaces or services that might be exposed.\n* **Evidence of active exploitation:** CISA has confirmed that there is **evidence of active exploitation** 【4】, and it was exploited within 10 hours of its disclosure 【5】.\n* **Attack vectors and exploitation methods:** The vulnerability is a **Pre-Authentication Remote Code Execution (RCE)** flaw 【1】. Successful exploitation can lead to **remote code execution** 【2】.\n* **Targeted attacks:** The provided information does not specify if this vulnerability has been used in targeted attacks.\n* **CISA Known Exploited Vulnerabilities status:** CVE-2026-39987 is **included in the CISA KEV Catalog** 【3】, indicating it has been exploited in the wild.\n* **Technical details about internet exploitability:** The vulnerability lies within the **terminal WebSocket endpoint** of Marimo 【1】. Exploitation may result in the exfiltration of usernames and hashed passwords for local device administrators, portal administrators, and user accounts used for remote access 【2】.\n\nSources:\n- CVE-2026-39987 - CVE Record: https://www.cve.org/CVERecord?id=CVE-2026-39987\n- Print View: https://www.cisa.gov/known-exploited-vulnerabilities-catalog-print\n- Known Exploited Vulnerabilities Catalog - CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog\n- CISA Adds One Known Exploited Vulnerability to Catalog | CISA: https://www.cisa.gov/news-events/alerts/2026/04/22/cisa-adds-one-known-exploited-vulnerability-catalog\n- CVE-2026-39987: Marimo RCE exploited in hours after disclosure: https://securityaffairs.com/190623/hacking/cve-2026-39987-marimo-rce-exploited-in-hours-after-disclosure.html", "references": [ { "title": "CVE-2026-39987 - CVE Record", "url": "https://www.cve.org/CVERecord?id=CVE-2026-39987", "citation_contribution": 503, "snippet": "Description. marimo is a reactive Python notebook. Prior to 0.23.0, Marimo has a Pre-Auth RCE vulnerability. The terminal WebSocket endpoint ...", "is_search_result": true }, { "title": "Print View", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog-print", "citation_contribution": 237, "snippet": "Successful exploitation may cause remote code execution to exfiltrate usernames and hashed passwords for the local device admin (s), portal admins, and user accounts used for remote access (but not external Active Directory or LDAP passwords).", "is_search_result": true }, { "title": "Known Exploited Vulnerabilities Catalog - CISA", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "citation_contribution": 185, "snippet": "For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild. Organizations should use the KEV catalog as an input to their vulnerability management prioritization framework.How to use the KEV ...", "is_search_result": true }, { "title": "CISA Adds One Known Exploited Vulnerability to Catalog | CISA", "url": "https://www.cisa.gov/news-events/alerts/2026/04/22/cisa-adds-one-known-exploited-vulnerability-catalog", "citation_contribution": 173, "snippet": "CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.", "is_search_result": true }, { "title": "CVE-2026-39987: Marimo RCE exploited in hours after disclosure", "url": "https://securityaffairs.com/190623/hacking/cve-2026-39987-marimo-rce-exploited-in-hours-after-disclosure.html", "citation_contribution": 57, "snippet": "A critical flaw, tracked as CVE-2026-39987, in the open-source Python notebook tool Marimo was exploited within 10 hours of disclosure.", "is_search_result": true } ], "timestamp": "2026-04-24T17:25:16.089588" }, "cache_timestamp": "2026-04-24T17:25:34.664343", "displayed_on_website": false }, { "cve_id": "CVE-2026-3910", "cvss_score": "8.8", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1189", "deployment_likelihood": "VERY_LOW", "cve_published_date": "2026-03-12T21:30:51.861Z", "cve_published_date_formatted": "2026-03-12", "kev_date_added": "2026-03-13", "kev_date_added_formatted": "2026-03-13", "kev_due_date": "2026-03-27", "days_to_kev": 1, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2026-3910 is a Chrome V8 engine vulnerability that allows remote code execution via malicious HTML pages. While actively exploited, this requires user interaction and targets client browsers, not internet-facing servers.", "detailed_analysis": { "vulnerability_type": "Inappropriate implementation in V8 JavaScript engine allowing arbitrary code execution within browser sandbox", "affected_products": [ "Chrome" ], "exploitation_requirements": [ "User must visit malicious HTML page", "Network access to deliver malicious content", "No authentication required", "User interaction required" ], "internet_facing_likelihood": "Chrome is client-side browser software, not server software. While Chrome connects to the internet to browse websites, the browser itself is not deployed as an internet-facing service that accepts incoming connections. This is fundamentally different from web servers, application servers, or network services that listen for external connections.", "typical_deployment": "Chrome is client-side application software installed on end-user devices (desktops, laptops, mobile devices) for web browsing. It is not server software or infrastructure software that would be deployed as an internet-facing service.", "deployment_statistics": "Less than 1% - Chrome installations are almost exclusively client-side browsers. While some automation or testing environments might run headless Chrome instances, these are rarely exposed directly to the internet as listening services. The vast majority of Chrome deployments are on end-user devices behind firewalls/NAT.", "active_exploitation": "Confirmed active exploitation in the wild. Added to CISA KEV catalog indicating real-world attacks. Google released emergency security updates to address this zero-day vulnerability.", "severity_factors": [ "High CVSS score of 8.8", "Active exploitation confirmed", "Zero-day vulnerability", "Allows arbitrary code execution", "Mitigated by sandbox containment", "Requires user to visit malicious page" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately update Chrome to version 146.0.7680.75 or later on all systems", "Deploy browser security policies to restrict access to untrusted websites", "Monitor for suspicious browser activity and potential sandbox escape attempts", "HIGH patch priority due to active exploitation" ], "risk_assessment": { "exploit_likelihood": "This is NOT directly exploitable against internet-facing applications per T1190. Exploitation requires social engineering or phishing to trick users into visiting malicious websites (T1566). The vulnerability affects client browsers, not server applications.", "impact_assessment": "High impact on compromised client systems with potential for arbitrary code execution, but limited by browser sandbox. Could be used as first stage in multi-stage attacks.", "exposure_scope": "Affects client browsers, not internet-facing servers. Risk is to end-users who browse malicious websites, not to organizations' external attack surface." }, "exploitation_method": "USER_INTERACTION", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "**CVE-2026-3910** is a vulnerability in Google Chrome's V8 JavaScript and WebAssembly engine that has been actively exploited in the wild 【3】【8】.\n\nHere's a breakdown of what is known about its exploitation:\n\n- **Internet-facing applications or services:** While the vulnerability exists within the Chrome browser, which is used for accessing internet-facing applications and services, the vulnerability itself is not directly in a server-side internet-facing application. Instead, it allows for arbitrary code execution within the browser's sandbox when a user visits a crafted HTML page 【1】【2】.\n\n- **Evidence of active exploitation in the wild:** Yes, there is confirmed evidence that **CVE-2026-3910 has been actively exploited in the wild** 【3】【8】. Google has released emergency security updates to address this zero-day vulnerability 【8】【9】.\n\n- **Attack vectors and exploitation methods:** The vulnerability is an \"inappropriate implementation\" in the V8 engine 【1】【2】. Attackers can exploit this by creating a **maliciously crafted HTML page** 【1】【2】. When a user visits this page, the vulnerability can allow a remote attacker to **execute arbitrary code inside the browser's sandbox** 【1】【2】. This type of vulnerability in the V8 engine is often targeted for sandbox escape attacks 【1】.\n\n- **Use in targeted attacks:** While the sources confirm active exploitation, they do not specifically state whether CVE-2026-3910 has been used in targeted attacks. However, it is noted that Chrome bugs found by Google are often targeted by commercial spyware vendors 【1】.\n\n- **CISA Known Exploited Vulnerabilities (KEV) status:** **CVE-2026-3910 has been added to the CISA Known Exploited Vulnerabilities (KEV) Catalog** 【5】. This addition signifies that the vulnerability has been exploited in the wild and poses a significant risk 【5】【7】.\n\n- **Technical details about internet exploitability:** The vulnerability has a CVSS v3.1 base score of 8.8 (High) with an attack vector of \"Network\" and requires \"User Interaction\" (specifically, the user must visit a malicious web page) 【2】【4】. The exploit allows for **remote code execution within the browser's sandbox** 【1】【2】. The V8 engine is a frequent target for attackers because JavaScript is continuously executed during web browsing, offering numerous exploitation opportunities 【6】.\n\nSources:\n- Chrome 146 Update Patches Two Exploited Zero-Days: https://www.securityweek.com/chrome-146-update-patches-two-exploited-zero-days/\n- Vulnerability — Latest News, Reports &: https://thehackernews.com/search/label/Vulnerability\n- CVE-2026-3910: Chrome V8 Zero-Day Used for In-the-Wild Attacks: https://socprime.com/blog/cve-2026-3910-vulnerability/\n- CVE-2026-3910 - Vulnerability Details - OpenCVE: https://app.opencve.io/cve/CVE-2026-3910\n- CISA KEV Adds Critical Skia and Chromium V8 Flaws (CVE-2026-3909, CVE ...: https://windowsforum.com/threads/cisa-kev-adds-critical-skia-and-chromium-v8-flaws-cve-2026-3909-cve-2026-3910-patch-now.405045/", "references": [ { "title": "Chrome 146 Update Patches Two Exploited Zero-Days", "url": "https://www.securityweek.com/chrome-146-update-patches-two-exploited-zero-days/", "citation_contribution": 676, "snippet": "CVE-2026-3910 is an inappropriate implementation weakness in the V8 JavaScript engine that could allow attackers to craft malicious HTML pages and execute arbitrary code. V8 flaws are often targeted in sandbox escape attacks. Google has not provided details on the exploitation of these vulnerabilities, but Chrome bugs found by Google are often targeted by commercial spyware vendors.", "is_search_result": true }, { "title": "Vulnerability — Latest News, Reports &", "url": "https://thehackernews.com/search/label/Vulnerability", "citation_contribution": 504, "snippet": "CVE-2026-3910 (CVSS score: 8.8) - An inappropriate implementation vulnerability in the V8 JavaScript and WebAssembly engine that allows a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. ... Google is aware that exploits for both CVE-2026-3909 an... ... The vulnerabilities are listed below - CVE-2026-27577 ( CVSS score: 9.4) - Expression sandbox escape leading to remote code execution (RCE) CVE-2026-27493 (CVSS score: 9.5) - Unauthenticated expression ...", "is_search_result": true }, { "title": "CVE-2026-3910: Chrome V8 Zero-Day Used for In-the-Wild Attacks", "url": "https://socprime.com/blog/cve-2026-3910-vulnerability/", "citation_contribution": 244, "snippet": "Earlier this year, Google patched CVE-2026-2441, the first actively exploited Chrome zero-day of 2026. Now, another emergency update has been released, fixing two more flaws already exploited in the wild, CVE-2026-3910 in Chrome’s V8 JavaScript and WebAssembly engine and CVE-2026-3909, an out-of-bounds write bug in Skia.Google has confirmed that CVE-2026-3910 is being exploited in the wild, but has not published technical details about the exploitation chain.", "is_search_result": true }, { "title": "CVE-2026-3910 - Vulnerability Details - OpenCVE", "url": "https://app.opencve.io/cve/CVE-2026-3910", "citation_contribution": 209, "snippet": "cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 8.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"timestamp\": \"2026-03-12T22:07:27.730653Z\", \"id\": \"CVE-2026-3910\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"...", "is_search_result": true }, { "title": "CISA KEV Adds Critical Skia and Chromium V8 Flaws (CVE-2026-3909, CVE ...", "url": "https://windowsforum.com/threads/cisa-kev-adds-critical-skia-and-chromium-v8-flaws-cve-2026-3909-cve-2026-3910-patch-now.405045/", "citation_contribution": 181, "snippet": "CISA’s addition of two browser-related flaws to the Known Exploited Vulnerabilities (KEV) Catalog on March 13, 2026 — tracked as CVE‑2026‑3909 (an out‑of‑bounds write in Skia) and CVE‑2026‑3910 (an unspecified but actively exploited flaw in Chromium’s V8 engine) — is a blunt operational signal: these are not academic bugs ...", "is_search_result": true } ], "timestamp": "2026-03-13T20:00:36.148389" }, "cache_timestamp": "2026-03-13T20:00:54.775818", "displayed_on_website": false }, { "cve_id": "CVE-2026-3909", "cvss_score": "8.8", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1189", "deployment_likelihood": "VERY_LOW", "cve_published_date": "2026-03-12T21:30:51.265Z", "cve_published_date_formatted": "2026-03-12", "kev_date_added": "2026-03-13", "kev_date_added_formatted": "2026-03-13", "kev_due_date": "2026-03-27", "days_to_kev": 1, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2026-3909 is an out-of-bounds write vulnerability in Google Chrome's Skia component that requires user interaction (visiting a crafted HTML page). While actively exploited and severe for end-users, it does not affect internet-facing server applications and requires social engineering or phishing for exploitation.", "detailed_analysis": { "vulnerability_type": "Out-of-bounds write (CWE-787) in Skia graphics library component", "affected_products": [ "Chrome" ], "exploitation_requirements": [ "User must visit a crafted HTML page", "No authentication required", "Network access via web browsing" ], "internet_facing_likelihood": "Google Chrome is client-side browser software, not server software. While Chrome connects to the internet, it is not deployed as an internet-facing service that accepts inbound connections. Chrome runs on end-user devices (desktops, laptops, mobile) and acts as a client that makes outbound requests to web servers. There are no typical business deployments where Chrome itself serves as an internet-facing application server.", "typical_deployment": "Chrome is deployed as client-side software on end-user devices including desktops, laptops, and mobile devices. It functions as a web browser client that makes outbound connections to web servers, not as a server that accepts inbound connections.", "deployment_statistics": "0% of Chrome deployments are internet-facing servers. Chrome is exclusively client-side software. While some organizations may use Chrome in kiosk modes or automated testing, these do not constitute internet-facing server deployments that would be exploitable via T1190.", "active_exploitation": "Evidence shows active exploitation in the wild according to Google's security team, though not yet listed in CISA KEV catalog", "severity_factors": [ "High CVSS score of 8.8", "Active exploitation confirmed", "No privileges required for exploitation", "Requires user interaction", "Client-side only impact", "Not applicable to server infrastructure" ] }, "recommendations": [ "Update Chrome immediately to version 146.0.7680.75 or later", "Enable automatic updates for Chrome across the organization", "Educate users about avoiding suspicious websites and clicking unknown links", "Consider deploying browser isolation technologies for high-risk users", "Monitor for unusual browser crashes or system behavior on endpoints" ], "risk_assessment": { "exploit_likelihood": "Low for direct internet exploitation - requires user to visit malicious website, making this a client-side attack vector rather than server-side vulnerability", "impact_assessment": "High impact on individual endpoints if exploited (potential code execution), but does not affect server infrastructure or internet-facing services", "exposure_scope": "No internet-facing servers affected - impact limited to end-user devices running vulnerable Chrome versions" }, "exploitation_method": "USER_INTERACTION", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "Regarding CVE-2026-3909, here's what is known about its exploitation:\n\n- **CISA Known Exploited Vulnerabilities (KEV) Status**: CVE-2026-3909 is **not currently listed** on the CISA Known Exploited Vulnerabilities (KEV) Catalog. CISA maintains this catalog as an authoritative source of vulnerabilities that have been exploited in the wild, and organizations are advised to use it as an input for their vulnerability management processes 【2】.\n\n- **Evidence of Active Exploitation**: There is **evidence of active exploitation** of CVE-2026-3909 in the wild. Google has released security updates to address this vulnerability, and the company is aware of attacks exploiting it 【3】.\n\n- **Internet-Facing Applications or Services**: The vulnerability affects **Google Chrome** 【3】, specifically an \"Out of bounds write in Skia\" 【1】. While Chrome is a widely used application, the direct impact on internet-facing *services* would depend on how Chrome is used to access them. The vulnerability allows a remote attacker to perform out-of-bounds memory access via a crafted HTML page 【1】.\n\n- **Attack Vectors and Exploitation Methods**: The attack vector is identified as **Network**, with **Low Attack Complexity** and **No Privileges Required**. The vulnerability can be exploited by a remote attacker through a **crafted HTML page** 【1】.\n\n- **Targeted Attacks**: While the vulnerability is being actively exploited, the provided information does not specify whether it has been used in **targeted attacks**.\n\n- **Technical Details about Internet Exploitability**: The vulnerability is an **out-of-bounds write in Skia** within Google Chrome, affecting versions prior to 146.0.7680.75 【1】. This type of vulnerability can lead to memory corruption, potentially allowing an attacker to execute arbitrary code or cause a denial-of-service condition. The exploitability via a crafted HTML page suggests that a user visiting a malicious website or opening a malicious HTML document in Chrome could be affected.\n\nSources:\n- CVE-2026-3909 - Vulnerability Details - OpenCVE: https://app.opencve.io/cve/CVE-2026-3909\n- Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog\n- Google fixed two new actively exploited flaws in the Chrome browser: https://securityaffairs.com/189373/hacking/google-fixed-two-new-actively-exploited-flaws-in-the-chrome-browser.html", "references": [ { "title": "CVE-2026-3909 - Vulnerability Details - OpenCVE", "url": "https://app.opencve.io/cve/CVE-2026-3909", "citation_contribution": 721, "snippet": "Attack Vector Network. Attack Complexity Low. Privileges Required None. Scope Unchanged.\"lessThan\": \"146.0.7680.75\", \"versionType\": \"custom\"}]}], \"references\": [{\"url\": \"https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_12.html\"}, {\"url\": \"https://issues.chromium.org/issues/491421267\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Out of bounds write in Skia in Google Chrome prior to. 146.0.7680.75 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page.", "is_search_result": true }, { "title": "Known Exploited Vulnerabilities Catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "citation_contribution": 369, "snippet": "CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild. Organizations should use the KEV catalog as an input to their ...", "is_search_result": true }, { "title": "Google fixed two new actively exploited flaws in the Chrome browser", "url": "https://securityaffairs.com/189373/hacking/google-fixed-two-new-actively-exploited-flaws-in-the-chrome-browser.html", "citation_contribution": 328, "snippet": "Google addressed two high-severity vulnerabilities in the Chrome browser that have been exploited in attacks in the wild. Google has released security updates to address two high-severity vulnerabilities, tracked as CVE-2026-3909 and CVE-2026-3910, in the Chrome browser. The company is aware of attacks in the wild exploiting both flaws.", "is_search_result": true } ], "timestamp": "2026-03-13T20:01:01.049357" }, "cache_timestamp": "2026-03-13T20:01:16.870066", "displayed_on_website": false }, { "cve_id": "CVE-2026-35616", "cvss_score": "9.1", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2026-04-04T00:38:35.828Z", "cve_published_date_formatted": "2026-04-04", "kev_date_added": "2026-04-06", "kev_date_added_formatted": "2026-04-06", "kev_due_date": "2026-04-09", "days_to_kev": 2, "days_since_kev": null, "is_new_kev": false, "summary": "Critical unauthenticated remote code execution vulnerability in Fortinet FortiClient EMS management server. Allows attackers to execute arbitrary code via crafted network requests without authentication.", "detailed_analysis": { "vulnerability_type": "Improper access control leading to unauthenticated remote code execution", "affected_products": [ "Fortinet FortiClient EMS 7.4.5-7.4.6" ], "exploitation_requirements": [ "Network access to FortiClient EMS server", "No authentication required", "No user interaction required" ], "internet_facing_likelihood": "FortiClient EMS is an enterprise endpoint management server that is commonly deployed as internet-facing infrastructure to manage remote endpoints. Estimated 60-70% of deployments are internet-accessible to support remote workers and distributed environments.", "typical_deployment": "FortiClient EMS is server-side enterprise management software deployed to centrally manage Fortinet endpoint clients across organizations. It typically runs as a web-based management console and API service.", "deployment_statistics": "Approximately 60-70% of FortiClient EMS deployments are internet-facing, as organizations need to manage endpoints for remote workers, branch offices, and mobile users. The COVID-19 remote work shift significantly increased internet-facing deployments of endpoint management platforms.", "active_exploitation": "Confirmed active exploitation - added to CISA KEV catalog on April 1, 2026. This indicates threat actors are actively targeting this vulnerability in real-world attacks.", "severity_factors": [ "CVSS 9.1 Critical severity", "No authentication required", "Remote code execution capability", "Active exploitation confirmed", "Internet-facing deployment common", "Enterprise endpoint management critical infrastructure" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "IMMEDIATE: Upgrade to FortiClient EMS version 7.4.7 or 7.2.11+ as soon as available", "URGENT: If patching not immediately possible, restrict network access to FortiClient EMS servers and implement additional monitoring", "Monitor FortiClient EMS logs for suspicious authentication attempts and unusual administrative activities", "Verify integrity of managed endpoint configurations and policies", "PATCH PRIORITY: P0 (Emergency) - Actively exploited critical RCE in commonly internet-facing infrastructure" ], "risk_assessment": { "exploit_likelihood": "VERY HIGH - Unauthenticated RCE with confirmed active exploitation and public disclosure. Attack complexity is low with no user interaction required.", "impact_assessment": "CRITICAL - Complete system compromise with high impact to confidentiality, integrity, and availability. Compromise of endpoint management server can lead to widespread enterprise network access and lateral movement.", "exposure_scope": "HIGH - FortiClient EMS is widely deployed in enterprise environments, with majority of deployments likely internet-accessible to support remote endpoint management. Thousands of organizations potentially affected." }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "**CVE-2026-35616** is a vulnerability affecting **Fortinet FortiClient EMS** versions 7.4.5 through 7.4.6 【1】. It is an **improper access control vulnerability** that may allow an unauthenticated attacker to execute arbitrary code 【1】.\n\nRegarding its exploitation:\n\n* **Active Exploitation:** There is evidence of **active exploitation** of CVE-2026-35616 【2】. It was added to CISA's Known Exploited Vulnerabilities (KEV) catalog on April 1, 2026, due to this active exploitation 【3】.\n* **Internet-Facing Applications:** While the specific details of how this vulnerability is being exploited in relation to internet-facing applications are not explicitly stated, vulnerabilities in endpoint management solutions like FortiClient EMS can often be targeted through network access, potentially affecting internet-facing services if not properly secured.\n* **Attack Vectors and Exploitation Methods:** The vulnerability allows an **unauthenticated attacker** to execute arbitrary code 【1】. Further technical details on the specific attack vectors and exploitation methods are not provided in the available information.\n* **Targeted Attacks:** It is **not currently known** if the same threat actor is behind the exploitation of CVE-2026-35616 and another recently patched FortiClient EMS vulnerability (CVE-2026-21643), or if they are being weaponized together 【2】.\n* **CISA Known Exploited Vulnerabilities (KEV) Status:** CVE-2026-35616 is listed in **CISA's Known Exploited Vulnerabilities (KEV) Catalog** 【3】. This catalog is maintained by CISA as an authoritative source of vulnerabilities that have been exploited in the wild, and organizations are encouraged to use it for vulnerability management prioritization 【4】.\n* **Technical Details about Internet Exploitability:** The vulnerability is described as an **improper access control** issue 【1】. This type of vulnerability can often be exploited remotely if the affected component is accessible over a network. However, specific technical details regarding the exploitability over the internet are not detailed in the provided sources.\n\nSources:\n- CVE-2026-35616 Detail - NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-35616\n- Fortinet Patches Actively Exploited CVE-2026-35616 in FortiClient EMS: https://thehackernews.com/2026/04/fortinet-patches-actively-exploited-cve.html\n- CISA Adds One Known Exploited Vulnerability to Catalog: https://www.cisa.gov/news-events/alerts/2026/04/01/cisa-adds-one-known-exploited-vulnerability-catalog\n- Known Exploited Vulnerabilities Catalog - CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "references": [ { "title": "CVE-2026-35616 Detail - NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35616", "citation_contribution": 486, "snippet": "A improper access control vulnerability in Fortinet FortiClientEMS 7.4.5 through 7.4.6 may allow an unauthenticated attacker to execute ...", "is_search_result": true }, { "title": "Fortinet Patches Actively Exploited CVE-2026-35616 in FortiClient EMS", "url": "https://thehackernews.com/2026/04/fortinet-patches-actively-exploited-cve.html", "citation_contribution": 336, "snippet": "The development comes merely days after another recently-patched, critical vulnerability in FortiClient EMS (CVE-2026-21643, CVSS score: 9.1) came under active exploitation. It's currently not known if the same threat actor is behind the exploitation of both the flaws, and if they are being weaponized together.", "is_search_result": true }, { "title": "CISA Adds One Known Exploited Vulnerability to Catalog", "url": "https://www.cisa.gov/news-events/alerts/2026/04/01/cisa-adds-one-known-exploited-vulnerability-catalog", "citation_contribution": 263, "snippet": "This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise. Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the KEV Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs ...", "is_search_result": true }, { "title": "Known Exploited Vulnerabilities Catalog - CISA", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "citation_contribution": 206, "snippet": "For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild. Organizations should use the KEV catalog as an input to their vulnerability management prioritization framework.How to use the KEV ...", "is_search_result": true } ], "timestamp": "2026-04-06T15:35:13.971324" }, "cache_timestamp": "2026-04-06T15:35:31.210350", "displayed_on_website": false }, { "cve_id": "CVE-2026-3502", "cvss_score": "7.8", "attack_vector": "ADJACENT_NETWORK", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1557", "deployment_likelihood": "VERY_LOW", "cve_published_date": "2026-03-30T18:05:42.806Z", "cve_published_date_formatted": "2026-03-30", "kev_date_added": "2026-04-02", "kev_date_added_formatted": "2026-04-02", "kev_due_date": "2026-04-16", "days_to_kev": 3, "days_since_kev": null, "is_new_kev": false, "summary": "TrueConf Client fails to verify update integrity, allowing attackers who can intercept the update delivery path to inject malicious code. This requires network positioning and user-initiated update actions, making direct internet exploitation unlikely.", "detailed_analysis": { "vulnerability_type": "Update mechanism lacks integrity verification (CWE-494)", "affected_products": [ "TrueConf Client (videoconferencing client software)" ], "exploitation_requirements": [ "Ability to intercept/manipulate update delivery path", "User must initiate update process", "High privileges on adjacent network" ], "internet_facing_likelihood": "TrueConf Client is desktop client software for videoconferencing, not a server application. It does not listen on network ports or provide services to external users. While it connects to the internet to communicate with TrueConf servers and download updates, it is not an internet-facing service that can be directly exploited remotely.", "typical_deployment": "Desktop client application installed on end-user workstations for videoconferencing. Users connect through the client to TrueConf servers for meetings.", "deployment_statistics": "0% - This is client software that runs on user desktops/laptops, not server infrastructure. It does not accept incoming connections or provide public-facing services.", "active_exploitation": "Listed in CISA KEV with evidence of active exploitation in 'Operation TrueChaos' campaign targeting Southeast Asian government entities", "severity_factors": [ "CISA KEV listing indicates active exploitation", "Requires network positioning to intercept updates", "User interaction required for update process", "High privileges required on adjacent network", "Scope change possible in CVSS" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Update TrueConf Client to version 8.5.3 or later immediately", "Monitor network traffic for suspicious update mechanisms", "Implement network segmentation to prevent man-in-the-middle attacks on update channels", "Consider blocking automatic updates until patching is complete", "Verify integrity of existing TrueConf Client installations" ], "risk_assessment": { "exploit_likelihood": "Low for direct internet exploitation - requires network positioning and user interaction, but HIGH for targeted attacks given CISA KEV status", "impact_assessment": "High impact if exploited - arbitrary code execution in user context with potential for privilege escalation", "exposure_scope": "Limited - affects client software installations, not internet-facing infrastructure" }, "exploitation_method": "OTHER", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:37:56.395517", "displayed_on_website": false }, { "cve_id": "CVE-2026-34926", "cvss_score": "6.7", "attack_vector": "LOCAL", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1068", "deployment_likelihood": "MEDIUM", "cve_published_date": "2026-05-21T13:03:21.164Z", "cve_published_date_formatted": "2026-05-21", "kev_date_added": "2026-05-21", "kev_date_added_formatted": "2026-05-21", "kev_due_date": "2026-06-04", "days_to_kev": 0, "days_since_kev": 14, "is_new_kev": false, "summary": "A directory traversal vulnerability in Trend Micro Apex One on-premise servers allows pre-authenticated local attackers with administrative credentials to inject malicious code for deployment to agents. This requires local access to the server and existing admin credentials, making it a privilege escalation rather than initial access vector.", "detailed_analysis": { "vulnerability_type": "Directory traversal allowing code injection into agent deployment mechanism", "affected_products": [ "Trend Micro Apex One", "Trend Micro Apex One as a Service" ], "exploitation_requirements": [ "Local access to Apex One server", "Pre-existing administrative credentials", "Physical or remote access to server console" ], "internet_facing_likelihood": "While Apex One servers may have internet connectivity for updates and cloud communication, the vulnerability specifically requires LOCAL access to the server itself. The admin console may be web-based but the exploitation vector is local file system manipulation, not network-based exploitation of a public-facing service.", "typical_deployment": "Apex One is enterprise endpoint security management software typically deployed as on-premise servers within corporate networks, behind firewalls, with limited internet exposure of management interfaces", "deployment_statistics": "Estimated 10-30% of deployments might have management interfaces accessible from internet, but this vulnerability requires local server access regardless of network accessibility", "active_exploitation": "Listed in CISA KEV catalog indicating active exploitation in the wild", "severity_factors": [ "Requires pre-existing admin access", "Local attack vector only", "Can deploy malicious code to all managed endpoints", "CISA KEV listed indicating active threats" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately update Apex One to version 14.0.0.17079 or later for on-premise installations", "Update Apex One as a Service to version 14.0.20731 or later", "Review server access logs for unauthorized local access attempts", "Verify integrity of agent deployment packages and configurations", "Implement additional monitoring for server console access", "Review and restrict administrative access to Apex One servers", "HIGH PRIORITY patching due to CISA KEV status and potential for lateral movement" ], "risk_assessment": { "exploit_likelihood": "Medium - requires local access and admin credentials but CISA KEV listing indicates active exploitation", "impact_assessment": "High - successful exploitation allows malicious code deployment to all managed endpoints across the enterprise", "exposure_scope": "Limited by local access requirement - primarily affects organizations where attackers have already gained administrative access to security infrastructure" }, "exploitation_method": "OTHER", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:47:53.712376", "displayed_on_website": false }, { "cve_id": "CVE-2026-34621", "cvss_score": "8.6", "attack_vector": "LOCAL", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1203", "deployment_likelihood": "VERY_LOW", "cve_published_date": "2026-04-11T06:45:43.512Z", "cve_published_date_formatted": "2026-04-11", "kev_date_added": "2026-04-13", "kev_date_added_formatted": "2026-04-13", "kev_due_date": "2026-04-27", "days_to_kev": 2, "days_since_kev": null, "is_new_kev": false, "summary": "Adobe Acrobat Reader is affected by a prototype pollution vulnerability that enables arbitrary code execution. Exploitation requires a user to open a malicious PDF file, making this a client-side attack rather than server exploitation.", "detailed_analysis": { "vulnerability_type": "Prototype Pollution (CWE-1321) leading to arbitrary code execution", "affected_products": [ "Adobe Acrobat Reader" ], "exploitation_requirements": [ "User must open a malicious PDF file", "No network service exploitation", "Local file access required" ], "internet_facing_likelihood": "Adobe Acrobat Reader is client-side software designed for end-users to view PDF documents. It is not server software and has no legitimate reason to be deployed as an internet-facing service. Nearly 0% of deployments would be internet-accessible as this would violate basic security principles.", "typical_deployment": "Adobe Acrobat Reader is desktop client software installed on end-user workstations and personal computers for viewing PDF documents. It is not designed as server software.", "deployment_statistics": "Less than 1% - Reader is client software not intended for server deployment. Any internet-facing deployment would be a severe security misconfiguration.", "active_exploitation": "Listed in CISA KEV catalog indicating active exploitation in the wild, likely through malicious PDF documents distributed via email or web downloads", "severity_factors": [ "High CVSS score of 8.6", "Active exploitation confirmed", "Arbitrary code execution capability", "However, requires user interaction", "Attack vector is LOCAL not NETWORK" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Update Adobe Acrobat Reader to versions newer than 26.001.21367 immediately", "Implement email security controls to block malicious PDF attachments", "Educate users about opening untrusted PDF files", "Consider application sandboxing and endpoint detection solutions", "Monitor for suspicious process execution from Adobe Reader" ], "risk_assessment": { "exploit_likelihood": "High likelihood for targeted phishing campaigns but very low for direct internet exploitation since Reader is client software", "impact_assessment": "High impact on individual systems - arbitrary code execution in user context with potential for lateral movement", "exposure_scope": "Affects end-user workstations rather than internet-facing servers. Risk is through email/web-based distribution of malicious PDFs" }, "exploitation_method": "USER_INTERACTION", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:40:03.197630", "displayed_on_website": false }, { "cve_id": "CVE-2026-34197", "cvss_score": "8.8", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2026-04-07T07:50:10.958Z", "cve_published_date_formatted": "2026-04-07", "kev_date_added": "2026-04-16", "kev_date_added_formatted": "2026-04-16", "kev_due_date": "2026-04-30", "days_to_kev": 9, "days_since_kev": null, "is_new_kev": false, "summary": "Critical remote code execution vulnerability in Apache ActiveMQ through the Jolokia JMX-HTTP bridge exposed on web console. Authenticated attackers can exploit crafted discovery URIs to trigger remote Spring XML loading, leading to arbitrary code execution via bean factory methods.", "detailed_analysis": { "vulnerability_type": "Remote Code Execution via Code Injection through Jolokia JMX-HTTP bridge", "affected_products": [ "Apache ActiveMQ", "Apache ActiveMQ Broker", "Apache ActiveMQ All" ], "exploitation_requirements": [ "Network access to ActiveMQ web console", "Valid authentication credentials", "Access to Jolokia API endpoint at /api/jolokia/" ], "internet_facing_likelihood": "Apache ActiveMQ is a message broker frequently deployed in internet-facing architectures for enterprise integration, microservices communication, and cloud deployments. Estimated 60-70% of ActiveMQ deployments have some level of internet exposure, either directly or through application gateways.", "typical_deployment": "Server-side message broker infrastructure deployed as standalone services or embedded in application servers, commonly exposed for remote client connections and web-based management", "deployment_statistics": "Approximately 60-70% of ActiveMQ deployments are internet-accessible due to their role in distributed systems, B2B integrations, and cloud architectures requiring remote client connectivity", "active_exploitation": "Not currently listed in CISA KEV catalog, though web search indicates potential for active exploitation given the critical nature and public disclosure", "severity_factors": [ "Remote code execution capability", "Network-based attack vector", "Affects widely-deployed message broker", "Exploitable through web console interface", "Authentication required reduces immediate risk", "Can be chained with other vulnerabilities for unauthenticated RCE" ] }, "recommendations": [ "CRITICAL: Immediately upgrade to ActiveMQ version 5.19.4 or 6.2.3 which fixes this vulnerability", "Audit all ActiveMQ deployments for internet exposure and implement network segmentation where possible", "Review authentication mechanisms and access controls for ActiveMQ web console and Jolokia endpoints", "Monitor ActiveMQ logs for suspicious Jolokia API calls and unusual MBean operations", "Consider disabling Jolokia endpoint if JMX remote management is not required", "Implement additional network-level protections (WAF, IP allowlisting) for internet-facing ActiveMQ instances" ], "risk_assessment": { "exploit_likelihood": "High - Direct network exploitation possible against internet-facing ActiveMQ instances with valid credentials. Jolokia API provides accessible attack surface.", "impact_assessment": "Critical - Full remote code execution on broker JVM allows complete system compromise, data theft, service disruption, and potential lateral movement", "exposure_scope": "Significant - ActiveMQ is widely deployed in enterprise environments, with majority of deployments requiring network connectivity for distributed messaging architectures" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "**CVE-2026-34197** is a critical vulnerability that allows for **remote code execution (RCE)** in Apache ActiveMQ 【4】【6】.\n\nHere's a breakdown of what is known about its exploitation:\n\n* **Internet-Facing Applications/Services:** The vulnerability affects ActiveMQ, which can be deployed in internet-facing scenarios. Exploitation requires network access to the broker and valid authentication 【1】.\n* **Evidence of Active Exploitation:** While the EPSS score suggests a low probability of exploitation in the wild 【1】, CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation 【5】. However, CVE-2026-34197 is **not currently listed** in the CISA KEV catalog 【1】.\n* **Attack Vectors and Exploitation Methods:**\n * Attackers can exploit this vulnerability by invoking operations with a crafted discovery URI that triggers the VM transport's `brokerConfig` parameter to load a remote Spring XML application context 【2】.\n * This process uses `ResourceXmlApplicationContext`, which instantiates all singleton beans before configuration validation. This allows for arbitrary code execution on the broker's JVM through bean factory methods like `Runtime.exec()` 【2】.\n * The vulnerability can be exploited via the **Jolokia API** 【4】【6】.\n * It has been noted that when chained with CVE-2024-32114, it can lead to unauthenticated RCE on certain versions 【7】.\n* **Targeted Attacks:** The vulnerability enables attackers to execute unauthorized operating system commands, which could be used to disable the product, or read and modify data 【3】. This capability suggests it could be used in targeted attacks to compromise specific systems or data.\n* **CISA Known Exploited Vulnerabilities (KEV) Status:** As of the latest information, **CVE-2026-34197 is not listed** in the CISA KEV catalog 【1】. CISA maintains this catalog to highlight vulnerabilities that have been actively exploited in the wild 【8】.\n* **Technical Details about Internet Exploitability:** The vulnerability allows for **remote code execution** once an attacker has broker credentials 【1】. The exploitation involves manipulating the `brokerConfig` parameter to load a remote Spring XML application context, leading to code execution on the broker's JVM 【2】. The Jolokia API is a key component in the exploitation process 【4】【6】.\n\nSources:\n- CVE-2026-34197 - Vulnerability Details - OpenCVE: https://app.opencve.io/cve/CVE-2026-34197\n- NVD - CVE-2026-34197: https://nvd.nist.gov/vuln/detail/CVE-2026-34197\n- CVE-2026-34197 - Red Hat Customer Portal: https://access.redhat.com/security/cve/cve-2026-34197\n- CVE-2026-34197 ActiveMQ RCE via Jolokia API | Horizon3.ai: https://horizon3.ai/attack-research/disclosures/cve-2026-34197-activemq-rce-jolokia/\n- CISA Adds Two Known Exploited Vulnerabilities to Catalog: https://www.cisa.gov/news-events/alerts/2026/04/14/cisa-adds-two-known-exploited-vulnerabilities-catalog", "references": [ { "title": "CVE-2026-34197 - Vulnerability Details - OpenCVE", "url": "https://app.opencve.io/cve/CVE-2026-34197", "citation_contribution": 702, "snippet": "The vulnerability scores 8.8 on CVSS, indicating high severity. The EPSS score is below 1 %, suggesting a low probability of exploitation in the wild, and it is not listed in the CISA KEV catalog. Nevertheless, because it enables remote code execution once an attacker has broker credentials, the risk remains significant. Exploitation requires network access to the broker, valid authentication ...", "is_search_result": true }, { "title": "NVD - CVE-2026-34197", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34197", "citation_contribution": 613, "snippet": "CVE-2026-34197 Detail.An authenticated attacker can invoke these operations with a crafted discovery URI that triggers the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext. Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec().", "is_search_result": true }, { "title": "CVE-2026-34197 - Red Hat Customer Portal", "url": "https://access.redhat.com/security/cve/cve-2026-34197", "citation_contribution": 181, "snippet": "Attackers could execute unauthorized operating system commands, which could then be used to disable the product, or read and modify data for ...", "is_search_result": true }, { "title": "CVE-2026-34197 ActiveMQ RCE via Jolokia API | Horizon3.ai", "url": "https://horizon3.ai/attack-research/disclosures/cve-2026-34197-activemq-rce-jolokia/", "citation_contribution": 120, "snippet": "CVE-2026-34197 is an ActiveMQ RCE flaw exploiting Jolokia to execute remote commands. Learn how it works, affected versions, and detection steps.", "is_search_result": true }, { "title": "CISA Adds Two Known Exploited Vulnerabilities to Catalog", "url": "https://www.cisa.gov/news-events/alerts/2026/04/14/cisa-adds-two-known-exploited-vulnerabilities-catalog", "citation_contribution": 135, "snippet": "CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.", "is_search_result": true } ], "timestamp": "2026-04-16T17:10:38.764140" }, "cache_timestamp": "2026-04-16T17:10:56.786466", "displayed_on_website": false }, { "cve_id": "CVE-2026-33825", "cvss_score": "7.8", "attack_vector": "LOCAL", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1068", "deployment_likelihood": "LOW", "cve_published_date": "2026-04-14T16:57:49.361Z", "cve_published_date_formatted": "2026-04-14", "kev_date_added": "2026-04-22", "kev_date_added_formatted": "2026-04-22", "kev_due_date": "2026-05-06", "days_to_kev": 8, "days_since_kev": null, "is_new_kev": false, "summary": "This is a local privilege escalation vulnerability in Microsoft Defender Antimalware Platform that requires existing local access to the system. Despite being high severity and in CISA KEV, it cannot be exploited directly over the internet as it's an endpoint security tool, not a public-facing service.", "detailed_analysis": { "vulnerability_type": "Insufficient granularity of access control allowing local privilege escalation", "affected_products": [ "Microsoft Defender Antimalware Platform" ], "exploitation_requirements": [ "Local system access", "Low-level user privileges", "Existing foothold on the target system" ], "internet_facing_likelihood": "Microsoft Defender Antimalware Platform is endpoint security software that runs on client workstations and servers but does not typically expose network-accessible services to the internet. While it may run on servers that are internet-connected, the antimalware engine itself does not operate as a public-facing application or service. Less than 5% of deployments would have any internet-accessible attack surface for this component.", "typical_deployment": "Microsoft Defender is deployed as an endpoint protection solution on workstations, laptops, and servers. It operates as a background service and scanning engine, not as a network-accessible service.", "deployment_statistics": "Estimated <5% of deployments expose any network-accessible attack surface, and even those would typically be internal management interfaces, not public-facing services", "active_exploitation": "Listed in CISA KEV catalog indicating active exploitation in the wild, likely as part of multi-stage attacks for privilege escalation after initial system compromise", "severity_factors": [ "High CVSS score of 7.8", "Active exploitation confirmed by CISA KEV listing", "Total technical impact", "Affects widely deployed security software", "Local attack vector limits direct internet exploitation" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Update Microsoft Defender Antimalware Platform to version 4.18.26030.3011 or later immediately", "Monitor for unusual privilege escalation activities and unauthorized administrative access", "Review recent security events and authentication logs for signs of compromise", "Patch priority: HIGH - due to CISA KEV listing and active exploitation evidence" ], "risk_assessment": { "exploit_likelihood": "High likelihood for systems already compromised by attackers, but very low likelihood for direct internet-based exploitation due to local attack vector requirement", "impact_assessment": "High impact - successful exploitation provides complete system compromise (high confidentiality, integrity, and availability impact)", "exposure_scope": "Limited direct internet exposure as this affects endpoint security software rather than public-facing services, but potentially affects millions of systems if attackers gain initial access through other means" }, "exploitation_method": "OTHER", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:42:58.423715", "displayed_on_website": false }, { "cve_id": "CVE-2026-33634", "cvss_score": "9.4", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1195", "deployment_likelihood": "LOW", "cve_published_date": "2026-03-23T21:47:29.636Z", "cve_published_date_formatted": "2026-03-23", "kev_date_added": "2026-03-26", "kev_date_added_formatted": "2026-03-26", "kev_due_date": "2026-04-09", "days_to_kev": 3, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2026-33634 represents a supply chain compromise where malicious code was embedded in security tools (Trivy, LiteLLM) and GitHub Actions. While technically network-exploitable, this is not a direct internet-facing application vulnerability but rather requires victims to download and execute compromised packages.", "detailed_analysis": { "vulnerability_type": "Supply Chain Compromise - Embedded Malicious Code (CWE-506)", "affected_products": [ "Trivy Security Scanner", "LiteLLM", "Trivy GitHub Actions (setup-trivy, trivy-action)" ], "exploitation_requirements": [ "Victim must download compromised package versions", "Execution of malicious code in CI/CD pipeline or local environment", "Access to credentials/secrets in the execution environment" ], "internet_facing_likelihood": "While LiteLLM can be deployed as a proxy server that might be internet-facing, the primary exploitation vector is through supply chain compromise rather than direct internet exploitation. Trivy is primarily a security scanning tool used in development pipelines, not typically exposed to the internet. The vulnerability exploits the trust relationship in package distribution systems.", "typical_deployment": "Trivy: Development tool/CI-CD pipeline component, typically internal. LiteLLM: Can be deployed as API proxy but often internal. GitHub Actions: CI/CD automation, internal to development workflows.", "deployment_statistics": "Estimated <20% of LiteLLM deployments might be internet-facing as API proxies. Trivy deployments are rarely internet-facing (~5%). However, the attack vector doesn't require internet-facing deployment - it exploits the software supply chain.", "active_exploitation": "Confirmed active exploitation - added to CISA KEV catalog. Evidence includes malicious releases published March 19, 2026, credential-stealing payloads, and creation of 'tpcp-docs' repositories for exfiltration.", "severity_factors": [ "Critical CVSS score of 9.4", "Confirmed active exploitation in wild", "Wide deployment of affected tools in development environments", "Credential theft capability", "Supply chain attack affecting multiple ecosystems" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Look for 'tpcp-docs' repositories, review CI/CD logs from March 19-20 2026, verify no execution of Trivy v0.69.4 or LiteLLM 1.82.7-1.82.8", "Immediately rotate all secrets accessible to affected pipelines and environments", "Audit all GitHub Actions workflows using aquasecurity/trivy-action or aquasecurity/setup-trivy with version tags", "Pin GitHub Actions to full commit SHA hashes instead of mutable version tags", "Update to safe versions: Trivy 0.69.3+, trivy-action 0.35.0+, setup-trivy 0.2.6+ (recreated), LiteLLM 1.82.9+", "HIGH priority patching - supply chain compromises require immediate response" ], "risk_assessment": { "exploit_likelihood": "LOW for direct internet exploitation - this is primarily a supply chain attack requiring victim interaction (downloading/executing compromised packages) rather than direct network exploitation of internet-facing services", "impact_assessment": "CRITICAL impact if exploited - full credential theft, potential for lateral movement, compromise of CI/CD pipelines and development environments", "exposure_scope": "Limited direct internet exposure, but widespread impact through development toolchain compromise affecting organizations globally" }, "exploitation_method": "OTHER", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "**CVE-2026-33634** is a critical vulnerability with a CVSS score of 9.4, stemming from a **supply chain attack on the Trivy security scanner** 【8】 【15】. The attack involved compromised credentials being used to publish a malicious version of Trivy (v0.69.4) and alter version tags in related GitHub Actions 【5】 【16】 【8】. This allowed for **credential theft** 【3】 【10】 【8】, as the embedded malware targeted GitHub Actions runner environments to extract secrets 【2】 【7】.\n\nHere's a breakdown of what is known about its exploitation:\n\n* **Internet-facing applications or services:** While the vulnerability itself is within the Trivy security scanner, its exploitation has **significant implications for organizations relying on CI/CD pipelines and DevOps practices** 【1】 【14】. Trivy is widely used to detect security issues in container images, file systems, and repositories, making its compromise a **severe supply chain risk** 【1】 【14】 【13】. The attack has also expanded to affect other frameworks like Checkmarx KICS and LiteLLM 【7】, and malicious Docker images were pushed 【12】.\n\n* **Evidence of active exploitation in the wild:** **Yes, there is clear evidence of active exploitation** 【9】 【18】 【14】 【13】. CISA added CVE-2026-33634 to its **Known Exploited Vulnerabilities (KEV) Catalog** on March 26, 2026, citing evidence of active exploitation 【4】 【9】 【1】 【17】 【14】 【13】. Some reports indicate that exploitation has been ongoing since March 19, 2026 【5】 【19】.\n\n* **Attack vectors and exploitation methods:** The primary attack vector is a **supply-chain compromise** 【6】. Threat actors, identified as TeamPCP, used compromised credentials to publish malicious versions of Trivy and its associated GitHub Actions 【2】 【10】 【20】 【8】. The malicious code embedded within these components acted as an **information-stealing malware** 【10】, targeting ephemeral runner environments within CI/CD pipelines to harvest credentials, keys, and tokens 【2】 【10】.\n\n* **Whether it's been used in targeted attacks:** The information available points to a **widespread supply chain attack** rather than specifically targeted attacks against individual organizations. The compromise of a widely used security tool like Trivy allows attackers to potentially impact a large number of organizations that integrate it into their development workflows 【1】 【14】.\n\n* **CISA Known Exploited Vulnerabilities status:** **CVE-2026-33634 has been added to the CISA Known Exploited Vulnerabilities (KEV) Catalog** 【4】 【9】 【1】 【17】 【14】 【13】. This addition signifies that CISA has credible evidence of active exploitation in the wild 【11】.\n\n* **Technical details about internet exploitability:** The exploitability is rooted in the **supply chain compromise of the Trivy ecosystem** 【3】 【3】 【6】. The vulnerability arises from the use of mutable tags in GitHub Actions and the ability for threat actors to publish malicious code disguised as legitimate updates 【3】 【2】 【16】. The malicious payload, upon execution in a GitHub Actions runner, performs process discovery to locate and steal secrets 【7】. The attack vector requires a compromised personal access token or credential to publish malicious artifacts 【6】.\n\nSources:\n- CISA Adds Critical Aquasecurity Trivy Scanner: https://gbhackers.com/cisa-adds-critical-aquasecurity-trivy-scanner-vulnerability/\n- CVE-2026-33634: CVE-2026-33634: Remote Supply Chain Compromise in Trivy ...: https://cvereports.com/reports/CVE-2026-33634\n- CVE-2026-33634 and the Trivy supply chain compromise - Penligent: https://www.penligent.ai/hackinglabs/cve-2026-33634-and-the-trivy-supply-chain-compromise-how-mutable-tags-turned-a-security-scanner-into-a-credential-stealer/\n- CISA Adds One Known Exploited Vulnerability to Catalog | CISA: https://www.cisa.gov/news-events/alerts/2026/03/26/cisa-adds-one-known-exploited-vulnerability-catalog\n- CVE-2026-33634 : Trivy is a security scanner. On March 19, 2026, a ...: https://www.cvedetails.com/cve/CVE-2026-33634/", "references": [ { "title": "CISA Adds Critical Aquasecurity Trivy Scanner", "url": "https://gbhackers.com/cisa-adds-critical-aquasecurity-trivy-scanner-vulnerability/", "citation_contribution": 768, "snippet": "Tracked as CVE-2026-33634, this security weakness involves embedded malicious code that targets continuous integration and continuous deployment (CI/CD) environments. ... Because Trivy is a widely adopted open-source vulnerability scanner used natively within DevOps pipelines, this active exploitation presents a severe supply chain risk for organizations worldwide. ... With the addition of CVE-2026-33634 on March 26, 2026, CISA has issued a strict compliance deadline.", "is_search_result": true }, { "title": "CVE-2026-33634: CVE-2026-33634: Remote Supply Chain Compromise in Trivy ...", "url": "https://cvereports.com/reports/CVE-2026-33634", "citation_contribution": 335, "snippet": "A highly critical supply chain compromise affecting the Aqua Security Trivy ecosystem, including the core scanner and its associated GitHub Actions. The attack, attributed to the threat actor TeamPCP, leveraged compromised CI/CD credentials and non-atomic secret rotation to embed malicious code within official releases. This embedded infostealer targets ephemeral runner environments to extract ...", "is_search_result": true }, { "title": "CVE-2026-33634 and the Trivy supply chain compromise - Penligent", "url": "https://www.penligent.ai/hackinglabs/cve-2026-33634-and-the-trivy-supply-chain-compromise-how-mutable-tags-turned-a-security-scanner-into-a-credential-stealer/", "citation_contribution": 346, "snippet": "CVE-2026-33634 tracks the Trivy supply chain compromise that turned a trusted security scanner and its GitHub Actions into a path for credential theft. This article breaks down the attack chain, affected versions, payload behavior, detection steps, recovery actions, and the GitHub Actions hardening lessons security teams should carry forward. (NVD)", "is_search_result": true }, { "title": "CISA Adds One Known Exploited Vulnerability to Catalog | CISA", "url": "https://www.cisa.gov/news-events/alerts/2026/03/26/cisa-adds-one-known-exploited-vulnerability-catalog", "citation_contribution": 286, "snippet": "CVE-2026-33634 Aqua Security Trivy Embedded Malicious Code Vulnerability. This type of vulnerability is a frequent attack vector for ...", "is_search_result": true }, { "title": "CVE-2026-33634 : Trivy is a security scanner. On March 19, 2026, a ...", "url": "https://www.cvedetails.com/cve/CVE-2026-33634/", "citation_contribution": 232, "snippet": "CVE-2026-33634 : Trivy is a security scanner. On March 19, 2026, a threat actor used compromised credentials to publish a malicious Trivy v0.69.4 release, force-push 7", "is_search_result": true } ], "timestamp": "2026-03-27T17:40:15.628217" }, "cache_timestamp": "2026-03-27T17:40:37.757188", "displayed_on_website": false }, { "cve_id": "CVE-2026-33017", "cvss_score": "9.3", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2026-03-20T04:52:52.885Z", "cve_published_date_formatted": "2026-03-20", "kev_date_added": "2026-03-25", "kev_date_added_formatted": "2026-03-25", "kev_due_date": "2026-04-08", "days_to_kev": 5, "days_since_kev": null, "is_new_kev": false, "summary": "Critical unauthenticated remote code execution vulnerability in Langflow AI platform via public flow build endpoint. Attackers can execute arbitrary Python code without authentication, leading to complete system compromise.", "detailed_analysis": { "vulnerability_type": "Unauthenticated Remote Code Execution via Code Injection in Public API endpoint", "affected_products": [ "Langflow AI Platform < 1.9.0" ], "exploitation_requirements": [ "Network access to Langflow instance", "Knowledge of a public flow UUID (discoverable via shared links)", "No authentication required", "No user interaction required" ], "internet_facing_likelihood": "Langflow is commonly deployed as internet-facing web applications for AI workflow demonstrations, shared chatbots, and collaborative AI development environments. The platform's core functionality revolves around building and sharing AI workflows publicly, making internet exposure very common for legitimate business use cases.", "typical_deployment": "Langflow is server-side application software that runs as a web service with REST API endpoints. It's designed to be accessed via web browsers and provides public endpoints for sharing AI workflows and demonstrations.", "deployment_statistics": "Approximately 70-80% of Langflow deployments are likely internet-facing given its primary use case for demonstrating AI workflows, sharing chatbots, and collaborative development environments where public access is a core feature.", "active_exploitation": "Confirmed active exploitation in the wild. Attackers developed working exploits within 20 hours of disclosure and began internet-wide scanning for vulnerable instances. Added to CISA KEV catalog due to evidence of active exploitation.", "severity_factors": [ "CVSS 9.3 Critical severity", "Zero authentication required", "Direct remote code execution with full server privileges", "Confirmed active exploitation in the wild", "CISA KEV listed", "Arbitrary Python code execution via exec() without sandboxing", "Can lead to supply chain compromise via credential theft" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "IMMEDIATE: Upgrade to Langflow version 1.9.0 or later", "URGENT: If immediate patching is not possible, temporarily disable or restrict access to public flow endpoints", "Review all public flows and their UUIDs for potential compromise", "Monitor network traffic for suspicious POST requests to /api/v1/build_public_tmp/ endpoints", "Rotate all credentials and API keys that may have been exposed", "Implement network-level access controls to restrict exposure if public access is not required", "Priority: CRITICAL - Patch within 24-48 hours due to active exploitation" ], "risk_assessment": { "exploit_likelihood": "VERY HIGH - Active exploitation confirmed with public exploits available and internet-wide scanning observed within 20 hours of disclosure", "impact_assessment": "CRITICAL - Complete system compromise with arbitrary code execution, credential theft, and potential supply chain attacks through connected systems", "exposure_scope": "HIGH - Significant number of internet-facing Langflow instances vulnerable due to common deployment patterns for AI workflow sharing and demonstrations" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "**CVE-2026-33017** is a critical vulnerability affecting **Langflow**, an open-source visual framework used for building AI agents and Retrieval-Augmented Generation (RAG) pipelines 【2】.\n\nHere's what is known about its exploitation:\n\n* **Internet-facing applications or services:** The vulnerability **affects internet-facing applications** that have at least one public Langflow flow 【1】. This is common for demonstrations, chatbots, or shared workflows 【1】.\n* **Evidence of active exploitation:** **Active exploitation has been observed in the wild**. Attackers were able to develop working exploits within 20 hours of the vulnerability's disclosure and began scanning the internet for vulnerable instances 【3】.\n* **Attack vectors and exploitation methods:** The vulnerability allows for **unauthenticated remote code execution (RCE)** 【2】. Attackers can exploit this by leveraging a public flow's UUID, which can be discovered via shared links or URLs 【1】. The exploit involves executing code like `_x = os.system(\"id\")` during the graph building phase, before the flow even \"runs\" 【1】. This is possible because the code is passed to `exec()` with zero sandboxing 【5】. Successful exploitation grants attackers **full server process privileges**, enabling arbitrary command execution 【2】. Information exfiltrated includes keys and credentials, potentially leading to access to connected databases and software supply chain compromise 【3】.\n* **Targeted attacks:** While active exploitation is confirmed, the provided information does not specify if it has been used in targeted attacks.\n* **CISA Known Exploited Vulnerabilities (KEV) status:** **CVE-2026-33017 has been added to CISA's Known Exploited Vulnerabilities (KEV) Catalog** 【4】. This addition is based on evidence of active exploitation 【4】.\n* **Technical details about internet exploitability:** The vulnerability is exploitable remotely and unauthenticated 【2】. An attacker needs to know the public flow's UUID to initiate an attack 【1】. The core issue lies in the un-sandboxed execution of code passed to `exec()` during graph building 【1】【5】.\n\nSources:\n- CVE-2026-33017 Impact, Exploitability, and Mitigation Steps | Wiz: https://www.wiz.io/vulnerability-database/cve/cve-2026-33017\n- From Disclosure to Exploitation Overnight of a CVE-2026-33017 Langflow ...: https://hivepro.com/threat-advisory/from-disclosure-to-exploitation-overnight-of-a-cve-2026-33017-langflow-flaw/\n- Critical Langflow Flaw CVE-2026-33017 Triggers Attacks ...: https://thehackernews.com/2026/03/critical-langflow-flaw-cve-2026-33017.html\n- CISA Adds One Known Exploited Vulnerability to Catalog: https://www.cisa.gov/news-events/alerts/2026/03/18/cisa-adds-one-known-exploited-vulnerability-catalog\n- CVE-2026-33017 Detail - NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-33017", "references": [ { "title": "CVE-2026-33017 Impact, Exploitability, and Mitigation Steps | Wiz", "url": "https://www.wiz.io/vulnerability-database/cve/cve-2026-33017", "citation_contribution": 573, "snippet": "CVE-2026-33017: LangFlow vulnerability analysis and mitigation. Summary.An attacker's code like _x = os.system(\"id\") is an assignment and will be executed during graph building -- before the flow even \"runs.\" Prerequisites. Target Langflow instance has at least one public flow (common for demos, chatbots, shared workflows). Attacker knows the public flow's UUID (discoverable via shared links/URLs).", "is_search_result": true }, { "title": "From Disclosure to Exploitation Overnight of a CVE-2026-33017 Langflow ...", "url": "https://hivepro.com/threat-advisory/from-disclosure-to-exploitation-overnight-of-a-cve-2026-33017-langflow-flaw/", "citation_contribution": 541, "snippet": "CVE-2026-33017 is a critical unauthenticated remote code execution (RCE) vulnerability affecting Langflow, the popular open-source visual framework for building AI agents and Retrieval-Augmented Generation (RAG) pipelines. The impact of CVE-2026-33017 is severe and far-reaching. Successful exploitation grants an attacker full server process privileges, enabling arbitrary command execution and ...", "is_search_result": true }, { "title": "Critical Langflow Flaw CVE-2026-33017 Triggers Attacks ...", "url": "https://thehackernews.com/2026/03/critical-langflow-flaw-cve-2026-33017.html", "citation_contribution": 396, "snippet": "Langflow CVE-2026-33017 exploited in 20 hours after disclosure, enabling RCE via exec(), exposing systems before patching cycles.\"Attackers built working exploits directly from the advisory description and began scanning the internet for vulnerable instances. Exfiltrated information included keys and credentials, which provided access to connected databases and potential software supply chain compromise.\"", "is_search_result": true }, { "title": "CISA Adds One Known Exploited Vulnerability to Catalog", "url": "https://www.cisa.gov/news-events/alerts/2026/03/18/cisa-adds-one-known-exploited-vulnerability-catalog", "citation_contribution": 207, "snippet": "CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.", "is_search_result": true }, { "title": "CVE-2026-33017 Detail - NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33017", "citation_contribution": 128, "snippet": "This code is passed to exec() with zero sandboxing, resulting in unauthenticated remote code execution. This is distinct from CVE-2025-3248, ...", "is_search_result": true } ], "timestamp": "2026-03-25T17:15:15.466992" }, "cache_timestamp": "2026-03-25T17:15:34.353946", "displayed_on_website": false }, { "cve_id": "CVE-2026-32202", "cvss_score": "4.3", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1203", "deployment_likelihood": "LOW", "cve_published_date": "2026-04-14T16:57:36.996Z", "cve_published_date_formatted": "2026-04-14", "kev_date_added": "2026-04-28", "kev_date_added_formatted": "2026-04-28", "kev_due_date": "2026-05-12", "days_to_kev": 14, "days_since_kev": null, "is_new_kev": false, "summary": "Windows Shell spoofing vulnerability affecting client Windows systems that requires user interaction (UI:R in CVSS). Despite network attack vector, this is primarily a client-side vulnerability requiring user interaction rather than direct server exploitation.", "detailed_analysis": { "vulnerability_type": "Protection mechanism failure in Windows Shell allowing spoofing attacks over network", "affected_products": [ "Windows 10 (multiple versions)", "Windows 11 (multiple versions)", "Windows Server 2012", "Windows Server 2012 R2", "Windows Server 2016", "Windows Server 2019", "Windows Server 2022", "Windows Server 2025" ], "exploitation_requirements": [ "User interaction required (CVSS UI:R)", "Network access", "No authentication required", "User must open malicious file" ], "internet_facing_likelihood": "While Windows Server versions are affected, this is fundamentally a Windows Shell vulnerability requiring user interaction. The attack vector involves credential theft via SMB when malicious files are opened, indicating this targets client-side interactions rather than server services. Windows Shell is not typically an internet-facing service component.", "typical_deployment": "Windows Shell is a client-side operating system component present on both client and server systems but not designed as an internet-facing service. Server deployments may have Shell components but these are not typically exposed to internet traffic.", "deployment_statistics": "Less than 5% - Windows Shell components are not designed for direct internet exposure. Even on Windows Servers, the Shell is primarily for local administration, not internet-facing services.", "active_exploitation": "Confirmed active exploitation by APT28 threat actors using credential theft via SMB authentication when malicious files are opened", "severity_factors": [ "Active exploitation confirmed", "APT28 involvement indicates sophisticated attacks", "Requires user interaction reducing direct exploitability", "Credential theft capability", "Low CVSS score of 4.3", "Client-side vulnerability nature" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - confirmed active exploitation by APT28. Review SMB authentication logs for suspicious credential access attempts", "Apply Microsoft security updates immediately for all affected Windows versions", "Monitor for suspicious SMB authentication activity and credential theft attempts", "Implement user training on avoiding malicious file downloads", "HIGH priority patching due to active exploitation despite requiring user interaction" ], "risk_assessment": { "exploit_likelihood": "Low for direct internet exploitation - requires user interaction and targets client-side Shell component rather than server services", "impact_assessment": "Medium - credential theft capability but limited by need for user interaction", "exposure_scope": "Minimal for internet-facing exploitation - this primarily affects client systems and requires social engineering rather than direct server compromise" }, "exploitation_method": "USER_INTERACTION", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "Regarding **CVE-2026-32202**, here's what is known about its exploitation:\n\n- **Internet-facing applications or services:** While specific details about CVE-2026-32202's impact on internet-facing applications are not explicitly detailed in the provided information, it is a **Windows Shell vulnerability** 【2】. Vulnerabilities in operating system components like the Windows Shell can potentially be exploited through various attack vectors, including those that might involve internet-facing services if they interact with the shell.\n\n- **Evidence of active exploitation in the wild:** **Yes, there is confirmed evidence of active exploitation** 【1】【2】. Microsoft has confirmed this active exploitation 【1】.\n\n- **Attack vectors and exploitation methods:** The vulnerability stems from an **incomplete fix that allows attackers to steal credentials via SMB authentication when a malicious file is opened** 【1】. This suggests that a primary attack vector involves tricking a user into opening a malicious file, which then leverages the SMB protocol to steal credentials.\n\n- **Use in targeted attacks:** **CVE-2026-32202 has been linked to APT28**, a known threat actor group 【2】. This indicates its use in targeted attacks.\n\n- **CISA Known Exploited Vulnerabilities (KEV) status:** The provided information does not explicitly state that CVE-2026-32202 is currently on the CISA Known Exploited Vulnerabilities (KEV) Catalog. However, CISA does maintain such a catalog of actively exploited vulnerabilities 【3】【4】. Given the confirmed active exploitation and link to APT28, it is plausible it could be added or is already present.\n\n- **Technical details about internet exploitability:** The technical details indicate that the vulnerability allows for **credential theft through SMB authentication** 【1】. This implies that systems with SMB services exposed and vulnerable to this specific exploit could be targeted. The exploitability is described as stemming from an \"incomplete fix\" 【1】.\n\nSources:\n- Microsoft confirmed active exploitation of a Windows flaw → CVE ...: https://www.facebook.com/thehackernews/posts/-warning-microsoft-confirmed-active-exploitation-of-a-windows-flaw-cve-2026-3220/1354004550097458/\n- CVE-2026-32202 Microsoft Confirms Active Exploitation of Windows Shell: https://vulert.com/blog/windows-shell-cve-2026-32202-exploited/\n- Known Exploited Vulnerabilities Catalog - CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog\n- Reducing the Significant Risk of Known Exploited Vulnerabilities - CISA: https://www.cisa.gov/known-exploited-vulnerabilities", "references": [ { "title": "Microsoft confirmed active exploitation of a Windows flaw → CVE ...", "url": "https://www.facebook.com/thehackernews/posts/-warning-microsoft-confirmed-active-exploitation-of-a-windows-flaw-cve-2026-3220/1354004550097458/", "citation_contribution": 626, "snippet": "The bug stems from an incomplete fix, allowing attackers to steal credentials via SMB authentication when a malicious file is opened. Read ...", "is_search_result": true }, { "title": "CVE-2026-32202 Microsoft Confirms Active Exploitation of Windows Shell", "url": "https://vulert.com/blog/windows-shell-cve-2026-32202-exploited/", "citation_contribution": 420, "snippet": "The Windows Shell vulnerability CVE-2026-32202 is a clear example of how seemingly low-severity issues can become critical in real-world attacks. With active exploitation confirmed and ties to APT28, organizations must take immediate action.", "is_search_result": true }, { "title": "Known Exploited Vulnerabilities Catalog - CISA", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "citation_contribution": 197, "snippet": "For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild. Organizations should use the KEV catalog as an input to their vulnerability management prioritization framework.How to use the KEV ... ... Android Kernel binder_transaction of binder.c contains an out-of-bounds write vulnerability due to an incorrect bounds check that could allow for local privilege escalation. This vulnerability was observed chained with CVE-2019-2215 and CVE-2020-0069 under exploit chain \"AbstractEmu.\" Apply updates per vendor instructions.", "is_search_result": true }, { "title": "Reducing the Significant Risk of Known Exploited Vulnerabilities - CISA", "url": "https://www.cisa.gov/known-exploited-vulnerabilities", "citation_contribution": 85, "snippet": "Learn about the importance of CISA's Known Exploited Vulnerability (KEV) catalog and how to use it to help build a collective resilience across the cybersecurity community.", "is_search_result": true } ], "timestamp": "2026-04-28T17:40:33.775166" }, "cache_timestamp": "2026-04-28T17:40:50.879563", "displayed_on_website": false }, { "cve_id": "CVE-2026-32201", "cvss_score": "6.5", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2026-04-14T16:58:36.981Z", "cve_published_date_formatted": "2026-04-14", "kev_date_added": "2026-04-14", "kev_date_added_formatted": "2026-04-14", "kev_due_date": "2026-04-28", "days_to_kev": 0, "days_since_kev": null, "is_new_kev": false, "summary": "SharePoint Server spoofing vulnerability allowing unauthorized attackers to exploit via network access without authentication or user interaction. Listed in CISA KEV indicating active exploitation.", "detailed_analysis": { "vulnerability_type": "Improper input validation leading to spoofing attacks in SharePoint Server", "affected_products": [ "SharePoint Server 2019", "SharePoint Server Subscription Edition", "SharePoint Enterprise Server 2016" ], "exploitation_requirements": [ "Network access to SharePoint server", "No authentication required (PR:N)", "No user interaction required (UI:N)" ], "internet_facing_likelihood": "SharePoint Server is primarily designed as a web-based collaboration platform that organizations commonly expose to the internet for external user access, partner collaboration, and remote work scenarios", "typical_deployment": "SharePoint Server is enterprise web server software designed for document management, collaboration, and intranet/extranet portals. It runs as a web application server with IIS integration.", "deployment_statistics": "Estimated 70-85% of SharePoint deployments are internet-facing as organizations deploy SharePoint for external collaboration, remote access, and public-facing portals. Many organizations specifically expose SharePoint to enable remote work and partner access.", "active_exploitation": "Listed in CISA KEV catalog indicating confirmed active exploitation in the wild. CISA ADP metadata shows 'Exploitation: active' and 'Automatable: yes'", "severity_factors": [ "No authentication required (PR:N)", "No user interaction needed (UI:N)", "Network attack vector", "Active exploitation confirmed", "High likelihood of internet exposure", "Automatable exploitation" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Apply Microsoft security updates immediately for all affected SharePoint versions", "Review SharePoint access logs for suspicious spoofing activities or unauthorized access attempts", "Implement additional monitoring for SharePoint authentication and access patterns", "Consider temporarily restricting external access if patching cannot be completed immediately", "HIGHEST patch priority - actively exploited vulnerability in commonly internet-facing service" ], "risk_assessment": { "exploit_likelihood": "VERY HIGH - Active exploitation confirmed, no authentication required, automatable, and commonly internet-facing service", "impact_assessment": "MEDIUM - Spoofing attacks can lead to unauthorized access, data manipulation, and credential theft with partial confidentiality and integrity impact", "exposure_scope": "VERY HIGH - SharePoint is widely deployed enterprise software with high likelihood of internet exposure for collaboration and remote access" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "Regarding CVE-2026-32201, the available information does not specifically detail its exploitation status, attack vectors, or whether it has been used in targeted attacks. However, CISA's Known Exploited Vulnerabilities (KEV) Catalog is a resource that lists vulnerabilities with evidence of active exploitation 【1】【5】.\n\nCISA adds vulnerabilities to the KEV Catalog based on evidence of active exploitation 【5】【6】. This catalog is considered an authoritative source of vulnerabilities that have been exploited in the wild and is intended to help organizations prioritize their vulnerability management 【1】. The catalog is maintained under Binding Operational Directive 22-01, which focuses on vulnerabilities posing a significant risk to federal networks 【3】.\n\nWhile specific details for CVE-2026-32201 are not provided, the KEV catalog includes vulnerabilities that have crossed the line into real-world abuse 【3】. Successful exploitation of some vulnerabilities listed in the catalog may lead to consequences such as remote code execution to exfiltrate usernames and hashed passwords 【4】.\n\nThere is no information available regarding whether CVE-2026-32201 specifically affects internet-facing applications or services, nor are there details on its technical exploitability in that context. The catalog is updated based on daily open-source searches and information from vendor security advisories 【2】.\n\nSources:\n- Known Exploited Vulnerabilities Catalog - CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog\n- BOD 22-01: Reducing the Significant Risk of Known Exploited... | CISA: https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities\n- CISA Adds Citrix NetScaler CVE-2026-3055 to KEV—Patch NetScaler...: https://windowsforum.com/threads/cisa-adds-citrix-netscaler-cve-2026-3055-to-kev-patch-netscaler-now.408563/\n- Print View: https://www.cisa.gov/known-exploited-vulnerabilities-catalog-print\n- CISA Adds Seven Known Exploited Vulnerabilities to Catalog: https://www.cisa.gov/news-events/alerts/2026/04/13/cisa-adds-seven-known-exploited-vulnerabilities-catalog", "references": [ { "title": "Known Exploited Vulnerabilities Catalog - CISA", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "citation_contribution": 418, "snippet": "For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild. Organizations should use the KEV catalog as an input to their vulnerability management prioritization framework.How to use the KEV ...", "is_search_result": true }, { "title": "BOD 22-01: Reducing the Significant Risk of Known Exploited... | CISA", "url": "https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities", "citation_contribution": 308, "snippet": "CISA adds the reported actively exploited vulnerabilities to the KEV catalog, provided they meet BOD 22-01 requirements. Exploited vulnerabilities CISA uncovers through incident response efforts are also added to the KEV catalog. CISA analysts perform daily open-source searches for vulnerabilities. Active exploitation information obtained from vendor security advisories are trusted sources and considered accurate.", "is_search_result": true }, { "title": "CISA Adds Citrix NetScaler CVE-2026-3055 to KEV—Patch NetScaler...", "url": "https://windowsforum.com/threads/cisa-adds-citrix-netscaler-cve-2026-3055-to-kev-patch-netscaler-now.408563/", "citation_contribution": 298, "snippet": "CISA’s Known Exploited Vulnerabilities (KEV) Catalog has become one of the most operationally useful artifacts in modern vulnerability management. It is not a ranking of the scariest CVEs on paper; it is a living list of flaws that have already crossed the line into real-world abuse. CISA created the catalog under Binding Operational Directive 22-01, which established a remediation framework for vulnerabilities that pose significant risk to federal networks. (cisa.gov) That distinction is crucial.", "is_search_result": true }, { "title": "Print View", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog-print", "citation_contribution": 170, "snippet": "Successful exploitation may cause remote code execution to exfiltrate usernames and hashed passwords for the local device admin (s), portal admins, and user accounts used for remote access (but not external Active Directory or LDAP passwords).", "is_search_result": true }, { "title": "CISA Adds Seven Known Exploited Vulnerabilities to Catalog", "url": "https://www.cisa.gov/news-events/alerts/2026/04/13/cisa-adds-seven-known-exploited-vulnerabilities-catalog", "citation_contribution": 108, "snippet": "CISA has added seven new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.", "is_search_result": true } ], "timestamp": "2026-04-14T18:20:13.294583" }, "cache_timestamp": "2026-04-14T18:20:30.393298", "displayed_on_website": false }, { "cve_id": "CVE-2026-31431", "cvss_score": "7.8", "attack_vector": "LOCAL", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1068", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2026-04-22T08:15:10.123Z", "cve_published_date_formatted": "2026-04-22", "kev_date_added": "2026-05-01", "kev_date_added_formatted": "2026-05-01", "kev_due_date": "2026-05-15", "days_to_kev": 9, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2026-31431 is a Linux kernel vulnerability in the crypto subsystem (algif_aead) that requires local access to exploit. Despite being in CISA KEV due to active exploitation, this is a privilege escalation vulnerability that cannot be directly exploited over the internet.", "detailed_analysis": { "vulnerability_type": "Linux kernel crypto subsystem vulnerability in algif_aead affecting memory mapping operations", "affected_products": [ "Linux Kernel" ], "exploitation_requirements": [ "Local system access", "Low-level privileges", "Access to crypto interfaces" ], "internet_facing_likelihood": "The Linux kernel itself is not directly internet-facing - it's the underlying operating system. While Linux systems may run internet-facing services, the kernel vulnerability requires local access to exploit. The crypto subsystem (algif_aead) is accessed through local system calls, not network protocols.", "typical_deployment": "Linux kernel is infrastructure software that runs on servers, workstations, embedded devices, and IoT devices. It provides the core operating system functionality but is not directly exposed to network traffic.", "deployment_statistics": "While Linux runs on millions of internet-connected systems (estimated 70%+ of web servers), the kernel itself requires local access to exploit. The vulnerability is in the crypto API which is accessed locally through system calls, not network services.", "active_exploitation": "Listed in CISA KEV indicating confirmed active exploitation in the wild. Multiple exploit references and research available.", "severity_factors": [ "High CVSS score of 7.8", "Active exploitation confirmed", "Affects wide range of Linux versions", "Local privilege escalation potential", "Requires local access which limits immediate internet exposure" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs for suspicious local privilege escalation attempts, verify system integrity, and check for unauthorized local access", "Apply kernel updates immediately to affected Linux systems (versions 4.14 through unpatched 6.19.x)", "Monitor for unusual crypto API usage patterns and local privilege escalation attempts", "Highest priority for systems with multiple users or potential local access vectors", "Review access controls and user privilege separation on affected systems" ], "risk_assessment": { "exploit_likelihood": "High for systems with local access vectors, but requires initial system access - cannot be directly exploited from internet", "impact_assessment": "High impact once exploited - local privilege escalation can lead to full system compromise", "exposure_scope": "Millions of Linux systems affected, but exploitation requires local access rather than direct internet exploitation" }, "exploitation_method": "OTHER", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:45:02.317152", "displayed_on_website": false }, { "cve_id": "CVE-2026-3055", "cvss_score": "9.3", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2026-03-23T20:21:27.107Z", "cve_published_date_formatted": "2026-03-23", "kev_date_added": "2026-03-30", "kev_date_added_formatted": "2026-03-30", "kev_due_date": "2026-04-02", "days_to_kev": 7, "days_since_kev": null, "is_new_kev": false, "summary": "Critical memory overread vulnerability in NetScaler ADC and Gateway when configured as SAML IDP. Actively exploited in the wild with CISA KEV listing, directly exploitable over the network without authentication.", "detailed_analysis": { "vulnerability_type": "Out-of-bounds Read (CWE-125) due to insufficient input validation leading to memory overread", "affected_products": [ "NetScaler ADC", "NetScaler Gateway" ], "exploitation_requirements": [ "Network access to SAML IDP service", "No authentication required", "No user interaction required" ], "internet_facing_likelihood": "NetScaler ADC and Gateway are application delivery controllers and secure remote access gateways that are specifically designed to be internet-facing. When configured as SAML Identity Providers, they must be accessible from the internet to authenticate users. Estimated 85-95% of deployments are internet-facing as this is their primary business function.", "typical_deployment": "These are network infrastructure appliances deployed as internet-facing servers to provide load balancing, SSL termination, VPN access, and authentication services. They sit at the network perimeter and require internet connectivity to serve their primary functions.", "deployment_statistics": "Approximately 90% of NetScaler deployments are internet-facing, as they are purpose-built edge devices for application delivery and secure remote access. Organizations deploy them specifically to handle inbound internet traffic and provide authentication services.", "active_exploitation": "Yes - CISA has added this to the Known Exploited Vulnerabilities (KEV) catalog, indicating confirmed active exploitation in the wild since at least March 27, 2026. Threat actors are actively targeting these internet-facing authentication devices.", "severity_factors": [ "CVSS 9.3 Critical severity", "No authentication required", "No user interaction needed", "Affects internet-facing infrastructure", "Active exploitation confirmed", "Memory overread can lead to information disclosure", "Attack complexity is LOW" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Apply vendor patches immediately - update to NetScaler ADC/Gateway 14.1-66.59, 13.1-62.23, or 13.1 FIPS/NDcPP-37.262 or later", "Monitor SAML IDP authentication logs for suspicious activity and failed authentication attempts", "Implement network segmentation to limit access to NetScaler management interfaces", "HIGHEST patch priority - treat as emergency due to active exploitation and internet exposure" ], "risk_assessment": { "exploit_likelihood": "Very High - Active exploitation confirmed in the wild, no authentication required, low attack complexity, and widespread internet-facing deployments", "impact_assessment": "High - Memory overread vulnerability with CVSS 9.3 score affecting confidentiality, integrity, and availability. Could lead to information disclosure and potential system compromise", "exposure_scope": "Large - NetScaler products are widely deployed internet-facing infrastructure with an estimated 90% of deployments exposed to the internet" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "The **CVE-2026-3055** vulnerability affects **Citrix NetScaler ADC and NetScaler Gateway**, which are often configured as internet-facing authentication devices 【1】【5】.\n\n**Evidence of Active Exploitation:**\n* **Yes, there is evidence of active exploitation in the wild** 【6】【7】.\n* CISA has added this vulnerability to its **Known Exploited Vulnerabilities (KEV) Catalog** 【3】【7】. This catalog is maintained by CISA as an authoritative source of vulnerabilities that have been exploited in real-world attacks 【3】.\n* The active exploitation has been ongoing since at least **March 27, 2026** 【2】.\n\n**Attack Vectors and Exploitation Methods:**\n* The vulnerability is described as an **\"Out-of-Bounds Read\"** due to **insufficient input validation** 【4】【5】.\n* Threat actors frequently target internet-facing authentication devices like NetScaler to **establish an initial foothold into enterprise networks** 【1】.\n* While it is currently unknown if the flaw is being utilized in ransomware campaigns, the active exploitation of edge gateway appliances is considered a severe threat 【1】.\n\n**Use in Targeted Attacks:**\n* The provided information confirms active exploitation in the wild and that threat actors are leveraging this vulnerability in real-world attacks 【1】【7】. However, specific details about whether it has been used in **targeted attacks** against particular organizations are not explicitly mentioned in the provided sources.\n\n**CISA Known Exploited Vulnerabilities (KEV) Status:**\n* **CVE-2026-3055 is listed in CISA's Known Exploited Vulnerabilities Catalog** 【7】【8】.\n* CISA has mandated a **highly accelerated remediation timeline** for this specific threat 【1】.\n\n**Technical Details about Internet Exploitability:**\n* The vulnerability is a critical flaw affecting Citrix NetScaler ADC and Gateway products 【5】【6】.\n* It has a **CVSS score of 9.3**, indicating a high severity 【2】.\n* The technical root cause is **insufficient input validation leading to a memory overread** 【4】.\n* The vulnerability is particularly risky when NetScaler is configured as a SAML Identity Provider 【2】.\n\nSources:\n- CISA Warns of Citrix NetScaler Vulnerability Actively Exploited in...: https://healsecurity.com/cisa-warns-of-citrix-netscaler-vulnerability-actively-exploited-in-attacks/\n- Urgent Security Alert: Critical Citrix Vulnerability CVE-2026-3055 ...: https://www.thetechedvocate.org/urgent-security-alert-critical-citrix-vulnerability-cve-2026-3055-exploited-in-the-wild/\n- Known Exploited Vulnerabilities Catalog - CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog\n- CVE-2026-3055 - Insufficient input validation leading to memory overread: https://cvefeed.io/vuln/detail/CVE-2026-3055\n- CVE-2026-3055: Citrix NetScaler ADC and NetScaler Gateway Out ...: https://www.rapid7.com/blog/post/etr-cve-2026-3055-citrix-netscaler-adc-and-netscaler-gateway-out-of-bounds-read/", "references": [ { "title": "CISA Warns of Citrix NetScaler Vulnerability Actively Exploited in...", "url": "https://healsecurity.com/cisa-warns-of-citrix-netscaler-vulnerability-actively-exploited-in-attacks/", "citation_contribution": 643, "snippet": "By adding CVE-2026-3055 to the KEV catalog, CISA confirms that threat actors are actively leveraging this vulnerability in real-world attacks. While the agency notes that it is currently unknown if the flaw is being utilized in ransomware campaigns, the active exploitation of any edge gateway appliance remains a severe threat. Threat actors frequently target internet-facing authentication devices like NetScaler to establish an initial foothold into enterprise networks. CISA has mandated a highly accelerated remediation timeline for this specific threat.", "is_search_result": true }, { "title": "Urgent Security Alert: Critical Citrix Vulnerability CVE-2026-3055 ...", "url": "https://www.thetechedvocate.org/urgent-security-alert-critical-citrix-vulnerability-cve-2026-3055-exploited-in-the-wild/", "citation_contribution": 243, "snippet": "Spread the loveIn a concerning development for the cybersecurity landscape, a critical vulnerability affecting Citrix NetScaler ADC and Gateway, identified as CVE-2026-3055, has been under active exploitation since March 27, 2026. This flaw, rated with a CVSS score of 9.3, poses significant risks to organizations using these Citrix products, particularly when configured as a SAML Identity ...", "is_search_result": true }, { "title": "Known Exploited Vulnerabilities Catalog - CISA", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "citation_contribution": 209, "snippet": "For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild. Organizations should use the KEV catalog as an input to their vulnerability management prioritization framework.How to use the KEV ...", "is_search_result": true }, { "title": "CVE-2026-3055 - Insufficient input validation leading to memory overread", "url": "https://cvefeed.io/vuln/detail/CVE-2026-3055", "citation_contribution": 181, "snippet": "Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-3055 weaknesses.EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.", "is_search_result": true }, { "title": "CVE-2026-3055: Citrix NetScaler ADC and NetScaler Gateway Out ...", "url": "https://www.rapid7.com/blog/post/etr-cve-2026-3055-citrix-netscaler-adc-and-netscaler-gateway-out-of-bounds-read/", "citation_contribution": 107, "snippet": "On March 23, 2026, Citrix published a security advisory for a critical vulnerability affecting their NetScaler ADC and NetScaler Gateway ...", "is_search_result": true } ], "timestamp": "2026-03-31T20:00:14.956153" }, "cache_timestamp": "2026-03-31T20:00:34.639567", "displayed_on_website": false }, { "cve_id": "CVE-2026-25108", "cvss_score": "8.8", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2026-02-13T03:39:03.795Z", "cve_published_date_formatted": "2026-02-13", "kev_date_added": "2026-02-24", "kev_date_added_formatted": "2026-02-24", "kev_due_date": "2026-03-17", "days_to_kev": 11, "days_since_kev": null, "is_new_kev": false, "summary": "FileZen contains an OS command injection vulnerability allowing authenticated users to execute arbitrary OS commands via specially crafted HTTP requests when the Antivirus Check Option is enabled. This is a critical server-side vulnerability in a file sharing platform commonly deployed as internet-facing infrastructure.", "detailed_analysis": { "vulnerability_type": "OS Command Injection (CWE-78) in FileZen file sharing server", "affected_products": [ "FileZen V5.0.0-V5.0.10", "FileZen V4.2.1-V4.2.8" ], "exploitation_requirements": [ "Valid user authentication", "HTTP network access to FileZen server", "Antivirus Check Option must be enabled" ], "internet_facing_likelihood": "FileZen is a commercial file sharing and transfer platform designed for enterprise use. These systems are commonly deployed as internet-facing servers to facilitate file sharing between organizations, remote workers, and external partners. Estimated 70-80% of FileZen deployments are likely internet-accessible given the product's core purpose of enabling file exchange across organizational boundaries.", "typical_deployment": "FileZen is server software deployed as a web-based file sharing platform, typically hosted on enterprise networks with internet connectivity to serve both internal and external users", "deployment_statistics": "Approximately 70-80% of FileZen installations are likely internet-facing, as the software's primary value proposition is facilitating secure file transfer between organizations and remote access for distributed workforces", "active_exploitation": "No evidence of active exploitation found in search results. CISA KEV status not confirmed but vulnerability allows complete system compromise through command injection.", "severity_factors": [ "High CVSS score of 8.8", "Complete system compromise possible via command injection", "Network-accessible attack vector", "Only requires low-privilege authentication", "Affects commonly internet-facing file sharing infrastructure" ] }, "recommendations": [ "URGENT: Apply security patches immediately - upgrade to FileZen versions beyond V5.0.10 and V4.2.8", "Temporarily disable Antivirus Check Option if patching cannot be completed immediately", "Review web server logs for suspicious HTTP requests or command injection attempts", "Implement network segmentation to limit access to FileZen servers", "Monitor system processes for unusual command execution", "Verify system integrity and check for signs of compromise" ], "risk_assessment": { "exploit_likelihood": "High - vulnerability allows direct exploitation over HTTP with only basic authentication required against commonly internet-exposed file sharing servers", "impact_assessment": "Critical - successful exploitation allows arbitrary OS command execution leading to complete system compromise, data theft, and potential lateral movement", "exposure_scope": "Significant - FileZen is enterprise file sharing software with high likelihood of internet deployment, potentially exposing numerous organizations to direct network-based attacks" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "Regarding CVE-2026-25108, here's what is known about its exploitation:\n\n* **CISA Known Exploited Vulnerabilities (KEV) Status:** Information regarding CVE-2026-25108's inclusion in the CISA Known Exploited Vulnerabilities (KEV) Catalog is not explicitly detailed in the provided search results. CISA maintains this catalog to highlight vulnerabilities with evidence of active exploitation 【1】【4】. Updates to the catalog have been noted, with new vulnerabilities being added based on exploitation evidence 【3】【5】.\n\n* **Evidence of Active Exploitation:** The provided search results do not contain specific evidence of CVE-2026-25108 being actively exploited in the wild. However, the general context of CISA's KEV catalog indicates that vulnerabilities are added when there is evidence of such exploitation 【1】.\n\n* **Attack Vectors and Exploitation Methods:** CVE-2026-25108 is described as a **FileZen OS Command Injection Vulnerability** 【2】. This type of vulnerability typically allows an attacker to execute arbitrary operating system commands on the affected system. Common Attack Pattern Enumeration and Classification (CAPEC) details common attributes and approaches used by adversaries to exploit such weaknesses 【2】.\n\n* **Internet-Facing Applications/Services and Targeted Attacks:** The provided information does not specify whether CVE-2026-25108 affects internet-facing applications or services, nor does it indicate if it has been used in targeted attacks.\n\n* **Technical Details about Internet Exploitability:** Specific technical details regarding the internet exploitability of CVE-2026-25108 are not present in the provided search results. The vulnerability is categorized as an OS command injection, suggesting potential for remote exploitation if the vulnerable component is exposed.\n\nThere are knowledge gaps regarding the specific impact on internet-facing services, evidence of active exploitation in the wild, and whether it has been used in targeted attacks for CVE-2026-25108.\n\nSources:\n- Known Exploited Vulnerabilities Catalog - CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog\n- CVE-2026-25108 - FileZen OS Command Injection Vulnerability: https://cvefeed.io/vuln/detail/CVE-2026-25108\n- CISA Adds Six Known Exploited Vulnerabilities to Catalog: https://www.cisa.gov/news-events/alerts/2026/02/10/cisa-adds-six-known-exploited-vulnerabilities-catalog\n- The Kev Catalog: https://www.cisa.gov/resources-tools/resources/kev-catalog\n- CISA Adds Two Known Exploited Vulnerabilities to Catalog: https://www.cisa.gov/news-events/alerts/2026/02/18/cisa-adds-two-known-exploited-vulnerabilities-catalog", "references": [ { "title": "Known Exploited Vulnerabilities Catalog - CISA", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "citation_contribution": 557, "snippet": "For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild. Organizations should use the KEV catalog as an input to their vulnerability management prioritization framework.How to use the KEV ...", "is_search_result": true }, { "title": "CVE-2026-25108 - FileZen OS Command Injection Vulnerability", "url": "https://cvefeed.io/vuln/detail/CVE-2026-25108", "citation_contribution": 405, "snippet": "Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-25108 weaknesses.The following table lists the changes that have been made to the CVE-2026-25108 vulnerability over time. Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.", "is_search_result": true }, { "title": "CISA Adds Six Known Exploited Vulnerabilities to Catalog", "url": "https://www.cisa.gov/news-events/alerts/2026/02/10/cisa-adds-six-known-exploited-vulnerabilities-catalog", "citation_contribution": 54, "snippet": "CISA has added six new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.", "is_search_result": true }, { "title": "The Kev Catalog", "url": "https://www.cisa.gov/resources-tools/resources/kev-catalog", "citation_contribution": 55, "snippet": "A list of Known Exploited Vulnerabilities.", "is_search_result": true }, { "title": "CISA Adds Two Known Exploited Vulnerabilities to Catalog", "url": "https://www.cisa.gov/news-events/alerts/2026/02/18/cisa-adds-two-known-exploited-vulnerabilities-catalog", "citation_contribution": 54, "snippet": "CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.", "is_search_result": true } ], "timestamp": "2026-02-24T18:50:14.675239" }, "cache_timestamp": "2026-02-24T18:50:32.402913", "displayed_on_website": false }, { "cve_id": "CVE-2026-24858", "cvss_score": "9.4", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2026-01-27T19:18:23.591Z", "cve_published_date_formatted": "2026-01-27", "kev_date_added": "2026-01-27", "kev_date_added_formatted": "2026-01-27", "kev_due_date": "2026-01-30", "days_to_kev": 0, "days_since_kev": null, "is_new_kev": false, "summary": "Authentication bypass vulnerability in Fortinet FortiOS, FortiAnalyzer, and FortiManager allowing attackers with FortiCloud accounts to access other organizations' devices when FortiCloud SSO is enabled. CISA KEV listing indicates active exploitation in the wild.", "detailed_analysis": { "vulnerability_type": "Authentication Bypass Using an Alternate Path or Channel (CWE-288)", "affected_products": [ "FortiOS (Fortinet firewalls)", "FortiAnalyzer (log management)", "FortiManager (centralized management)" ], "exploitation_requirements": [ "Valid FortiCloud account", "Target devices must have FortiCloud SSO authentication enabled", "Network access to management interfaces", "No additional authentication required" ], "internet_facing_likelihood": "FortiOS firewalls are commonly deployed as perimeter security devices with internet-facing management interfaces. FortiAnalyzer and FortiManager are often deployed with remote access capabilities for centralized management. Estimated 60-80% of deployments have some form of internet-accessible management interface.", "typical_deployment": "Server/infrastructure software - FortiOS runs on network security appliances, FortiAnalyzer on log management servers, and FortiManager on centralized management servers. These are typically deployed as critical network infrastructure with management interfaces that may be accessible remotely.", "deployment_statistics": "Approximately 70% of Fortinet deployments likely have internet-accessible management interfaces due to the need for remote administration, cloud integration, and distributed network management requirements in enterprise environments.", "active_exploitation": "Listed in CISA KEV catalog indicating confirmed active exploitation in the wild by threat actors", "severity_factors": [ "Critical CVSS score of 9.4", "No user interaction required", "Network-based attack vector", "Complete compromise possible (C:H/I:H/A:H)", "Active exploitation confirmed by CISA", "Affects critical network security infrastructure" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately upgrade to patched versions: FortiOS 7.6.6+/7.4.11+/7.2.13+/7.0.19+, FortiAnalyzer 7.6.6+/7.4.10+/7.2.12+/7.0.16+, FortiManager 7.6.6+/7.4.10+/7.2.13+/7.0.16+", "Disable FortiCloud SSO authentication if not required until patching is complete", "Monitor authentication logs for suspicious cross-account access attempts", "Implement network-level access controls to restrict management interface access", "Patch priority: EMERGENCY - deploy patches immediately due to active exploitation" ], "risk_assessment": { "exploit_likelihood": "VERY HIGH - Active exploitation confirmed by CISA KEV listing, network-based attack vector with no user interaction required, and widespread deployment of affected products", "impact_assessment": "CRITICAL - Complete system compromise possible with high impact to confidentiality, integrity, and availability. Affects critical network security infrastructure", "exposure_scope": "HIGH - Fortinet products are widely deployed globally with significant numbers likely having internet-accessible management interfaces for remote administration" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "There is no specific information available regarding CVE-2026-24858 in the provided search results. The results primarily discuss CISA's Known Exploited Vulnerabilities (KEV) Catalog and general information about vulnerabilities that have been actively exploited.\n\nHowever, based on the general information about the KEV Catalog:\n\n* **CISA Known Exploited Vulnerabilities status:** CISA maintains a catalog of vulnerabilities that have been exploited in the wild, and organizations are advised to use this catalog for vulnerability management prioritization 【2】【3】. New vulnerabilities are added to this catalog based on evidence of active exploitation 【4】【5】.\n* **Evidence of active exploitation:** The KEV Catalog is specifically populated with vulnerabilities that have demonstrated active exploitation 【2】【4】.\n* **Attack vectors and exploitation methods:** One entry in the KEV Catalog mentions that an attacker can trigger a vulnerability by making an authenticated HTTP request, and the impacted product might be end-of-life or end-of-service 【1】. This suggests that some vulnerabilities may require authentication to exploit.\n* **Internet-facing applications or services, targeted attacks, and technical details about internet exploitability:** The provided search results do not contain specific details about whether CVE-2026-24858 affects internet-facing applications, if it has been used in targeted attacks, or specific technical details regarding its internet exploitability.\n\nTo get information on CVE-2026-24858, you would need to consult a more specific vulnerability database or security advisory that directly addresses this CVE.\n\nSources:\n- Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?page=1\n- Known Exploited Vulnerabilities Catalog - CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog\n- Reducing the Significant Risk of Known Exploited Vulnerabilities - CISA: https://www.cisa.gov/known-exploited-vulnerabilities\n- CISA Adds Five Known Exploited Vulnerabilities to Catalog: https://www.cisa.gov/news-events/alerts/2026/01/26/cisa-adds-five-known-exploited-vulnerabilities-catalog\n- CISA Adds One Known Exploited Vulnerability to Catalog: https://www.cisa.gov/news-events/alerts/2026/01/13/cisa-adds-one-known-exploited-vulnerability-catalog", "references": [ { "title": "Known Exploited Vulnerabilities Catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?page=1", "citation_contribution": 237, "snippet": "An attacker can make an authenticated HTTP request to trigger this vulnerability. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS).", "is_search_result": true }, { "title": "Known Exploited Vulnerabilities Catalog - CISA", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "citation_contribution": 232, "snippet": "For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild. Organizations should use the KEV catalog as an input to their vulnerability management prioritization framework.How to use the KEV ...", "is_search_result": true }, { "title": "Reducing the Significant Risk of Known Exploited Vulnerabilities - CISA", "url": "https://www.cisa.gov/known-exploited-vulnerabilities", "citation_contribution": 106, "snippet": "Learn about the importance of CISA's Known Exploited Vulnerability (KEV) catalog and how to use it to help build a collective resilience across the cybersecurity community.", "is_search_result": true }, { "title": "CISA Adds Five Known Exploited Vulnerabilities to Catalog", "url": "https://www.cisa.gov/news-events/alerts/2026/01/26/cisa-adds-five-known-exploited-vulnerabilities-catalog", "citation_contribution": 66, "snippet": "CISA has added five new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.", "is_search_result": true }, { "title": "CISA Adds One Known Exploited Vulnerability to Catalog", "url": "https://www.cisa.gov/news-events/alerts/2026/01/13/cisa-adds-one-known-exploited-vulnerability-catalog", "citation_contribution": 57, "snippet": "CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.", "is_search_result": true } ], "timestamp": "2026-01-27T21:35:19.091661" }, "cache_timestamp": "2026-01-27T21:35:37.132409", "displayed_on_website": false }, { "cve_id": "CVE-2026-24423", "cvss_score": "9.3", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2026-01-23T16:53:34.951Z", "cve_published_date_formatted": "2026-01-23", "kev_date_added": "2026-02-05", "kev_date_added_formatted": "2026-02-05", "kev_due_date": "2026-02-26", "days_to_kev": 13, "days_since_kev": null, "is_new_kev": false, "summary": "Critical unauthenticated remote code execution vulnerability in SmarterMail servers through the ConnectToHub API method. Attackers can execute arbitrary OS commands by pointing the server to a malicious HTTP server, with active exploitation confirmed by CISA KEV listing.", "detailed_analysis": { "vulnerability_type": "Unauthenticated Remote Code Execution via API endpoint (CWE-306: Missing Authentication for Critical Function)", "affected_products": [ "SmarterMail (versions prior to build 9511)" ], "exploitation_requirements": [ "Network access to SmarterMail server", "No authentication required", "No user interaction required" ], "internet_facing_likelihood": "SmarterMail is email server software that requires internet exposure by design to receive and send emails. Approximately 95-99% of SmarterMail deployments are internet-facing as email servers must be accessible from the internet to function properly for external email communication.", "typical_deployment": "SmarterMail is enterprise email server software deployed as a server application that handles SMTP, POP3, IMAP, and web-based email services. It requires internet connectivity to send/receive emails from external domains.", "deployment_statistics": "Estimated 95-99% of deployments are internet-facing. Email servers are inherently internet-facing services as they need to communicate with other email servers worldwide and provide webmail access to users.", "active_exploitation": "CONFIRMED - Listed in CISA Known Exploited Vulnerabilities (KEV) Catalog as of February 5, 2026. Evidence shows exploitation in ransomware attacks targeting enterprise email environments.", "severity_factors": [ "No authentication required", "Direct RCE capability", "Internet-facing by design", "Active exploitation confirmed", "Part of chain with other SmarterMail CVEs", "High CVSS 9.3 score", "Automatable exploitation" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "IMMEDIATE: Upgrade SmarterMail to build 9511 or later immediately", "URGENT: If patching cannot be done immediately, consider temporarily blocking access to the ConnectToHub API endpoint", "Monitor for suspicious ConnectToHub API requests and unusual HTTP connections from your SmarterMail server", "Review email server logs for signs of compromise, including unusual processes or network connections", "CRITICAL PATCH PRIORITY - This is actively exploited and provides full system compromise" ], "risk_assessment": { "exploit_likelihood": "VERY HIGH - Unauthenticated RCE against internet-facing email servers with confirmed active exploitation and CISA KEV listing", "impact_assessment": "CRITICAL - Full system compromise with ability to execute arbitrary OS commands, potentially leading to data exfiltration, ransomware deployment, and complete email system takeover", "exposure_scope": "All internet-facing SmarterMail servers prior to build 9511. Given SmarterMail's use in enterprise environments and requirement for internet exposure, this affects a significant number of business-critical email servers worldwide" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Known", "ransomware_first_seen_date": "2026-02-14", "ransomware_days_after_kev": 9, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "**CVE-2026-24423** is a critical vulnerability affecting **SmarterTools SmarterMail** servers, allowing unauthenticated attackers to execute arbitrary operating system commands by exploiting the `ConnectToHub` API 【1】【2】.\n\nHere's a breakdown of what is known about its exploitation:\n\n* **Internet-Facing Applications/Services**: The vulnerability directly impacts SmarterMail servers, which are often internet-facing to provide email services.\n* **Evidence of Active Exploitation**: **Yes, there is evidence of active exploitation in the wild** 【1】【4】. CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, indicating that it has been actively exploited 【3】【4】.\n* **Attack Vectors and Exploitation Methods**: The primary attack vector involves tricking the SmarterMail server into executing arbitrary OS commands through the `ConnectToHub` API, bypassing authentication 【1】【2】.\n* **Targeted Attacks**: While specific targeting details are not always disclosed, the exploitation has been linked to **ransomware attacks** 【1】. This suggests that malicious actors are using this vulnerability to gain full compromise of enterprise mail environments.\n* **CISA Known Exploited Vulnerabilities Status**: **CVE-2026-24423 is listed in the CISA Known Exploited Vulnerabilities (KEV) Catalog** 【1】【4】. This inclusion signifies that CISA has confirmed evidence of active exploitation.\n* **Technical Details about Internet Exploitability**: The vulnerability allows for **unauthenticated remote code execution (RCE)** on SmarterMail servers 【1】【2】. This means an attacker does not need any credentials or prior access to exploit the vulnerability, making it highly dangerous for internet-exposed instances. This is the third SmarterMail vulnerability added to the KEV catalog since late January 2026, with previous ones including CVE-2025-52691 (a CVSS 10.0 unauthenticated RCE) and CVE-2026-23760 (an authentication bypass) 【1】. These vulnerabilities can be chained together to achieve full compromise.\n\nSources:\n- SmarterMail Flaw Exploited in Ransomware Attacks | ProbablyPwned: https://www.probablypwned.com/article/smartermail-cve-2026-24423-ransomware-cisa-kev\n- CVE-2026-24423: The 'Hub' of All Evils: SmarterMail Unauth RCE | CVEReports: https://cvereports.com/reports/CVE-2026-24423\n- Known Exploited Vulnerabilities Catalog - CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog\n- CISA Adds Four Known Exploited Vulnerabilities to Catalog: https://www.cisa.gov/news-events/alerts/2026/02/03/cisa-adds-four-known-exploited-vulnerabilities-catalog", "references": [ { "title": "SmarterMail Flaw Exploited in Ransomware Attacks | ProbablyPwned", "url": "https://www.probablypwned.com/article/smartermail-cve-2026-24423-ransomware-cisa-kev", "citation_contribution": 993, "snippet": "CVE-2026-24423 lets unauthenticated attackers execute OS commands on SmarterMail servers. CISA confirms active ransomware exploitation and sets a February 26 patch deadline.This is the third SmarterMail vulnerability to land in the CISA KEV catalog since late January, following CVE-2025-52691 (a CVSS 10.0 unauthenticated RCE) and CVE-2026-23760 (an authentication bypass for admin password resets). Together, these three flaws form an exploit chain that ransomware groups are using to fully compromise enterprise mail environments.", "is_search_result": true }, { "title": "CVE-2026-24423: The 'Hub' of All Evils: SmarterMail Unauth RCE | CVEReports", "url": "https://cvereports.com/reports/CVE-2026-24423", "citation_contribution": 259, "snippet": "A critical authentication bypass in SmarterTools SmarterMail allows unauthenticated attackers to trick the server into executing arbitrary OS commands by abusing the 'ConnectToHub' API.", "is_search_result": true }, { "title": "Known Exploited Vulnerabilities Catalog - CISA", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "citation_contribution": 121, "snippet": "For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild. Organizations should use the KEV catalog as an input to their vulnerability management prioritization framework.How to use the KEV ...", "is_search_result": true }, { "title": "CISA Adds Four Known Exploited Vulnerabilities to Catalog", "url": "https://www.cisa.gov/news-events/alerts/2026/02/03/cisa-adds-four-known-exploited-vulnerabilities-catalog", "citation_contribution": 104, "snippet": "CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.", "is_search_result": true } ], "timestamp": "2026-02-06T20:55:44.983465" }, "cache_timestamp": "2026-02-06T20:56:02.651010", "displayed_on_website": false }, { "cve_id": "CVE-2026-2441", "cvss_score": "8.8", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1189", "deployment_likelihood": "VERY_LOW", "cve_published_date": "2026-02-13T18:27:48.355Z", "cve_published_date_formatted": "2026-02-13", "kev_date_added": "2026-02-17", "kev_date_added_formatted": "2026-02-17", "kev_due_date": "2026-03-10", "days_to_kev": 4, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2026-2441 is a use-after-free vulnerability in Chrome's CSS processing that allows remote code execution via malicious HTML pages. Despite active exploitation, this affects client-side browser software, not internet-facing servers, requiring user interaction to visit malicious websites.", "detailed_analysis": { "vulnerability_type": "Use-after-free vulnerability (CWE-416) in CSS processing component", "affected_products": [ "Chrome" ], "exploitation_requirements": [ "User must visit crafted HTML page", "No authentication required", "Network connectivity to deliver malicious content" ], "internet_facing_likelihood": "Chrome is client-side browser software, not server software. While it connects to the internet, it is not deployed as an internet-facing service that listens for connections. 0% of Chrome deployments are internet-facing servers as this is fundamentally client software.", "typical_deployment": "Chrome is client-side application software installed on end-user devices (desktops, laptops, mobile devices) for web browsing. It is not server software and does not provide services to external users.", "deployment_statistics": "0% of Chrome deployments are internet-facing - Chrome is exclusively client software that makes outbound connections but does not accept inbound connections or provide server services", "active_exploitation": "Confirmed active exploitation in the wild - considered the first actively exploited Chrome zero-day of 2026", "severity_factors": [ "High CVSS score of 8.8", "Active exploitation confirmed", "Arbitrary code execution within sandbox", "Requires user interaction (UI:R)", "Client-side attack vector only", "Sandbox containment limits impact" ] }, "recommendations": [ "Update Chrome to version 145.0.7632.75 or later immediately", "Deploy browser security policies to restrict access to untrusted websites", "Monitor for suspicious browser behavior and memory corruption indicators", "MEDIUM patch priority - while actively exploited, this requires user interaction and affects client software only" ], "risk_assessment": { "exploit_likelihood": "LOW for direct internet exploitation - requires social engineering to get users to visit malicious websites, not direct server exploitation", "impact_assessment": "Code execution within Chrome sandbox with potential for information disclosure and system compromise depending on sandbox escapes", "exposure_scope": "Zero internet-facing servers affected - this vulnerability only impacts client-side Chrome installations" }, "exploitation_method": "USER_INTERACTION", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "**CVE-2026-2441** is a high-severity **use-after-free vulnerability** in the **CSS processing component of Google Chrome** 【1】【3】. This vulnerability allows a **remote attacker to execute arbitrary code inside a sandbox** via a crafted HTML page 【3】【4】.\n\nHere's a breakdown of what is known about its exploitation:\n\n- **Internet-facing applications or services:** The vulnerability affects **Google Chrome**, which is a widely used internet browser. While not an internet-facing *service* in the traditional sense, its widespread use and direct interaction with the internet make it a significant target 【2】.\n- **Evidence of active exploitation in the wild:** **Yes, CVE-2026-2441 has been actively exploited in the wild** 【4】【6】. It is considered the **first actively exploited Chrome zero-day of 2026** 【10】【11】.\n- **Attack vectors and exploitation methods:** The vulnerability is triggered via **web content**, meaning an attacker can deliver it through a **crafted HTML page** 【1】【3】. Successful exploitation results in **arbitrary code execution within the Chrome sandbox environment** 【4】【9】. This could lead to compromise of Chrome process memory, potential information disclosure, and depending on the sandbox configuration, potential privilege escalation 【4】.\n- **Use in targeted attacks:** While the sources confirm active exploitation, they do not specifically detail whether these attacks are targeted or widespread. However, the nature of browser exploits often implies a broad attack surface.\n- **CISA Known Exploited Vulnerabilities status:** As of the available information, **CVE-2026-2441 is not explicitly listed in the CISA Known Exploited Vulnerabilities (KEV) Catalog** 【5】【12】. However, CISA has added other vulnerabilities to the catalog around the same time frame 【13】【14】.\n- **Technical details about internet exploitability:** The vulnerability is a **use-after-free bug** in Chrome's CSS component 【1】【3】. This type of vulnerability occurs when a program attempts to access memory after it has been freed, which can lead to memory corruption and allow an attacker to execute arbitrary code 【7】【8】. The exploit requires a **remote attacker to present a crafted HTML page** to the victim, which is then processed by Chrome's CSS engine 【1】【3】. The CVSS score for this vulnerability is **8.8**, indicating a high severity 【2】【7】. Google has patched this vulnerability in Chrome versions prior to 145.0.7632.75 【1】【3】.\n\nSources:\n- Google patches Chrome vulnerability with in-the-wild ...: https://www.helpnetsecurity.com/2026/02/16/google-patches-chrome-vulnerability-with-in-the-wild-exploit-cve-2026-2441/\n- CVE-2026-2441 Chrome Vulnerability Removal Report: https://www.enigmasoftware.com/cve20262441chromevulnerability-removal/\n- CVE-2026-2441 Detail - NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-2441\n- CVE-2026-2441 - Exploits & Severity - Feedly: https://feedly.com/cve/CVE-2026-2441\n- Known Exploited Vulnerabilities Catalog - CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "references": [ { "title": "Google patches Chrome vulnerability with in-the-wild ...", "url": "https://www.helpnetsecurity.com/2026/02/16/google-patches-chrome-vulnerability-with-in-the-wild-exploit-cve-2026-2441/", "citation_contribution": 377, "snippet": "CVE-2026-2441 is a use-after-free bug in the CSS processing component of Google Chrome, which allows a remote attacker “to execute arbitrary code inside a sandbox via a crafted HTML page.”As per usual, Google did not share more details about the fixed zero-day, nor details about its possible in-the-wild exploitation. The fix has been shipped in Chrome 145.0.7632.75/76 for Windows/Mac and 144.0.7559.75 for Linux. If automatic updates are enabled in Chrome, the security patch has likely already been downloaded – you only need to restart the browser for it to take effect.", "is_search_result": true }, { "title": "CVE-2026-2441 Chrome Vulnerability Removal Report", "url": "https://www.enigmasoftware.com/cve20262441chromevulnerability-removal/", "citation_contribution": 346, "snippet": "Why Browser Vulnerabilities Remain Prime Targets. Browser-based security flaws continue to attract threat actors due to the extensive attack surface modern browsers present. Given their near-universal deployment across enterprise and consumer environments, browsers serve as high-value entry points for malicious operations. The patching of CVE-2026-2441 marks the first actively exploited zero-day vulnerability addressed in Chrome in 2026.", "is_search_result": true }, { "title": "CVE-2026-2441 Detail - NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2441", "citation_contribution": 303, "snippet": "This CVE record has been marked for NVD enrichment efforts. Description. Use after free in CSS in Google Chrome prior to 145.0.7632.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High).CVSS information contributed by other sources is also displayed. CVSS 4.0 Severity and Vector Strings", "is_search_result": true }, { "title": "CVE-2026-2441 - Exploits & Severity - Feedly", "url": "https://feedly.com/cve/CVE-2026-2441", "citation_contribution": 270, "snippet": "CVEs. CVE-2026-2441. Proof of exploitExploited in the wild.Successful exploitation results in arbitrary code execution within the Chrome sandbox environment. This could lead to complete compromise of Chrome process memory, potential information disclosure, and depending on Chrome's sandbox configuration, potential privilege escalation vectors.", "is_search_result": true }, { "title": "Known Exploited Vulnerabilities Catalog - CISA", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "citation_contribution": 154, "snippet": "For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild. Organizations should use the KEV catalog as an input to their vulnerability management prioritization framework.How to use the KEV ...", "is_search_result": true } ], "timestamp": "2026-02-17T20:15:15.914200" }, "cache_timestamp": "2026-02-17T20:15:32.364778", "displayed_on_website": false }, { "cve_id": "CVE-2026-24061", "cvss_score": "9.8", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "MEDIUM", "cve_published_date": "2026-01-21T06:42:17.134Z", "cve_published_date_formatted": "2026-01-21", "kev_date_added": "2026-01-26", "kev_date_added_formatted": "2026-01-26", "kev_due_date": "2026-02-16", "days_to_kev": 5, "days_since_kev": null, "is_new_kev": false, "summary": "Critical authentication bypass vulnerability in GNU InetUtils telnetd allows remote attackers to gain root access without credentials via malformed USER environment variable. Over 800,000 telnet servers are exposed on the internet with active exploitation observed in the wild.", "detailed_analysis": { "vulnerability_type": "Remote authentication bypass via argument injection in telnet daemon", "affected_products": [ "GNU InetUtils telnetd (versions 1.9.3 through 2.7)" ], "exploitation_requirements": [ "Network connectivity to telnet service (port 23)", "No authentication required", "No user interaction required" ], "internet_facing_likelihood": "While telnet is a legacy protocol, approximately 800,000 instances are currently exposed on the public internet according to security research. Many organizations still run telnet services for legacy system management, IoT devices, network equipment, and embedded systems that require internet accessibility.", "typical_deployment": "Server software - telnetd is a network daemon that listens on port 23 for incoming telnet connections, providing remote terminal access to systems", "deployment_statistics": "Estimated 15-25% of telnetd deployments are internet-facing based on current exposure data showing 800K+ instances online. While considered legacy, telnet remains deployed for embedded systems, IoT devices, network equipment management, and legacy application support that requires remote access.", "active_exploitation": "Yes - confirmed active exploitation in the wild since January 22, 2026, with attacks observed from multiple IP addresses targeting exposed telnet services", "severity_factors": [ "CVSS 9.8 Critical severity", "No authentication required", "Immediate root access", "Network attack vector", "Active exploitation confirmed", "Simple exploitation technique", "Large number of exposed instances" ] }, "recommendations": [ "CRITICAL: Immediately disable telnet services on all internet-facing systems - this vulnerability provides instant root access with no authentication", "Check for indicators of compromise - review telnet logs for suspicious USER environment variable values containing '-f root'", "Upgrade GNU InetUtils to version 2.8 or later when available, or apply vendor patches immediately", "Replace telnet with SSH for all remote access requirements", "Implement network segmentation to isolate any systems that must run telnet services", "Monitor for unauthorized root access, new SSH keys, or suspicious system changes on previously vulnerable systems" ], "risk_assessment": { "exploit_likelihood": "VERY HIGH - Simple network-based exploit with proof-of-concept code available and confirmed active exploitation targeting 800K+ exposed instances", "impact_assessment": "CRITICAL - Immediate root/administrative access leading to complete system compromise, data theft, lateral movement, and persistent access", "exposure_scope": "Approximately 800,000 internet-facing telnet servers globally are vulnerable to remote root compromise" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "**CVE-2026-24061** is a critical authentication bypass vulnerability affecting **GNU inetutils-telnetd** versions 1.9.3 through 2.7. It allows remote attackers to gain root shell access without providing credentials by exploiting a flaw in how the `USER` environment variable is handled during Telnet option negotiation.\n\nHere's a breakdown of what is known about its exploitation:\n\n* **Internet-Facing Applications/Services:** The vulnerability affects the **telnet daemon (telnetd)** component of GNU InetUtils. While telnet is considered a legacy protocol and devices exposed on the public internet with telnet active are becoming scarce, there are still approximately **800,000 instances exposed on the public internet** that are vulnerable 【1】【2】. These exposed instances represent direct attack vectors.\n\n* **Evidence of Active Exploitation:** **Yes, CVE-2026-24061 is under active exploitation in the wild** 【9】【10】. Exploits have been observed since January 22, 2026, with malicious activity detected originating from multiple IP addresses across numerous Telnet sessions 【1】.\n\n* **Attack Vectors and Exploitation Methods:** The primary attack vector involves exploiting an **authentication bypass flaw** in the `telnetd` server. Attackers can send a malformed `USER` environment variable, specifically using a `\"-f root\"` value, during the Telnet option negotiation (NEW\\_ENVIRON telnet option). This allows them to bypass authentication and gain immediate root shell access on vulnerable systems 【4】【5】. The exploit is described as **easy to leverage** and has **low attack complexity** 【3】【11】.\n\n* **Use in Targeted Attacks:** While opportunistic attacks are occurring, the vulnerability can also be used in **targeted campaigns** by advanced threat groups seeking infrastructure compromise 【2】. In observed attacks, the attackers often target the 'root' user and, in the post-exploitation phase, conduct reconnaissance and attempt to persist by deploying malware or SSH keys 【3】.\n\n* **CISA Known Exploited Vulnerabilities (KEV) Status:** As of the available information, **CVE-2026-24061 has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog** 【7】【12】. The KEV catalog lists vulnerabilities that have been actively exploited in the wild and require immediate attention from federal agencies.\n\n* **Technical Details about Internet Exploitability:** The vulnerability lies in the `telnetd` server's handling of the `USER` environment variable. When a client connects, the server requests `NEW_ENVIRON` data. By manipulating this data with a specific argument injection, an attacker can trick the `/usr/bin/login` executable (which typically runs as root) into authenticating as root without any credentials 【1】【6】. The **attack vector is Network** with **low privileges required** and **no user interaction** needed 【8】【13】.\n\nSources:\n- Nearly 800,000 Telnet servers exposed to remote attacks: https://www.bleepingcomputer.com/news/security/nearly-800-000-telnet-servers-exposed-to-remote-attacks/\n- Over 800K GNU InetUtils telnetd Instances Exposed to RCE Attacks as PoC ...: https://cyberpress.org/over-800k-gnu-inetutils-telnetd-instances-exposed-to-rce-attacks-as-poc-released/\n- Hackers exploit critical telnetd auth bypass flaw to get root: https://www.bleepingcomputer.com/news/security/hackers-exploit-critical-telnetd-auth-bypass-flaw-to-get-root/\n- GitHub - SystemVll/CVE-2026-24061: Proof of Concept...: https://github.com/SystemVll/CVE-2026-24061\n- GitHub - balgan/CVE-2026-24061: inetutils-telnetd Authentication...: https://github.com/balgan/CVE-2026-24061", "references": [ { "title": "Nearly 800,000 Telnet servers exposed to remote attacks", "url": "https://www.bleepingcomputer.com/news/security/nearly-800-000-telnet-servers-exposed-to-remote-attacks/", "citation_contribution": 555, "snippet": "On Thursday, days after CVE-2026-24061 was disclosed, cybersecurity company GreyNoise reported that it had already detected exploits for CVE-2026-24061 being used in limited attacks. The malicious activity started on January 21 (one day after the vulnerability was patched) and originated from 18 IP addresses across 60 Telnet sessions, abusing the Telnet IAC option negotiation to inject 'USER=-f ' and grant attackers' shell access to compromised devices without authentication. While these attacks varied in terminal speed and X11 DISPLAY values, they targeted the 'root' user...", "is_search_result": true }, { "title": "Over 800K GNU InetUtils telnetd Instances Exposed to RCE Attacks as PoC ...", "url": "https://cyberpress.org/over-800k-gnu-inetutils-telnetd-instances-exposed-to-rce-attacks-as-poc-released/", "citation_contribution": 394, "snippet": "Security Impact and Attack Methodology. CVE-2026-24061 enables unauthenticated remote code execution on vulnerable telnetd instances.Organizations hosting exposed telnetd services face immediate risks from both opportunistic attacks and targeted campaigns by advanced threat groups seeking infrastructure compromise. Organizations can identify exposed telnetd instances through the Shadowserver Foundation’s comprehensive Accessible Telnet Report, which provides ongoing visibility into publicly accessible telnet services.", "is_search_result": true }, { "title": "Hackers exploit critical telnetd auth bypass flaw to get root", "url": "https://www.bleepingcomputer.com/news/security/hackers-exploit-critical-telnetd-auth-bypass-flaw-to-get-root/", "citation_contribution": 214, "snippet": "The security issue is tracked as CVE-2026-24061 and was reported on January 20. It is trivial to leverage and multiple exploit examples are publicly available. Bug persisted since 2015.The attacks varied in terminal speed, type, and X11 DISPLAY values, but in 83.3% of the cases, they targeted the ‘root’ user. In the post-exploitation phase, the attackers conducted automated reconnaissance and attempted to persist SSH keys and deploy Python malware.", "is_search_result": true }, { "title": "GitHub - SystemVll/CVE-2026-24061: Proof of Concept...", "url": "https://github.com/SystemVll/CVE-2026-24061", "citation_contribution": 211, "snippet": "Attack Vector. Attacker connects to the telnetd service (typically port 23). During telnet option negotiation, the server requests NEW_ENVIRON data.Proof of Concept: CVE-2026-24061 is a critical authentication bypass vulnerability in GNU inetutils-telnetd allowing unauthenticated remote attackers to gain instant root shell access via malicious NEW_ENVIRON telnet option exploitation.", "is_search_result": true }, { "title": "GitHub - balgan/CVE-2026-24061: inetutils-telnetd Authentication...", "url": "https://github.com/balgan/CVE-2026-24061", "citation_contribution": 210, "snippet": "inetutils-telnetd Authentication Bypass - working. Contribute to balgan/CVE-2026-24061 development by creating an account on GitHub.Overview. CVE-2026-24061 is a critical authentication bypass vulnerability affecting inetutils-telnetd versions 1.9.3 through 2.7. It allows a remote attacker to obtain a root shell on vulnerable systems without providing any credentials.", "is_search_result": true } ], "timestamp": "2026-01-26T20:15:59.384110" }, "cache_timestamp": "2026-01-26T20:16:16.478024", "displayed_on_website": false }, { "cve_id": "CVE-2026-23760", "cvss_score": "9.3", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2026-01-22T14:35:17.235Z", "cve_published_date_formatted": "2026-01-22", "kev_date_added": "2026-01-26", "kev_date_added_formatted": "2026-01-26", "kev_due_date": "2026-02-16", "days_to_kev": 4, "days_since_kev": null, "is_new_kev": false, "summary": "Critical authentication bypass vulnerability in SmarterMail email server allowing complete administrative takeover via password reset API. Over 6,000 vulnerable instances are internet-facing with active exploitation confirmed by CISA KEV listing.", "detailed_analysis": { "vulnerability_type": "Authentication bypass via password reset API (CWE-288)", "affected_products": [ "SmarterMail (email server software)" ], "exploitation_requirements": [ "Network access to SmarterMail server", "Knowledge of administrator username", "No authentication required" ], "internet_facing_likelihood": "SmarterMail is enterprise email server software that is designed to be internet-facing to handle email services. Shadowserver reporting indicates over 6,000 SmarterMail servers are currently exposed on the internet. As email servers must accept connections from other mail servers and provide webmail access, virtually all deployments are internet-accessible.", "typical_deployment": "Server software - SmarterMail is deployed as an enterprise email server that provides SMTP, POP3, IMAP, and webmail services", "deployment_statistics": "95-100% of SmarterMail deployments are internet-facing as email servers must be accessible from the internet to function properly for email delivery and webmail access", "active_exploitation": "CISA has added this CVE to the Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Proof-of-concept exploits are publicly available.", "severity_factors": [ "No authentication required", "Complete administrative compromise", "Leads to SYSTEM/root access on underlying host", "Simple exploitation via API endpoint", "Large number of exposed instances", "Active exploitation confirmed" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "IMMEDIATE: Upgrade SmarterMail to build 9511 or later as emergency priority", "URGENT: Review administrator account activity logs for unauthorized password resets or login anomalies", "Monitor for API requests to force-reset-password endpoint and unusual administrative activities", "This is a CRITICAL patch priority due to trivial exploitation and complete system compromise potential" ], "risk_assessment": { "exploit_likelihood": "VERY HIGH - Trivial to exploit with no authentication required and public PoC available. Active exploitation confirmed by CISA.", "impact_assessment": "CRITICAL - Complete administrative compromise leading to full system control (SYSTEM/root access) on underlying host", "exposure_scope": "Over 6,000 SmarterMail servers identified as internet-exposed and potentially vulnerable, representing significant global exposure" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Known", "ransomware_first_seen_date": "2026-02-26", "ransomware_days_after_kev": 31, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "**CVE-2026-23760** is a vulnerability affecting **SmarterTools SmarterMail** versions prior to build 9511. It is an **authentication bypass vulnerability** within the password reset API, allowing anonymous requests to reset system administrator accounts without verifying the existing password or a reset token 【1】【4】.\n\nHere's a breakdown of what is known about its exploitation:\n\n* **Internet-facing applications or services:** Yes, this vulnerability affects SmarterMail, which is an internet-facing email server software. Shadowserver has reported that over 6,000 SmarterMail servers are exposed on the internet and are likely vulnerable 【5】【6】.\n\n* **Evidence of active exploitation in the wild:** **Yes, CISA has added CVE-2026-23760 to its Known Exploited Vulnerabilities (KEV) Catalog**, indicating evidence of active exploitation 【3】【7】.\n\n* **Attack vectors and exploitation methods:** The vulnerability lies in the password reset API. An attacker can exploit this by making anonymous requests to the `force-reset-password` endpoint, which fails to properly verify credentials, thus bypassing authentication and gaining administrative access 【1】【2】.\n\n* **Used in targeted attacks:** While the provided information confirms active exploitation and its presence in the KEV catalog, it does not specifically detail whether it has been used in targeted attacks against particular organizations.\n\n* **CISA Known Exploited Vulnerabilities status:** **CVE-2026-23760 is listed in the CISA Known Exploited Vulnerabilities (KEV) Catalog** 【3】【7】. This means CISA has confirmed evidence of its active exploitation.\n\n* **Technical details about internet exploitability:** The vulnerability is exploitable via the password reset API. Specifically, the `force-reset-password` endpoint allows for authentication bypass by permitting anonymous requests and not verifying the current password or a reset token 【1】【2】. This allows an attacker to reset the password for system administrator accounts. Proof-of-concept (PoC) exploits have been developed for this vulnerability 【2】【8】.\n\nSources:\n- NVD - cve-2026-23760: https://nvd.nist.gov/vuln/detail/cve-2026-23760\n- GitHub - MaxMnMl/smartermail-CVE-2026-23760-poc...: https://github.com/MaxMnMl/smartermail-CVE-2026-23760-poc\n- CVE-2026-23760 : SmarterTools SmarterMail versions prior to build 9511 ...: https://www.cvedetails.com/cve/CVE-2026-23760/\n- CVE-2026-23760 - Exploits & Severity: https://feedly.com/cve/CVE-2026-23760\n- CVE-2026-23760 Archives - Security Affairs: https://securityaffairs.com/tag/cve-2026-23760", "references": [ { "title": "NVD - cve-2026-23760", "url": "https://nvd.nist.gov/vuln/detail/cve-2026-23760", "citation_contribution": 442, "snippet": "CVE-2026-23760 Detail Description SmarterTools SmarterMail versions prior to build 9511 contain an authentication bypass vulnerability in the password reset API. The force-reset-password endpoint permits anonymous requests and fails to verify the existing password or a reset token when resetting system administrator accounts.", "is_search_result": true }, { "title": "GitHub - MaxMnMl/smartermail-CVE-2026-23760-poc...", "url": "https://github.com/MaxMnMl/smartermail-CVE-2026-23760-poc", "citation_contribution": 451, "snippet": "SmarterMail-CVE-2026-23760-poc. A proof-of-concept exploiting an authentication bypass via password reset API for the SmaretMail system administrator account. Vulnerability.Unauthorized access to computer systems is illegal. About. CVE-2026-23760 - An authentication bypass via password reset API in SmarterMail. Resources.", "is_search_result": true }, { "title": "CVE-2026-23760 : SmarterTools SmarterMail versions prior to build 9511 ...", "url": "https://www.cvedetails.com/cve/CVE-2026-23760/", "citation_contribution": 198, "snippet": "CVE-2026-23760 is in the CISA Known Exploited Vulnerabilities Catalog CISA vulnerability name: SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel Vulnerability CISA required action:", "is_search_result": true }, { "title": "CVE-2026-23760 - Exploits & Severity", "url": "https://feedly.com/cve/CVE-2026-23760", "citation_contribution": 167, "snippet": "SmarterTools SmarterMail versions prior to build 9511 contain an authentication bypass vulnerability in the password reset API.", "is_search_result": true }, { "title": "CVE-2026-23760 Archives - Security Affairs", "url": "https://securityaffairs.com/tag/cve-2026-23760", "citation_contribution": 131, "snippet": "Nonprofit security organization Shadowserver reported that over 6,000 SmarterMail servers are exposed on the internet and likely vulnerable to attacks exploiting a critical authentication bypass flaw tracked as CVE-2026-23760.", "is_search_result": true } ], "timestamp": "2026-01-27T20:20:33.673086" }, "cache_timestamp": "2026-01-27T20:20:49.947944", "displayed_on_website": false }, { "cve_id": "CVE-2026-22769", "cvss_score": "10.0", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "MEDIUM", "cve_published_date": "2026-02-17T19:19:34.178Z", "cve_published_date_formatted": "2026-02-17", "kev_date_added": "2026-02-18", "kev_date_added_formatted": "2026-02-18", "kev_due_date": "2026-02-21", "days_to_kev": 1, "days_since_kev": null, "is_new_kev": false, "summary": "Dell RecoverPoint for VMs contains hardcoded credentials allowing unauthenticated remote attackers to gain root-level access to the underlying OS. This critical vulnerability is under active exploitation in the wild.", "detailed_analysis": { "vulnerability_type": "Hardcoded credentials (CWE-798) allowing unauthorized remote authentication", "affected_products": [ "Dell RecoverPoint for Virtual Machines" ], "exploitation_requirements": [ "Network connectivity to the service", "Knowledge of hardcoded credentials", "No authentication required" ], "internet_facing_likelihood": "Dell RecoverPoint for VMs is enterprise backup/disaster recovery software that provides continuous data protection services. While primarily designed for internal enterprise networks, many deployments expose management interfaces to the internet for remote management, monitoring, and replication between geographically distributed sites. Estimated 30-40% of deployments have some level of internet exposure.", "typical_deployment": "Enterprise server infrastructure software providing continuous data protection and disaster recovery services for virtualized environments", "deployment_statistics": "Approximately 30-40% of deployments likely have internet-facing components due to remote management requirements, multi-site replication needs, and cloud integration capabilities common in enterprise DR solutions", "active_exploitation": "Confirmed active exploitation in the wild according to threat intelligence sources, though not yet added to CISA KEV catalog", "severity_factors": [ "CVSS 10.0 Critical severity", "No authentication required", "Remote network exploitation", "Root-level system compromise", "Active exploitation confirmed", "Hardcoded credentials cannot be easily changed without patches" ] }, "recommendations": [ "CRITICAL: Immediately check for indicators of compromise - this vulnerability is under active exploitation. Review authentication logs, check for unauthorized access, verify system integrity, and look for signs of persistence mechanisms", "URGENT: Upgrade to Dell RecoverPoint for VMs version 6.0.3.1 HF1 or later immediately", "IMMEDIATE: If patching cannot be completed immediately, implement network-level restrictions to block internet access to RecoverPoint management interfaces", "Monitor network traffic to/from RecoverPoint systems for suspicious authentication attempts and unauthorized access patterns", "Priority: CRITICAL - Patch within 24-48 hours due to active exploitation and ease of compromise" ], "risk_assessment": { "exploit_likelihood": "VERY HIGH - Hardcoded credentials with confirmed active exploitation make this extremely likely to be exploited against internet-facing instances", "impact_assessment": "CRITICAL - Complete system compromise with root-level access, potential for data theft, ransomware deployment, and persistent backdoor installation on critical backup infrastructure", "exposure_scope": "MODERATE - While not as ubiquitous as web servers, enterprise backup solutions like RecoverPoint are commonly deployed with internet-facing management interfaces, potentially affecting hundreds to thousands of organizations globally" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "The **CVE-2026-22769** vulnerability, affecting **Dell RecoverPoint for Virtual Machines versions prior to 6.0.3.1 HF1**, is a critical hardcoded credential vulnerability that is **under active exploitation** 【2】.\n\nHere's a breakdown of what is known:\n\n* **Internet-Facing Applications/Services:** The vulnerability affects Dell RecoverPoint for Virtual Machines. While not explicitly stated if it's exclusively internet-facing, the nature of hardcoded credentials can pose a significant risk if accessible remotely.\n* **Evidence of Active Exploitation:** There is clear evidence of active exploitation in the wild 【2】.\n* **Attack Vectors and Exploitation Methods:** The vulnerability involves **hardcoded credentials**. An unauthenticated remote attacker with knowledge of these credentials can exploit this flaw to gain unauthorized access to the underlying operating system and achieve root-level persistence 【1】.\n* **Targeted Attacks:** While the provided information confirms active exploitation, it does not specify if CVE-2026-22769 has been used in targeted attacks. However, the potential for root-level persistence suggests it could be a valuable tool for sophisticated attackers.\n* **CISA Known Exploited Vulnerabilities (KEV) Status:** As of the provided information, CVE-2026-22769 is **not listed** on CISA's Known Exploited Vulnerabilities (KEV) Catalog 【3】. CISA regularly updates this catalog based on evidence of active exploitation 【4】【5】.\n* **Technical Details about Internet Exploitability:** The vulnerability allows an **unauthenticated remote attacker** to exploit the hardcoded credentials. This grants them unauthorized access to the operating system, enabling them to establish persistence at the root level 【1】.\n\nSources:\n- Dell RecoverPoint for VMs Zero-Day CVE-2026-22769 Exploited...: https://thehackernews.com/2026/02/dell-recoverpoint-for-vms-zero-day-cve.html\n- CVE-2026-22769: Dell RecoverPoint Zero-Day Exploited — Analyst Advisory: https://threatlandscape.io/blog/analyst-advisory-critical-zero-day-cve-2026-22769-dell-recoverpoint\n- Known Exploited Vulnerabilities Catalog - CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog\n- CISA Adds Six Known Exploited Vulnerabilities to Catalog: https://www.cisa.gov/news-events/alerts/2026/02/10/cisa-adds-six-known-exploited-vulnerabilities-catalog\n- CISA Adds Four Known Exploited Vulnerabilities to Catalog: https://www.cisa.gov/news-events/alerts/2026/02/12/cisa-adds-four-known-exploited-vulnerabilities-catalog", "references": [ { "title": "Dell RecoverPoint for VMs Zero-Day CVE-2026-22769 Exploited...", "url": "https://thehackernews.com/2026/02/dell-recoverpoint-for-vms-zero-day-cve.html", "citation_contribution": 572, "snippet": "The activity involves the exploitation of CVE-2026-22769 (CVSS score: 10.0), a case of hard-coded credentials affecting versions prior to 6.0.3.1 HF1. Other products, including RecoverPoint Classic, are not vulnerable to the flaw. \"This is considered critical as an unauthenticated remote attacker with knowledge of the hardcoded credential could potentially exploit this vulnerability, leading to unauthorized access to the underlying operating system and root-level persistence,\" Dell said in a bulletin released Tuesday.", "is_search_result": true }, { "title": "CVE-2026-22769: Dell RecoverPoint Zero-Day Exploited — Analyst Advisory", "url": "https://threatlandscape.io/blog/analyst-advisory-critical-zero-day-cve-2026-22769-dell-recoverpoint", "citation_contribution": 309, "snippet": "Critical unauthenticated hardcoded-credential vulnerability in Dell RecoverPoint is under active exploitation. CVE-2026-22769 Immediate patching and network isolation recommended.", "is_search_result": true }, { "title": "Known Exploited Vulnerabilities Catalog - CISA", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "citation_contribution": 180, "snippet": "For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild. Organizations should use the KEV catalog as an input to their vulnerability management prioritization framework.How to use the KEV ...", "is_search_result": true }, { "title": "CISA Adds Six Known Exploited Vulnerabilities to Catalog", "url": "https://www.cisa.gov/news-events/alerts/2026/02/10/cisa-adds-six-known-exploited-vulnerabilities-catalog", "citation_contribution": 40, "snippet": "CISA has added six new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-21510", "is_search_result": true }, { "title": "CISA Adds Four Known Exploited Vulnerabilities to Catalog", "url": "https://www.cisa.gov/news-events/alerts/2026/02/12/cisa-adds-four-known-exploited-vulnerabilities-catalog", "citation_contribution": 36, "snippet": "CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.", "is_search_result": true } ], "timestamp": "2026-02-18T16:30:15.439411" }, "cache_timestamp": "2026-02-18T16:30:34.045394", "displayed_on_website": false }, { "cve_id": "CVE-2026-22719", "cvss_score": "8.1", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2026-02-25T19:18:59.269Z", "cve_published_date_formatted": "2026-02-25", "kev_date_added": "2026-03-03", "kev_date_added_formatted": "2026-03-03", "kev_due_date": "2026-03-24", "days_to_kev": 6, "days_since_kev": null, "is_new_kev": false, "summary": "Command injection vulnerability in VMware Aria Operations allows unauthenticated remote code execution during support-assisted product migration. Affects critical enterprise infrastructure management platforms commonly exposed to internet.", "detailed_analysis": { "vulnerability_type": "Command injection (CWE-77) leading to remote code execution", "affected_products": [ "VMware Aria Operations", "VMware Cloud Foundation", "VMware Telco Cloud Platform", "VMware Telco Cloud Infrastructure" ], "exploitation_requirements": [ "Network access to affected system", "Support-assisted product migration must be in progress", "No authentication required", "No user interaction required" ], "internet_facing_likelihood": "VMware Aria Operations and related cloud management platforms are frequently deployed as internet-facing services to enable remote administration, cloud operations management, and support access. These are enterprise-grade server applications designed for centralized infrastructure management, commonly requiring internet connectivity for cloud integration, remote management, and vendor support operations.", "typical_deployment": "Server-side enterprise infrastructure management platforms deployed in data centers and cloud environments, typically requiring network accessibility for administrative functions and cloud service integration", "deployment_statistics": "Estimated 70-80% of deployments are internet-accessible due to the nature of cloud operations management, remote administration requirements, and support-assisted migration processes that necessitate external connectivity", "active_exploitation": "No evidence of active exploitation in the wild currently. Not listed in CISA KEV catalog.", "severity_factors": [ "Unauthenticated remote code execution", "High CVSS score of 8.1", "Affects critical enterprise infrastructure", "Attack complexity is high but still network-exploitable", "Requires specific migration process to be active", "Multiple VMware enterprise products affected" ] }, "recommendations": [ "Immediate patching: Apply VMware Aria Operations 8.18.6, Cloud Foundation Operations 9.0.2.0, and other fixed versions listed in VMSA-2026-0001", "Review vendor workarounds in KB430349 if immediate patching is not possible", "Monitor for unauthorized command execution during migration processes", "Restrict network access to management interfaces where possible", "Review logs for suspicious activity during support-assisted migrations", "HIGH priority patching due to unauthenticated RCE capability" ], "risk_assessment": { "exploit_likelihood": "High for internet-facing deployments during migration processes, though attack complexity is elevated requiring specific timing when support-assisted migration is active", "impact_assessment": "Complete system compromise with full confidentiality, integrity, and availability impact on critical enterprise infrastructure management systems", "exposure_scope": "Significant exposure given widespread enterprise deployment of VMware infrastructure management platforms, particularly in cloud and hybrid environments" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "**CVE-2026-22719** is a **command injection vulnerability** affecting **VMware Aria Operations** 【2】【8】.\n\nHere's a breakdown of what is known about its exploitation:\n\n* **Internet-Facing Applications or Services:** The vulnerability is present in VMware Aria Operations, which can be internet-facing, especially when support-assisted product migration is in progress 【1】【2】.\n\n* **Evidence of Active Exploitation:** **There is currently no indication of active exploitation in the wild** 【4】.\n\n* **Attack Vectors and Exploitation Methods:**\n * A **malicious unauthenticated actor** can exploit this vulnerability 【1】【2】.\n * Exploitation is possible **while support-assisted product migration is in progress** 【1】【2】.\n * The vulnerability allows for the **execution of arbitrary commands**, which can lead to **remote code execution (RCE)** 【1】【2】.\n * The CVSS score for this vulnerability is **8.1 (High)** 【9】【10】.\n * While the exploitability is considered high due to the lack of privilege requirements, the **attack complexity is also noted as high**, meaning specific conditions must be met for a successful exploit 【1】【5】.\n\n* **Targeted Attacks:** There is no specific information available regarding whether this vulnerability has been used in targeted attacks.\n\n* **CISA Known Exploited Vulnerabilities (KEV) Status:** CVE-2026-22719 is **not currently listed** on the CISA Known Exploited Vulnerabilities (KEV) Catalog 【3】【11】.\n\n* **Technical Details about Internet Exploitability:** The vulnerability allows an unauthenticated actor to execute arbitrary commands remotely, specifically during the support-assisted product migration process 【1】【2】. This implies that the exploitability is tied to the availability and execution of this specific migration process.\n\nTo remediate CVE-2026-22719, it is recommended to apply the patches listed in the 'Fixed Version' column of the 'Response Matrix' found in VMware Security Advisory VMSA-2026-0001 【2】【6】. Workarounds are also documented in the 'Workarounds' column of the same matrix 【7】.\n\nSources:\n- CVE-2026-22719 Security Vulnerability & Exploit Details: https://cve.akaoma.com/cve-2026-22719\n- CVE-2026-22719 Detail - NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-22719\n- Known Exploited Vulnerabilities Catalog - CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog\n- VMware cloud management platform in triple threat -: https://www.sdxcentral.com/news/vmware-cloud-management-platform-in-triple-threat/\n- CVE-2026-27119 Security Vulnerability & Exploit Details: https://cve.akaoma.com/cve-2026-27119", "references": [ { "title": "CVE-2026-22719 Security Vulnerability & Exploit Details", "url": "https://cve.akaoma.com/cve-2026-22719", "citation_contribution": 509, "snippet": "CVE-2026-22719 presents a challenge to exploit due to its high attack complexity, but the absence of privilege requirements still makes it a viable target for skilled attackers. A thorough security review is advised.Below is the Impact Analysis for CVE-2026-22719, showing how Confidentiality, Integrity, and Availability might be affected if the vulnerability is exploited. Higher values usually signal greater potential damage.", "is_search_result": true }, { "title": "CVE-2026-22719 Detail - NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22719", "citation_contribution": 434, "snippet": "Information Technology Laboratory. National Vulnerability Database.A malicious unauthenticated actor may exploit this issue to execute arbitrary commands which may lead to remote code execution in VMware Aria Operations while support-assisted product migration is in progress. To remediate CVE-2026-22719, apply the patches listed in the 'Fixed Version' column of the ' Response Matrix https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947 ' in VMSA-2026-0001.", "is_search_result": true }, { "title": "Known Exploited Vulnerabilities Catalog - CISA", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "citation_contribution": 144, "snippet": "For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild. Organizations should use the KEV catalog as an input to their vulnerability management prioritization framework.How to use the KEV ...", "is_search_result": true }, { "title": "VMware cloud management platform in triple threat -", "url": "https://www.sdxcentral.com/news/vmware-cloud-management-platform-in-triple-threat/", "citation_contribution": 113, "snippet": "The new advisory revealed VMware Aria Operations is at risk from a triple threat of a command injection vulnerability (CVE-2026-22719), a stored cross-site scripting vulnerability (CVE-2026-22720), and a privilege escalation vulnerability (CVE-2026-22721). ... is currently no indication of active exploitation ... Designated as CVE-2024-37079, the exploit enables RCE or privilege escalation via the use of a specially made network packet in VMware's centralized management utility, vCenter Server.", "is_search_result": true }, { "title": "CVE-2026-27119 Security Vulnerability & Exploit Details", "url": "https://cve.akaoma.com/cve-2026-27119", "citation_contribution": 98, "snippet": "CVE-2026-27119 - svelte performance oriented web framework. From 5.39.3, <=5.51.4, in certain circumstances, the server-side rendering output of…Above is the CVSS Sub-score Breakdown for CVE-2026-27119, illustrating how Base, Impact, and Exploitability factors combine to form the overall severity rating. A higher sub-score typically indicates a more severe or easier-to-exploit vulnerability.", "is_search_result": true } ], "timestamp": "2026-03-03T18:30:26.125673" }, "cache_timestamp": "2026-03-03T18:30:43.423166", "displayed_on_website": false }, { "cve_id": "CVE-2026-21643", "cvss_score": "9.1", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2026-02-06T08:24:43.877Z", "cve_published_date_formatted": "2026-02-06", "kev_date_added": "2026-04-13", "kev_date_added_formatted": "2026-04-13", "kev_due_date": "2026-04-16", "days_to_kev": 66, "days_since_kev": null, "is_new_kev": false, "summary": "Critical unauthenticated SQL injection vulnerability in Fortinet FortiClient EMS 7.4.4 allows remote code execution via HTTP requests. This vulnerability is actively being exploited in the wild and has been added to CISA's KEV catalog.", "detailed_analysis": { "vulnerability_type": "Unauthenticated SQL injection (CWE-89) leading to remote code execution", "affected_products": [ "Fortinet FortiClient EMS 7.4.4" ], "exploitation_requirements": [ "Network access to FortiClient EMS server", "No authentication required", "No user interaction required" ], "internet_facing_likelihood": "FortiClient EMS is frequently deployed as an internet-facing server application. As an endpoint management server, it requires connectivity from remote endpoints and is commonly exposed to the internet to manage distributed clients. Web search indicates over 2,000 instances are currently exposed online.", "typical_deployment": "FortiClient EMS is server software designed to centrally manage FortiClient endpoint security installations across an organization. It typically runs as a web-based management server that needs to be accessible by remote endpoints.", "deployment_statistics": "Approximately 60-70% of deployments are likely internet-facing, as the primary use case involves managing distributed endpoints that may be outside the corporate network. The web search confirms thousands of instances are currently exposed online.", "active_exploitation": "CISA has added this to the KEV catalog based on evidence of active exploitation. Web search confirms this vulnerability is being actively exploited in the wild with proof-of-concept code available on GitHub.", "severity_factors": [ "CVSS 9.1 Critical severity", "No authentication required", "Remote code execution capability", "Active exploitation confirmed", "Public exploit code available", "Thousands of exposed instances online" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs for suspicious HTTP requests, check for unauthorized access, verify system integrity and look for anomalous activity or unexpected outbound connections", "IMMEDIATE: Upgrade to FortiClientEMS version 7.4.5 or above, or upcoming version 8.0.0", "URGENT: If patching cannot be done immediately, restrict internet-facing access using firewall rules or VPN-gated access", "Monitor HTTP access logs for unusual SQL injection attempts or crafted requests to the EMS interface", "Highest patch priority - treat as emergency due to active exploitation and unauthenticated RCE capability" ], "risk_assessment": { "exploit_likelihood": "VERY HIGH - Active exploitation confirmed with public proof-of-concept code available and no authentication required", "impact_assessment": "CRITICAL - Full system compromise possible with ability to execute arbitrary code, exfiltrate credentials, and potentially pivot to managed endpoints", "exposure_scope": "HIGH - Web search indicates 2,000+ FortiClient EMS instances are currently exposed online, representing significant attack surface" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "**CVE-2026-21643** is a critical vulnerability affecting **Fortinet's FortiClient Endpoint Management Server (EMS)**, specifically version 7.4.4 【3】. It has been **actively exploited in the wild** 【2】【3】.\n\nHere's a breakdown of what is known about its exploitation:\n\n* **Internet-facing applications or services:** The vulnerability affects FortiClient EMS, which can be exposed to the internet, making it a potential target for external attackers 【1】.\n* **Evidence of active exploitation:** There is clear evidence that this vulnerability is being exploited in the wild, with threat actors leveraging it in attacks 【2】【3】. Defused Cyber is credited with detecting zero-day active attacks 【2】.\n* **Attack vectors and exploitation methods:** CVE-2026-21643 is classified as an **unauthenticated RCE (Remote Code Execution) flaw** 【1】. It is described as a **SQL injection vulnerability** 【3】. Successful exploitation may lead to remote code execution, allowing attackers to exfiltrate usernames and hashed passwords for local device administrators, portal administrators, and user accounts used for remote access 【4】.\n* **Targeted attacks:** While the provided information confirms active exploitation, it does not explicitly state whether these attacks have been used in targeted campaigns against specific organizations.\n* **CISA Known Exploited Vulnerabilities (KEV) status:** As of April 6, 2026, CISA added CVE-2026-21643 to its Known Exploited Vulnerabilities (KEV) Catalog 【5】. This addition is based on evidence of active exploitation 【5】. Organizations are advised to use the KEV catalog for vulnerability prioritization 【7】.\n* **Technical details about internet exploitability:** The vulnerability allows for unauthorized code or commands to be executed through maliciously crafted HTTP requests 【2】. It is an unauthenticated flaw, meaning an attacker with network-level access to the EMS management server can carry out the attack without prior authentication 【6】.\n\n**Recommendations for mitigation include:**\n\n* Applying patches released by Fortinet addressing CVE-2026-21643 without delay 【1】.\n* Restricting internet-facing access to the EMS management interface using firewall rules or VPN-gated access 【1】.\n* Reviewing logs for anomalous activity, unauthorized configuration changes, or unexpected outbound connections 【1】.\n\nSources:\n- 2,000+ FortiClient EMS Instances Exposed Online Amid Active RCE...: https://cybersecuritynews.com/forticlient-ems-instances-exposed-online/\n- Fortinet EMS Vulnerabilities Actively Exploited: https://www.greenbone.net/en/blog/patch-now-2026-35616-and-cve-2026-21643/\n- Critical Fortinet Forticlient EMS Vulnerability Exploited in Attacks: https://cybersecuritynews.com/forticlient-ems-vulnerability-exploited/\n- Print View: https://www.cisa.gov/known-exploited-vulnerabilities-catalog-print\n- CISA Adds One Known Exploited Vulnerability to Catalog | CISA: https://www.cisa.gov/news-events/alerts/2026/04/06/cisa-adds-one-known-exploited-vulnerability-catalog", "references": [ { "title": "2,000+ FortiClient EMS Instances Exposed Online Amid Active RCE...", "url": "https://cybersecuritynews.com/forticlient-ems-instances-exposed-online/", "citation_contribution": 628, "snippet": "Two vulnerabilities, CVE-2026-35616 and CVE-2026-21643, both classified as unauthenticated RCE flaws, were exploited in the wild, affecting Fortinet’s FortiClient EMS platform.Apply patches released by Fortinet addressing CVE-2026-35616 and CVE-2026-21643 without delay. Restrict internet-facing access to the EMS management interface using firewall rules or VPN-gated access. Review logs for anomalous activity, unauthorized configuration changes, or unexpected outbound connections.", "is_search_result": true }, { "title": "Fortinet EMS Vulnerabilities Actively Exploited", "url": "https://www.greenbone.net/en/blog/patch-now-2026-35616-and-cve-2026-21643/", "citation_contribution": 338, "snippet": "An attacker exploiting CVE-2026-35616 may execute unauthorized code or commands through maliciously crafted HTTP requests.Active exploitation of CVE-2026-21643 (CVSS 9.8) was acknowledged in Fortinet’s security advisory (FG-IR-26-099) on April 4th. Defused Cyber is credited with detection of zero-day active attacks and responsible disclosure to the vendor.", "is_search_result": true }, { "title": "Critical Fortinet Forticlient EMS Vulnerability Exploited in Attacks", "url": "https://cybersecuritynews.com/forticlient-ems-vulnerability-exploited/", "citation_contribution": 309, "snippet": "A critical SQL injection vulnerability in Fortinet’s FortiClient Endpoint Management Server (EMS), tracked as CVE-2026-21643, is actively being exploited in the wild. Threat actors have been leveraging this flaw in attacks starting four days ago, despite it not yet appearing on the CISA Known Exploited Vulnerabilities catalog. The security flaw affects FortiClient EMS version 7.4.4, leaving ...", "is_search_result": true }, { "title": "Print View", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog-print", "citation_contribution": 220, "snippet": "Successful exploitation may cause remote code execution to exfiltrate usernames and hashed passwords for the local device admin (s), portal admins, and user accounts used for remote access (but not external Active Directory or LDAP passwords).", "is_search_result": true }, { "title": "CISA Adds One Known Exploited Vulnerability to Catalog | CISA", "url": "https://www.cisa.gov/news-events/alerts/2026/04/06/cisa-adds-one-known-exploited-vulnerability-catalog", "citation_contribution": 217, "snippet": "CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.", "is_search_result": true } ], "timestamp": "2026-04-13T17:30:28.888749" }, "cache_timestamp": "2026-04-13T18:55:21.307349", "displayed_on_website": false }, { "cve_id": "CVE-2026-21533", "cvss_score": "7.8", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "MEDIUM_RISK", "confidence": "HIGH", "mitre_technique": "T1133", "deployment_likelihood": "HIGH", "cve_published_date": "2026-02-10T17:51:26.211Z", "cve_published_date_formatted": "2026-02-10", "kev_date_added": "2026-02-10", "kev_date_added_formatted": "2026-02-10", "kev_due_date": "2026-03-03", "days_to_kev": 0, "days_since_kev": null, "is_new_kev": false, "summary": "Windows Remote Desktop Services privilege escalation vulnerability affecting multiple Windows versions. Allows authorized attackers to elevate privileges locally, potentially leading to full system compromise on RDP-enabled systems. Listed in CISA KEV indicating active exploitation.", "detailed_analysis": { "vulnerability_type": "Privilege escalation in Windows Remote Desktop Services (improper privilege management)", "affected_products": [ "Windows Server 2012", "Windows Server 2012 R2", "Windows Server 2016", "Windows Server 2019", "Windows Server 2022", "Windows Server 2025", "Windows 10 (versions 1607, 1809, 21H2, 22H2)", "Windows 11 (versions 22H3, 23H2, 24H2, 25H2, 26H1)" ], "exploitation_requirements": [ "Authentication to RDP service", "Network access to RDP port (3389)", "Valid user credentials" ], "internet_facing_likelihood": "RDP services are commonly exposed to the internet in enterprise environments for remote administration, though security best practices recommend against direct internet exposure. Estimated 15-30% of RDP deployments may be internet-accessible through direct exposure or VPN gateways.", "typical_deployment": "RDP is primarily a server-side service listening on network ports for remote administration and user access. While present on client systems, it's most commonly enabled and used on servers and workstations that need remote access.", "deployment_statistics": "Approximately 20-35% of RDP deployments may be accessible from the internet either directly or through remote access infrastructure, particularly in organizations using RDP for remote work or server administration.", "active_exploitation": "Listed in CISA KEV catalog indicating confirmed exploitation in the wild", "severity_factors": [ "Requires authentication which reduces immediate impact", "Leads to privilege escalation enabling full system compromise", "Affects widely deployed RDP service", "Active exploitation confirmed by CISA KEV listing" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review RDP logs, check for unauthorized privilege escalations, verify administrator account integrity", "Apply security updates immediately for all affected Windows systems with RDP enabled", "Audit RDP access logs for suspicious authentication and privilege escalation attempts", "Consider implementing RDP gateway solutions instead of direct internet exposure", "Enable RDP network level authentication and restrict RDP access to specific user groups", "Monitor for unusual administrative activity following RDP sessions" ], "risk_assessment": { "exploit_likelihood": "HIGH - Requires authentication but RDP is commonly exposed and vulnerability is actively exploited", "impact_assessment": "HIGH - Privilege escalation can lead to full system compromise and lateral movement in enterprise networks", "exposure_scope": "MEDIUM-HIGH - Significant number of internet-accessible RDP services in enterprise environments" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:29:35.890405", "displayed_on_website": false }, { "cve_id": "CVE-2026-21525", "cvss_score": "6.2", "attack_vector": "LOCAL", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1499", "deployment_likelihood": "LOW", "cve_published_date": "2026-02-10T17:51:34.755Z", "cve_published_date_formatted": "2026-02-10", "kev_date_added": "2026-02-10", "kev_date_added_formatted": "2026-02-10", "kev_due_date": "2026-03-03", "days_to_kev": 0, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2026-21525 is a null pointer dereference vulnerability in Windows Remote Access Connection Manager that allows local denial of service attacks. Despite being in CISA KEV, the CVSS attack vector is LOCAL, making it unsuitable for direct internet exploitation.", "detailed_analysis": { "vulnerability_type": "Null pointer dereference leading to denial of service in Windows Remote Access Connection Manager (CWE-476)", "affected_products": [ "Windows Server 2025", "Windows Server 2022", "Windows Server 2019", "Windows Server 2016", "Windows Server 2012 R2", "Windows Server 2012", "Windows 11", "Windows 10" ], "exploitation_requirements": [ "Local access to system", "No authentication required for local exploitation", "Access to Windows Remote Access Connection Manager component" ], "internet_facing_likelihood": "The Windows Remote Access Connection Manager is primarily a client-side component that manages outbound VPN and dial-up connections. While Windows Servers may have this component, it is not typically exposed as an internet-facing service. The LOCAL attack vector in CVSS confirms this vulnerability requires local system access rather than network-based exploitation.", "typical_deployment": "Windows Remote Access Connection Manager is a system service that manages outbound remote access connections (VPN, dial-up). It runs on both client and server systems but is not designed as an internet-facing service - it facilitates outbound connections rather than accepting inbound network connections.", "deployment_statistics": "Less than 5% of deployments would be directly exploitable over the internet, as this component is not intended for internet exposure. The vulnerability requires local access to trigger the null pointer dereference.", "active_exploitation": "Listed in CISA KEV indicating active exploitation, likely through local access scenarios or as part of attack chains where attackers have already gained initial system access", "severity_factors": [ "CISA KEV listing indicates real-world exploitation", "Local attack vector limits direct internet exploitation", "Denial of service impact only", "No privilege escalation or code execution", "Affects critical Windows infrastructure component" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs for unusual Remote Access Connection Manager activity, check for unauthorized local access, verify system stability", "Apply Microsoft security updates immediately for all affected Windows systems", "Monitor Windows Event Logs for crashes or errors related to Remote Access Connection Manager service", "Review local user access and authentication logs for signs of unauthorized system access", "HIGH patch priority due to CISA KEV listing despite local attack vector" ], "risk_assessment": { "exploit_likelihood": "Low for direct internet exploitation due to LOCAL attack vector, but HIGH for environments where attackers have local access or use this in attack chains", "impact_assessment": "Denial of service impact affecting Remote Access Connection Manager functionality, potentially disrupting VPN and remote access capabilities", "exposure_scope": "Limited direct internet exposure, but widespread deployment across Windows infrastructure makes this significant for environments where local access is possible" }, "exploitation_method": "OTHER", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:29:15.147305", "displayed_on_website": false }, { "cve_id": "CVE-2026-21519", "cvss_score": "7.8", "attack_vector": "LOCAL", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1068", "deployment_likelihood": "VERY_LOW", "cve_published_date": "2026-02-10T17:51:13.956Z", "cve_published_date_formatted": "2026-02-10", "kev_date_added": "2026-02-10", "kev_date_added_formatted": "2026-02-10", "kev_due_date": "2026-03-03", "days_to_kev": 0, "days_since_kev": null, "is_new_kev": false, "summary": "This is a local privilege escalation vulnerability in the Windows Desktop Window Manager (DWM) that requires local authentication and user interaction. While it affects both client and server Windows systems, it cannot be directly exploited over the internet as it requires local access to the system.", "detailed_analysis": { "vulnerability_type": "Type confusion vulnerability in Desktop Window Manager allowing local privilege escalation", "affected_products": [ "Windows 10 (multiple versions)", "Windows 11 (multiple versions)", "Windows Server 2016", "Windows Server 2019", "Windows Server 2022", "Windows Server 2025" ], "exploitation_requirements": [ "Local authentication required", "Local access to the system", "Access to Desktop Window Manager", "Low-privilege user account" ], "internet_facing_likelihood": "Desktop Window Manager is a local Windows graphics subsystem component that manages desktop composition and window rendering. It is not a network service and does not listen on network ports. This component operates locally within the Windows desktop environment and is not directly accessible from the internet. Even on Windows Server systems, DWM operates as a local system component.", "typical_deployment": "Desktop Window Manager is a core Windows component that runs on all Windows desktop and server installations to manage window composition and desktop graphics. It is not a network-facing service.", "deployment_statistics": "0% - Desktop Window Manager is never directly internet-facing as it is a local graphics subsystem component", "active_exploitation": "Listed in CISA KEV catalog indicating active exploitation in the wild, likely being used for local privilege escalation in attack chains", "severity_factors": [ "High CVSS score of 7.8", "Active exploitation confirmed (CISA KEV)", "Affects wide range of Windows versions", "Local privilege escalation capability", "Requires local access limiting remote exploitation" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Apply Microsoft security updates immediately for all affected Windows systems", "Monitor for unusual privilege escalation activities on local systems", "Implement principle of least privilege to limit impact of successful exploitation", "Review endpoint detection and response (EDR) logs for suspicious local privilege escalation attempts" ], "risk_assessment": { "exploit_likelihood": "Low for direct internet exploitation (requires local access), but high for post-compromise privilege escalation given active exploitation", "impact_assessment": "High impact for compromised systems - allows attackers with local access to gain elevated privileges", "exposure_scope": "Not directly internet-facing, but affects millions of Windows systems that could be targeted after initial compromise" }, "exploitation_method": "OTHER", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:29:55.967537", "displayed_on_website": false }, { "cve_id": "CVE-2026-21514", "cvss_score": "7.8", "attack_vector": "LOCAL", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1203", "deployment_likelihood": "VERY_LOW", "cve_published_date": "2026-02-10T17:51:34.153Z", "cve_published_date_formatted": "2026-02-10", "kev_date_added": "2026-02-10", "kev_date_added_formatted": "2026-02-10", "kev_due_date": "2026-03-03", "days_to_kev": 0, "days_since_kev": null, "is_new_kev": false, "summary": "Security feature bypass vulnerability in Microsoft Word that allows attackers to bypass security protections when users open malicious documents. Requires local access and user interaction, making it unsuitable for direct internet exploitation despite being in CISA KEV.", "detailed_analysis": { "vulnerability_type": "Security Feature Bypass (CWE-807: Reliance on Untrusted Inputs in a Security Decision)", "affected_products": [ "Microsoft 365 Apps for Enterprise", "Microsoft Office LTSC 2021", "Microsoft Office LTSC 2024", "Microsoft Office LTSC for Mac 2021", "Microsoft Office LTSC for Mac 2024" ], "exploitation_requirements": [ "Local access to target system", "User interaction required (UI:R)", "No authentication required (PR:N)", "Low attack complexity (AC:L)" ], "internet_facing_likelihood": "Microsoft Office applications are client-side productivity software, not server applications. They are not designed to be internet-facing services and are typically deployed on end-user workstations and laptops. While Office 365 cloud services exist, this vulnerability specifically affects the local Office applications, not the cloud infrastructure.", "typical_deployment": "Client-side desktop/laptop applications for document creation and editing. These are end-user productivity tools installed on individual workstations, not server software.", "deployment_statistics": "Less than 1% of deployments would be internet-facing. Office applications are designed for local use and exposing them directly to the internet would be a severe security misconfiguration.", "active_exploitation": "Listed in CISA KEV catalog indicating active exploitation in the wild, likely through malicious document campaigns or local attacks", "severity_factors": [ "High CVSS score of 7.8", "Active exploitation confirmed by CISA KEV listing", "Affects widely deployed Office applications", "Local attack vector limits remote exploitation", "Requires user interaction" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Apply Microsoft security updates immediately for all affected Office versions", "Implement application control policies to prevent execution of untrusted Office documents", "Train users on identifying and avoiding malicious documents", "Enable Microsoft Office Protected View and disable macros by default", "Monitor for suspicious Office application behavior and file access patterns", "High priority patching due to CISA KEV listing and active exploitation" ], "risk_assessment": { "exploit_likelihood": "Low for direct internet exploitation due to local attack vector requirement, but high for targeted attacks using malicious documents", "impact_assessment": "High impact (C:H/I:H/A:H) allowing complete compromise of affected workstation when successfully exploited locally", "exposure_scope": "Minimal internet-facing exposure as these are client applications, but widespread deployment across enterprise environments creates large attack surface for document-based attacks" }, "exploitation_method": "USER_INTERACTION", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:30:18.797167", "displayed_on_website": false }, { "cve_id": "CVE-2026-21513", "cvss_score": "8.8", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1189", "deployment_likelihood": "VERY_LOW", "cve_published_date": "2026-02-10T17:51:26.733Z", "cve_published_date_formatted": "2026-02-10", "kev_date_added": "2026-02-10", "kev_date_added_formatted": "2026-02-10", "kev_due_date": "2026-03-03", "days_to_kev": 0, "days_since_kev": null, "is_new_kev": false, "summary": "MSHTML Framework security feature bypass vulnerability requiring user interaction. While CVSS shows network attack vector, MSHTML is a client-side HTML rendering engine used in browsers and applications, not an internet-facing server service.", "detailed_analysis": { "vulnerability_type": "Security Feature Bypass (CWE-693) - Protection mechanism failure in MSHTML Framework allowing unauthorized bypass of security features", "affected_products": [ "Windows 11 (all versions)", "Windows 10 (multiple versions)", "Windows Server 2025", "Windows Server 2022", "Windows Server 2019", "Windows Server 2016", "Windows Server 2012/2012 R2" ], "exploitation_requirements": [ "User interaction required (UI:R in CVSS)", "Network access to deliver malicious content", "Target must access malicious HTML content" ], "internet_facing_likelihood": "MSHTML Framework is a client-side HTML rendering engine integrated into Internet Explorer, WebBrowser controls, and various Windows applications. It is NOT a server-side service that listens on network ports. While Windows Servers are affected, they would only be vulnerable when users on those servers interact with HTML content through applications using MSHTML.", "typical_deployment": "MSHTML is a client-side component used for HTML rendering in desktop applications, not a network service. Even on Windows Server installations, MSHTML functions as a client-side library for applications that need HTML rendering capabilities.", "deployment_statistics": "Less than 1% - MSHTML does not run as an internet-facing service. It's a client-side component that processes HTML content within applications. Exploitation requires user interaction with malicious content.", "active_exploitation": "No evidence of active exploitation mentioned in sources. Not listed in CISA KEV catalog.", "severity_factors": [ "High CVSS score (8.8) due to potential for complete system compromise", "Requires user interaction (UI:R) which limits direct internet exploitation", "Security feature bypass could enable further attack chains", "Affects multiple Windows versions including servers" ] }, "recommendations": [ "Apply Microsoft security updates for February 2026 Patch Tuesday", "Educate users about risks of opening untrusted HTML content or visiting suspicious websites", "Implement application control policies to restrict execution of potentially malicious content", "Medium priority patching - while high CVSS score, requires user interaction and is not directly internet-exploitable" ], "risk_assessment": { "exploit_likelihood": "Low for direct internet exploitation - requires user to interact with malicious HTML content, making this more suitable for phishing/social engineering attacks rather than direct network exploitation", "impact_assessment": "High impact if exploited (CVSS 8.8) - could lead to complete compromise of affected system with high confidentiality, integrity, and availability impact", "exposure_scope": "Limited - no internet-facing MSHTML services exist; vulnerability requires user interaction with malicious content rather than direct network exploitation" }, "exploitation_method": "USER_INTERACTION", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "Regarding CVE-2026-21513, here's what is known about its exploitation:\n\n- **Affected Applications/Services**: The vulnerability is associated with **MSHTML Framework** 【2】【5】.\n\n- **Evidence of Active Exploitation**: There is **no direct evidence** in the provided search results indicating that CVE-2026-21513 has been actively exploited in the wild. However, Microsoft has released security updates for it, suggesting it is a vulnerability of concern 【2】【4】. Some sources mention that Microsoft attaches its standard report-confidence indicator to the advisory for this CVE, which typically means it's a confirmed vulnerability 【2】.\n\n- **Attack Vectors and Exploitation Methods**: The vulnerability is classified as a **Security Feature Bypass** 【2】【5】. This means an attacker could potentially bypass security features implemented in the MSHTML Framework. The exact technical details of how this bypass is achieved are not elaborated upon in the provided information, but it is described as a \"protection mechanism failure\" 【1】.\n\n- **Use in Targeted Attacks**: There is **no specific information** available in the provided search results detailing whether CVE-2026-21513 has been used in targeted attacks.\n\n- **CISA Known Exploited Vulnerabilities (KEV) Status**: CVE-2026-21513 is **not listed** on CISA's Known Exploited Vulnerabilities (KEV) catalog based on the provided search results. CISA's KEV catalog is a resource of vulnerabilities that have been actively exploited in the wild 【3】【6】.\n\n- **Technical Details about Internet Exploitability**: The provided information indicates that the vulnerability allows an unauthorized attacker to bypass a security feature **over a network** 【1】. This suggests potential for remote exploitation, but specific details on how it affects internet-facing applications or services are not detailed. The vulnerability is in MSHTML, which is a component used in various Microsoft products, and security feature bypasses can often be triggered through specially crafted content, potentially over a network.\n\nSources:\n- February 2026 Patch Tuesday: 10 Critical Vulnerabilities Amid 59 CVEs: https://feedly.com/cve/security-advisories/microsoft/2026-02-10-february-2026-patch-tuesday-10-critical-vulnerabilities-amid-59-cves\n- CVE-2026-21513 MSHTML Security Feature Bypass: Patch and Harden Now: https://windowsforum.com/threads/cve-2026-21513-mshtml-security-feature-bypass-patch-and-harden-now.400782/\n- Known Exploited Vulnerabilities Catalog - CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog\n- Microsoft February 2026 Patch Tuesday fixes 6 zero-days, 58 flaws: https://www.bleepingcomputer.com/news/microsoft/microsoft-february-2026-patch-tuesday-fixes-6-zero-days-58-flaws/\n- Microsoft Patch Tuesday February 2026 – 54 Vulnerabilities Fixed ...: https://cybersecuritynews.com/microsoft-patch-tuesday-february-2026/", "references": [ { "title": "February 2026 Patch Tuesday: 10 Critical Vulnerabilities Amid 59 CVEs", "url": "https://feedly.com/cve/security-advisories/microsoft/2026-02-10-february-2026-patch-tuesday-10-critical-vulnerabilities-amid-59-cves", "citation_contribution": 466, "snippet": "CVE-2026-21513 Protection mechanism failure in MSHTML Framework allows an unauthorized attacker to bypass a security feature over a network.", "is_search_result": true }, { "title": "CVE-2026-21513 MSHTML Security Feature Bypass: Patch and Harden Now", "url": "https://windowsforum.com/threads/cve-2026-21513-mshtml-security-feature-bypass-patch-and-harden-now.400782/", "citation_contribution": 381, "snippet": "What Microsoft’s advisory actually tells us The vendor entry for CVE‑2026‑21513 in the Microsoft Security Update Guide confirms three short, authoritative facts: the affected product surface is MSHTML, the classification is Security Feature Bypass, and Microsoft attaches its standard report‑confidence indicator to the advisory.", "is_search_result": true }, { "title": "Known Exploited Vulnerabilities Catalog - CISA", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "citation_contribution": 234, "snippet": "For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild. Organizations should use the KEV catalog as an input to their vulnerability management prioritization framework.How to use the KEV ...", "is_search_result": true }, { "title": "Microsoft February 2026 Patch Tuesday fixes 6 zero-days, 58 flaws", "url": "https://www.bleepingcomputer.com/news/microsoft/microsoft-february-2026-patch-tuesday-fixes-6-zero-days-58-flaws/", "citation_contribution": 178, "snippet": "As no details have been released, it is unclear if CVE-2026-21510, CVE-2026-21513, and CVE-2026-21514 were exploited in the same campaign. ... Of ...", "is_search_result": true }, { "title": "Microsoft Patch Tuesday February 2026 – 54 Vulnerabilities Fixed ...", "url": "https://cybersecuritynews.com/microsoft-patch-tuesday-february-2026/", "citation_contribution": 97, "snippet": "These include: CVE-2026-21514: Security feature bypass in Microsoft Office Word. CVE-2026-21513: Security feature bypass in MSHTML Framework.", "is_search_result": true } ], "timestamp": "2026-02-10T19:05:28.293377" }, "cache_timestamp": "2026-02-10T19:05:47.740751", "displayed_on_website": false }, { "cve_id": "CVE-2026-21510", "cvss_score": "8.8", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "MEDIUM", "mitre_technique": "T1548", "deployment_likelihood": "VERY_LOW", "cve_published_date": "2026-02-10T17:51:32.210Z", "cve_published_date_formatted": "2026-02-10", "kev_date_added": "2026-02-10", "kev_date_added_formatted": "2026-02-10", "kev_due_date": "2026-03-03", "days_to_kev": 0, "days_since_kev": null, "is_new_kev": false, "summary": "Windows Shell security feature bypass vulnerability with high CVSS score but requires user interaction. Affects primarily client systems with minimal internet-facing deployment likelihood.", "detailed_analysis": { "vulnerability_type": "Protection mechanism failure in Windows Shell allowing security feature bypass (CWE-693)", "affected_products": [ "Windows 10 (various versions)", "Windows 11 (various versions)", "Windows Server 2012/2012 R2", "Windows Server 2016", "Windows Server 2019", "Windows Server 2022", "Windows Server 2025" ], "exploitation_requirements": [ "Network access", "User interaction required (UI:R)", "No authentication required (PR:N)", "Low attack complexity (AC:L)" ], "internet_facing_likelihood": "While Windows Server versions are affected, the Windows Shell component is primarily part of the desktop environment rather than server services. Windows Servers are typically deployed without the full shell interface in production environments, especially internet-facing ones. Server Core installations, which are common for internet-facing deployments, have minimal shell components.", "typical_deployment": "Windows Shell is primarily a client-side desktop environment component. Even on Windows Server, it's mainly used for local administration rather than serving internet-facing applications. Most internet-facing Windows servers use Server Core or have shell access restricted to local/management networks.", "deployment_statistics": "Estimated <5% of affected systems are internet-facing. Windows client systems (10/11) are typically behind NAT/firewalls. Windows servers with full shell exposed to internet are rare due to security best practices favoring Server Core and restricted management access.", "active_exploitation": "No evidence of active exploitation found. Not listed in CISA KEV catalog.", "severity_factors": [ "High CVSS score (8.8) indicates significant potential impact", "User interaction requirement limits direct exploitation", "Affects both client and server systems", "Security feature bypass could enable further attacks", "Wide range of affected Windows versions" ] }, "recommendations": [ "Apply Microsoft security updates for affected Windows versions", "Prioritize patching for systems with interactive user access", "Review Windows Server deployments to ensure Server Core usage where possible", "Implement network segmentation to limit shell access to management networks only", "Monitor for unusual shell process activity or security feature bypass attempts" ], "risk_assessment": { "exploit_likelihood": "Low for direct internet exploitation due to user interaction requirement and minimal internet-facing deployment of Windows Shell components", "impact_assessment": "High impact if exploited (CVSS 8.8) - could lead to complete system compromise with high confidentiality, integrity, and availability impact", "exposure_scope": "Limited internet-facing exposure - primarily affects client systems and server management interfaces not typically exposed to internet" }, "exploitation_method": "USER_INTERACTION", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "Regarding CVE-2026-21510, there is **no specific information available** about its exploitation, including whether it affects internet-facing applications, evidence of active exploitation, attack vectors, targeted attacks, or its status on the CISA Known Exploited Vulnerabilities (KEV) catalog.\n\nThe CISA KEV catalog is a resource that lists vulnerabilities that have been actively exploited in the wild, and organizations are encouraged to use it for vulnerability management prioritization 【1】【5】. CISA regularly updates this catalog with new vulnerabilities based on evidence of active exploitation 【2】【3】. However, CVE-2026-21510 is not mentioned in the provided information.\n\nWhile some vulnerabilities have had exploitation efforts ongoing since specific dates 【4】, and CISA has added multiple vulnerabilities to its KEV catalog in early 2026 【2】【3】, there are no details linking CVE-2026-21510 to any of these activities or providing technical details about its exploitability.\n\nSources:\n- Known Exploited Vulnerabilities Catalog - CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog\n- CISA Adds Two Known Exploited Vulnerabilities to Catalog: https://www.cisa.gov/news-events/alerts/2026/02/05/cisa-adds-two-known-exploited-vulnerabilities-catalog\n- CISA Adds One Known Exploited Vulnerability to Catalog: https://www.cisa.gov/news-events/alerts/2026/01/13/cisa-adds-one-known-exploited-vulnerability-catalog\n- CISA Updates KEV Catalog with Four Actively Exploited Software...: https://thehackernews.com/2026/01/cisa-updates-kev-catalog-with-four.html\n- Reducing the Significant Risk of Known Exploited Vulnerabilities - CISA: https://www.cisa.gov/known-exploited-vulnerabilities", "references": [ { "title": "Known Exploited Vulnerabilities Catalog - CISA", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "citation_contribution": 136, "snippet": "For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild. Organizations should use the KEV catalog as an input to their vulnerability management prioritization framework.How to use the KEV ...", "is_search_result": true }, { "title": "CISA Adds Two Known Exploited Vulnerabilities to Catalog", "url": "https://www.cisa.gov/news-events/alerts/2026/02/05/cisa-adds-two-known-exploited-vulnerabilities-catalog", "citation_contribution": 91, "snippet": "CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.", "is_search_result": true }, { "title": "CISA Adds One Known Exploited Vulnerability to Catalog", "url": "https://www.cisa.gov/news-events/alerts/2026/01/13/cisa-adds-one-known-exploited-vulnerability-catalog", "citation_contribution": 89, "snippet": "CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.", "is_search_result": true }, { "title": "CISA Updates KEV Catalog with Four Actively Exploited Software...", "url": "https://thehackernews.com/2026/01/cisa-updates-kev-catalog-with-four.html", "citation_contribution": 86, "snippet": "CISA added four actively exploited vulnerabilities to its KEV catalog, urging U.S. federal agencies to apply fixes by February 12, 2026.According to CrowdSec, exploitation efforts targeting CVE-2025-68645 have been ongoing since January 14, 2026. There are currently no details on how the other vulnerabilities are being exploited in the wild.", "is_search_result": true }, { "title": "Reducing the Significant Risk of Known Exploited Vulnerabilities - CISA", "url": "https://www.cisa.gov/known-exploited-vulnerabilities", "citation_contribution": 59, "snippet": "Learn about the importance of CISA's Known Exploited Vulnerability (KEV) catalog and how to use it to help build a collective resilience across the cybersecurity community.", "is_search_result": true } ], "timestamp": "2026-02-10T19:05:53.135017" }, "cache_timestamp": "2026-02-10T19:06:11.287649", "displayed_on_website": false }, { "cve_id": "CVE-2026-21509", "cvss_score": "7.8", "attack_vector": "LOCAL", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1204", "deployment_likelihood": "VERY_LOW", "cve_published_date": "2026-01-26T17:06:35.512Z", "cve_published_date_formatted": "2026-01-26", "kev_date_added": "2026-01-26", "kev_date_added_formatted": "2026-01-26", "kev_due_date": "2026-02-16", "days_to_kev": 0, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2026-21509 is a security feature bypass vulnerability in Microsoft Office applications that requires local access and user interaction (AV:L/UI:R). Despite being in CISA KEV, it primarily affects client-side Office applications through malicious documents rather than internet-facing servers.", "detailed_analysis": { "vulnerability_type": "Security Feature Bypass - Reliance on Untrusted Inputs (CWE-807)", "affected_products": [ "Microsoft 365 Apps for Enterprise", "Microsoft Office 2019", "Microsoft Office LTSC 2021", "Microsoft Office LTSC 2024", "Microsoft Office 2016" ], "exploitation_requirements": [ "Local access to target system", "User interaction required", "Malicious Office document or file", "User must open/execute the malicious content" ], "internet_facing_likelihood": "Microsoft Office applications are primarily client-side desktop productivity software. While Office 365/Microsoft 365 has web components, this CVE specifically targets the desktop Office applications (Word, Excel, PowerPoint, etc.). These are not typically deployed as internet-facing server applications. Estimated <1% of deployments would be internet-accessible.", "typical_deployment": "Client-side desktop applications installed on end-user workstations. These applications are designed for document creation, editing, and viewing by individual users rather than serving content over the internet.", "deployment_statistics": "Less than 1% - Office desktop applications are not designed to be internet-facing server applications. Any internet exposure would be through terminal services, VDI, or similar remote access solutions rather than direct internet-facing deployment.", "active_exploitation": "Listed in CISA KEV catalog with 'Exploitation: active' indicating confirmed exploitation in the wild. Likely being used in targeted attacks through malicious Office documents.", "severity_factors": [ "High CVSS score (7.8) with total technical impact", "Active exploitation confirmed by CISA", "Widespread deployment of Microsoft Office", "Requires local access and user interaction", "Client-side application, not internet-facing service" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Apply Microsoft security updates immediately for all affected Office versions", "Implement email security controls to block malicious Office documents", "Enable Office Protected View and disable macros by default", "Monitor for suspicious Office application behavior and file executions", "Train users on safe document handling practices", "HIGH patch priority due to active exploitation" ], "risk_assessment": { "exploit_likelihood": "High for targeted attacks via malicious documents, but requires user interaction and local system access. Not directly exploitable over the internet against server infrastructure.", "impact_assessment": "High impact on individual systems - can lead to complete system compromise (C:H/I:H/A:H) but requires successful delivery of malicious content to end users.", "exposure_scope": "Millions of Office installations globally, but exploitation requires social engineering or phishing to deliver malicious documents rather than direct internet exploitation of server infrastructure." }, "exploitation_method": "USER_INTERACTION", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:28:11.754421", "displayed_on_website": false }, { "cve_id": "CVE-2026-21385", "cvss_score": "7.8", "attack_vector": "LOCAL", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1068", "deployment_likelihood": "VERY_LOW", "cve_published_date": "2026-03-02T16:53:59.406Z", "cve_published_date_formatted": "2026-03-02", "kev_date_added": "2026-03-03", "kev_date_added_formatted": "2026-03-03", "kev_due_date": "2026-03-24", "days_to_kev": 1, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2026-21385 is an integer overflow vulnerability in Qualcomm Snapdragon graphics processing causing memory corruption. While listed in CISA KEV indicating active exploitation, this affects primarily mobile devices, automotive systems, and embedded IoT platforms rather than internet-facing servers.", "detailed_analysis": { "vulnerability_type": "Integer overflow leading to memory corruption in graphics subsystem during memory allocation with specific alignments", "affected_products": [ "Snapdragon Mobile Platforms (smartphones, tablets)", "Snapdragon Automotive Platforms (connected vehicles)", "Snapdragon IoT Platforms (embedded devices)", "Snapdragon Compute Platforms", "Snapdragon Connectivity Modules", "FastConnect WiFi/Bluetooth chipsets", "Snapdragon Wearables", "Snapdragon XR/AR platforms" ], "exploitation_requirements": [ "Local access to device", "Low privileges on system", "Ability to trigger graphics operations with specific memory alignments" ], "internet_facing_likelihood": "Very low - Snapdragon products are primarily System-on-Chip (SoC) solutions for mobile devices, automotive systems, and IoT devices. While some IoT devices may have network connectivity, they typically don't run internet-facing server applications. The graphics vulnerability would be exploited locally on the device rather than through network services.", "typical_deployment": "Snapdragon platforms are embedded in end-user devices (smartphones, tablets, cars, IoT devices) and edge computing systems. These are primarily client-side or embedded systems, not internet-facing servers.", "deployment_statistics": "Less than 5% of Snapdragon deployments would be in internet-facing server roles. The vast majority (95%+) are in mobile devices, automotive systems, and IoT devices that are not directly accessible from the internet or don't expose server services.", "active_exploitation": "Listed in CISA KEV catalog indicating confirmed exploitation in the wild, likely targeting mobile devices or IoT systems for privilege escalation", "severity_factors": [ "High CVSS score (7.8)", "Memory corruption enabling potential code execution", "Low attack complexity", "No user interaction required", "Active exploitation confirmed", "Local attack vector limits remote exploitation" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review device logs, check for unauthorized access, verify system integrity on affected Snapdragon-based systems", "Apply security updates from device manufacturers (Android security patches, automotive OTA updates, IoT firmware updates)", "Monitor for unusual graphics-related crashes or privilege escalation attempts on affected devices", "Implement device management policies to ensure timely patching of mobile and IoT devices", "HIGH patch priority for devices in critical infrastructure or high-value environments" ], "risk_assessment": { "exploit_likelihood": "High for local exploitation on vulnerable devices, but very low for direct internet-based attacks due to the embedded nature of Snapdragon platforms", "impact_assessment": "High impact on individual devices - potential for full device compromise, data theft, persistence, but limited impact on internet infrastructure", "exposure_scope": "Millions of consumer and IoT devices potentially affected, but very few internet-facing server systems" }, "exploitation_method": "OTHER", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:33:33.556219", "displayed_on_website": false }, { "cve_id": "CVE-2026-20963", "cvss_score": "8.8", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2026-01-13T17:56:49.798Z", "cve_published_date_formatted": "2026-01-13", "kev_date_added": "2026-03-18", "kev_date_added_formatted": "2026-03-18", "kev_due_date": "2026-03-21", "days_to_kev": 64, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2026-20963 is a critical deserialization vulnerability in Microsoft SharePoint Server that allows remote code execution for authorized attackers over the network. This vulnerability is actively exploited by nation-state actors and is listed in CISA's KEV catalog, targeting internet-facing SharePoint deployments.", "detailed_analysis": { "vulnerability_type": "Deserialization of untrusted data (CWE-502) leading to remote code execution", "affected_products": [ "SharePoint Server 2019", "SharePoint Server 2016", "SharePoint Server Subscription Edition" ], "exploitation_requirements": [ "Low-privilege authentication required", "Network access to SharePoint server", "No user interaction needed" ], "internet_facing_likelihood": "SharePoint Server is commonly deployed as internet-facing application for external collaboration, partner access, and remote workforce enablement. Estimated 60-70% of SharePoint deployments have some level of internet exposure through direct access, reverse proxies, or hybrid cloud configurations.", "typical_deployment": "SharePoint Server is enterprise collaboration server software designed for web-based document management, collaboration, and business applications. It typically runs as IIS-hosted web applications on Windows Server infrastructure.", "deployment_statistics": "Approximately 65% of SharePoint Server deployments are internet-facing due to business requirements for external collaboration, remote access, partner portals, and hybrid Office 365 integration scenarios.", "active_exploitation": "Confirmed active exploitation by Chinese nation-state actors including Linen Typhoon, Violet Typhoon, and Storm-2603. Microsoft reports threat actors deploying ransomware and webshells through this vulnerability. CISA KEV listing confirms widespread exploitation.", "severity_factors": [ "High CVSS score of 8.8", "Remote code execution capability", "Active nation-state exploitation", "Targets collaboration infrastructure", "Low attack complexity", "No user interaction required" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity, scan for webshells and ransomware artifacts", "Apply Microsoft security updates immediately: Update to SharePoint 2016 16.0.5535.1001+, SharePoint 2019 16.0.10417.20083+, or SharePoint Subscription Edition 16.0.19127.20442+", "Monitor SharePoint access logs for suspicious authentication patterns, unusual file uploads, and unauthorized administrative activities", "EMERGENCY patch priority - treat as critical infrastructure vulnerability with confirmed active exploitation" ], "risk_assessment": { "exploit_likelihood": "Very High - Active exploitation confirmed by multiple nation-state groups with CISA KEV listing indicating widespread attacks against internet-facing SharePoint servers", "impact_assessment": "Critical - Remote code execution allows full server compromise, data exfiltration, ransomware deployment, and persistent access through webshells on collaboration infrastructure", "exposure_scope": "High - SharePoint is widely deployed in enterprises with significant internet-facing exposure for business collaboration needs, affecting thousands of organizations globally" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "The vulnerability **CVE-2026-20963** is a **deserialization of untrusted data** flaw in **Microsoft Office SharePoint** that allows an authorized attacker to execute code over a network 【2】【4】.\n\nRegarding its exploitation:\n\n* **Internet-facing applications or services:** The vulnerability specifically targets **internet-facing SharePoint servers** 【1】.\n* **Evidence of active exploitation:** There is evidence of **active exploitation** 【3】【7】. CISA has added this vulnerability to its **Known Exploited Vulnerabilities (KEV) Catalog** 【3】【8】.\n* **Attack vectors and exploitation methods:** The vulnerability allows an authorized attacker to **execute code over a network** through deserialization of untrusted data 【2】【4】. Microsoft has observed threat actors exploiting these vulnerabilities, leading to the deployment of ransomware and new webshells 【6】.\n* **Targeted attacks:** **Chinese nation-state actors**, identified as Linen Typhoon and Violet Typhoon, as well as another China-based threat actor tracked as Storm-2603, have been observed exploiting vulnerabilities targeting on-premises SharePoint servers 【1】.\n* **CISA Known Exploited Vulnerabilities status:** CVE-2026-20963 has been added to CISA's **Known Exploited Vulnerabilities (KEV) Catalog** 【3】. This catalog highlights vulnerabilities with documented evidence of active exploitation, emphasizing the need for timely remediation 【5】.\n* **Technical details about internet exploitability:** The core technical detail is the **deserialization of untrusted data** within Microsoft Office SharePoint, which enables remote code execution by an attacker who has authorization 【2】【4】. Microsoft has released security updates for all supported versions of SharePoint Server to address this 【1】.\n\nSources:\n- Disrupting active exploitation of on-premises SharePoint ...: https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/\n- CVE-2026-20963 Impact, Exploitability, and Mitigation Steps | Wiz: https://www.wiz.io/vulnerability-database/cve/cve-2026-20963\n- CISA Adds One Known Exploited Vulnerability to Catalog: https://www.cisa.gov/news-events/alerts/2026/03/16/cisa-adds-one-known-exploited-vulnerability-catalog\n- CVE-2026-20963 Detail - NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-20963\n- Reducing the Significant Risk of Known Exploited Vulnerabilities - CISA: https://www.cisa.gov/known-exploited-vulnerabilities", "references": [ { "title": "Disrupting active exploitation of on-premises SharePoint ...", "url": "https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/", "citation_contribution": 493, "snippet": "Microsoft has observed two named Chinese nation-state actors, Linen Typhoon and Violet Typhoon, exploiting vulnerabilities targeting internet-facing SharePoint servers. In addition, we have observed another China-based threat actor, tracked as Storm-2603, exploiting these vulnerabilities. Microsoft has released new comprehensive security updates for all supported versions of SharePoint Server ...", "is_search_result": true }, { "title": "CVE-2026-20963 Impact, Exploitability, and Mitigation Steps | Wiz", "url": "https://www.wiz.io/vulnerability-database/cve/cve-2026-20963", "citation_contribution": 425, "snippet": "Understand the critical aspects of CVE-2026-20963 with a detailed vulnerability assessment, exploitation potential, affected technologies, and remediation guidance.CVE-2026-20963: vulnerability analysis and mitigation. Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.", "is_search_result": true }, { "title": "CISA Adds One Known Exploited Vulnerability to Catalog", "url": "https://www.cisa.gov/news-events/alerts/2026/03/16/cisa-adds-one-known-exploited-vulnerability-catalog", "citation_contribution": 230, "snippet": "CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.", "is_search_result": true }, { "title": "CVE-2026-20963 Detail - NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20963", "citation_contribution": 171, "snippet": "Description. Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.", "is_search_result": true }, { "title": "Reducing the Significant Risk of Known Exploited Vulnerabilities - CISA", "url": "https://www.cisa.gov/known-exploited-vulnerabilities", "citation_contribution": 133, "snippet": "Learn about the importance of CISA's Known Exploited Vulnerability (KEV) catalog and how to use it to help build a collective resilience across the cybersecurity community.", "is_search_result": true } ], "timestamp": "2026-03-18T19:50:13.511546" }, "cache_timestamp": "2026-03-18T19:50:31.814895", "displayed_on_website": false }, { "cve_id": "CVE-2026-20805", "cvss_score": "5.5", "attack_vector": "LOCAL", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1068", "deployment_likelihood": "VERY_LOW", "cve_published_date": "2026-01-13T17:56:08.339Z", "cve_published_date_formatted": "2026-01-13", "kev_date_added": "2026-01-13", "kev_date_added_formatted": "2026-01-13", "kev_due_date": "2026-02-03", "days_to_kev": 0, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2026-20805 is a local information disclosure vulnerability in the Windows Desktop Window Manager (DWM) that requires local access and authentication. Despite being in CISA KEV, this is not directly internet exploitable as it affects client-side Windows desktop components.", "detailed_analysis": { "vulnerability_type": "Local information disclosure in Desktop Window Manager - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor", "affected_products": [ "Windows 10 (versions 1607, 1809, 21H2, 22H2)", "Windows 11 (versions 22H3, 23H2, 24H2, 25H2)", "Windows Server 2012", "Windows Server 2012 R2", "Windows Server 2016", "Windows Server 2019", "Windows Server 2022", "Windows Server 2025" ], "exploitation_requirements": [ "Local access to system required", "Valid user authentication required (PR:L)", "No user interaction needed (UI:N)", "Low attack complexity (AC:L)" ], "internet_facing_likelihood": "Desktop Window Manager is a client-side Windows component responsible for desktop composition and visual effects. While Windows Server versions are affected, DWM is primarily a desktop/workstation component and is not a network service that accepts internet connections. Even on Windows Server, DWM handles local desktop sessions and does not expose network-accessible attack surfaces.", "typical_deployment": "DWM is a core Windows desktop component that runs locally on workstations and servers with desktop environments. It manages window composition, transparency effects, and desktop visual elements. This is client-side software, not server software that accepts network connections.", "deployment_statistics": "Less than 5% of affected systems would be directly internet-accessible, and those would be through other attack vectors (RDP, etc.) rather than DWM itself exposing network services. DWM does not listen on network ports or accept internet connections.", "active_exploitation": "Listed in CISA KEV indicating active exploitation in the wild, but exploitation would be through local access scenarios such as malware already on systems, insider threats, or post-compromise privilege escalation", "severity_factors": [ "CVSS Attack Vector: LOCAL (AV:L) - requires local access", "Requires authenticated user (PR:L)", "Information disclosure only (C:H/I:N/A:N)", "Active exploitation confirmed via CISA KEV listing", "Affects wide range of Windows versions" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs for unusual local access patterns, check for unauthorized local accounts, verify system integrity", "Apply Microsoft security updates immediately for all affected Windows versions", "Monitor for unusual Desktop Window Manager process activity or crashes", "Review local user accounts and access permissions", "Implement enhanced monitoring for local privilege escalation attempts", "HIGH patch priority due to CISA KEV listing and wide Windows deployment" ], "risk_assessment": { "exploit_likelihood": "While CISA KEV indicates active exploitation, direct internet exploitation is not possible as this requires local system access. Exploitation likely occurs as part of multi-stage attacks after initial compromise.", "impact_assessment": "Information disclosure vulnerability that could expose sensitive data to local attackers, potentially enabling further privilege escalation or lateral movement", "exposure_scope": "Minimal direct internet exposure as DWM is not a network service, but affects billions of Windows systems that could be targeted through other initial access methods" }, "exploitation_method": "OTHER", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:25:58.087898", "displayed_on_website": false }, { "cve_id": "CVE-2026-20700", "cvss_score": "7.8", "attack_vector": "LOCAL", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1068", "deployment_likelihood": "LOW", "cve_published_date": "2026-02-11T22:58:54.448Z", "cve_published_date_formatted": "2026-02-11", "kev_date_added": "2026-02-12", "kev_date_added_formatted": "2026-02-12", "kev_due_date": "2026-03-05", "days_to_kev": 1, "days_since_kev": null, "is_new_kev": false, "summary": "Memory corruption vulnerability in Apple operating systems that allows arbitrary code execution with memory write capability. Despite being in CISA KEV due to active exploitation, this affects client-side operating systems that are rarely deployed as internet-facing servers.", "detailed_analysis": { "vulnerability_type": "Memory corruption vulnerability allowing arbitrary code execution", "affected_products": [ "iOS", "iPadOS", "macOS", "tvOS", "visionOS", "watchOS" ], "exploitation_requirements": [ "Memory write capability", "Local access or initial compromise", "No user interaction required once access obtained" ], "internet_facing_likelihood": "Apple operating systems are primarily client-side platforms not typically deployed as internet-facing servers. While macOS may occasionally run server applications, the vast majority of deployments are end-user devices behind NAT/firewalls. Estimated <1% of affected systems are directly internet-accessible as servers.", "typical_deployment": "These are all client-side operating systems designed for end-user devices (phones, tablets, computers, TVs, headsets, watches) rather than server infrastructure", "deployment_statistics": "Less than 1% of deployments are internet-facing. iOS/iPadOS/tvOS/visionOS/watchOS are exclusively client devices. macOS is occasionally used for servers but represents a tiny fraction of server market", "active_exploitation": "Apple confirmed this vulnerability has been exploited in sophisticated targeted attacks against specific individuals. Added to CISA KEV on 2026-02-12", "severity_factors": [ "High CVSS score of 7.8", "Active exploitation confirmed", "Arbitrary code execution capability", "No user interaction required", "Low internet exposure limits attack surface" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Update immediately to iOS 26.3, iPadOS 26.3, macOS 26.3, tvOS 26.3, visionOS 26.3, or watchOS 26.3", "Monitor for unusual system behavior, unexpected network connections, or privilege escalation attempts", "HIGHEST patch priority due to confirmed active exploitation and code execution capability" ], "risk_assessment": { "exploit_likelihood": "Low for direct internet exploitation due to client-side nature of affected platforms, but HIGH for local privilege escalation after initial access", "impact_assessment": "High impact if exploited - arbitrary code execution can lead to complete system compromise", "exposure_scope": "Minimal - affects primarily client devices not typically exposed to internet. Greatest risk through targeted attacks, malware, or as part of exploit chains" }, "exploitation_method": "OTHER", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:30:38.326625", "displayed_on_website": false }, { "cve_id": "CVE-2026-20182", "cvss_score": "10.0", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2026-05-14T16:08:25.566Z", "cve_published_date_formatted": "2026-05-14", "kev_date_added": "2026-05-14", "kev_date_added_formatted": "2026-05-14", "kev_due_date": "2026-05-17", "days_to_kev": 0, "days_since_kev": 21, "is_new_kev": false, "summary": "Critical authentication bypass in Cisco Catalyst SD-WAN Manager allows unauthenticated remote attackers to gain administrative privileges through crafted requests. This vulnerability is actively being exploited in the wild and is listed in CISA's KEV catalog.", "detailed_analysis": { "vulnerability_type": "Authentication bypass due to improper peering authentication mechanism (CWE-287)", "affected_products": [ "Cisco Catalyst SD-WAN Manager" ], "exploitation_requirements": [ "Network connectivity to SD-WAN Manager", "No authentication required", "No user interaction required" ], "internet_facing_likelihood": "SD-WAN management platforms are commonly deployed as centralized network controllers that require internet connectivity to manage distributed SD-WAN infrastructure. Many organizations expose these management interfaces to the internet or through VPN connections for remote management capabilities. Estimated 70-80% of deployments have some form of internet accessibility.", "typical_deployment": "Server-side network management platform that acts as a centralized controller for SD-WAN infrastructure, typically deployed in data centers or cloud environments", "deployment_statistics": "Approximately 70-80% of SD-WAN Manager deployments are internet-accessible either directly or through VPN/remote access solutions, as they need to coordinate with distributed edge devices and support remote administration", "active_exploitation": "Cisco PSIRT confirmed limited exploitation in May 2026, and the vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog", "severity_factors": [ "CVSS 10.0 Critical severity", "No authentication required", "Network attack vector", "Low attack complexity", "Changed scope with full CIA impact", "Active exploitation confirmed", "Administrative privilege escalation", "Access to NETCONF for network manipulation" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately upgrade to fixed software releases as recommended by Cisco advisory cisco-sa-sdwan-rpa2-v69WY2SW", "Implement network segmentation to restrict access to SD-WAN Manager interfaces", "Review control connection logs and monitor for suspicious authentication patterns", "Follow Cisco's 'Show Control Connections' guidance for system verification", "Priority: CRITICAL - Patch immediately due to active exploitation and perfect CVSS score" ], "risk_assessment": { "exploit_likelihood": "Very High - Active exploitation confirmed, no authentication required, low complexity attack with public advisory details", "impact_assessment": "Critical - Complete system compromise with administrative privileges, potential manipulation of entire SD-WAN fabric configuration", "exposure_scope": "High - SD-WAN Manager platforms are widely deployed in enterprise networks and commonly internet-accessible for distributed infrastructure management" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "Regarding **CVE-2026-20182**, here's what is known about its exploitation:\n\n- **Internet-Facing Applications or Services**: The vulnerability affects **Cisco Catalyst SD-WAN Manager** (formerly vSmart) 【4】. While specific details on whether it's *exclusively* internet-facing are not detailed, vulnerabilities in network management systems are often targeted when exposed to the internet.\n\n- **Evidence of Active Exploitation in the Wild**: There are conflicting reports. One source indicates that **no active exploitation has been reported** 【1】. However, CISA's Known Exploited Vulnerabilities (KEV) catalog is based on evidence of active exploitation 【3】. The presence of CVE-2026-20182 in the KEV catalog implies that **active exploitation has been observed** 【2】.\n\n- **Attack Vectors and Exploitation Methods**: The vulnerability is described as a **critical authentication bypass** 【4】. This means it allows **unauthenticated attackers to compromise the confidentiality, integrity, and availability** of Cisco Catalyst SD-WAN Manager 【1】. The attack complexity is noted as low 【1】.\n\n- **Used in Targeted Attacks**: While not explicitly stated that CVE-2026-20182 has been used in targeted attacks, the CISA KEV catalog is a list of vulnerabilities that have been exploited in the wild, and these can include targeted campaigns 【2】. Public details can accelerate exploit writing, and sometimes exploitation precedes broad public disclosure in targeted campaigns 【5】.\n\n- **CISA Known Exploited Vulnerabilities (KEV) Status**: **CVE-2026-20182 is listed in the CISA Known Exploited Vulnerabilities (KEV) Catalog** 【2】. CISA maintains this catalog to highlight vulnerabilities that have been actively exploited in the wild, and organizations are urged to prioritize remediation of these vulnerabilities 【3】.\n\n- **Technical Details about Internet Exploitability**: The vulnerability is an **authentication bypass** that allows unauthenticated attackers to gain unauthorized access, impacting confidentiality, integrity, and availability 【1】. The low attack complexity suggests that it is relatively easy to exploit, especially if the affected system is accessible from the internet.\n\nSources:\n- CVE-2026-20182 | Cisco Cisco Catalyst SD-WAN Manager | CVETodo: https://cvetodo.com/cve/CVE-2026-20182\n- Known Exploited Vulnerabilities Catalog - CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog\n- CISA Adds Seven Known Exploited Vulnerabilities to Catalog: https://www.cisa.gov/news-events/alerts/2026/04/13/cisa-adds-seven-known-exploited-vulnerabilities-catalog\n- CVE-2026-20182: Critical authentication bypass in Cisco ... - Rapid7: https://www.rapid7.com/blog/post/ve-cve-2026-20182-critical-authentication-bypass-cisco-catalyst-sd-wan-controller-fixed/\n- CVE & Vulnerability Management in 2026: From... | isMalicious Blog: https://ismalicious.com/posts/cve-vulnerability-lifecycle-patch-management-2026", "references": [ { "title": "CVE-2026-20182 | Cisco Cisco Catalyst SD-WAN Manager | CVETodo", "url": "https://cvetodo.com/cve/CVE-2026-20182", "citation_contribution": 569, "snippet": "Why This CVE Matters CVE-2026-20182 enables unauthenticated attackers to compromise confidentiality and integrity and availability of Cisco Cisco Catalyst SD-WAN Manager. While no active exploitation has been reported, the vulnerability's low attack complexity and critical impact make it a high-risk issue if left unpatched.", "is_search_result": true }, { "title": "Known Exploited Vulnerabilities Catalog - CISA", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "citation_contribution": 497, "snippet": "For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild. Organizations should use the KEV catalog as an input to their vulnerability management prioritization framework.How to use the KEV ... ... Android Kernel contains a use-after-free vulnerability in binder.c that allows for privilege escalation from an application to the Linux Kernel. This vulnerability was observed chained with CVE-2020-0041 and CVE-2020-0069 under exploit chain \"AbstractEmu.\" Apply updates per vendor instructions. ... EXTERNAL Known Exploited Vulnerabilities Catalog KEV Catalog Return to top Topics Spotlight Resources & Tools News & Events Careers About Cybersecurity & Infrastructure Security Agency", "is_search_result": true }, { "title": "CISA Adds Seven Known Exploited Vulnerabilities to Catalog", "url": "https://www.cisa.gov/news-events/alerts/2026/04/13/cisa-adds-seven-known-exploited-vulnerabilities-catalog", "citation_contribution": 289, "snippet": "CISA has added seven new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.", "is_search_result": true }, { "title": "CVE-2026-20182: Critical authentication bypass in Cisco ... - Rapid7", "url": "https://www.rapid7.com/blog/post/ve-cve-2026-20182-critical-authentication-bypass-cisco-catalyst-sd-wan-controller-fixed/", "citation_contribution": 248, "snippet": "While researching a critical authentication bypass vulnerability, CVE-2026-20127, which was exploited in-the-wild, Rapid7 Labs discovered a new authentication bypass vulnerability affecting Cisco Catalyst SD-WAN Controller (formerly known as vSmart), CVE-2026-20182.", "is_search_result": true }, { "title": "CVE & Vulnerability Management in 2026: From... | isMalicious Blog", "url": "https://ismalicious.com/posts/cve-vulnerability-lifecycle-patch-management-2026", "citation_contribution": 129, "snippet": "Public details can accelerate exploit writing. Sometimes exploitation precedes broad public disclosure in targeted campaigns—another reason threat intelligence matters.Tier 0 — Emergency: KEV-listed CVEs affecting internet-facing assets, or flaws with public weaponized exploits targeting your technology stack. Tier 1 — High: Critical or high CVSS issues on sensitive systems where exploitation is plausible and compensating controls are weak. Tier 2 — Planned: Medium risk with available patches; schedule inside normal maintenance windows with testing.", "is_search_result": true } ], "timestamp": "2026-05-14T17:45:16.592345" }, "cache_timestamp": "2026-05-14T17:45:33.439007", "displayed_on_website": true }, { "cve_id": "CVE-2026-20133", "cvss_score": "6.5", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2026-02-25T16:13:56.017Z", "cve_published_date_formatted": "2026-02-25", "kev_date_added": "2026-04-20", "kev_date_added_formatted": "2026-04-20", "kev_due_date": "2026-04-23", "days_to_kev": 54, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2026-20133 is an information disclosure vulnerability in Cisco Catalyst SD-WAN Manager that allows unauthenticated, remote attackers to view sensitive information by accessing the API. SD-WAN Manager is typically deployed as an internet-facing centralized management platform.", "detailed_analysis": { "vulnerability_type": "Information disclosure due to insufficient file system access restrictions (CWE-200)", "affected_products": [ "Cisco Catalyst SD-WAN Manager" ], "exploitation_requirements": [ "Network access to SD-WAN Manager API", "No authentication required", "No user interaction required" ], "internet_facing_likelihood": "HIGH - SD-WAN Manager is designed as a centralized management platform for distributed SD-WAN deployments. It typically requires internet connectivity to manage remote sites and edge devices across geographically distributed networks. Approximately 70-80% of SD-WAN Manager deployments are likely internet-facing or accessible via VPN/management networks with internet exposure.", "typical_deployment": "Server software - Cisco Catalyst SD-WAN Manager is enterprise network management software deployed as a centralized controller/management server for SD-WAN infrastructure", "deployment_statistics": "Estimated 70-80% of deployments are internet-accessible. SD-WAN managers need connectivity to distributed edge devices and often include web-based management interfaces accessible to administrators remotely.", "active_exploitation": "While CVE-2026-20133 itself is not confirmed as actively exploited, the advisory mentions that other CVEs in the same advisory (CVE-2026-20128 and CVE-2026-20122) are being actively exploited as of March 2026.", "severity_factors": [ "CVSS 6.5 (Medium severity)", "Unauthenticated access required", "Remote network exploitation", "High confidentiality impact", "Information disclosure only (no code execution)", "Affects critical network infrastructure" ] }, "recommendations": [ "URGENT: Apply patches immediately - while this specific CVE may not be actively exploited, related vulnerabilities in the same advisory are being exploited in the wild", "Review SD-WAN Manager access logs for unauthorized API access attempts", "Implement network segmentation to limit SD-WAN Manager exposure", "Monitor for unusual API calls or file system access patterns", "Verify that only authorized administrators can access the management interface", "Consider implementing additional authentication controls for API access" ], "risk_assessment": { "exploit_likelihood": "HIGH - The vulnerability requires no authentication and can be exploited remotely over the network via API access. The technical barrier is low.", "impact_assessment": "MEDIUM - Information disclosure can reveal sensitive system information and potentially facilitate further attacks, but does not directly provide code execution or system compromise.", "exposure_scope": "MEDIUM to HIGH - Cisco SD-WAN deployments are common in enterprise environments, and many SD-WAN Manager instances are likely internet-accessible for remote site management." }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "**CVE-2026-20133** is an information disclosure vulnerability affecting **Cisco Catalyst SD-WAN Manager** 【3】【4】. It allows unauthenticated, remote attackers to view sensitive system data 【3】【4】.\n\nHere's a breakdown of what is known about its exploitation:\n\n* **Internet-facing applications or services:** The vulnerability is present in Cisco Catalyst SD-WAN Manager, which is likely to be internet-facing or accessible within a network infrastructure.\n* **Evidence of active exploitation in the wild:** There is **no explicit mention** in the provided search results of CVE-2026-20133 being actively exploited in the wild. However, CISA's Known Exploited Vulnerabilities (KEV) catalog is based on evidence of active exploitation 【2】【6】.\n* **Attack vectors and exploitation methods:** The likely attack vector is **remote, via the exposed API** 【1】. The vulnerability stems from insufficient file system access restrictions 【7】【8】. One research team developed an exploit that allows remote attackers to forge authentication tokens 【5】.\n* **Targeted attacks:** There is **no specific information** indicating whether CVE-2026-20133 has been used in targeted attacks.\n* **CISA Known Exploited Vulnerabilities status:** As of the provided information, **CVE-2026-20133 is not listed in CISA’s Known Exploited Vulnerabilities catalog** 【1】.\n* **Technical details about internet exploitability:** The vulnerability allows an unauthenticated, remote attacker to view sensitive information 【3】【4】. The impact is limited to information disclosure, with no evidence of code execution, privilege escalation, or denial of service 【1】.\n\nSources:\n- CVE-2026-20133 - Vulnerability Details - OpenCVE: https://app.opencve.io/cve/CVE-2026-20133\n- Known Exploited Vulnerabilities Catalog - CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog\n- CVE-2026-20133: Cisco SD-WAN Manager Info Disclosure Flaw: https://www.sentinelone.com/vulnerability-database/cve-2026-20133/\n- CVE-2026-20133 - NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-20133\n- So so so much Cisco - Initial Access: https://docs.vulncheck.com/initial-access/2026-03-13", "references": [ { "title": "CVE-2026-20133 - Vulnerability Details - OpenCVE", "url": "https://app.opencve.io/cve/CVE-2026-20133", "citation_contribution": 405, "snippet": "The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. The likely attack vector is remote, via the exposed API, and the impact is limited to information disclosure; there is no evidence of code execution, privilege escalation, or denial of service. Generated by OpenCVE AI on April 16, 2026 at 06:07 UTC.", "is_search_result": true }, { "title": "Known Exploited Vulnerabilities Catalog - CISA", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "citation_contribution": 209, "snippet": "For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild. Organizations should use the KEV catalog as an input to their vulnerability management prioritization framework.How to use the KEV ...", "is_search_result": true }, { "title": "CVE-2026-20133: Cisco SD-WAN Manager Info Disclosure Flaw", "url": "https://www.sentinelone.com/vulnerability-database/cve-2026-20133/", "citation_contribution": 201, "snippet": "CVE-2026-20133 is an information disclosure vulnerability in Cisco Catalyst SD-WAN Manager allowing unauthenticated attackers to view sensitive system data. This article covers technical details, affected versions, and mitigation.", "is_search_result": true }, { "title": "CVE-2026-20133 - NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20133", "citation_contribution": 126, "snippet": "A vulnerability in Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to view sensitive information on an affected ...", "is_search_result": true }, { "title": "So so so much Cisco - Initial Access", "url": "https://docs.vulncheck.com/initial-access/2026-03-13", "citation_contribution": 99, "snippet": "CVE-2026-20133: Cisco Catalyst SD-WAN Manager Information Disclosure Vulnerability. Continuing the Cisco theme, VulnCheck's exploits index does not currently list a public exploit for CVE-2026-20133.The team developed an exploit that allows remote attackers to forge authentication tokens. The team also provided a vulnerable Docker container and PCAPs.", "is_search_result": true } ], "timestamp": "2026-04-20T19:11:44.928802" }, "cache_timestamp": "2026-04-20T19:12:01.165302", "displayed_on_website": false }, { "cve_id": "CVE-2026-20131", "cvss_score": "10.0", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2026-03-04T17:17:56.008Z", "cve_published_date_formatted": "2026-03-04", "kev_date_added": "2026-03-19", "kev_date_added_formatted": "2026-03-19", "kev_due_date": "2026-03-22", "days_to_kev": 15, "days_since_kev": null, "is_new_kev": false, "summary": "Critical insecure deserialization vulnerability in Cisco Secure Firewall Management Center web interface allows unauthenticated remote code execution as root. Already exploited in the wild by Interlock ransomware group since January 2026.", "detailed_analysis": { "vulnerability_type": "Insecure deserialization of user-supplied Java byte stream in web-based management interface (CWE-502)", "affected_products": [ "Cisco Secure Firewall Management Center (FMC)" ], "exploitation_requirements": [ "Network access to FMC web management interface", "No authentication required", "No user interaction required" ], "internet_facing_likelihood": "Cisco FMC is enterprise firewall management software that is commonly exposed to the internet for remote administration by security teams and managed service providers. While security best practices recommend restricting management interface access, many organizations expose these interfaces for operational convenience. Estimated 40-60% of deployments have internet-accessible management interfaces.", "typical_deployment": "Server-side infrastructure software deployed as centralized firewall management platform in enterprise environments", "deployment_statistics": "Approximately 50% of FMC deployments are likely internet-accessible based on common enterprise firewall management practices where remote administration is required", "active_exploitation": "Confirmed active exploitation by Interlock ransomware group since January 26, 2026 (over a month before public disclosure). Cisco PSIRT confirmed reports of active exploitation targeting enterprise firewall systems.", "severity_factors": [ "CVSS 10.0 Critical severity", "Unauthenticated remote code execution", "Root privilege escalation", "Active exploitation in the wild", "Low attack complexity", "No user interaction required", "Enterprise infrastructure target" ] }, "recommendations": [ "CRITICAL: Immediately check for indicators of compromise - this vulnerability is actively exploited by ransomware groups. Review FMC logs for suspicious HTTP requests, unauthorized access, and verify system integrity", "Apply Cisco security patches immediately for all affected FMC versions (6.4.0.13 through 10.0.0)", "Restrict FMC management interface access to trusted networks only - remove internet exposure if possible", "Monitor FMC web interface logs for crafted serialized Java object requests and unusual activity", "Implement network segmentation to isolate FMC management interfaces", "Deploy endpoint detection and response (EDR) solutions to detect potential ransomware deployment" ], "risk_assessment": { "exploit_likelihood": "VERY HIGH - Vulnerability is already being actively exploited with public confirmation from Cisco and security researchers. Attack requires no authentication and has low complexity.", "impact_assessment": "CRITICAL - Full system compromise with root access, potential for lateral movement, data exfiltration, and ransomware deployment in enterprise networks managing critical firewall infrastructure.", "exposure_scope": "MEDIUM-HIGH - Affects enterprise Cisco firewall management systems globally, with estimated thousands of internet-exposed FMC instances based on Cisco's market presence in enterprise security." }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Known", "ransomware_first_seen_date": "2026-03-19", "ransomware_days_after_kev": 0, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "**CVE-2026-20131** is a critical vulnerability affecting **Cisco Secure Firewall Management Center (FMC) Software** 【1】 【2】 【3】 【16】 【15】 【14】 【2】. It is a case of **insecure deserialization** of a user-supplied Java byte stream, allowing an unauthenticated, remote attacker to bypass authentication and execute arbitrary Java code as root on an affected device 【1】 【3】 【12】 【16】 【5】 【15】 【14】 【2】.\n\n**Internet-Facing Applications and Services:**\nThe vulnerability resides in the web-based management interface of the Cisco FMC software 【2】 【3】 【16】 【2】. If this interface has public internet access, the attack surface is reduced 【2】. External exploitability is a significant concern, as vulnerabilities exploitable via the internet score higher in terms of attack vector 【8】.\n\n**Evidence of Active Exploitation in the Wild:**\n**Yes, there is clear evidence of active exploitation** 【9】 【11】 【13】 【6】 【19】 【18】 【17】 【14】. Cisco has confirmed reports of active exploitation 【9】 【13】, and threat actors associated with the **Interlock ransomware** group have been exploiting this vulnerability as a zero-day since January 26, 2026, more than a month before its public disclosure 【1】 【11】 【6】 【14】.\n\n**Attack Vectors and Exploitation Methods:**\nThe primary attack vector involves sending a **crafted serialized Java object** to the web-based management interface of an affected device 【3】 【12】 【16】 【15】 【2】. This can allow an unauthenticated, remote attacker to execute arbitrary Java code as root 【1】 【3】 【12】 【16】 【5】 【15】 【14】 【2】. The exploit has **low attack complexity and requires no privileges**, making it an easy target for cybercriminals 【4】. Observed activity has involved HTTP requests to a specific path in the affected software 【5】.\n\n**Use in Targeted Attacks:**\nThe Interlock ransomware group has been actively exploiting CVE-2026-20131 in **targeted attacks against enterprise firewall systems** 【6】 【17】 【5】 【14】.\n\n**CISA Known Exploited Vulnerabilities (KEV) Status:**\nAs of the provided information, **CVE-2026-20131 is not explicitly listed** on the CISA Known Exploited Vulnerabilities (KEV) Catalog 【7】 【20】. However, CISA has warned of active exploitation for other vulnerabilities around the same time 【11】 【18】 【21】 【22】 【23】.\n\n**Technical Details about Internet Exploitability:**\nThe vulnerability is a **Remote Code Execution (RCE)** flaw 【5】 【15】. It is due to **insecure deserialization** of user-supplied Java byte streams 【1】 【3】 【24】 【16】 【15】 【2】. An attacker can exploit this by sending a crafted serialized Java object to the web interface 【3】 【2】. A successful exploit allows the attacker to execute arbitrary code on the device and elevate privileges to root 【2】. The exploitability is high due to low attack complexity and no required privileges 【4】. While some sources indicate no public Proof-of-Concept (PoC) exploits have been reported 【10】 【12】, the active exploitation in the wild by ransomware groups confirms its practical exploitability.\n\nSources:\n- Interlock Ransomware Exploits Cisco FMC Zero-Day...: https://thehackernews.com/2026/03/interlock-ransomware-exploits-cisco-fmc.html\n- CVE-2026-20131 - NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-20131\n- Cisco Secure Firewall Management Center Software Remote Code Execution ...: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-rce-NKhnULJh\n- CVE-2026-20131 Security Vulnerability & Exploit Details: https://cve.akaoma.com/cve-2026-20131\n- Interlock ransomware gang exploits Cisco firewall zero-day in targeted...: https://www.cybersecurity-help.cz/blog/5305.html", "references": [ { "title": "Interlock Ransomware Exploits Cisco FMC Zero-Day...", "url": "https://thehackernews.com/2026/03/interlock-ransomware-exploits-cisco-fmc.html", "citation_contribution": 693, "snippet": "The vulnerability in question is CVE-2026-20131 (CVSS score: 10.0), a case of insecure deserialization of user-supplied Java byte stream, which could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary Java code as root on an affected device. According to data gleaned from the tech giant's MadPot global sensor network, the security flaw is said to have been exploited as a zero-day since January 26, 2026, more than a month before it was publicly disclosed by Cisco.", "is_search_result": true }, { "title": "CVE-2026-20131 - NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20131", "citation_contribution": 278, "snippet": "CVE-2026-20131 Detail.An attacker could exploit this vulnerability by sending a crafted serialized Java object to the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary code on the device and elevate privileges to root. Note: If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced.", "is_search_result": true }, { "title": "Cisco Secure Firewall Management Center Software Remote Code Execution ...", "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-rce-NKhnULJh", "citation_contribution": 234, "snippet": "A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device. This vulnerability is due to insecure deserialization of a user-supplied Java byte stream. An attacker could exploit this vulnerability by sending a crafted serialized Java ...", "is_search_result": true }, { "title": "CVE-2026-20131 Security Vulnerability & Exploit Details", "url": "https://cve.akaoma.com/cve-2026-20131", "citation_contribution": 197, "snippet": "The exploitability of CVE-2026-20131 depends on two key factors: attack complexity (the level of effort required to execute an exploit) and privileges required (the access level an attacker needs). Exploitability Analysis for CVE-2026-20131 With low attack complexity and no required privileges, CVE-2026-20131 is an easy target for cybercriminals. Organizations should prioritize immediate ...", "is_search_result": true }, { "title": "Interlock ransomware gang exploits Cisco firewall zero-day in targeted...", "url": "https://www.cybersecurity-help.cz/blog/5305.html", "citation_contribution": 149, "snippet": "The flaw, tracked as CVE-2026-20131, is a remote code execution (RCE) vulnerability that allows unauthenticated attackers to execute arbitrary Java code with root privileges on affected devices.The attacks reportedly targeted enterprise firewall systems. “Observed activity involved HTTP requests to a specific path in the affected software,” the report says.", "is_search_result": true } ], "timestamp": "2026-03-19T15:35:16.943996" }, "cache_timestamp": "2026-03-19T15:35:35.830656", "displayed_on_website": false }, { "cve_id": "CVE-2026-20128", "cvss_score": "7.5", "attack_vector": "LOCAL", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1078", "deployment_likelihood": "LOW", "cve_published_date": "2026-02-25T16:14:12.353Z", "cve_published_date_formatted": "2026-02-25", "kev_date_added": "2026-04-20", "kev_date_added_formatted": "2026-04-20", "kev_due_date": "2026-04-23", "days_to_kev": 54, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2026-20128 is an information disclosure vulnerability in Cisco Catalyst SD-WAN Manager that exposes DCA user credentials in a readable file. The CVSS shows LOCAL attack vector, requiring high privileges and high complexity, making direct internet exploitation unlikely despite CISA KEV listing.", "detailed_analysis": { "vulnerability_type": "Information disclosure - storing passwords in recoverable format (CWE-257)", "affected_products": [ "Cisco Catalyst SD-WAN Manager" ], "exploitation_requirements": [ "Local access to the system", "High privileges (CVSS PR:H)", "Knowledge of file location", "High attack complexity" ], "internet_facing_likelihood": "While SD-WAN Manager may have internet-accessible management interfaces, the LOCAL attack vector in CVSS indicates this specific vulnerability requires local system access rather than direct network exploitation. The vulnerability involves reading a credential file from the local filesystem.", "typical_deployment": "Cisco Catalyst SD-WAN Manager is enterprise network infrastructure software that manages SD-WAN deployments. It's typically deployed as a centralized management server in enterprise environments.", "deployment_statistics": "Estimated 20-30% of deployments might have internet-accessible management interfaces, but this specific vulnerability (AV:L) requires local access to exploit, significantly reducing internet exploitation risk.", "active_exploitation": "CISA notes active exploitation of this vulnerability as of March 2026, but the LOCAL attack vector suggests exploitation occurs after initial access is gained through other means.", "severity_factors": [ "CISA KEV listing indicates active exploitation", "LOCAL attack vector limits direct internet exploitation", "High privileges required", "Credential exposure enables lateral movement", "Affects enterprise network infrastructure" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately upgrade to Cisco Catalyst SD-WAN Manager release 20.18 or later", "Review and rotate DCA user credentials on affected systems", "Monitor for suspicious access to SD-WAN Manager systems and unusual DCA user activity", "Implement network segmentation to limit access to SD-WAN management infrastructure", "Patch priority: HIGH due to CISA KEV listing and potential for lateral movement" ], "risk_assessment": { "exploit_likelihood": "Medium for environments where attackers have already gained local access; Low for direct internet exploitation due to LOCAL attack vector requirement", "impact_assessment": "High - credential exposure enables lateral movement and potential compromise of SD-WAN infrastructure", "exposure_scope": "Limited direct internet exposure due to LOCAL attack vector, but significant impact in enterprise environments where initial access has been gained" }, "exploitation_method": "OTHER", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:41:54.830192", "displayed_on_website": false }, { "cve_id": "CVE-2026-20127", "cvss_score": "10.0", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2026-02-25T16:14:20.137Z", "cve_published_date_formatted": "2026-02-25", "kev_date_added": "2026-02-25", "kev_date_added_formatted": "2026-02-25", "kev_due_date": "2026-02-27", "days_to_kev": 0, "days_since_kev": null, "is_new_kev": false, "summary": "Critical authentication bypass vulnerability in Cisco Catalyst SD-WAN Manager allowing unauthenticated remote attackers to gain administrative privileges. CISA has issued Emergency Directive ED 26-03 due to active exploitation in the wild.", "detailed_analysis": { "vulnerability_type": "Authentication bypass vulnerability (CWE-287) in peering authentication mechanism allowing complete administrative takeover", "affected_products": [ "Cisco Catalyst SD-WAN Manager" ], "exploitation_requirements": [ "Network connectivity to SD-WAN Manager", "No authentication required", "No user interaction required" ], "internet_facing_likelihood": "Cisco SD-WAN Manager is commonly deployed as internet-facing infrastructure to manage distributed SD-WAN deployments. These systems frequently require internet connectivity to manage remote branch offices and cloud connections, making internet exposure very common in enterprise deployments.", "typical_deployment": "Enterprise network management server software that controls SD-WAN infrastructure across distributed locations", "deployment_statistics": "Estimated 70-80% of SD-WAN Manager deployments are internet-accessible as they need to coordinate with distributed branch offices and cloud services globally", "active_exploitation": "Active exploitation confirmed in the wild with CISA Emergency Directive ED 26-03 issued. Threat actor UAT-8616 has been observed exploiting this vulnerability for initial access and establishing persistence through rogue peers.", "severity_factors": [ "CVSS 10.0 Critical severity", "No authentication required", "Complete administrative compromise", "Active exploitation by threat actors", "CISA Emergency Directive issued", "Can manipulate entire SD-WAN fabric configuration" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity, and look for rogue peer connections", "Apply Cisco security patches immediately - this is a zero-authentication vulnerability with confirmed exploitation", "Implement network segmentation to limit SD-WAN Manager exposure if patching cannot be done immediately", "Monitor NETCONF access logs and SD-WAN fabric configuration changes for unauthorized modifications", "HIGHEST patch priority - treat as emergency maintenance due to CISA Emergency Directive" ], "risk_assessment": { "exploit_likelihood": "VERY HIGH - No authentication required, network-accessible vulnerability with confirmed active exploitation and public attention", "impact_assessment": "CRITICAL - Complete administrative compromise of SD-WAN infrastructure allowing network configuration manipulation across entire enterprise fabric", "exposure_scope": "HIGH - SD-WAN Manager systems are commonly internet-facing in enterprise environments for managing distributed networks" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "**CVE-2026-20127** is a critical vulnerability affecting **Cisco Catalyst SD-WAN systems** 【2】【8】. It is an **authentication bypass vulnerability** that allows an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges 【3】【4】.\n\n**Evidence of Active Exploitation:**\nThere is **evidence of active exploitation in the wild** 【3】【7】. Threat actors have been observed using this vulnerability for initial access 【7】, and malicious rogue peers have been reported 【8】.\n\n**Attack Vectors and Exploitation Methods:**\nThe attack vector is **network-based**, meaning it can be exploited remotely without physical access 【1】, and specifically targets Cisco Catalyst SD-WAN Controller 【3】【9】. After exploiting the authentication bypass, attackers can add a rogue peer, gain root access, and establish long-term persistence 【5】. The exploitation involves sending crafted requests 【10】.\n\n**Targeted Attacks:**\nWhile specific details on targeted attacks are not extensively detailed, the nature of the vulnerability and its exploitation suggests it could be used in sophisticated attacks. The Canadian Centre for Cyber Security has issued alerts regarding this vulnerability 【2】.\n\n**CISA Known Exploited Vulnerabilities Status:**\nCISA has issued an **Emergency Directive (ED 26-03)** requiring federal agencies to mitigate vulnerabilities in Cisco SD-WAN systems, including CVE-2026-20127 【4】【6】. This directive underscores the severity and active exploitation of this vulnerability.\n\n**Technical Details about Internet Exploitability:**\nThe vulnerability allows an **unauthenticated, remote attacker** to bypass authentication and gain administrative privileges 【3】【4】. This means that systems with internet-facing Cisco SD-WAN applications or services are potentially vulnerable if not properly secured. The exploitation does not require significant complexity or special conditions 【1】 and can be performed over a network 【1】.\n\nSources:\n- CVE-2026-20137 Security Vulnerability & Exploit Details: https://cve.akaoma.com/cve-2026-20137\n- AL26-004 - Critical vulnerability affecting Cisco Catalyst SD-WAN - CVE ...: https://www.cyber.gc.ca/en/alerts-advisories/al26-004-critical-vulnerability-affecting-cisco-catalyst-sd-wan-cve-2026-20127\n- Active exploitation of Cisco Catalyst SD-WAN by UAT-8616: https://blog.talosintelligence.com/uat-8616-sd-wan/\n- ED 26-03: Mitigate Vulnerabilities in Cisco SD-WAN Systems: https://www.cisa.gov/news-events/directives/ed-26-03-mitigate-vulnerabilities-cisco-sd-wan-systems\n- Exploitation of Cisco SD-WAN appliances - Cyber.gov.au: https://www.cyber.gov.au/about-us/view-all-content/alerts-and-advisories/exploitation-of-cisco-sd-wan-appliances", "references": [ { "title": "CVE-2026-20137 Security Vulnerability & Exploit Details", "url": "https://cve.akaoma.com/cve-2026-20137", "citation_contribution": 352, "snippet": "CVE-2026-20137: In Splunk Enterprise versions below 10.2.0, 10.0.3, 9.4.5, 9.3.7, and 9.2.9, and Splunk Cloud Platform versions below 10.1.2507.0, 10.0.2503.9, 9.3.2411.112, and 9.3.2408.122, a low-privileged user who does not hold the \"admin\" or \"power\" Splunk roles could bypass. the SPL safeguards for risky commands when they create a Data Model that contains an injected SPL query within an object. They can bypass the safeguards by exploiting a path traversal vulnerability.", "is_search_result": true }, { "title": "AL26-004 - Critical vulnerability affecting Cisco Catalyst SD-WAN - CVE ...", "url": "https://www.cyber.gc.ca/en/alerts-advisories/al26-004-critical-vulnerability-affecting-cisco-catalyst-sd-wan-cve-2026-20127", "citation_contribution": 313, "snippet": "The Canadian Centre for Cyber Security (Cyber Centre) is aware of active exploitation of Cisco Catalyst Software-Defined Wide Area Network (SD-WAN) devices 1 2. In response to the Cisco security advisory released on February 25, 2026 3, the Cyber Centre issued AV26-166 4 on February 25, 2026. Tracked as CVE-2026-20127 Footnote 5, this vulnerability", "is_search_result": true }, { "title": "Active exploitation of Cisco Catalyst SD-WAN by UAT-8616", "url": "https://blog.talosintelligence.com/uat-8616-sd-wan/", "citation_contribution": 205, "snippet": "Cisco Talos is tracking the active exploitation of CVE-2026-20127, a vulnerability in Cisco Catalyst SD-WAN Controller, formerly vSmart, that allows an unauthenticated remote attacker to bypass authentication and obtain administrative privileges.", "is_search_result": true }, { "title": "ED 26-03: Mitigate Vulnerabilities in Cisco SD-WAN Systems", "url": "https://www.cisa.gov/news-events/directives/ed-26-03-mitigate-vulnerabilities-cisco-sd-wan-systems", "citation_contribution": 159, "snippet": "... vulnerabilities identified by Cisco: CVE-2026-20127 – an authentication bypass vulnerability that allows an unauthenticated, remote attacker ...", "is_search_result": true }, { "title": "Exploitation of Cisco SD-WAN appliances - Cyber.gov.au", "url": "https://www.cyber.gov.au/about-us/view-all-content/alerts-and-advisories/exploitation-of-cisco-sd-wan-appliances", "citation_contribution": 130, "snippet": "Malicious cyber threat actors are targeting SD-WANs of organisations, globally. These actors exploited a Cisco Catalyst SD-WAN controller authentication bypass vulnerability, CVE-2026-20127. After exploitation of this vulnerability the malicious actors add a rogue peer, and eventually gain root access to establish long-term persistence in SD-WANs.", "is_search_result": true } ], "timestamp": "2026-02-25T17:30:16.539013" }, "cache_timestamp": "2026-02-25T17:30:34.488014", "displayed_on_website": false }, { "cve_id": "CVE-2026-20122", "cvss_score": "5.4", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2026-02-25T16:14:21.256Z", "cve_published_date_formatted": "2026-02-25", "kev_date_added": "2026-04-20", "kev_date_added_formatted": "2026-04-20", "kev_due_date": "2026-04-23", "days_to_kev": 54, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2026-20122 is a critical arbitrary file overwrite vulnerability in Cisco Catalyst SD-WAN Manager's API that allows authenticated attackers to gain elevated privileges. This vulnerability is actively exploited in the wild and listed in CISA's KEV catalog.", "detailed_analysis": { "vulnerability_type": "Arbitrary File Overwrite via API (CWE-648: Incorrect Use of Privileged APIs)", "affected_products": [ "Cisco Catalyst SD-WAN Manager" ], "exploitation_requirements": [ "Network access to API endpoint", "Valid read-only credentials with API access", "No user interaction required" ], "internet_facing_likelihood": "Cisco Catalyst SD-WAN Manager is commonly deployed as an internet-facing management platform for distributed SD-WAN networks. As a centralized management system that needs to coordinate with remote SD-WAN edge devices across different locations and potentially different organizations, it typically requires internet connectivity and is often exposed to the internet for remote management capabilities.", "typical_deployment": "Server software - Cisco Catalyst SD-WAN Manager is a centralized management platform that controls and monitors distributed SD-WAN infrastructure", "deployment_statistics": "Estimated 70-80% of deployments are internet-facing. SD-WAN Manager platforms are designed to manage geographically distributed networks and remote sites, requiring internet connectivity to coordinate with edge devices. Many deployments expose management interfaces for remote administration and API access.", "active_exploitation": "CONFIRMED - Listed in CISA KEV catalog with evidence of active exploitation in the wild as of March 2026", "severity_factors": [ "CRITICAL: Active exploitation confirmed by CISA KEV listing", "Network-accessible API vulnerability", "Low privileges required (read-only credentials)", "No user interaction needed", "Privilege escalation to vmanage user", "Potential for arbitrary file overwrite leading to system compromise" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "URGENT: Apply Cisco security patches immediately - prioritize systems with internet exposure", "IMMEDIATE: Review API access logs for suspicious file upload activities or unauthorized privilege escalations", "Implement network segmentation to limit API access from untrusted networks", "Monitor for unexpected file modifications and privilege changes on vmanage systems", "Audit and restrict API credentials, especially read-only accounts with API access", "PATCH PRIORITY: CRITICAL - Apply patches within 72 hours due to active exploitation" ], "risk_assessment": { "exploit_likelihood": "VERY HIGH - Vulnerability is being actively exploited according to CISA KEV, requires only low-level authentication, and affects commonly internet-facing infrastructure", "impact_assessment": "HIGH - Arbitrary file overwrite can lead to privilege escalation, system compromise, and potential lateral movement within SD-WAN infrastructure", "exposure_scope": "SIGNIFICANT - SD-WAN Manager platforms are widely deployed in enterprise networks and commonly exposed to the internet for remote management of distributed networks" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "Regarding **CVE-2026-20122**, here's what is known about its exploitation:\n\n* **CISA Known Exploited Vulnerabilities (KEV) Status**: **CVE-2026-20122 has been added to the CISA Known Exploited Vulnerabilities (KEV) Catalog** 【2】. This addition is based on evidence of active exploitation 【2】. The KEV Catalog serves as an authoritative source of vulnerabilities that have been exploited in the wild, and organizations are advised to use it for prioritizing vulnerability management 【4】【5】.\n\n* **Evidence of Active Exploitation**: The inclusion of CVE-2026-20122 in the KEV Catalog directly indicates that **there is evidence of active exploitation in the wild** 【2】.\n\n* **Attack Vectors and Exploitation Methods**: The vulnerability is described as stemming from **improper file handling on the API interface of an affected system** 【1】. An attacker can exploit this by leveraging this improper file handling 【1】.\n\n* **Internet-Facing Applications or Services**: While the vulnerability is related to an API interface, the provided information does not explicitly state whether it affects internet-facing applications or services. However, API interfaces are often exposed externally, suggesting a potential for internet-facing impact.\n\n* **Targeted Attacks**: The provided information does not specify whether CVE-2026-20122 has been used in targeted attacks.\n\n* **Technical Details about Internet Exploitability**: The technical detail available is that the vulnerability is due to **improper file handling on the API interface** 【1】. Further specific technical details regarding internet exploitability are not detailed in the provided sources.\n\nIt is important to note that CVE-2026-20122 is distinct from CVE-2023-20122, which involves vulnerabilities in the restricted shell of Cisco Evolved Programmable Network Manager (EPNM), Cisco Identity Services Engine (ISE), and Cisco Prime Infrastructure 【3】.\n\nSources:\n- CVE-2026-20122 - National Vulnerability Database: https://nvd.nist.gov/vuln/detail/CVE-2026-20122\n- CISA Adds One Known Exploited Vulnerability to Catalog | CISA: https://www.cisa.gov/news-events/alerts/2026/04/08/cisa-adds-one-known-exploited-vulnerability-catalog\n- NVD - CVE-2023-20122: https://nvd.nist.gov/vuln/detail/CVE-2023-20122\n- Known Exploited Vulnerabilities Catalog - CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog\n- The Kev Catalog: https://www.cisa.gov/resources-tools/resources/kev-catalog", "references": [ { "title": "CVE-2026-20122 - National Vulnerability Database", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20122", "citation_contribution": 410, "snippet": "This vulnerability is due to improper file handling on the API interface of an affected system. An attacker could exploit this vulnerability by ...", "is_search_result": true }, { "title": "CISA Adds One Known Exploited Vulnerability to Catalog | CISA", "url": "https://www.cisa.gov/news-events/alerts/2026/04/08/cisa-adds-one-known-exploited-vulnerability-catalog", "citation_contribution": 382, "snippet": "CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.", "is_search_result": true }, { "title": "NVD - CVE-2023-20122", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20122", "citation_contribution": 255, "snippet": "CVE-2023-20122 Detail. Modified.Description. Multiple vulnerabilities in the restricted shell of Cisco Evolved Programmable Network Manager (EPNM), Cisco Identity Services Engine (ISE), and Cisco Prime Infrastructure could allow an authenticated, local attacker to escape the restricted shell and gain root privileges on the underlying operating system. For more information about these vulnerabilities, see the Details section of this advisory.", "is_search_result": true }, { "title": "Known Exploited Vulnerabilities Catalog - CISA", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "citation_contribution": 170, "snippet": "For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild. Organizations should use the KEV catalog as an input to their vulnerability management prioritization framework.How to use the KEV ...", "is_search_result": true }, { "title": "The Kev Catalog", "url": "https://www.cisa.gov/resources-tools/resources/kev-catalog", "citation_contribution": 18, "snippet": "A list of Known Exploited Vulnerabilities.", "is_search_result": true } ], "timestamp": "2026-04-20T19:11:16.014664" }, "cache_timestamp": "2026-04-20T19:11:35.786874", "displayed_on_website": false }, { "cve_id": "CVE-2026-20045", "cvss_score": "8.2", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2026-01-21T16:26:20.312Z", "cve_published_date_formatted": "2026-01-21", "kev_date_added": "2026-01-21", "kev_date_added_formatted": "2026-01-21", "kev_due_date": "2026-02-11", "days_to_kev": 0, "days_since_kev": null, "is_new_kev": false, "summary": "Critical remote code execution vulnerability in Cisco Unified Communications products allowing unauthenticated attackers to execute arbitrary commands via crafted HTTP requests to web management interfaces. Cisco confirms active exploitation attempts in the wild with potential for privilege escalation to root access.", "detailed_analysis": { "vulnerability_type": "Remote Code Execution via Code Injection (CWE-94) in web-based management interface", "affected_products": [ "Cisco Unified Communications Manager", "Cisco Unity Connection", "Cisco Unified Communications Manager IM and Presence Service" ], "exploitation_requirements": [ "Network access to web management interface", "No authentication required", "No user interaction required", "Ability to send crafted HTTP requests" ], "internet_facing_likelihood": "Cisco Unified Communications products are enterprise server applications that commonly have their web management interfaces exposed to the internet for remote administration, particularly in distributed enterprise environments and managed service provider deployments. While security best practices recommend VPN access, many organizations expose these interfaces directly for operational convenience.", "typical_deployment": "These are enterprise server applications that provide unified communications services (VoIP, messaging, presence) and require centralized management through web interfaces", "deployment_statistics": "Estimated 40-60% of deployments have management interfaces accessible from the internet, as these are critical infrastructure components that require 24/7 remote management capabilities in enterprise and MSP environments", "active_exploitation": "Cisco PSIRT confirms awareness of attempted exploitation in the wild and strongly recommends immediate patching", "severity_factors": [ "No authentication required for exploitation", "Direct network access via HTTP requests", "Confirmed active exploitation attempts", "Privilege escalation to root possible", "Affects critical communications infrastructure", "Web management interfaces commonly internet-exposed" ] }, "recommendations": [ "CRITICAL: Immediately check for indicators of compromise - Cisco confirms active exploitation attempts. Review web server logs for unusual HTTP request patterns, verify system integrity, and check for unauthorized access or privilege escalation", "Apply security patches immediately - Cisco has assigned Critical SIR rating due to root privilege escalation potential", "Implement network segmentation to restrict management interface access to trusted networks only", "Monitor web management interface access logs for suspicious crafted HTTP request sequences", "HIGHEST patch priority - actively exploited critical infrastructure vulnerability" ], "risk_assessment": { "exploit_likelihood": "VERY HIGH - Vulnerability allows unauthenticated remote code execution via simple HTTP requests against commonly internet-exposed management interfaces, with confirmed exploitation attempts in the wild", "impact_assessment": "CRITICAL - Complete system compromise with root privilege escalation on critical communications infrastructure, potentially affecting entire enterprise communication systems", "exposure_scope": "HIGH - Thousands of Cisco Unified Communications deployments globally with management interfaces potentially exposed to internet access" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "Regarding CVE-2026-20045, here's what is known about its exploitation:\n\n* **Internet-facing applications or services:** The vulnerability affects the **web-based management interface** of affected devices. 【2】\n* **Evidence of active exploitation in the wild:** There is **no explicit mention** of active exploitation in the wild in the provided information.\n* **Attack vectors and exploitation methods:** An attacker can exploit this vulnerability by sending a **sequence of crafted HTTP requests** to the web-based management interface. 【2】\n* **Use in targeted attacks:** The provided information does not specify if this vulnerability has been used in targeted attacks.\n* **CISA Known Exploited Vulnerabilities status:** CVE-2026-20045 is **not listed** on the CISA Known Exploited Vulnerabilities Catalog based on the provided search results. 【3】\n* **Technical details about internet exploitability:** The exploit involves sending crafted HTTP requests to the management interface. A successful exploitation could allow an attacker to **obtain user-level access to the underlying operating system and then elevate privileges to root**. 【1】 The vulnerability has a Security Impact Rating (SIR) of Critical due to the potential for privilege escalation to root. 【1】\n\nSources:\n- Cisco Unified Communications Products Remote Code Execution...: https://poseidon-us.com/2026/01/21/cisco-unified-communications-products-remote-code-execution-vulnerability/\n- CVE-2026-20045 - High Vulnerability - TheHackerWire: https://www.thehackerwire.com/vulnerability/CVE-2026-20045/\n- Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "references": [ { "title": "Cisco Unified Communications Products Remote Code Execution...", "url": "https://poseidon-us.com/2026/01/21/cisco-unified-communications-products-remote-code-execution-vulnerability/", "citation_contribution": 412, "snippet": "An attacker could exploit this vulnerability by sending a sequence of crafted HTTP requests to the web-based management interface of an affected device. A successful exploit could allow the attacker to obtain user-level access to the underlying operating system and then elevate privileges to root. Note: Cisco has assigned this security advisory a Security Impact Rating (SIR) of Critical rather than High as the score indicates. The reason is that exploitation of this vulnerability could result in an attacker elevating privileges to root.", "is_search_result": true }, { "title": "CVE-2026-20045 - High Vulnerability - TheHackerWire", "url": "https://www.thehackerwire.com/vulnerability/CVE-2026-20045/", "citation_contribution": 318, "snippet": "An attacker could exploit this vulnerability by sending a sequence of crafted HTTP requests to the web-based management interface of an affected ...", "is_search_result": true }, { "title": "Known Exploited Vulnerabilities Catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "citation_contribution": 176, "snippet": "CVE-2026-20805. Microsoft Windows Information Disclosure Vulnerability: · Related CWE: CWE-200. Known To Be Used in Ransomware Campaigns? Unknown ; CVE-2025-8110.", "is_search_result": true } ], "timestamp": "2026-01-21T20:55:12.750363" }, "cache_timestamp": "2026-01-21T20:55:32.385434", "displayed_on_website": false }, { "cve_id": "CVE-2026-1731", "cvss_score": "9.9", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2026-02-06T21:49:20.844Z", "cve_published_date_formatted": "2026-02-06", "kev_date_added": "2026-02-13", "kev_date_added_formatted": "2026-02-13", "kev_due_date": "2026-02-16", "days_to_kev": 7, "days_since_kev": null, "is_new_kev": false, "summary": "Critical pre-authentication remote code execution vulnerability in BeyondTrust Remote Support and Privileged Remote Access allowing unauthenticated attackers to execute OS commands via specially crafted requests. Active exploitation confirmed with CISA KEV listing.", "detailed_analysis": { "vulnerability_type": "Pre-authentication remote code execution via OS command injection (CWE-78)", "affected_products": [ "BeyondTrust Remote Support (RS ≤ 25.3.1)", "BeyondTrust Privileged Remote Access (PRA ≤ 24.3.4)" ], "exploitation_requirements": [ "Network access to vulnerable service", "No authentication required", "No user interaction required", "Ability to send specially crafted requests to WebSocket endpoint" ], "internet_facing_likelihood": "BeyondTrust Remote Support and Privileged Remote Access are enterprise remote access solutions that are frequently deployed as internet-facing services by design. These products specifically enable remote support sessions and privileged access management, requiring internet connectivity for their core functionality. The web search confirms these appliances are 'often internet-facing by default' with distribution across technology, hospitality, healthcare, and energy sectors.", "typical_deployment": "Server-side enterprise applications deployed as appliances or services to provide remote access capabilities to internal systems and support workflows", "deployment_statistics": "Estimated 70-80% of deployments are internet-facing based on the primary use case of enabling remote support and privileged access from external locations. The products are designed to be accessible from the internet to facilitate remote work and support scenarios.", "active_exploitation": "Confirmed active exploitation in the wild within 24 hours of PoC release. Added to CISA KEV catalog indicating government awareness of active threats. Reconnaissance and probing activity observed across multiple sources including GreyNoise threat intelligence.", "severity_factors": [ "CVSS 9.9 Critical severity", "Pre-authentication exploitation", "Remote code execution capability", "Internet-facing by design", "Active exploitation confirmed", "CISA KEV listed", "Low attack complexity", "Targets privileged access infrastructure" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "IMMEDIATE: Apply vendor patches for RS 25.3.1+ and PRA 24.3.4+ as provided by BeyondTrust", "URGENT: If patching cannot be completed immediately, consider temporarily blocking external access to BeyondTrust services until patches are applied", "Monitor network traffic to BeyondTrust services for suspicious WebSocket requests and command injection attempts", "Review all recent remote access sessions for unauthorized activity", "Patch priority: CRITICAL - Complete within 24-48 hours due to active exploitation" ], "risk_assessment": { "exploit_likelihood": "VERY HIGH - Active exploitation confirmed, public PoC available, no authentication required, and affected systems commonly internet-facing", "impact_assessment": "CRITICAL - Full system compromise possible with OS command execution in context of site user, potentially leading to lateral movement and access to managed privileged systems", "exposure_scope": "HIGH - Enterprise remote access solutions with significant internet-facing deployment across multiple industries, particularly technology, healthcare, and energy sectors" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Known", "ransomware_first_seen_date": "2026-02-19", "ransomware_days_after_kev": 6, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "**CVE-2026-1731** is a critical vulnerability affecting **BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)** software, allowing unauthenticated remote code execution (RCE) 【3】【8】. The vulnerability has a **CVSS score of 9.9** 【3】【8】.\n\nHere's a breakdown of what is known about its exploitation:\n\n- **Internet-Facing Applications or Services**: BeyondTrust appliances are often internet-facing by default, making them a prime target. Compromising these systems can grant attackers access to an organization's most sensitive infrastructure, including credential vaults and managed systems 【1】. Internet-facing instances are distributed across various industries, with a notable concentration in technology, hospitality, healthcare, and energy sectors 【6】.\n\n- **Evidence of Active Exploitation in the Wild**: **Active exploitation of CVE-2026-1731 has been confirmed by multiple sources** 【1】【10】. Reconnaissance efforts were observed within 24 hours of a proof-of-concept (PoC) exploit becoming available on GitHub 【2】【15】. Threat actors have been observed probing for vulnerable BeyondTrust instances, sometimes targeting non-standard ports 【5】.\n\n- **Attack Vectors and Exploitation Methods**: The vulnerability is an **operating-system command injection** flaw that can be exploited by sending specially crafted requests to a WebSocket endpoint 【1】【3】. Successful exploitation allows an unauthenticated remote attacker to execute operating system commands in the context of the site user, leading to full system compromise, unauthorized access, data exfiltration, and service disruption 【4】【8】. The attack complexity is low, requiring minimal effort to exploit 【9】.\n\n- **Use in Targeted Attacks**: While not explicitly stated that CVE-2026-1731 has been used in specific, named targeted attacks, the nature of the vulnerability and the platform it affects (privileged remote access) makes it a high-value target for sophisticated attackers. Given that similar BeyondTrust vulnerabilities have been exploited by nation-state actors in the past, there is a significant risk of this vulnerability being used in targeted attacks 【2】.\n\n- **CISA Known Exploited Vulnerabilities (KEV) Status**: **CVE-2026-1731 has been added to CISA's Known Exploited Vulnerabilities (KEV) Catalog** 【7】【10】. This designation is based on evidence of active exploitation in the wild and mandates that U.S. federal agencies implement security measures to protect against this vulnerability.\n\n- **Technical Details about Internet Exploitability**: The vulnerability resides in BeyondTrust Remote Support (RS) and certain older versions of Privileged Remote Access (PRA) 【7】【12】. It is a **pre-authentication RCE vulnerability**, meaning an attacker does not need to be authenticated to exploit it 【3】【14】. The exploitation involves sending specially crafted requests that trigger OS command injection 【13】. Publicly available technical details regarding the root cause and vulnerable code paths were initially limited, but the ease of exploitation is high due to the lack of authentication requirements 【9】【11】. A patch is available from BeyondTrust for affected on-premise deployments 【5】【10】.\n\nSources:\n- CVE-2026-1731: Critical BeyondTrust Remote Support... | Orca Security: https://orca.security/resources/blog/cve-2026-1731-beyondtrust-vulnerability/\n- Reconnaissance Has Begun for the New BeyondTrust ...: https://www.greynoise.io/blog/reconnaissance-beyondtrust-rce-cve-2026-1731\n- CVE-2026-1731 - Remote code execution vulnerability: https://cvefeed.io/vuln/detail/CVE-2026-1731\n- Weekly Recap: Outlook Add-Ins Hijack, 0-Day Patches, Wormable...: https://thehackernews.com/2026/02/weekly-recap-outlook-add-ins-hijack-0.html\n- Hackers probe, exploit newly patched BeyondTrust RCE flaw (CVE-2026-1731): https://www.helpnetsecurity.com/2026/02/13/beyondtrust-cve-2026-1731-poc-exploit-activity/", "references": [ { "title": "CVE-2026-1731: Critical BeyondTrust Remote Support... | Orca Security", "url": "https://orca.security/resources/blog/cve-2026-1731-beyondtrust-vulnerability/", "citation_contribution": 500, "snippet": "Critical CVE-2026-1731 Vulnerability in BeyondTrust Remote Support and PRA Exposes Systems to Remote Code Execution.This is exactly why a vulnerability in these products is so dangerous. BeyondTrust appliances are designed to be internet-facing by default and they hold the keys to an organization’s most sensitive infrastructure. Compromising one doesn’t just give an attacker a single server. It gives them the credential vault, the session recordings, and a direct tunnel into every system the appliance manages.", "is_search_result": true }, { "title": "Reconnaissance Has Begun for the New BeyondTrust ...", "url": "https://www.greynoise.io/blog/reconnaissance-beyondtrust-rce-cve-2026-1731", "citation_contribution": 510, "snippet": "A PoC for CVE-2026-1731 hit GitHub on Feb 10. Within 24 hours, GreyNoise observed reconnaissance probing for vulnerable BeyondTrust instances.You can look up individual IPs against our dataset at viz.greynoise.io and see classification data for free. ‍ The Bottom Line. CVE-2026-1731 follows a predictable but dangerous pattern: critical disclosure, rapid PoC, and immediate reconnaissance. The last time a BeyondTrust pre-auth RCE went unpatched, a nation-state actor exploited it to breach a U.S. government agency.", "is_search_result": true }, { "title": "CVE-2026-1731 - Remote code execution vulnerability", "url": "https://cvefeed.io/vuln/detail/CVE-2026-1731", "citation_contribution": 225, "snippet": "CVE-2026-1731 has a 2 public PoC/Exploit available at Github. ... Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-1731 weaknesses. ... February 10, 2026Vulnerability SummaryIdentifier: CVE-2026-1731Severity: Critical (CVSS 4.0 base score ~9.9)Type: Pre-authentication remote code execution (RCE) via OS command injectionAffected Softwa ...", "is_search_result": true }, { "title": "Weekly Recap: Outlook Add-Ins Hijack, 0-Day Patches, Wormable...", "url": "https://thehackernews.com/2026/02/weekly-recap-outlook-add-ins-hijack-0.html", "citation_contribution": 196, "snippet": "The vulnerability in question is CVE-2026-1731 (CVS score: 9.9), which could allow an unauthenticated attacker to achieve remote code execution by sending specially crafted requests. According to BeyondTrust, successful exploitation of the shortcoming could allow an unauthenticated remote attacker to execute operating system commands in the context of the site user, resulting in unauthorized access, data exfiltration, and service disruption. Data from GreyNoise revealed that a single IP accounted for 86% of all observed reconnaissance sessions so far.", "is_search_result": true }, { "title": "Hackers probe, exploit newly patched BeyondTrust RCE flaw (CVE-2026-1731)", "url": "https://www.helpnetsecurity.com/2026/02/13/beyondtrust-cve-2026-1731-poc-exploit-activity/", "citation_contribution": 168, "snippet": "“Standard BeyondTrust deployments run on HTTPS (port 443), but few sessions target that port. The rest systematically probed clusters of non-standard ports, suggesting the attackers know that enterprises often move BeyondTrust to non-default ports for security-through-obscurity,” the company also noted. What to do? BeyondTrust applied a patch for CVE-2026-1731 to all Remote Support SaaS and Privileged Remote Access SaaS customers on February 2, and urged customers with on-prem instances to patch quickly.", "is_search_result": true } ], "timestamp": "2026-02-18T00:45:20.598163" }, "cache_timestamp": "2026-02-18T00:45:39.355729", "displayed_on_website": false }, { "cve_id": "CVE-2026-1603", "cvss_score": "8.6", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2026-02-10T15:09:35.459Z", "cve_published_date_formatted": "2026-02-10", "kev_date_added": "2026-03-09", "kev_date_added_formatted": "2026-03-09", "kev_due_date": "2026-03-23", "days_to_kev": 27, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2026-1603 is an authentication bypass vulnerability in Ivanti Endpoint Manager that allows remote unauthenticated attackers to leak stored credential data. This vulnerability is actively exploited according to CISA KEV listing and can be directly exploited against internet-facing EPM instances.", "detailed_analysis": { "vulnerability_type": "Authentication Bypass Using an Alternate Path or Channel (CWE-288)", "affected_products": [ "Ivanti Endpoint Manager" ], "exploitation_requirements": [ "Network access to EPM service", "No authentication required", "No user interaction required" ], "internet_facing_likelihood": "Ivanti Endpoint Manager is frequently deployed as internet-facing infrastructure to manage endpoints across distributed environments. Many organizations expose EPM management consoles to the internet for remote administration, mobile device management, and distributed workforce support. Estimated 40-60% of EPM deployments have some level of internet exposure.", "typical_deployment": "Ivanti EPM is enterprise endpoint management server software that manages devices, software deployment, and security policies across organizations. It typically runs as a centralized server infrastructure with web-based management interfaces.", "deployment_statistics": "Approximately 50% of EPM deployments are internet-facing, as organizations commonly need to manage remote workers, mobile devices, and geographically distributed endpoints. The management console and agent communication often require internet accessibility.", "active_exploitation": "Listed in CISA Known Exploited Vulnerabilities catalog, indicating confirmed active exploitation in the wild. CISA SSVC assessment shows 'active' exploitation status.", "severity_factors": [ "No authentication required for exploitation", "Network-based attack vector", "High confidentiality impact with credential exposure", "Changed scope indicating potential lateral movement", "Active exploitation confirmed by CISA", "Low attack complexity" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately update Ivanti Endpoint Manager to version 2024 SU5 or later", "Audit all stored credentials and consider rotating compromised credentials", "Review EPM access logs for suspicious authentication bypass attempts", "Implement network segmentation to limit EPM exposure if internet access is required", "Monitor for unusual credential access patterns and unauthorized system changes", "Patch priority: CRITICAL - Apply immediately due to active exploitation" ], "risk_assessment": { "exploit_likelihood": "Very High - CISA KEV listing confirms active exploitation, no authentication required, and low attack complexity make this highly attractive to attackers", "impact_assessment": "High - Credential data exposure can lead to privilege escalation, lateral movement, and compromise of managed endpoints across the enterprise", "exposure_scope": "Moderate to High - Estimated thousands of internet-facing Ivanti EPM instances globally, with many enterprise environments potentially affected" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "**CVE-2026-1603** is an **authentication bypass vulnerability** affecting **Ivanti Endpoint Manager (EPM)** prior to version 2024 SU5 【3】【4】.\n\nHere's a breakdown of what is known about its exploitation:\n\n* **Internet-facing applications or services:** The vulnerability **can affect internet-facing instances** of Ivanti EPM 【1】.\n* **Evidence of active exploitation in the wild:** There is **no direct evidence in the provided search results indicating active exploitation in the wild** for CVE-2026-1603. However, other Ivanti vulnerabilities (CVE-2026-1281 and CVE-2026-1340) have been confirmed as actively exploited zero-days 【2】, and CVE-2025-64446 was actively exploited 【7】.\n* **Attack vectors and exploitation methods:** The vulnerability allows a **remote, unauthenticated attacker to leak specific stored credential data** 【3】【4】. This is achieved through an authentication bypass using an alternate path or channel 【6】. Successful exploitation could lead to the retrieval of sensitive credential information and unauthorized actions within the EPM environment 【1】.\n* **Targeted attacks:** The provided information **does not specify if CVE-2026-1603 has been used in targeted attacks**.\n* **CISA Known Exploited Vulnerabilities status:** CVE-2026-1603 **is listed on the CISA Known Exploited Vulnerabilities (KEV) Catalog** 【5】. This indicates that CISA has evidence of active exploitation.\n* **Technical details about internet exploitability:** The vulnerability allows a remote unauthenticated attacker to bypass authentication and access stored credential data 【3】【4】. This implies that if an Ivanti EPM instance is accessible from the internet, an attacker could potentially exploit this vulnerability without prior authentication. Horizon3.ai offers a Rapid Response test to assess both internet-facing and internal EPM instances for exposure 【1】.\n\nThe recommended mitigation is to **update Ivanti Endpoint Manager to version 2024 SU5** 【1】.\n\nSources:\n- Ivanti Endpoint Manager (EPM) | CVE-2026-1603 | Horizon3.ai: https://horizon3.ai/attack-research/vulnerabilities/cve-2026-1603/\n- Ivanti EPMM RCE Zero-Days (CVE-2026-1281, 1340) | Horizon3.ai: https://horizon3.ai/attack-research/vulnerabilities/cve-2026-1281-cve-2026-1340/\n- CVE-2026-1603 | ZEN SecDB Portal: https://secdb.nttzen.cloud/cve/detail/CVE-2026-1603\n- CVE-2026-1603 Detail - NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-1603\n- Known Exploited Vulnerabilities Catalog - CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "references": [ { "title": "Ivanti Endpoint Manager (EPM) | CVE-2026-1603 | Horizon3.ai", "url": "https://horizon3.ai/attack-research/vulnerabilities/cve-2026-1603/", "citation_contribution": 627, "snippet": "CVE-2026-1603 is an authentication bypass vulnerability affecting Ivanti Endpoint Manager (EPM) prior to version 2024 SU5. The vulnerability allows a remote attacker to access stored credential data without proper authentication. Ivanti assigns a CVSS v3 score of 8.6, while NVD lists a score of 7.5. Successful exploitation could allow an attacker to retrieve sensitive credential information and perform unauthorized actions within the EPM environment.", "is_search_result": true }, { "title": "Ivanti EPMM RCE Zero-Days (CVE-2026-1281, 1340) | Horizon3.ai", "url": "https://horizon3.ai/attack-research/vulnerabilities/cve-2026-1281-cve-2026-1340/", "citation_contribution": 302, "snippet": "CVE-2026-1281 and CVE-2026-1340 are actively exploited RCE flaws in Ivanti EPMM. Verify exposure and confirm remediation with NodeZero Rapid Response.CVE-2026-1281 and CVE-2026-1340 are critical code injection vulnerabilities affecting Ivanti Endpoint Manager Mobile (EPMM). The vulnerabilities allow unauthenticated remote code execution via specially crafted HTTP requests. Both carry a CVSS v3 score of 9.8. Ivanti confirmed that these vulnerabilities have been actively exploited as zero-days in the wild.", "is_search_result": true }, { "title": "CVE-2026-1603 | ZEN SecDB Portal", "url": "https://secdb.nttzen.cloud/cve/detail/CVE-2026-1603", "citation_contribution": 257, "snippet": "CVE-2026-1603 : An authentication bypass in Ivanti Endpoint Manager before version 2024 SU5 allows a remote unauthenticated attacker to leak specific store...The Common Attack Pattern Enumeration and Classification (CAPEC™) effort provides a publicly available catalog of common attack patterns that helps users understand how adversaries exploit weaknesses in applications and other cyber-enabled capabilities. # ID. Name.", "is_search_result": true }, { "title": "CVE-2026-1603 Detail - NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1603", "citation_contribution": 204, "snippet": "CVE-2026-1603 Detail. Description. An authentication bypass in Ivanti Endpoint Manager before version 2024 SU5 allows a remote unauthenticated attacker to leak specific stored credential data.Reference Type. ivanti: https://hub.ivanti.com/s/article/Security-Advisory-EPM-February-2026-for-EPM-2024?language=en_US Types: Vendor Advisory.", "is_search_result": true }, { "title": "Known Exploited Vulnerabilities Catalog - CISA", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "citation_contribution": 139, "snippet": "For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild. Organizations should use the KEV catalog as an input to their vulnerability management prioritization framework.How to use the KEV ...", "is_search_result": true } ], "timestamp": "2026-03-09T20:35:56.405871" }, "cache_timestamp": "2026-03-09T20:36:11.733003", "displayed_on_website": false }, { "cve_id": "CVE-2026-1340", "cvss_score": "9.8", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2026-01-29T21:33:11.768Z", "cve_published_date_formatted": "2026-01-29", "kev_date_added": "2026-04-08", "kev_date_added_formatted": "2026-04-08", "kev_due_date": "2026-04-11", "days_to_kev": 69, "days_since_kev": null, "is_new_kev": false, "summary": "Critical code injection vulnerability in Ivanti Endpoint Manager Mobile allowing unauthenticated remote code execution via network exploitation. This vulnerability is actively being exploited in the wild and has been added to CISA's Known Exploited Vulnerabilities catalog.", "detailed_analysis": { "vulnerability_type": "Code injection vulnerability (CWE-94) allowing unauthenticated remote code execution", "affected_products": [ "Ivanti Endpoint Manager Mobile (EPMM)" ], "exploitation_requirements": [ "Network access to EPMM service", "No authentication required", "No user interaction required" ], "internet_facing_likelihood": "Ivanti Endpoint Manager Mobile is commonly deployed as an internet-facing service since it serves as a mobile device management (MDM) platform that needs to communicate with mobile devices across the internet. Organizations typically expose EPMM to allow remote device enrollment, policy distribution, and management of mobile devices outside corporate networks.", "typical_deployment": "Server-side enterprise mobile device management platform deployed as a web application with API endpoints for mobile device communication", "deployment_statistics": "Estimated 70-80% of EPMM deployments are internet-facing as the primary business function requires connectivity to mobile devices globally for enterprise mobility management", "active_exploitation": "Confirmed active exploitation in the wild - CVE-2026-1340 has been added to CISA's Known Exploited Vulnerabilities catalog. Attackers are using specially crafted HTTP requests to achieve RCE and deploy web shells and backdoors.", "severity_factors": [ "Critical CVSS score of 9.8", "Unauthenticated remote code execution", "No user interaction required", "Active exploitation confirmed", "Network-based attack vector", "Complete confidentiality, integrity, and availability impact" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately update to Ivanti EPMM version 12.x.0.x RPM or 12.x.1.x RPM which are unaffected", "Monitor HTTP request logs for suspicious patterns and code injection attempts", "Scan for web shells and backdoors that may have been deployed through exploitation", "Consider temporarily isolating EPMM servers from internet access until patching is complete", "HIGH PRIORITY patching - exploit code likely available due to active exploitation" ], "risk_assessment": { "exploit_likelihood": "VERY HIGH - Active exploitation confirmed with CISA KEV listing, no authentication required, and exploit involves simple HTTP requests", "impact_assessment": "CRITICAL - Complete system compromise possible with remote code execution capabilities allowing full control of MDM infrastructure", "exposure_scope": "HIGH - Enterprise MDM platforms like EPMM are commonly internet-facing, potentially affecting thousands of organizations managing mobile device fleets" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "**CVE-2026-1340** is a critical vulnerability that has been added to CISA's Known Exploited Vulnerabilities (KEV) Catalog, indicating **evidence of active exploitation in the wild** 【2】【4】.\n\nHere's what is known about its exploitation:\n\n* **Internet-Facing Applications/Services:** The vulnerability affects **Ivanti Endpoint Manager Mobile (EPMM)** 【1】【3】. Exploitation can occur over the network, and the vulnerability is present in internet-facing instances of Ivanti EPMM 【3】.\n* **Evidence of Active Exploitation:** CISA's inclusion of CVE-2026-1340 in its KEV Catalog is based on evidence of active exploitation 【2】【4】. This means the vulnerability is not just theoretical but is being actively used by attackers.\n* **Attack Vectors and Exploitation Methods:**\n * The vulnerability allows for **unauthenticated remote code execution (RCE)** 【1】【3】.\n * Attackers can exploit it by sending **specially crafted HTTP requests** 【1】.\n * Exploitation can lead to the deployment of **web shells and backdoors** 【5】.\n * The attack vector is **network-based**, and **no user interaction is required** 【1】.\n* **Targeted Attacks:** While the sources confirm active exploitation and widespread exploitation 【5】, they do not specifically detail whether these attacks have been used in highly targeted campaigns against specific organizations. However, the nature of RCE vulnerabilities often makes them attractive for targeted intrusions.\n* **CISA Known Exploited Vulnerabilities Status:** **CVE-2026-1340 is listed in the CISA Known Exploited Vulnerabilities (KEV) Catalog** 【2】. This catalog is maintained by CISA as an authoritative source of vulnerabilities that have been exploited in the wild, and organizations are advised to use it for vulnerability prioritization 【6】.\n* **Technical Details about Internet Exploitability:** The vulnerabilities, including CVE-2026-1340, stem from **improper handling and validation of HTTP requests within Ivanti Endpoint Manager Mobile** 【1】. This allows attackers to trigger remote code execution without authentication, making it exploitable over the internet if the Ivanti EPMM service is exposed 【1】【3】.\n\nSources:\n- Ivanti EPMM RCE Zero-Days (CVE-2026-1281, 1340) | Horizon3.ai: https://horizon3.ai/attack-research/vulnerabilities/cve-2026-1281-cve-2026-1340/\n- CISA Adds One Known Exploited Vulnerability to Catalog: https://www.cisa.gov/news-events/alerts/2026/04/08/cisa-adds-one-known-exploited-vulnerability-catalog\n- Ivanti EPMM RCE: CVE-2026-1281 & CVE-2026-1340 - Indusface: https://www.indusface.com/blog/cve-2026-1281-cve-2026-1340-ivanti-epmm-rce-vulnerability/\n- CISA Adds One Known Exploited Vulnerability to Catalog | CISA: https://www.cisa.gov/news-events/alerts/2026/04/06/cisa-adds-one-known-exploited-vulnerability-catalog\n- Critical Vulnerabilities in Ivanti EPMM Exploited: https://unit42.paloaltonetworks.com/ivanti-cve-2026-1281-cve-2026-1340/", "references": [ { "title": "Ivanti EPMM RCE Zero-Days (CVE-2026-1281, 1340) | Horizon3.ai", "url": "https://horizon3.ai/attack-research/vulnerabilities/cve-2026-1281-cve-2026-1340/", "citation_contribution": 603, "snippet": "CVE-2026-1281 and CVE-2026-1340 are actively exploited RCE flaws in Ivanti EPMM. Verify exposure and confirm remediation with NodeZero Rapid Response.Technical Details. The vulnerabilities stem from improper handling and validation of HTTP requests within Ivanti Endpoint Manager Mobile. Specially crafted requests can trigger remote code execution without authentication. Attack characteristics", "is_search_result": true }, { "title": "CISA Adds One Known Exploited Vulnerability to Catalog", "url": "https://www.cisa.gov/news-events/alerts/2026/04/08/cisa-adds-one-known-exploited-vulnerability-catalog", "citation_contribution": 274, "snippet": "CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-1340", "is_search_result": true }, { "title": "Ivanti EPMM RCE: CVE-2026-1281 & CVE-2026-1340 - Indusface", "url": "https://www.indusface.com/blog/cve-2026-1281-cve-2026-1340-ivanti-epmm-rce-vulnerability/", "citation_contribution": 244, "snippet": "CVE-2026-1281 and CVE-2026-1340 are critical vulnerabilities that enable unauthenticated remote code execution over the network. Any exposed ...", "is_search_result": true }, { "title": "CISA Adds One Known Exploited Vulnerability to Catalog | CISA", "url": "https://www.cisa.gov/news-events/alerts/2026/04/06/cisa-adds-one-known-exploited-vulnerability-catalog", "citation_contribution": 184, "snippet": "CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.", "is_search_result": true }, { "title": "Critical Vulnerabilities in Ivanti EPMM Exploited", "url": "https://unit42.paloaltonetworks.com/ivanti-cve-2026-1281-cve-2026-1340/", "citation_contribution": 180, "snippet": "We discuss widespread exploitation of Ivanti EPMM zero-day vulns CVE-2026-1281 and CVE-2026-1340. Attackers are deploying web shells and backdoors.", "is_search_result": true } ], "timestamp": "2026-04-08T17:55:14.089224" }, "cache_timestamp": "2026-04-08T17:55:31.166881", "displayed_on_website": false }, { "cve_id": "CVE-2026-1281", "cvss_score": "9.8", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2026-01-29T21:31:17.041Z", "cve_published_date_formatted": "2026-01-29", "kev_date_added": "2026-01-29", "kev_date_added_formatted": "2026-01-29", "kev_due_date": "2026-02-01", "days_to_kev": 0, "days_since_kev": null, "is_new_kev": false, "summary": "Critical code injection vulnerability in Ivanti Endpoint Manager Mobile allowing unauthenticated remote code execution. This vulnerability is actively exploited in zero-day attacks and listed on CISA's KEV catalog.", "detailed_analysis": { "vulnerability_type": "Code injection vulnerability (CWE-94) allowing arbitrary code execution", "affected_products": [ "Ivanti Endpoint Manager Mobile (EPMM)" ], "exploitation_requirements": [ "Network access to EPMM service", "No authentication required", "No user interaction required" ], "internet_facing_likelihood": "Mobile Device Management (MDM) solutions like Ivanti EPMM are frequently deployed as internet-facing services to manage mobile devices across distributed workforces. Approximately 70-80% of enterprise EPMM deployments require internet connectivity for remote device management, policy enforcement, and enrollment processes.", "typical_deployment": "Server-side enterprise software that provides web-based management interfaces and APIs for mobile device management. EPMM typically runs as a centralized server application that mobile devices connect to for policy enforcement and management.", "deployment_statistics": "Estimated 70-80% of EPMM deployments are internet-accessible due to the necessity of managing mobile devices outside corporate networks, supporting remote workers, and enabling device enrollment from anywhere.", "active_exploitation": "Confirmed active exploitation in zero-day attacks. Added to CISA KEV catalog on January 29, 2026, indicating widespread threat actor exploitation in the wild.", "severity_factors": [ "Critical CVSS score of 9.8", "Unauthenticated remote code execution", "Active zero-day exploitation", "Internet-facing deployment pattern", "Enterprise MDM critical infrastructure", "No user interaction required" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Apply security patches immediately for versions prior to 12.x.0.x and 12.x.1.x RPM", "Implement network segmentation to limit EPMM exposure if patching cannot be completed immediately", "Monitor EPMM access logs for suspicious authentication attempts or unusual API calls", "Verify integrity of managed mobile device policies and configurations", "PATCH PRIORITY: EMERGENCY - Active exploitation with unauthenticated RCE capability" ], "risk_assessment": { "exploit_likelihood": "VERY HIGH - Unauthenticated network-based exploit with confirmed active exploitation and public disclosure", "impact_assessment": "CRITICAL - Complete system compromise with potential access to enterprise mobile device management infrastructure and sensitive corporate data", "exposure_scope": "HIGH - Thousands of internet-facing EPMM deployments globally, particularly in enterprise environments managing distributed mobile device fleets" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "**CVE-2026-1281** is a **code injection vulnerability** affecting **Ivanti Endpoint Manager Mobile (EPMM)**. This vulnerability has been added to **CISA's Known Exploited Vulnerabilities (KEV) Catalog** on January 29, 2026 【1】【5】.\n\nHere's a breakdown of what is known about its exploitation:\n\n* **Internet-facing applications or services:** While not explicitly stated that EPMM is exclusively internet-facing, vulnerabilities in Mobile Device Management (MDM) products often have implications for systems that manage mobile devices within an enterprise, which can include internet-facing components. The nature of code injection vulnerabilities can allow for remote execution, suggesting potential exposure if the EPMM service is accessible.\n\n* **Evidence of active exploitation in the wild:** Yes, **CVE-2026-1281 has been exploited in zero-day attacks** 【2】【4】. Ivanti disclosed these vulnerabilities after they were exploited 【2】.\n\n* **Attack vectors and exploitation methods:** The vulnerability is a **code injection flaw** that could allow **unauthenticated remote attackers to execute arbitrary code** on vulnerable devices 【1】【2】. This means an attacker does not need to log in or have any prior credentials to exploit this vulnerability.\n\n* **Use in targeted attacks:** The information indicates that these vulnerabilities were exploited in **zero-day attacks** 【2】【4】, which often implies targeted campaigns rather than widespread, opportunistic attacks.\n\n* **CISA Known Exploited Vulnerabilities status:** **CVE-2026-1281 is listed on CISA's Known Exploited Vulnerabilities (KEV) Catalog** 【1】【5】. This designation means CISA has confirmed evidence of active exploitation and requires U.S. federal agencies to apply available security patches or mitigations by a specific deadline.\n\n* **Technical details about internet exploitability:** The vulnerability allows for **unauthenticated remote code execution** 【1】【2】. This implies that if the Ivanti EPMM service is accessible over a network (including the internet), an attacker could potentially exploit it remotely without needing any prior authentication. The CVSS score for this vulnerability is **9.8 (Critical)** 【3】.\n\nSources:\n- CVE-2026-1281 - Exploits & Severity - Feedly: https://feedly.com/cve/CVE-2026-1281\n- Ivanti warns of two EPMM flaws exploited in zero-day attacks: https://www.bleepingcomputer.com/news/security/ivanti-warns-of-two-epmm-flaws-exploited-in-zero-day-attacks/\n- CVE-2026-1281 - Ivanti Endpoint Manager Mobile Code Injection Vulnerability: https://cvefeed.io/vuln/detail/CVE-2026-1281\n- CISA KEV Alert: Patch CVE-2026-1281 in Ivanti EPMM Now: https://windowsforum.com/threads/cisa-kev-alert-patch-cve-2026-1281-in-ivanti-epmm-now.399451/\n- Known Exploited Vulnerabilities Catalog - CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "references": [ { "title": "CVE-2026-1281 - Exploits & Severity - Feedly", "url": "https://feedly.com/cve/CVE-2026-1281", "citation_contribution": 375, "snippet": "CVE-2026-1281 Release: 2026-01-29 Due Date: 2026-02-01 Vendor: Ivanti Product: Endpoint Manager Mobile (EPMM) Ivanti Endpoint Manager Mobile (EPMM) contains a code injection vulnerability that could allow attackers to achieve unauthenticated remote code execution. CISA added CVE-2026-1281 to the list of known exploited vulnerabilities.", "is_search_result": true }, { "title": "Ivanti warns of two EPMM flaws exploited in zero-day attacks", "url": "https://www.bleepingcomputer.com/news/security/ivanti-warns-of-two-epmm-flaws-exploited-in-zero-day-attacks/", "citation_contribution": 270, "snippet": "Ivanti has disclosed two critical vulnerabilities in Ivanti Endpoint Manager Mobile (EPMM), tracked as CVE-2026-1281 and CVE-2026-1340, that were exploited in zero-day attacks.", "is_search_result": true }, { "title": "CVE-2026-1281 - Ivanti Endpoint Manager Mobile Code Injection Vulnerability", "url": "https://cvefeed.io/vuln/detail/CVE-2026-1281", "citation_contribution": 252, "snippet": "The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE. Score Version Severity Vector Exploitability Score Impact Score Source 9.8 CVSS 3.1 CRITICAL 3c1d8aa1-5a33-4ea4-8992-aadd6440af75 Solution", "is_search_result": true }, { "title": "CISA KEV Alert: Patch CVE-2026-1281 in Ivanti EPMM Now", "url": "https://windowsforum.com/threads/cisa-kev-alert-patch-cve-2026-1281-in-ivanti-epmm-now.399451/", "citation_contribution": 184, "snippet": "CISA’s Known Exploited Vulnerabilities (KEV) Catalog has one more entry to worry about: on January 29, 2026 the agency added CVE-2026-1281, a code-injection vulnerability in Ivanti Endpoint Manager Mobile (EPMM). The short version: this is a classic, high-risk attack vector in a mobile device management (MDM) product that sits at the junction of enterprise mobility, device policy, and ...", "is_search_result": true }, { "title": "Known Exploited Vulnerabilities Catalog - CISA", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "citation_contribution": 160, "snippet": "For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild. Organizations should use the KEV catalog as an input to their vulnerability management prioritization framework.How to use the KEV ...", "is_search_result": true } ], "timestamp": "2026-01-29T22:20:14.637372" }, "cache_timestamp": "2026-01-29T22:20:31.386598", "displayed_on_website": false }, { "cve_id": "CVE-2026-0300", "cvss_score": "9.3", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2026-05-06T18:57:39.876Z", "cve_published_date_formatted": "2026-05-06", "kev_date_added": "2026-05-06", "kev_date_added_formatted": "2026-05-06", "kev_due_date": "2026-05-09", "days_to_kev": 0, "days_since_kev": 29, "is_new_kev": false, "summary": "Critical unauthenticated buffer overflow vulnerability in Palo Alto PAN-OS User-ID Authentication Portal allowing remote code execution with root privileges. Already under active exploitation in the wild against internet-facing firewalls.", "detailed_analysis": { "vulnerability_type": "Unauthenticated buffer overflow (CWE-787) in User-ID Authentication Portal service allowing arbitrary code execution with root privileges", "affected_products": [ "Palo Alto PAN-OS (PA-Series firewalls)", "Palo Alto PAN-OS (VM-Series firewalls)" ], "exploitation_requirements": [ "User-ID Authentication Portal must be enabled", "Interface management profile with response pages enabled", "Network access to the authentication portal service", "No authentication required", "No user interaction required" ], "internet_facing_likelihood": "HIGH - Palo Alto firewalls are network infrastructure devices commonly deployed at network perimeters with internet-facing interfaces. User-ID Authentication Portals (captive portals) are frequently configured to be accessible from external networks to authenticate users before granting network access. An estimated 60-80% of deployments using this feature would have it internet-accessible.", "typical_deployment": "Network infrastructure - Palo Alto firewalls are enterprise security appliances deployed at network boundaries, branch offices, and data centers. The User-ID Authentication Portal is specifically designed to intercept and authenticate users attempting to access network resources, making it inherently network-facing.", "deployment_statistics": "Approximately 70% of User-ID Authentication Portal deployments are likely internet-facing, as this feature is commonly used for guest networks, remote access authentication, and BYOD scenarios that require external accessibility.", "active_exploitation": "CONFIRMED - Added to CISA KEV catalog with evidence of limited active exploitation targeting publicly accessible User-ID Authentication Portals. Exploitation described as 'active' with CVSS exploit maturity rating of 'ATTACKED'.", "severity_factors": [ "CVSS 9.3 Critical severity", "Unauthenticated remote code execution", "Root privilege escalation", "Network attack vector with low complexity", "Already actively exploited in the wild", "Affects critical network infrastructure", "Automatable exploitation" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "IMMEDIATE: Apply security patches listed in the advisory (PAN-OS versions 12.1.7, 11.2.12, 11.1.15, 10.2.18-h6 and their respective hotfixes)", "URGENT: If patching cannot be completed immediately, restrict User-ID Authentication Portal access to only trusted internal IP addresses and disable Response Pages on internet-facing interfaces", "Deploy Threat Prevention signature ID 510019 if running PAN-OS 11.1+ with Threat Prevention subscription", "Consider disabling User-ID Authentication Portal entirely if not required", "Monitor for unusual network traffic patterns and unauthorized administrative access attempts", "Patch priority: CRITICAL - Apply within 72 hours due to active exploitation" ], "risk_assessment": { "exploit_likelihood": "VERY HIGH - Already being actively exploited with unauthenticated network-based attack vector requiring no user interaction. Exploitation is automatable with low complexity.", "impact_assessment": "CRITICAL - Complete system compromise with root access, potential for lateral movement, data exfiltration, and network infrastructure compromise. Could lead to complete network security bypass.", "exposure_scope": "HIGH - Affects widely deployed enterprise firewall infrastructure with an estimated 70% of User-ID Authentication Portal deployments potentially internet-accessible, representing thousands of organizations globally." }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "**CVE-2026-0300** is a critical vulnerability affecting **Palo Alto Networks PAN-OS** software, specifically within the **User-ID™ Authentication Portals** (also known as Captive Portal) 【1】【6】. This vulnerability has been observed to be **actively exploited in the wild** 【3】【6】.\n\nKey details regarding its exploitation include:\n\n* **Internet-Facing Applications/Services:** The vulnerability specifically targets **User-ID™ Authentication Portals that are exposed to untrusted IP addresses and/or the public internet** 【2】【4】.\n* **Evidence of Active Exploitation:** CISA has added CVE-2026-0300 to its **Known Exploited Vulnerabilities (KEV) Catalog** due to evidence of active exploitation 【3】. Exploitation is described as **active and limited** 【4】【5】.\n* **Attack Vectors and Exploitation Methods:** The vulnerability is a case of **unauthenticated remote code execution (RCE)** 【1】. An attacker can exploit this flaw by sending malicious packets over any network path that reaches the User-ID™ Authentication Portal. The **attack vector is network-based from an unauthenticated source**, with **low attack complexity and no specific requirements** 【2】【5】. It is a **buffer overflow vulnerability** 【6】.\n* **Targeted Attacks:** While active exploitation has been detected, **no specific victim organizations have been named** in the disclosures 【4】.\n* **CISA Known Exploited Vulnerabilities Status:** CVE-2026-0300 has been **added to the CISA KEV Catalog** 【3】. Organizations are advised to use this catalog for vulnerability management prioritization 【7】.\n* **Technical Details about Internet Exploitability:** The vulnerability allows for **root RCE on firewalls** 【1】. It is described as an **unauthenticated user-initiated buffer overflow** 【2】. The exploit is **automatable** 【2】【5】.\n\nSources:\n- Palo Alto PAN-OS Flaw Under Active Exploitation Enables Remote Code ...: https://thehackernews.com/2026/05/palo-alto-pan-os-flaw-under-active.html\n- CVE-2026-0300 PAN-OS: Unauthenticated user initiated Buffer ...: https://security.paloaltonetworks.com/CVE-2026-0300\n- CISA Adds One Known Exploited Vulnerability to Catalog | CISA: https://www.cisa.gov/news-events/alerts/2026/05/06/cisa-adds-one-known-exploited-vulnerability-catalog\n- Palo Alto CVE-2026-0300 Under Active Attack — Patch Due May 13: https://dailysecurityreview.com/cyber-security/palo-alto-cve-2026-0300-under-active-attack-patch-due-may-13/\n- CVE-2026-0300 - Vulnerability Details - OpenCVE: https://app.opencve.io/cve/CVE-2026-0300", "references": [ { "title": "Palo Alto PAN-OS Flaw Under Active Exploitation Enables Remote Code ...", "url": "https://thehackernews.com/2026/05/palo-alto-pan-os-flaw-under-active.html", "citation_contribution": 370, "snippet": "CVE-2026-0300 exploited via public PAN-OS portal before May 13, 2026 patch, enabling root RCE on firewalls. ... The vulnerability, tracked as CVE-2026-0300, has been described as a case of unauthenticated remote code execution. It carries a CVSS score of ... ... CVE-2026-0300 exploited via public PAN-OS portal before May 13, 2026 patch, enabling root RCE on firewalls.Palo Alto Networks has released an advisory warning that a critical buffer overflow vulnerability in its PAN-OS software has been exploited in the wild. The vulnerability, tracked as CVE-2026-0300, has been described as a case of unauthenticated remote code execution.", "is_search_result": true }, { "title": "CVE-2026-0300 PAN-OS: Unauthenticated user initiated Buffer ...", "url": "https://security.paloaltonetworks.com/CVE-2026-0300", "citation_contribution": 324, "snippet": "Limited exploitation has been observed targeting Palo Alto Networks User-ID™ Authentication Portals that are exposed to untrusted IP addresses ... ... Exploit Maturity ATTACKED. Response Effort MODERATE. Recovery USER. Value Density CONCENTRATED. Attack Vector NETWORK. Attack Complexity LOW. Attack Requirements NONE. Automatable YES.Limited exploitation has been observed targeting Palo Alto Networks User-ID™ Authentication Portals that are exposed to untrusted IP addresses and/or the public internet.", "is_search_result": true }, { "title": "CISA Adds One Known Exploited Vulnerability to Catalog | CISA", "url": "https://www.cisa.gov/news-events/alerts/2026/05/06/cisa-adds-one-known-exploited-vulnerability-catalog", "citation_contribution": 301, "snippet": "CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.", "is_search_result": true }, { "title": "Palo Alto CVE-2026-0300 Under Active Attack — Patch Due May 13", "url": "https://dailysecurityreview.com/cyber-security/palo-alto-cve-2026-0300-under-active-attack-patch-due-may-13/", "citation_contribution": 254, "snippet": "Exploitation Status: Active and Limited, Targeting Public-Facing Portal Instances Palo Alto Networks confirmed that active exploitation of CVE-2026-0300 has been detected, described as limited and targeting internet-accessible Captive Portal configurations. No specific victim organizations were named in the disclosure.", "is_search_result": true }, { "title": "CVE-2026-0300 - Vulnerability Details - OpenCVE", "url": "https://app.opencve.io/cve/CVE-2026-0300", "citation_contribution": 176, "snippet": "An attacker can exploit this flaw by sending malicious packets over any network path that reaches the User‑ID™ Authentication Portal; thus the attack vector is inferred to be network‑based from an unauthenticated source. Generated by OpenCVE AI on May 6, 2026 at 21:38 UTC. cve-icon Mitre Data.No EPSS score available. Exploitation active. Automatable yes. Technical Impact total.", "is_search_result": true } ], "timestamp": "2026-05-07T19:20:24.300550" }, "cache_timestamp": "2026-05-07T19:20:47.162206", "displayed_on_website": true }, { "cve_id": "CVE-2026-0257", "cvss_score": "7.8", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2026-05-13T18:15:10.172Z", "cve_published_date_formatted": "2026-05-13", "kev_date_added": "2026-05-29", "kev_date_added_formatted": "2026-05-29", "kev_due_date": "2026-06-01", "days_to_kev": 16, "days_since_kev": 6, "is_new_kev": false, "summary": "Authentication bypass vulnerability in GlobalProtect portal/gateway components of Palo Alto Networks PAN-OS allows remote attackers to establish unauthorized VPN connections. Active exploitation confirmed with public PoC available.", "detailed_analysis": { "vulnerability_type": "Authentication bypass due to reliance on cookies without validation and integrity checking (CWE-565)", "affected_products": [ "PAN-OS", "Prisma Access" ], "exploitation_requirements": [ "Network connectivity to GlobalProtect portal/gateway", "Authentication override cookies enabled on target", "Specific certificate configuration present" ], "internet_facing_likelihood": "GlobalProtect portal and gateway components are designed to be internet-facing services that provide VPN access to remote users. These services must be accessible from the internet by design to allow employees to connect from anywhere. Estimated 95%+ of GlobalProtect deployments are internet-facing as this is their primary use case.", "typical_deployment": "Enterprise VPN infrastructure - GlobalProtect portal and gateway are server-side components that authenticate users and provide VPN tunnel endpoints for remote access", "deployment_statistics": "95%+ internet-facing - GlobalProtect is specifically designed for remote access VPN, requiring internet exposure to serve remote users connecting from various locations", "active_exploitation": "Confirmed active exploitation in the wild with 'limited exploit attempts' observed by Palo Alto Networks. Public proof-of-concept exploits are available. Added to CISA KEV catalog.", "severity_factors": [ "No authentication required for exploitation", "Direct network access to VPN infrastructure", "Bypasses primary security control (authentication)", "Widely deployed enterprise VPN solution", "Active exploitation confirmed" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review VPN logs for unauthorized connections, check for suspicious authentication patterns, verify user session legitimacy", "Immediately apply vendor patches per upgrade matrix or implement workarounds (disable authentication override cookies or use dedicated certificates)", "Monitor GlobalProtect logs for unusual connection patterns, failed authentication attempts, or connections from unexpected geographic locations", "Patch priority: CRITICAL - Apply immediately due to confirmed exploitation and internet-facing exposure" ], "risk_assessment": { "exploit_likelihood": "Very High - Active exploitation confirmed, public PoCs available, and vulnerability affects internet-facing VPN infrastructure that is a high-value target", "impact_assessment": "High - Unauthorized VPN access can lead to network lateral movement, data exfiltration, and compromise of internal systems", "exposure_scope": "Large - GlobalProtect is widely deployed in enterprise environments, with most installations internet-facing by design" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "CVE-2026-0257 is a medium-severity authentication bypass vulnerability affecting the GlobalProtect portal and gateway in Palo Alto Networks PAN-OS software and Prisma Access 【1】 【3】.\n\nHere is the current status of the vulnerability based on available information:\n\n### **Exploitation and Impact**\n* **Active Exploitation:** There is confirmed evidence of active exploitation in the wild 【2】 【4】. Palo Alto Networks has acknowledged \"limited exploit attempts\" on unpatched devices that do not have specific mitigations applied 【1】.\n* **Internet-Facing Exposure:** The vulnerability affects the GlobalProtect portal and gateway, which are typically internet-facing components used for VPN access 【1】.\n* **Attack Vectors:** A remote, unauthenticated attacker can exploit this vulnerability to bypass security restrictions and establish an unauthorized VPN connection to the affected network 【1】 【3】.\n* **Technical Details:** The vulnerability is classified as CWE-565 (Use of Insecure or Untrusted Control Flow) 【3】. It requires a specific configuration to be present on the target device to be exploitable 【2】. Publicly available proof-of-concept (PoC) scripts exist for testing purposes 【4】.\n* **Targeted Attacks:** While active exploitation has been observed, there is currently no specific public reporting detailing its use in advanced, targeted campaigns (e.g., by specific APT groups).\n\n### **CISA KEV Status**\nAs of May 30, 2026, CVE-2026-0257 is not explicitly highlighted in the provided search results as being added to the CISA Known Exploited Vulnerabilities (KEV) catalog, though it is actively being exploited in the wild. Organizations should consult the official [CISA KEV Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) for the most up-to-date status.\n\n### **Recommendations**\n* **Patching/Mitigation:** Palo Alto Networks has released security advisories and guidance for this vulnerability. Organizations using PAN-OS or Prisma Access should verify their exposure and apply the recommended patches or mitigations provided by the vendor 【1】.\n* **Assessment:** Security teams can use authenticated vulnerability scanners (such as those provided by Rapid7) to assess whether their specific device configurations are susceptible to this vulnerability 【2】.\n\nSources:\n- CVE-2026-0257 PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities: https://security.paloaltonetworks.com/CVE-2026-0257\n- Rapid7 Observed Exploitation of PAN-OS GlobalProtect ...: https://www.rapid7.com/blog/post/etr-rapid7-observed-exploitation-of-pan-os-globalprotect-authentication-bypass-vulnerability-cve-2026-0257/\n- CVE-2026-0257 - Vulnerability Details - OpenCVE: https://app.opencve.io/cve/CVE-2026-0257\n- CVE-2026-0257 - Exploits & Severity - Feedly: https://feedly.com/cve/CVE-2026-0257", "references": [ { "title": "CVE-2026-0257 PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities", "url": "https://security.paloaltonetworks.com/CVE-2026-0257", "citation_contribution": 923, "snippet": "Palo Alto Networks Security Advisory: CVE-2026-0257 PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection. Panorama and Cloud NGFW are not impacted by these issues. ... Palo Alto Networks has become aware of limited exploit attempts on unpatched PAN-OS devices without mitigations applied. Weakness Type and ... Palo Alto Networks Security Advisory: CVE-2026-0257 PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection. Panorama and Cloud NGFW are not impacted by these issues.", "is_search_result": true }, { "title": "Rapid7 Observed Exploitation of PAN-OS GlobalProtect ...", "url": "https://www.rapid7.com/blog/post/etr-rapid7-observed-exploitation-of-pan-os-globalprotect-authentication-bypass-vulnerability-cve-2026-0257/", "citation_contribution": 390, "snippet": "Rapid7 MDR has observed active exploitation of PAN-OS GlobalProtect Authentication Bypass Vulnerability CVE-2026-0257. ... Vulnerabilities and Exploits. Rapid7 Observed Exploitation of PAN-OS GlobalProtect Authentication Bypass Vulnerability (CVE-2026-0257).Exposure Command, InsightVM, and Nexpose customers can assess exposure to CVE-2026-0257 using an authenticated check available since the May 15 content release. Known Indicators of Compromise. ... Overview On May 13, 2026, Palo Alto Networks published a security advisory for CVE-2026-0257, a medium severity authentication bypass affecting PAN-OS and Prisma Access when a specific configuration is present. Successful exploitation of this vulnerability allows a remote unauthenticated attacker to successfully establish a VPN connection through the GlobalProtect gateway of an affected ...", "is_search_result": true }, { "title": "CVE-2026-0257 - Vulnerability Details - OpenCVE", "url": "https://app.opencve.io/cve/CVE-2026-0257", "citation_contribution": 114, "snippet": "Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection. Panorama and Cloud NGFW are not impacted by these issues. ... CVE-2026-0257 - PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities.AI Analysis. Impact. Authentication bypass vulnerabilities in Palo Alto Networks GlobalProtect portal and gateway allow an attacker to bypass VPN authentication requirements and establish an unauthorized VPN connection, compromising confidentiality and accessibility of the protected network. The weakness is classified as CWE‑565 (Use of Insecure or Untrusted Control Flow).", "is_search_result": true }, { "title": "CVE-2026-0257 - Exploits & Severity - Feedly", "url": "https://feedly.com/cve/CVE-2026-0257", "citation_contribution": 77, "snippet": "Threat Intelligence Report CVE-2026-0257 is a medium severity authentication bypass vulnerability in PAN-OS and Prisma Access, allowing remote unauthenticated attackers to establish VPN connections via the GlobalProtect gateway under specific configurations. Rapid7 MDR confirmed exploitation of this vulnerability in the wild, with a publicly available proof-of-concept script developed to test ...", "is_search_result": true } ], "timestamp": "2026-05-30T19:25:07.658947" }, "cache_timestamp": "2026-05-30T19:25:26.787455", "displayed_on_website": true }, { "cve_id": "CVE-2025-9377", "cvss_score": "8.6", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2025-08-29T17:30:33.700Z", "cve_published_date_formatted": "2025-08-29", "kev_date_added": "2025-09-03", "kev_date_added_formatted": "2025-09-03", "kev_due_date": "2025-09-24", "days_to_kev": 5, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2025-9377 is an authenticated remote command execution vulnerability in TP-Link router web interfaces that allows network-based exploitation of internet-facing devices. CISA has confirmed active exploitation and added it to the KEV catalog.", "detailed_analysis": { "vulnerability_type": "Authenticated Remote Command Execution (RCE) via OS Command Injection in web interface", "affected_products": [ "TP-Link Systems Inc. Archer C7(EU) V2", "TP-Link Systems Inc. TL-WR841N/ND(MS) V9" ], "exploitation_requirements": [ "Network access to router web interface", "Authentication to router admin panel", "Access to Parental Control page functionality" ], "internet_facing_likelihood": "Consumer and small business routers are inherently internet-facing network infrastructure devices. Approximately 90-95% of these devices have their web management interfaces accessible from the WAN side either by default configuration, UPnP exposure, or intentional remote management setup. Even when not directly exposed, they process internet traffic and often have exploitable attack surfaces.", "typical_deployment": "These are network infrastructure devices (routers) that sit at the network perimeter and handle internet connectivity. They run embedded Linux with web-based management interfaces that are commonly accessible from both LAN and WAN sides.", "deployment_statistics": "Estimated 85-95% of deployments are effectively internet-facing due to: default remote management enabled, UPnP automatic port forwarding, NAT traversal techniques, and users enabling remote access for convenience. Home and small office routers are primary targets for botnet recruitment.", "active_exploitation": "CISA has confirmed active exploitation in the wild and added CVE-2025-9377 to the Known Exploited Vulnerabilities catalog. The vulnerability is being used in botnet campaigns targeting these EOL router models.", "severity_factors": [ "CISA KEV listing indicates active exploitation", "Network attack vector enables remote exploitation", "High CVSS score of 8.6", "Affects EOL products with no security updates", "Command injection leads to full device compromise", "Router compromise enables network pivoting and botnet recruitment" ] }, "recommendations": [ "CRITICAL: Replace EOL routers immediately as no patches will be provided", "If replacement not possible, disable remote management and WAN access to admin interface", "Monitor network traffic for unusual router behavior and botnet communication patterns", "Change default credentials and enable strongest available authentication" ], "risk_assessment": { "exploit_likelihood": "Very High - Active exploitation confirmed by CISA, network-accessible attack vector, and common deployment of vulnerable EOL devices with weak security postures", "impact_assessment": "High - Full device compromise enables network reconnaissance, traffic interception, botnet recruitment, and lateral movement to connected devices", "exposure_scope": "Large - Millions of consumer and small business deployments of these popular EOL router models remain internet-accessible and unpatched" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "Here's what is known about the CVE-2025-9377 vulnerability exploitation:\n\n- **Affected Applications/Services:** The vulnerability affects **TP-Link Archer C7 (EU) V2 and TL-WR841N/ND (MS) routers**, which are internet-facing devices 【1】【2】.\n\n- **Active Exploitation:** **CISA has confirmed active exploitation** of CVE-2025-9377 in the wild and has added it to its Known Exploited Vulnerabilities (KEV) catalog 【3】【4】.\n\n- **Attack Vectors and Exploitation Methods:** It is an **authenticated remote command execution (RCE) vulnerability** found in the Parental Control page 【1】【5】. Exploitation allows attackers to **execute arbitrary commands remotely**, gaining control over the affected device 【1】【5】.\n\n- **Targeted Attacks:** While actively exploited, the provided information does not explicitly confirm its use in *targeted* attacks 【2】, though it is associated with botnet activity 【5】.\n\n- **CISA KEV Status:** CVE-2025-9377 is listed in the **CISA KEV catalog**, with a deadline for remediation by **September 24, 2025** 【3】.\n\n- **Technical Details (Internet Exploitability):** The vulnerability has a **network attack vector** and requires **high privileges (authentication) for exploitation** 【6】.\n\nSources:\n- CVE-2025-9377 - CVE Details & Analysis | SOCRadar Labs CVE Radar: https://socradar.io/labs/app/cve-radar/cve-2025-9377\n- CVE-2025-9377 Detail - NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-9377\n- CISA Flags TP-Link Router Flaws CVE-2023-50224 and CVE-2025 ...: https://thehackernews.com/2025/09/cisa-flags-tp-link-router-flaws-cve.html\n- CISA Warns: TP-Link Vulnerabilities Under Active Exploitation: https://gbhackers.com/cisa-warns-tp-link-vulnerabilities/\n- TP-Link warns of botnet infecting routers and targeting Microsoft 365 ...: https://www.malwarebytes.com/blog/news/2025/09/tp-link-warns-of-botnet-infecting-routers-and-targeting-microsoft-365-accounts", "references": [ { "title": "CVE-2025-9377 - CVE Details & Analysis | SOCRadar Labs CVE Radar", "url": "https://socradar.io/labs/app/cve-radar/cve-2025-9377", "snippet": "Description CVE-2025-9377 is an authenticated remote command execution (RCE) vulnerability affecting the Parental Control page of TP-Link Archer C7 (EU) V2 and TL-WR841N/ND (MS) V9 routers. Successful exploitation allows an attacker to execute arbitrary commands remotely, gaining control over the affected device.", "is_search_result": true }, { "title": "CVE-2025-9377 Detail - NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9377", "snippet": "Description. The authenticated remote command execution (RCE) vulnerability exists in the Parental Control page on TP-Link Archer C7(EU) V2 ...", "is_search_result": true }, { "title": "CISA Flags TP-Link Router Flaws CVE-2023-50224 and CVE-2025 ...", "url": "https://thehackernews.com/2025/09/cisa-flags-tp-link-router-flaws-cve.html", "snippet": "CISA flags TP-Link flaws CVE-2023-50224 and CVE-2025-9377 as exploited, urging fixes by Sept 24, 2025.", "is_search_result": true }, { "title": "CISA Warns: TP-Link Vulnerabilities Under Active Exploitation", "url": "https://gbhackers.com/cisa-warns-tp-link-vulnerabilities/", "snippet": "CISA has issued an urgent warning regarding critical vulnerabilities in popular TP-Link router that are currently being actively exploited.", "is_search_result": true }, { "title": "TP-Link warns of botnet infecting routers and targeting Microsoft 365 ...", "url": "https://www.malwarebytes.com/blog/news/2025/09/tp-link-warns-of-botnet-infecting-routers-and-targeting-microsoft-365-accounts", "snippet": "CVE-2025-50224 is a vulnerability that allows an attacker to steal passwords from the router and CVE-2025-9377 is a known Parental Control ...", "is_search_result": true } ], "timestamp": "2025-09-06T17:14:57.725954" }, "cache_timestamp": "2025-09-06T17:15:22.534935", "displayed_on_website": false }, { "cve_id": "CVE-2025-9242", "cvss_score": "9.3", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2025-09-17T07:29:23.738Z", "cve_published_date_formatted": "2025-09-17", "kev_date_added": "2025-11-12", "kev_date_added_formatted": "2025-11-12", "kev_due_date": "2025-12-03", "days_to_kev": 56, "days_since_kev": null, "is_new_kev": false, "summary": "Critical out-of-bounds write vulnerability in WatchGuard Fireware OS affecting IKEv2 VPN services that allows unauthenticated remote code execution. This is actively exploited in the wild according to CISA KEV and affects security appliances that are inherently internet-facing by design.", "detailed_analysis": { "vulnerability_type": "Out-of-bounds Write (CWE-787) in IKEv2 VPN negotiation process allowing arbitrary code execution", "affected_products": [ "WatchGuard Firewall/Fireware OS" ], "exploitation_requirements": [ "Network access to IKEv2 service (typically UDP 500/4500)", "No authentication required", "Vulnerable configuration with dynamic gateway peer" ], "internet_facing_likelihood": "WatchGuard firewalls are security appliances specifically designed to be deployed at network perimeters as internet-facing gateways. The affected IKEv2 VPN functionality is commonly exposed to the internet to support remote access and site-to-site VPN connections. Estimated 90-95% of deployments have internet-facing exposure.", "typical_deployment": "Network security appliance deployed as perimeter firewall/VPN gateway with direct internet connectivity", "deployment_statistics": "Approximately 90-95% of WatchGuard firewall deployments are internet-facing as they serve as primary network security gateways. The affected IKEv2 VPN service is commonly exposed for remote access needs.", "active_exploitation": "CISA has added this CVE to the Known Exploited Vulnerabilities catalog, indicating confirmed active exploitation in the wild. Mass exploitation campaigns have been observed targeting this vulnerability.", "severity_factors": [ "No authentication required", "Remote code execution capability", "Affects critical security infrastructure", "Active exploitation confirmed", "High CVSS score of 9.3", "Targets internet-facing services" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately update to patched versions: 11.12.4_Update2 or later for 11.x, 12.11.4 or later for 12.x, 2025.1.1 or later for 2025.x", "Monitor IKEv2 VPN logs for suspicious connection attempts and unusual authentication patterns", "Consider temporarily disabling IKEv2 VPN if not critically needed until patching is complete", "HIGHEST patch priority - treat as emergency security update" ], "risk_assessment": { "exploit_likelihood": "VERY HIGH - Active exploitation confirmed by CISA KEV listing with mass exploitation campaigns targeting over 75,000 vulnerable devices. No authentication required and publicly available exploit code.", "impact_assessment": "CRITICAL - Complete system compromise possible through remote code execution on security infrastructure devices, potentially allowing bypass of all network security controls", "exposure_scope": "Extensive - WatchGuard firewalls are widely deployed as internet-facing security appliances, with an estimated 75,000+ vulnerable devices exposed to the internet" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "CVE-2025-9242 is a critical out-of-bounds write vulnerability affecting WatchGuard Fireware OS, specifically the `iked` process responsible for IKEv2 VPN negotiations 【1】【8】. This vulnerability allows for unauthenticated remote code execution 【11】【10】.\n\nHere's a breakdown of what is known about its exploitation:\n\n* **Internet-facing applications or services:** Yes, CVE-2025-9242 affects internet-facing applications and services 【4】.\n* **Active exploitation in the wild:** CISA has added CVE-2025-9242 to its Known Exploited Vulnerabilities Catalog, indicating active exploitation 【3】【5】.\n* **Attack vectors and exploitation methods:** The vulnerability can be exploited by sending specially crafted IKEv2 packets to vulnerable Firebox endpoints, forcing it to write data to unintended memory areas 【1】. This can be done without authentication 【6】.\n* **Targeted attacks:** While not explicitly stated, the addition to CISA's KEV catalog and the potential for remote code execution suggests it could be used in targeted attacks 【5】【2】.\n* **CISA Known Exploited Vulnerabilities (KEV) status:** CVE-2025-9242 is listed in CISA's KEV catalog 【3】【5】.\n* **Technical details about internet exploitability:** The vulnerability is an out-of-bounds write in the Fireware OS `iked` process, which handles IKEv2 VPN negotiations 【1】. It can be exploited without authentication by sending specially crafted IKEv2 packets to vulnerable Firebox endpoints 【1】【6】. This allows remote attackers to execute arbitrary code 【11】【12】. The CVSS score is 9.3, indicating critical severity 【1】【7】.\n\nThe vulnerability affects Fireware OS versions 11.10.2 up to and including 11.12.4\\_Update1, 12.0 up to and including 12.11.3, and 2025.1 【9】【7】.\n\nSources:\n- Over 75,000 WatchGuard security devices vulnerable to critical RCE: https://www.bleepingcomputer.com/news/security/over-75-000-watchguard-security-devices-vulnerable-to-critical-rce/\n- Alert CISA Adds Three Known Exploited Vulnerabilities to Catalog...: https://community.opentextcybersecurity.com/vulnerability-vault-228/alert-cisa-adds-three-known-exploited-vulnerabilities-to-catalog-release-date-november-12-2025-362621\n- CISA Adds Three Known Exploited Vulnerabilities to Catalog: https://www.cisa.gov/news-events/alerts/2025/11/12/cisa-adds-three-known-exploited-vulnerabilities-catalog\n- Cleopatra’s Shadow: A Mass Exploitation Campaign... - Arctic Wolf: https://arcticwolf.com/resources/blog/cleopatras-shadow-a-mass-exploitation-campaign/\n- Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "references": [ { "title": "Over 75,000 WatchGuard security devices vulnerable to critical RCE", "url": "https://www.bleepingcomputer.com/news/security/over-75-000-watchguard-security-devices-vulnerable-to-critical-rce/", "citation_contribution": 512, "snippet": "WatchGuard disclosed CVE-2025-9242 in a security bulletin on September 17 and rated the vulnerability with a critical-severity score of 9.3. The security problem is an out-of-bounds write in the Fireware OS ‘iked’ process, which handles IKEv2 VPN negotiations. The flaw can be exploited without authentication by sending specially crafted IKEv2 packets to vulnerable Firebox endpoints, forcing it to write data to unintended memory areas.", "is_search_result": true }, { "title": "Alert CISA Adds Three Known Exploited Vulnerabilities to Catalog...", "url": "https://community.opentextcybersecurity.com/vulnerability-vault-228/alert-cisa-adds-three-known-exploited-vulnerabilities-to-catalog-release-date-november-12-2025-362621", "citation_contribution": 159, "snippet": "CVE-2025-9242.These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise. Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the KEV Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise.", "is_search_result": true }, { "title": "CISA Adds Three Known Exploited Vulnerabilities to Catalog", "url": "https://www.cisa.gov/news-events/alerts/2025/11/12/cisa-adds-three-known-exploited-vulnerabilities-catalog", "citation_contribution": 146, "snippet": "CISA Adds Three Known Exploited Vulnerabilities to Catalog · CVE-2025-9242 WatchGuard Firebox Out-of-Bounds Write Vulnerability · CVE-2025-12480 ...", "is_search_result": true }, { "title": "Cleopatra’s Shadow: A Mass Exploitation Campaign... - Arctic Wolf", "url": "https://arcticwolf.com/resources/blog/cleopatras-shadow-a-mass-exploitation-campaign/", "citation_contribution": 119, "snippet": "September 17, 2025. CVE-2025-9242: Critical Unauthenticated Out-of-Bounds Write Vulnerability in WatchGuard Firebox.Additionally, devices should be continuously audited for potential weaknesses in internet-accessible services, and vulnerable services should be kept off the public internet where possible to minimize the potential exposure in mass exploitation campaigns such as this one. This can be accomplished by IP access control lists, or by keeping applications behind a VPN to reduce the potential attack surface.", "is_search_result": true }, { "title": "Known Exploited Vulnerabilities Catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "citation_contribution": 128, "snippet": "CVE-2025-9242. WatchGuard Firebox Out-of-Bounds Write Vulnerability ... Successful exploitation of this vulnerability could enable the attacker to gain SYSTEM- ...", "is_search_result": true } ], "timestamp": "2025-11-13T15:45:23.673580" }, "cache_timestamp": "2025-11-13T15:45:43.191840", "displayed_on_website": false }, { "cve_id": "CVE-2025-8876", "cvss_score": "9.4", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2025-08-14T14:53:55.176Z", "cve_published_date_formatted": "2025-08-14", "kev_date_added": "2025-08-13", "kev_date_added_formatted": "2025-08-13", "kev_due_date": "2025-08-20", "days_to_kev": -1, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2025-8876 is a critical OS command injection vulnerability in N-able N-central RMM platform that allows authenticated attackers to execute arbitrary commands. CISA has confirmed active exploitation in the wild, and the vulnerability affects internet-facing management platforms used by MSPs.", "detailed_analysis": { "vulnerability_type": "OS Command Injection due to improper input validation (CWE-20), enabling attackers to execute arbitrary system commands", "affected_products": [ "N-able N-central before version 2025.3.1" ], "exploitation_requirements": [ "Low privilege authentication required", "Network access to N-central instance", "No user interaction needed" ], "internet_facing_likelihood": "N-able N-central is a Remote Monitoring and Management (RMM) platform specifically designed for Managed Service Providers (MSPs) to remotely manage client endpoints and infrastructure. By design, these platforms must be accessible over the internet to fulfill their core function of remote management. Approximately 85-95% of N-central deployments are internet-facing as MSPs need to access the platform from various locations and manage distributed client environments.", "typical_deployment": "N-central is server software that runs as a centralized management platform, typically deployed in data centers or cloud environments with web-based interfaces accessible over the internet", "deployment_statistics": "Estimated 85-95% of deployments are internet-facing because MSPs require remote access to manage clients across multiple locations, making internet accessibility essential for business operations", "active_exploitation": "CISA has confirmed active exploitation in the wild and added this vulnerability to the Known Exploited Vulnerabilities Catalog on the same day patches were released", "severity_factors": [ "Critical CVSS score of 9.4", "Command injection allows full system compromise", "Active exploitation confirmed by CISA", "Affects MSP infrastructure with cascading impact potential", "Low attack complexity", "No user interaction required" ] }, "recommendations": [ "Immediately update N-central to version 2025.3.1 or later", "Implement network segmentation to limit access to N-central instances", "Monitor for suspicious command execution and unauthorized access attempts", "Review authentication logs for compromise indicators", "Consider this a CRITICAL patch priority due to active exploitation" ], "risk_assessment": { "exploit_likelihood": "Very High - CISA confirmed active exploitation, low attack complexity, and the platform is designed to be internet-accessible", "impact_assessment": "Critical impact - successful exploitation grants attackers command execution capabilities on the management platform, potentially leading to full system compromise and access to managed client environments", "exposure_scope": "Hundreds of internet-facing N-central instances globally, with cascading impact to MSP clients and their managed infrastructure" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "Here's what is known about the CVE-2025-8876 vulnerability:\n\n* **Affected Applications/Services**: CVE-2025-8876 affects **N-able N-central**, a remote monitoring and management (RMM) platform 【1】. It is likely to affect internet-facing instances 【2】.\n* **Active Exploitation**: CISA reported awareness of active exploitation of CVE-2025-8876 in N-able N-central on the same day the patches were released 【3】【4】.\n* **Attack Vectors/Exploitation Methods**:\n * CVE-2025-8876 is a **command injection vulnerability** 【5】.\n * It stems from **improper input validation** 【6】【7】 and can be exploited by authenticated attackers 【6】.\n * Successful exploitation allows attackers to **inject and execute commands** on unpatched devices 【6】.\n* **Targeted Attacks:** There is no explicit mention of \"targeted attacks\" specifically for CVE-2025-8876 【8】.\n* **CISA KEV Status**: CVE-2025-8876 is listed in **CISA's Known Exploited Vulnerabilities Catalog** 【8】【9】.\n* **Technical Details**: The vulnerability is due to **improper input sanitization** and **insecure deserialization** 【6】. Exploitation requires authenticated access 【6】.\n\nSources:\n- Vulnerabilities in MSP-friendly RMM solution: https://www.helpnetsecurity.com/2025/08/14/vulnerabilities-in-msp-friendly-rmm-solution-exploited-in-the-wild-cve-2025-8875-cve-2025-8876/\n- Critical flaw gives attackers control of vulnerable: https://www.helpnetsecurity.com/2020/07/14/cve-2020-6287/\n- CISA Warns of Attacks Exploiting N-able Vulnerabilities: https://www.securityweek.com/cisa-warns-of-attacks-exploiting-n-able-vulnerabilities/\n- Vulnerabilities Archives - SecurityWeek: https://www.securityweek.com/category/vulnerabilities/\n- Hundreds of N-able N-central Instances Affected by Exploited...: https://www.securityweek.com/hundreds-of-n-able-n-central-instances-affected-by-exploited-vulnerabilities/", "references": [ { "title": "Vulnerabilities in MSP-friendly RMM solution", "url": "https://www.helpnetsecurity.com/2025/08/14/vulnerabilities-in-msp-friendly-rmm-solution-exploited-in-the-wild-cve-2025-8875-cve-2025-8876/", "snippet": "Two vulnerabilities (CVE-2025-8875, CVE-2025-8876) in the N-able N-central RMM platform are being exploited by attackers, according to CISA.", "is_search_result": true }, { "title": "Critical flaw gives attackers control of vulnerable", "url": "https://www.helpnetsecurity.com/2020/07/14/cve-2020-6287/", "snippet": "... prioritize patching internet-facing systems ... Vulnerabilities in MSP-friendly RMM solution exploited in the wild (CVE-2025-8875, CVE-2025-8876)", "is_search_result": true }, { "title": "CISA Warns of Attacks Exploiting N-able Vulnerabilities", "url": "https://www.securityweek.com/cisa-warns-of-attacks-exploiting-n-able-vulnerabilities/", "snippet": "CISA reported becoming aware of attacks exploiting CVE-2025-8875 and CVE-2025-8876 in N-able N-central on the day they were patched.", "is_search_result": true }, { "title": "Vulnerabilities Archives - SecurityWeek", "url": "https://www.securityweek.com/category/vulnerabilities/", "snippet": "Vulnerabilities. Apple Patches Zero-Day Exploited in Targeted Attacks.CISA reported becoming aware of attacks exploiting CVE-2025-8875 and CVE-2025-8876 in N-able N-central on the day they were patched.", "is_search_result": true }, { "title": "Hundreds of N-able N-central Instances Affected by Exploited...", "url": "https://www.securityweek.com/hundreds-of-n-able-n-central-instances-affected-by-exploited-vulnerabilities/", "snippet": "The security defects, tracked as CVE-2025-8875 and CVE-2025-8876, are described as an insecure deserialization issue and a command injection bug, respectively. The flaws were disclosed on August 13, when N-able announced that patches for them were included in version 2025.3 of its...", "is_search_result": true } ], "timestamp": "2025-09-06T17:17:28.791021" }, "cache_timestamp": "2025-09-06T17:17:44.000196", "displayed_on_website": false }, { "cve_id": "CVE-2025-8875", "cvss_score": "9.4", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2025-08-14T14:56:11.884Z", "cve_published_date_formatted": "2025-08-14", "kev_date_added": "2025-08-13", "kev_date_added_formatted": "2025-08-13", "kev_due_date": "2025-08-20", "days_to_kev": -1, "days_since_kev": null, "is_new_kev": false, "summary": "Critical deserialization vulnerability in N-able N-central allows remote code execution with low privileges over network. This is actively exploited according to CISA KEV listing. N-central is commonly deployed as an internet-facing server for MSP remote management services.", "detailed_analysis": { "vulnerability_type": "Deserialization of Untrusted Data (CWE-502) leading to Local Execution of Code", "affected_products": [ "N-able N-central" ], "exploitation_requirements": [ "Network access to N-central server", "Low privileges required", "No user interaction needed" ], "internet_facing_likelihood": "N-able N-central is a managed service provider (MSP) platform designed for remote monitoring and management of client systems. By its core business purpose, it requires internet connectivity to manage distributed client environments. Estimated 70-80% of N-central deployments are internet-facing as MSPs need to provide services to clients across different networks and locations.", "typical_deployment": "N-central is server software deployed as a centralized management platform for MSPs to monitor and manage multiple client environments remotely", "deployment_statistics": "Approximately 70-80% of N-central deployments are likely internet-facing, as the software's primary function is remote management of distributed client systems for MSP business models", "active_exploitation": "Listed in CISA KEV catalog on 2025-08-13, indicating confirmed active exploitation in the wild", "severity_factors": [ "Critical CVSS 9.4 score", "Network-based attack vector", "Low attack complexity", "No user interaction required", "High impact on confidentiality, integrity, and availability", "Active exploitation confirmed by CISA" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "IMMEDIATE: Update N-able N-central to version 2025.3.1 or later immediately", "URGENT: Review all N-central server logs for suspicious activity or unauthorized access attempts", "Consider temporarily restricting network access to N-central servers until patching is complete", "Monitor for any unusual network traffic or system behavior on N-central infrastructure", "Verify integrity of managed client systems that may have been compromised through N-central" ], "risk_assessment": { "exploit_likelihood": "Very High - Active exploitation confirmed by CISA KEV listing, network-based attack vector with low complexity and minimal privileges required", "impact_assessment": "Critical - Remote code execution on MSP management platform could lead to compromise of numerous managed client environments", "exposure_scope": "Significant - N-central is widely used by MSPs globally, with majority of deployments being internet-facing for remote client management" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:11:08.260931", "displayed_on_website": false }, { "cve_id": "CVE-2025-8110", "cvss_score": "8.7", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2025-12-10T13:23:46.777Z", "cve_published_date_formatted": "2025-12-10", "kev_date_added": "2026-01-12", "kev_date_added_formatted": "2026-01-12", "kev_due_date": "2026-02-02", "days_to_kev": 33, "days_since_kev": null, "is_new_kev": false, "summary": "Critical RCE vulnerability in Gogs Git service allows authenticated users to achieve remote code execution via symbolic link bypass in the PutContents API. Over 700 internet-facing instances have been compromised with active exploitation ongoing.", "detailed_analysis": { "vulnerability_type": "Improper symbolic link handling leading to path traversal and remote code execution", "affected_products": [ "Gogs (self-hosted Git service) versions 0 through 0.13.3" ], "exploitation_requirements": [ "Low-privileged authentication", "Network access to Gogs instance", "Access to PutContents API" ], "internet_facing_likelihood": "HIGH - Gogs is a self-hosted Git service specifically designed to be accessed over networks. The primary purpose is to provide Git repository hosting similar to GitHub/GitLab, which inherently requires network accessibility for users to clone, push, and manage repositories. Research shows over 700 compromised internet-facing instances, indicating widespread internet deployment.", "typical_deployment": "Gogs is server software designed to run as a web service, typically listening on ports 80/443 or custom ports like 3000. Organizations deploy it to provide internal and external Git repository hosting.", "deployment_statistics": "Estimated 70-80% of Gogs deployments are internet-facing, as the software's primary value proposition is providing accessible Git hosting. While some organizations may run it internally only, the collaborative nature of Git development typically requires external access for remote developers, contractors, and open source projects.", "active_exploitation": "CONFIRMED - Added to CISA KEV catalog January 12, 2026. Wiz Research identified over 700 compromised internet-facing instances as of December 2025. CVSS indicates 'ATTACKED' exploitation maturity.", "severity_factors": [ "Remote code execution capability", "Low attack complexity", "No user interaction required", "Automatable exploitation", "Bypass of previous security fix (CVE-2024-55947)", "Widespread internet deployment", "Active exploitation in the wild" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "IMMEDIATE: Update to Gogs version 0.13.4 or later once available, or apply the patch from commit 553707f3fd5f68f47f531cfcff56aa3ec294c6f6", "URGENT: If patching is not immediately possible, consider temporarily restricting access to Gogs instances or taking them offline until patched", "Monitor for unusual file modifications, unexpected processes, or unauthorized access attempts in Gogs logs", "Review user accounts and permissions for any unauthorized changes or privilege escalations", "Patch priority: CRITICAL - Treat as emergency patching due to active exploitation and RCE impact" ], "risk_assessment": { "exploit_likelihood": "VERY HIGH - Active exploitation confirmed with over 700 compromised instances. The vulnerability is automatable with low complexity and requires only low-privileged authentication.", "impact_assessment": "CRITICAL - Full remote code execution allows complete system compromise including data theft, system manipulation, and potential lateral movement within networks.", "exposure_scope": "HIGH - Thousands of internet-facing Gogs instances globally, particularly affecting organizations using self-hosted Git services for software development and code collaboration." }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "**CVE-2025-8110** is a critical vulnerability affecting **Gogs**, a self-hosted Git service written in Go. The vulnerability has been actively exploited in the wild, leading to its inclusion in the **CISA Known Exploited Vulnerabilities (KEV) catalog** on January 12, 2026.\n\nHere's a breakdown of what is known about its exploitation:\n\n* **Internet-Facing Applications/Services:** The vulnerability primarily affects **internet-facing Gogs instances**. Wiz research identified over 700 compromised instances publicly accessible on the internet as of December 1, 2025. 【1】\n\n* **Evidence of Active Exploitation:** **Active exploitation is ongoing**, with reports indicating that over 700 Gogs instances have been compromised. 【1】【4】 CISA's addition of CVE-2025-8110 to its KEV catalog on January 12, 2026, further confirms real-world exploitation. 【2】\n\n* **Attack Vectors and Exploitation Methods:** The vulnerability stems from an **improper handling of symbolic links in Gogs' PutContents API**. 【3】 This flaw allows **authenticated users** to overwrite files outside of a repository, directly leading to **Remote Code Execution (RCE)**. 【1】【3】 It functions as a bypass for a previously patched RCE vulnerability, CVE-2024-55947, where the fix did not account for symbolic links within Git repositories. 【7】【8】\n\n* **Targeted Attacks:** While specific threat actors and attack methodologies are not fully disclosed, the active exploitation status indicates that this vulnerability is being used in real-world attacks, moving beyond theoretical concerns. 【2】\n\n* **CISA Known Exploited Vulnerabilities Status:** **CVE-2025-8110 has been added to the CISA Known Exploited Vulnerabilities (KEV) catalog** on January 12, 2026. 【5】\n\n* **Technical Details about Internet Exploitability:** The vulnerability allows authenticated users to achieve RCE by exploiting a symlink bypass in the file update API. 【1】【6】 This enables them to overwrite files outside the intended repository, making it a significant threat to internet-facing Gogs installations. 【1】 The vulnerability has a CVSS v4.0 score of 8.7. 【3】 A patch for this specific vulnerability was not immediately available as of December 2025, though a fix was reportedly in the works. 【1】【4】\n\nSources:\n- Gogs Zero-Day RCE (CVE-2025-8110) Actively Exploited | Wiz Blog: https://www.wiz.io/blog/wiz-research-gogs-cve-2025-8110-rce-exploit\n- CISA Warns of Actively Exploited Gogs Path Traversal Vulnerability: https://cyberpress.org/cisa-gogs-vulnerability/\n- CISA Flags Actively Exploited Gogs Vulnerability With No Patch: https://www.infosecurity-magazine.com/news/cisa-flags-exploited-gogs-flaw-no/\n- Unpatched Gogs Zero-Day Exploited Across 700+ Instances Amid Active Attacks: https://thehackernews.com/2025/12/unpatched-gogs-zero-day-exploited.html\n- CISA Adds One Known Exploited Vulnerability to Catalog: https://www.cisa.gov/news-events/alerts/2026/01/12/cisa-adds-one-known-exploited-vulnerability-catalog", "references": [ { "title": "Gogs Zero-Day RCE (CVE-2025-8110) Actively Exploited | Wiz Blog", "url": "https://www.wiz.io/blog/wiz-research-gogs-cve-2025-8110-rce-exploit", "citation_contribution": 501, "snippet": "A symlink bypass (CVE-2025-8110) of a previously patched RCE (CVE-2024-55947) allows authenticated users to overwrite files outside the repository, leading to Remote Code Execution (RCE). We identified over 700 compromised instances public-facing on the internet. As of December 1, 2025, active exploitation is ongoing, and a patch is not yet available.", "is_search_result": true }, { "title": "CISA Warns of Actively Exploited Gogs Path Traversal Vulnerability", "url": "https://cyberpress.org/cisa-gogs-vulnerability/", "citation_contribution": 359, "snippet": "Active Exploitation and CISA’s Response CISA’s inclusion of CVE-2025-8110 in its KEV catalog on January 12, 2026, signals that real-world exploitation is already underway. While the specific threat actors and attack methodologies remain undisclosed, the active exploitation status elevates this vulnerability beyond theoretical concern.", "is_search_result": true }, { "title": "CISA Flags Actively Exploited Gogs Vulnerability With No Patch", "url": "https://www.infosecurity-magazine.com/news/cisa-flags-exploited-gogs-flaw-no/", "citation_contribution": 284, "snippet": "Tracked as CVE-2025-8110 and rated 8.7 on the CVSS v4.0 scale, the vulnerability stems from improper handling of symbolic links in Gogs’ PutContents API. The flaw allows authenticated users to overwrite files outside a repository, which can lead directly to remote code execution (RCE). Exploitation at Scale", "is_search_result": true }, { "title": "Unpatched Gogs Zero-Day Exploited Across 700+ Instances Amid Active Attacks", "url": "https://thehackernews.com/2025/12/unpatched-gogs-zero-day-exploited.html", "citation_contribution": 235, "snippet": "A high-severity unpatched security vulnerability in Gogs has come under active exploitation, with more than 700 compromised instances accessible over the internet, according to new findings from Wiz. The flaw, tracked as CVE-2025-8110 (CVSS score: 8.7), is a case of file overwrite in the file update API of the Go-based self-hosted Git service. A fix for the issue is said to be currently in the works. The company said it accidentally discovered the zero-day flaw in July 2025 while investigating a malware infection on a customer's machine.", "is_search_result": true }, { "title": "CISA Adds One Known Exploited Vulnerability to Catalog", "url": "https://www.cisa.gov/news-events/alerts/2026/01/12/cisa-adds-one-known-exploited-vulnerability-catalog", "citation_contribution": 165, "snippet": "This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise. Binding ...", "is_search_result": true } ], "timestamp": "2026-01-13T18:50:16.104843" }, "cache_timestamp": "2026-01-13T18:50:37.905207", "displayed_on_website": false }, { "cve_id": "CVE-2025-8088", "cvss_score": "8.4", "attack_vector": "LOCAL", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1203", "deployment_likelihood": "VERY_LOW", "cve_published_date": "2025-08-08T11:11:41.842Z", "cve_published_date_formatted": "2025-08-08", "kev_date_added": "2025-08-12", "kev_date_added_formatted": "2025-08-12", "kev_due_date": "2025-09-02", "days_to_kev": 4, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2025-8088 is a path traversal vulnerability in WinRAR that allows arbitrary code execution through malicious archive files. This requires user interaction to open/extract crafted archives and is not directly exploitable over the internet against public-facing services.", "detailed_analysis": { "vulnerability_type": "Path traversal vulnerability (CWE-35) allowing arbitrary code execution through malicious archive extraction", "affected_products": [ "win.rar GmbH WinRAR (Windows versions up to 7.12)" ], "exploitation_requirements": [ "User must open/extract a malicious RAR archive", "Local file system access", "Active user interaction required" ], "internet_facing_likelihood": "WinRAR is a desktop client application for archive management. It is not designed as server software and has virtually no legitimate business use cases for internet exposure. Estimated <0.1% of deployments would be internet-accessible, and such deployments would be against security best practices.", "typical_deployment": "WinRAR is exclusively client-side desktop software used by end users to create, extract, and manage compressed archives. It operates as a local application with a GUI interface and file association handlers.", "deployment_statistics": "Approximately 99.9% of WinRAR deployments are on end-user workstations with no network listening services. The software's primary function is local file compression/decompression and does not require or provide network connectivity.", "active_exploitation": "Actively exploited in the wild as a zero-day by RomCom threat actors through phishing campaigns targeting financial, manufacturing, defense, and logistics companies in Europe and Canada", "severity_factors": [ "High CVSS score of 8.4", "Active exploitation in targeted attacks", "CISA KEV listing", "Requires user interaction (reduces direct internet risk)", "Client-side application (not server-facing)", "Path traversal with code execution capability" ] }, "recommendations": [ "Immediately update WinRAR to version 7.13 or later", "Implement email security controls to block malicious RAR attachments", "User awareness training about opening untrusted archive files", "Monitor for suspicious file extractions to system directories" ], "risk_assessment": { "exploit_likelihood": "Very low for direct internet exploitation as WinRAR is client software requiring user interaction to process malicious archives", "impact_assessment": "High impact if successfully exploited (arbitrary code execution, system compromise) but requires social engineering delivery", "exposure_scope": "Minimal internet-facing exposure as WinRAR is not designed for server deployment; primary risk is through phishing/email delivery" }, "exploitation_method": "USER_INTERACTION", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "Here's a breakdown of the CVE-2025-8088 vulnerability exploitation:\n\n* **Affected Applications/Services:**\n\n * The vulnerability affects the Windows version of **WinRAR** (versions up to 7.12) and related tools like **UnRAR.dll** 【1】【2】.\n\n* **Active Exploitation:**\n\n * **CVE-2025-8088** has been actively exploited as a **zero-day** vulnerability 【3】【4】. It was discovered in mid-July 2025 and has been exploited in the wild 【5】【6】.\n\n* **Attack Vectors and Exploitation Methods:**\n\n * The primary attack vector involves **social engineering and phishing attacks** 【7】【4】.\n * Attackers create **specially crafted RAR archives** that, when extracted, write malicious files to arbitrary locations on the system 【8】【9】.\n * This path traversal vulnerability allows writing files to sensitive directories, including the **Windows Startup folder**, leading to arbitrary code execution 【7】【10】.\n * The vulnerability can be exploited using **NTFS Alternate Data Streams** 【11】.\n\n* **Targeted Attacks:**\n\n * The Russian hacking group **RomCom** has exploited this vulnerability in **targeted attacks** 【3】【4】.\n * These attacks have targeted **financial, manufacturing, defense, and logistics companies** in Europe and Canada 【12】【13】.\n\n* **CISA KEV Status:**\n\n * **CISA has added CVE-2025-8088 to its Known Exploited Vulnerabilities (KEV) catalog** 【14】【15】.\n\n* **Technical Details/Internet Exploitability:**\n\n * **CVE-2025-8088** is a **path traversal vulnerability** 【1】【2】.\n * It allows attackers to **execute arbitrary code** by crafting malicious archive files 【9】【16】.\n * The vulnerability has a CVSS score of 8.4, indicating high risk 【1】【2】.\n * Proof-of-concept (PoC) exploits are available 【1】【8】.\n * Successful exploitation allows unauthorized attackers to copy malicious files into sensitive directories, such as the Windows Startup folder 【7】.\n\nSources:\n- GitHub - sxyrxyy/CVE-2025-8088-WinRAR-Proof...: https://github.com/sxyrxyy/CVE-2025-8088-WinRAR-Proof-of-Concept-PoC-Exploit-\n- Our Blog - Greenbone: https://www.greenbone.net/en/blog/\n- Details emerge on WinRAR zero-day attacks that ... - BleepingComputer: https://www.bleepingcomputer.com/news/security/details-emerge-on-winrar-zero-day-attacks-that-infected-pcs-with-malware/\n- WinRAR zero-day exploited to plant malware on archive extraction: https://www.bleepingcomputer.com/news/security/winrar-zero-day-flaw-exploited-by-romcom-hackers-in-phishing-attacks/\n- A path traversal vulnerability affecting the Windows...: https://github.com/advisories/GHSA-832g-3rcm-wcrf", "references": [ { "title": "GitHub - sxyrxyy/CVE-2025-8088-WinRAR-Proof...", "url": "https://github.com/sxyrxyy/CVE-2025-8088-WinRAR-Proof-of-Concept-PoC-Exploit-", "snippet": "CVE-2025-8088 WinRAR Proof of Concept (PoC-Exploit).This repository contains a Proof of Concept (PoC) script for CVE-2025-8088, a path traversal vulnerability in WinRAR versions up to 7.12.", "is_search_result": true }, { "title": "Our Blog - Greenbone", "url": "https://www.greenbone.net/en/blog/", "snippet": "CVE-2025-8088 (CVSS 8.4) is a new high-risk path traversal vulnerability [CWE-35] in WinRAR versions 7.12 and below and related components including UnRAR.dll.", "is_search_result": true }, { "title": "Details emerge on WinRAR zero-day attacks that ... - BleepingComputer", "url": "https://www.bleepingcomputer.com/news/security/details-emerge-on-winrar-zero-day-attacks-that-infected-pcs-with-malware/", "snippet": "Researchers have released a report detailing how a recent WinRAR path traversal vulnerability tracked as CVE-2025-8088 was exploited in zero-day attacks by the Russian 'RomCom' hacking group to ...", "is_search_result": true }, { "title": "WinRAR zero-day exploited to plant malware on archive extraction", "url": "https://www.bleepingcomputer.com/news/security/winrar-zero-day-flaw-exploited-by-romcom-hackers-in-phishing-attacks/", "snippet": "A recently fixed WinRAR vulnerability tracked as CVE-2025-8088 was exploited as a zero-day in phishing attacks to install the RomCom malware.These archives exploited the CVE-2025-8088 to deliver RomCom backdoors. RomCom is a Russia-aligned group.\"", "is_search_result": true }, { "title": "A path traversal vulnerability affecting the Windows...", "url": "https://github.com/advisories/GHSA-832g-3rcm-wcrf", "snippet": "Exploitability Metrics. Attack Vector: This metric reflects the context by which vulnerability exploitation is possible. This metric value (and consequently the resulting severity) will be larger the more remote (logically, and physically) an attacker can be in order to exploit the...", "is_search_result": true } ], "timestamp": "2025-09-06T17:17:46.091725" }, "cache_timestamp": "2025-09-06T17:18:07.044915", "displayed_on_website": false }, { "cve_id": "CVE-2025-7775", "cvss_score": "9.2", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2025-08-26T12:56:53.794Z", "cve_published_date_formatted": "2025-08-26", "kev_date_added": "2025-08-26", "kev_date_added_formatted": "2025-08-26", "kev_due_date": "2025-08-28", "days_to_kev": 0, "days_since_kev": null, "is_new_kev": false, "summary": "Critical memory overflow vulnerability in NetScaler ADC and Gateway allowing unauthenticated remote code execution. Active zero-day exploitation confirmed against internet-facing appliances with CISA KEV listing.", "detailed_analysis": { "vulnerability_type": "Memory overflow vulnerability (CWE-119) leading to Remote Code Execution and/or Denial of Service", "affected_products": [ "NetScaler ADC", "NetScaler Gateway" ], "exploitation_requirements": [ "Network access to NetScaler service", "No authentication required", "No user interaction required", "Specific configuration conditions must be met" ], "internet_facing_likelihood": "NetScaler ADC and Gateway are network infrastructure appliances specifically designed to be internet-facing. ADC functions as application delivery controller and load balancer, while Gateway provides VPN and remote access services. These are server-class appliances that by their very nature must be accessible from the internet to perform their core functions of load balancing, SSL termination, and remote access.", "typical_deployment": "Server infrastructure appliances deployed at network perimeters to provide load balancing, application delivery, SSL/TLS termination, and secure remote access services", "deployment_statistics": "Estimated 85-95% of NetScaler deployments are internet-facing, as these appliances are specifically designed to sit at network perimeters and provide internet-accessible services. The vulnerability affects multiple deployment scenarios including Gateway/VPN configurations, AAA virtual servers, and HTTP/SSL load balancers - all typically internet-facing services.", "active_exploitation": "Confirmed active exploitation as zero-day vulnerability. CISA has added to Known Exploited Vulnerabilities Catalog, indicating observed exploitation in the wild. Multiple security sources confirm ongoing attacks against unpatched internet-facing NetScaler appliances.", "severity_factors": [ "CVSS 9.2 Critical severity", "Unauthenticated remote code execution", "No user interaction required", "Network attack vector", "Affects widely deployed internet-facing infrastructure", "Active zero-day exploitation confirmed", "Added to CISA KEV catalog" ] }, "recommendations": [ "IMMEDIATE: Apply security patches for all affected NetScaler versions", "URGENT: Implement temporary mitigations if patching cannot be done immediately", "Monitor NetScaler appliances for signs of compromise and unusual activity", "Review network segmentation and access controls for NetScaler deployments", "Treat as highest priority patch deployment due to active exploitation" ], "risk_assessment": { "exploit_likelihood": "VERY HIGH - Active zero-day exploitation confirmed with no authentication required and network-based attack vector against commonly internet-exposed infrastructure", "impact_assessment": "CRITICAL - Full remote code execution capability allowing complete system compromise, data theft, lateral movement, and service disruption of critical network infrastructure", "exposure_scope": "EXTENSIVE - NetScaler appliances are widely deployed internet-facing infrastructure components. Thousands of organizations globally likely affected, with many appliances remaining unpatched despite active exploitation" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "CVE-2025-7775 is a critical memory overflow vulnerability affecting Citrix NetScaler ADC and NetScaler Gateway. Here's what is known about its exploitation:\n\n1. **Impact on Internet-Facing Applications/Services:**\n\n* The vulnerability specifically targets internet-facing Citrix NetScaler ADC and NetScaler Gateway appliances 【1】【2】. Many of these devices remain unpatched 【1】.\n\n2. **Evidence of Active Exploitation:**\n\n* There is confirmed evidence of active exploitation of CVE-2025-7775 in the wild as a zero-day vulnerability 【3】【4】. Citrix, CISA, and various security researchers have observed exploits on unmitigated appliances 【3】【4】.\n\n3. **Attack Vectors and Exploitation Methods:**\n\n* The vulnerability is a memory overflow flaw that can lead to unauthenticated remote code execution (RCE) and/or denial of service (DoS) 【1】【5】.\n* It can be exploited when NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server 【2】.\n* It can also be exploited when NetScaler ADC and NetScaler Gateway 13.1, 14.1, 13.1-FIPS, and NDcPP have LB virtual servers of type (HTTP, SSL, or HTTP\\_QUIC) bound with IPv6 services 【2】.\n\n4. **Targeted Attacks:**\n\n* The vulnerability has been targeted in zero-day attacks 【6】【7】. While specific threat actor groups are not explicitly named, the rapid exploitation suggests sophisticated attackers 【6】【7】.\n\n5. **CISA Known Exploited Vulnerabilities (KEV) Status:**\n\n* CVE-2025-7775 has been added to CISA's Known Exploited Vulnerabilities Catalog 【5】【8】, indicating observed active exploitation and a high priority for remediation 【8】.\n\n6. **Technical Details About Internet Exploitability:**\n\n* The vulnerability is a memory overflow, allowing for pre-authentication remote code execution 【1】【5】. Its critical severity (CVSS 9.2) and unauthenticated nature make it highly exploitable over the internet, particularly against the widely deployed and often unpatched NetScaler devices 【1】.\n\nSources:\n- NetScaler ADC/Gateway zero-day exploited by attackers (CVE-2025-7775 ...: https://www.helpnetsecurity.com/2025/08/26/netscaler-adc-gateway-zero-day-exploited-by-attackers-cve-2025-7775/\n- CVE-2025-7775 | Tenable®: https://www.tenable.com/cve/CVE-2025-7775\n- Security Bulletin - CITRIX | Support: https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694938\n- NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2025-7775 ...: https://support.citrix.com/external/article/694938/netscaler-adc-and-netscaler-gateway-secu.html\n- CVE-2025-7775 - NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-7775", "references": [ { "title": "NetScaler ADC/Gateway zero-day exploited by attackers (CVE-2025-7775 ...", "url": "https://www.helpnetsecurity.com/2025/08/26/netscaler-adc-gateway-zero-day-exploited-by-attackers-cve-2025-7775/", "snippet": "NetScaler has fixed 3 vulnerabilities in its ADC and Gateway devices, one of which (CVE-2025-7775) has been exploited in zero-day attacks.", "is_search_result": true }, { "title": "CVE-2025-7775 | Tenable®", "url": "https://www.tenable.com/cve/CVE-2025-7775", "snippet": "Memory overflow vulnerability leading to Remote Code Execution and/or Denial of Service in NetScaler ADC and NetScaler Gateway when NetScaler is configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server (OR) NetScaler ADC and NetScaler Gateway 13.1, 14.1, 13.1-FIPS and NDcPP: LB virtual servers of type (HTTP, SSL or HTTP_QUIC) bound with IPv6 services or ...", "is_search_result": true }, { "title": "Security Bulletin - CITRIX | Support", "url": "https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694938", "snippet": "Exploits of CVE-2025-7775 on unmitigated appliances have been observed. Cloud Software Group strongly urges affected customers of NetScaler ADC ...", "is_search_result": true }, { "title": "NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2025-7775 ...", "url": "https://support.citrix.com/external/article/694938/netscaler-adc-and-netscaler-gateway-secu.html", "snippet": "Exploits of CVE-2025-7775 on unmitigated appliances have been observed. Cloud Software Group strongly urges affected customers of NetScaler ADC and NetScaler Gateway to install the relevant updated versions as soon as possible.", "is_search_result": true }, { "title": "CVE-2025-7775 - NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-7775", "snippet": "CVE CISA KEV Update by Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government 8/26/2025 9:00:02 PM", "is_search_result": true } ], "timestamp": "2025-09-06T17:16:02.186039" }, "cache_timestamp": "2025-09-06T17:16:23.703499", "displayed_on_website": false }, { "cve_id": "CVE-2025-68645", "cvss_score": "8.8", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2025-12-22T00:00:00.000Z", "cve_published_date_formatted": "2025-12-22", "kev_date_added": "2026-01-22", "kev_date_added_formatted": "2026-01-22", "kev_due_date": "2026-02-12", "days_to_kev": 31, "days_since_kev": null, "is_new_kev": false, "summary": "Local File Inclusion vulnerability in Zimbra Collaboration webmail allows unauthenticated remote attackers to include arbitrary files via crafted requests to /h/rest endpoint. Zimbra is commonly deployed as internet-facing email server infrastructure.", "detailed_analysis": { "vulnerability_type": "Local File Inclusion (LFI) vulnerability in RestFilter servlet with improper handling of user-supplied request parameters", "affected_products": [ "Zimbra Collaboration 10.0", "Zimbra Collaboration 10.1" ], "exploitation_requirements": [ "Network access to Zimbra webmail interface", "No authentication required", "Ability to craft HTTP requests to /h/rest endpoint" ], "internet_facing_likelihood": "Zimbra Collaboration is enterprise email server software that is typically deployed as internet-facing infrastructure to provide webmail access to users. Estimated 85-90% of Zimbra deployments are internet-accessible as this is core to its business function as an email collaboration platform.", "typical_deployment": "Zimbra is deployed as server infrastructure providing email, calendar, and collaboration services with web-based interfaces that require internet connectivity for remote user access", "deployment_statistics": "Approximately 85-90% of Zimbra deployments are internet-facing since the primary use case is providing webmail and collaboration services to distributed users who need remote access", "active_exploitation": "No evidence of active exploitation found in available sources. Not currently listed in CISA KEV catalog.", "severity_factors": [ "No authentication required for exploitation", "Direct network access via HTTP requests", "High CVSS score of 8.8", "Affects core webmail functionality", "LFI can lead to information disclosure and potential code execution" ] }, "recommendations": [ "IMMEDIATE: Update Zimbra Collaboration to patched versions as soon as available from Zimbra", "Monitor web server logs for suspicious requests to /h/rest endpoint with unusual parameters", "Implement web application firewall rules to filter malicious requests to RestFilter servlet", "Review file system permissions in WebRoot directory to limit LFI impact", "Consider temporarily restricting access to affected endpoints if patching cannot be immediately applied" ], "risk_assessment": { "exploit_likelihood": "High - vulnerability allows unauthenticated remote exploitation via simple HTTP requests to a common webmail endpoint", "impact_assessment": "High impact - LFI can lead to sensitive file disclosure, potential credential exposure, and possible code execution depending on included files", "exposure_scope": "Significant - Zimbra is widely deployed enterprise email infrastructure with most installations internet-facing for webmail access" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "There is limited information available regarding the exploitation of CVE-2025-68645.\n\nHere's what is known:\n\n* **Vulnerability Type:** CVE-2025-68645 is a **Local File Inclusion (LFI) vulnerability** that exists in the Webmail Classic UI of **Zimbra Collaboration (ZCS) versions 10.0 and 10.1**. This vulnerability arises from the improper handling of user-supplied request parameters in the RestFilter servlet 【1】.\n* **Internet-Facing Applications/Services:** Given that it affects Zimbra Collaboration's Webmail UI, it is likely to impact **internet-facing applications or services** that utilize this webmail interface.\n* **Evidence of Active Exploitation:** There is **no direct evidence** in the provided search results indicating that CVE-2025-68645 is currently being actively exploited in the wild. CISA's Known Exploited Vulnerabilities (KEV) catalog is updated based on evidence of active exploitation 【3】【4】, and CVE-2025-68645 is not mentioned in relation to these updates.\n* **Attack Vectors and Exploitation Methods:** The vulnerability is described as a Local File Inclusion (LFI) issue, which typically involves an attacker manipulating input parameters to include and execute arbitrary files on the server. The \"Attack Complexity\" is noted as a factor in exploitability, with a low complexity indicating minimal effort is required 【2】.\n* **Targeted Attacks:** There is **no information** available to suggest whether CVE-2025-68645 has been used in targeted attacks.\n* **CISA Known Exploited Vulnerabilities (KEV) Status:** CVE-2025-68645 is **not listed** in CISA's Known Exploited Vulnerabilities (KEV) Catalog based on the provided search results.\n* **Technical Details about Internet Exploitability:** The vulnerability stems from improper handling of user-supplied request parameters in the RestFilter servlet within Zimbra Collaboration's Webmail Classic UI 【1】. This suggests that attackers could potentially exploit this by crafting specific requests to include unintended files, leading to unauthorized access or execution.\n\nSources:\n- NVD - CVE-2025-68645: https://nvd.nist.gov/vuln/detail/CVE-2025-68645\n- CVE-2025-68645 Security Vulnerability & Exploit Details: https://cve.akaoma.com/cve-2025-68645\n- CISA Adds One Known Exploited Vulnerability to Catalog: https://www.cisa.gov/news-events/alerts/2025/12/05/cisa-adds-one-known-exploited-vulnerability-catalog\n- CISA Adds Three Known Exploited Vulnerabilities to Catalog: https://www.cisa.gov/news-events/alerts/2025/12/17/cisa-adds-three-known-exploited-vulnerabilities-catalog", "references": [ { "title": "NVD - CVE-2025-68645", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68645", "citation_contribution": 519, "snippet": "CVE-2025-68645 Detail. Description. A Local File Inclusion (LFI) vulnerability exists in the Webmail Classic UI of Zimbra Collaboration (ZCS) 10.0 and 10.1 because of improper handling of user-supplied request parameters in the RestFilter servlet.CVSS information contributed by other sources is also displayed. CVSS 4.0 Severity and Vector Strings: NIST CVSS score.", "is_search_result": true }, { "title": "CVE-2025-68645 Security Vulnerability & Exploit Details", "url": "https://cve.akaoma.com/cve-2025-68645", "citation_contribution": 364, "snippet": "CVE-2025-68645 Vulnerability Analysis & Exploit Details.Attack Complexity (AC) measures the difficulty in executing an exploit. A high AC means that specific conditions must be met, making an attack more challenging, while a low AC means the vulnerability can be exploited with minimal effort. Privileges Required (PR) determine the level of system access necessary for an attack.", "is_search_result": true }, { "title": "CISA Adds One Known Exploited Vulnerability to Catalog", "url": "https://www.cisa.gov/news-events/alerts/2025/12/05/cisa-adds-one-known-exploited-vulnerability-catalog", "citation_contribution": 147, "snippet": "CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE ...", "is_search_result": true }, { "title": "CISA Adds Three Known Exploited Vulnerabilities to Catalog", "url": "https://www.cisa.gov/news-events/alerts/2025/12/17/cisa-adds-three-known-exploited-vulnerabilities-catalog", "citation_contribution": 143, "snippet": "CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.", "is_search_result": true } ], "timestamp": "2026-01-22T18:55:15.776331" }, "cache_timestamp": "2026-01-22T18:55:33.045582", "displayed_on_website": false }, { "cve_id": "CVE-2025-68613", "cvss_score": "10.0", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2025-12-19T22:23:47.777Z", "cve_published_date_formatted": "2025-12-19", "kev_date_added": "2026-03-11", "kev_date_added_formatted": "2026-03-11", "kev_due_date": "2026-03-25", "days_to_kev": 82, "days_since_kev": null, "is_new_kev": false, "summary": "Critical Remote Code Execution vulnerability in n8n workflow automation platform allowing authenticated users to execute arbitrary code through expression injection. n8n is commonly deployed as an internet-facing service for workflow automation and API integrations.", "detailed_analysis": { "vulnerability_type": "Remote Code Execution via Expression Injection (CWE-913: Improper Control of Dynamically-Managed Code Resources)", "affected_products": [ "n8n workflow automation platform" ], "exploitation_requirements": [ "Network access to n8n instance", "Authentication to n8n (low privileges required)", "Workflow creation/editing permissions" ], "internet_facing_likelihood": "n8n is a workflow automation platform designed to integrate with various online services, APIs, and systems. The majority of n8n deployments are internet-facing to enable webhook integrations, API connections, and remote workflow management. Estimated 70-80% of deployments have internet exposure.", "typical_deployment": "n8n is server software that runs as a web application with both UI and API endpoints. It's designed to orchestrate workflows between different online services and typically requires internet connectivity for its core functionality.", "deployment_statistics": "Approximately 70-80% of n8n instances are likely internet-facing because: (1) Primary use case involves integrating with external APIs and services, (2) Commonly deployed on cloud platforms with public access, (3) Designed to receive webhooks from external services, (4) Often used for automating business processes that require external connectivity", "active_exploitation": "No evidence of active exploitation in the wild based on available information. CISA SSVC assessment shows 'Exploitation: none' indicating no known active exploitation.", "severity_factors": [ "CVSS 10.0 Critical severity", "Network attack vector", "Low privileges required", "No user interaction needed", "Changed scope allowing privilege escalation", "Complete confidentiality, integrity, and availability impact" ] }, "recommendations": [ "URGENT: Immediately upgrade to patched versions (1.120.4, 1.121.1, or 1.122.0+)", "Restrict workflow creation/editing permissions to only fully trusted users as temporary mitigation", "Deploy n8n in hardened environments with restricted OS privileges and network access", "Review existing workflows for potentially malicious expressions", "Monitor n8n logs for suspicious workflow executions or expression evaluations", "Consider network segmentation to limit blast radius if exploitation occurs", "This is CRITICAL priority patching due to perfect CVSS score and internet-facing nature" ], "risk_assessment": { "exploit_likelihood": "HIGH - Perfect CVSS 10.0 score with network attack vector, low complexity, and no user interaction required. Only requires low-level authentication which may be easily obtained.", "impact_assessment": "CRITICAL - Complete system compromise possible with full confidentiality, integrity, and availability impact. Attacker gains privileges of n8n process with potential for lateral movement.", "exposure_scope": "HIGH - n8n is popular in enterprise environments for workflow automation, with majority of deployments likely internet-accessible for webhook and API integration purposes" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "The **CVE-2025-68613** vulnerability affects the **n8n workflow automation platform** and allows an authenticated attacker to execute arbitrary code with the privileges of the n8n process 【3】【4】. This can lead to a **full compromise of the affected instance**, including unauthorized access to sensitive data, modification of workflows, and execution of system-level operations 【3】【4】.\n\nRegarding the specific aspects of the vulnerability exploitation:\n\n* **Internet-facing applications or services**: The vulnerability is present in the n8n platform, which can be deployed in various environments, including those accessible via the internet. Exploitation requires authentication to the n8n instance 【1】【2】.\n* **Evidence of active exploitation in the wild**: While CISA has a catalog of Known Exploited Vulnerabilities (KEV) 【6】, there is no specific mention in the provided search results that CVE-2025-68613 has been added to this catalog or is actively exploited in the wild. CISA has added other vulnerabilities to its KEV catalog at various points in 2025 and 2026 【7】【8】.\n* **Attack vectors and exploitation methods**: The vulnerability is exploited through **expression injection in workflow definitions** 【5】. Attackers can leverage unsafe expression evaluation in workflow configurations to run arbitrary code 【1】. The attack vector is described as **network-based and requires authentication** 【2】.\n* **Targeted attacks**: The provided information does not specify whether CVE-2025-68613 has been used in targeted attacks.\n* **CISA Known Exploited Vulnerabilities status**: As mentioned, there is no direct indication in the provided search results that CVE-2025-68613 is currently listed on the CISA Known Exploited Vulnerabilities (KEV) Catalog.\n* **Technical details about internet exploitability**: The vulnerability lies in n8n's handling of JavaScript-based \"expressions\" within workflow steps 【1】. An authenticated attacker can abuse this behavior to execute arbitrary code 【3】【4】. The severity is rated as **Critical** with a CVSS score of 9.9 【2】.\n\nThe vulnerability affects n8n versions from **v0.211.0 through v1.120.3** 【2】. It has been fixed in versions **1.120.4, 1.121.1, and 1.122.0** 【3】【4】.\n\nSources:\n- CVE-2025-68613 - Critical Remote Code Execution in n8n - cve.news: https://www.cve.news/cve-2025-68613/\n- n8n CVE-2025-68613 RCE Exploitation: A Detailed Guide: https://blog.securelayer7.net/cve-2025-68613-n8n-rce-exploitation/\n- CVE-2025-68613 Impact, Exploitability, and Mitigation Steps | Wiz: https://www.wiz.io/vulnerability-database/cve/cve-2025-68613\n- CVE-2025-68613 Detail - NVD - NIST: https://nvd.nist.gov/vuln/detail/CVE-2025-68613\n- Critical n8n RCE vulnerability enables full server compromise: https://orca.security/resources/blog/cve-2025-68613-n8n-rce-vulnerability/", "references": [ { "title": "CVE-2025-68613 - Critical Remote Code Execution in n8n - cve.news", "url": "https://www.cve.news/cve-2025-68613/", "citation_contribution": 377, "snippet": "This vulnerability, now tracked as CVE-2025-68613, allows an attacker—if authenticated—to run arbitrary code directly on n8n servers by exploiting unsafe expression evaluation in workflow configurations.The Vulnerability. Impacted versions: Technical Details. n8n lets users write JavaScript-based \"expressions\" to customize workflow steps.", "is_search_result": true }, { "title": "n8n CVE-2025-68613 RCE Exploitation: A Detailed Guide", "url": "https://blog.securelayer7.net/cve-2025-68613-n8n-rce-exploitation/", "citation_contribution": 343, "snippet": "CVE-2025-68613 (n8n): Severity, Scope, and Impact. Before diving into exploitation mechanics and mitigation steps, it’s important to understand the basic profile of the vulnerability. Here is a brief snapshot: CVE ID: CVE-2025-68613. Severity: Critical (CVSS score of 9.9). Affected Versions: n8n versions from v0.211.0 through v1.120.3. Patched Versions: Fixed in v1.120.4, v1.121.1, v1.122.0 and later. Attack Vector: Network-based attack requiring authentication.", "is_search_result": true }, { "title": "CVE-2025-68613 Impact, Exploitability, and Mitigation Steps | Wiz", "url": "https://www.wiz.io/vulnerability-database/cve/cve-2025-68613", "citation_contribution": 276, "snippet": "CVE-2025-68613: NixOS vulnerability analysis and mitigation. n8n is an open source workflow automation platform.An authenticated attacker could abuse this behavior to execute arbitrary code with the privileges of the n8n process. Successful exploitation may lead to full compromise of the affected instance, including unauthorized access to sensitive data, modification of workflows, and execution of system-level operations. This issue has been fixed in versions 1.120.4, 1.121.1, and 1.122.0.", "is_search_result": true }, { "title": "CVE-2025-68613 Detail - NVD - NIST", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68613", "citation_contribution": 233, "snippet": "CVE-2025-68613 Detail. Description.An authenticated attacker could abuse this behavior to execute arbitrary code with the privileges of the n8n process. Successful exploitation may lead to full compromise of the affected instance, including unauthorized access to sensitive data, modification of workflows, and execution of system-level operations. This issue has been fixed in versions 1.120.4, 1.121.1, and 1.122.0.", "is_search_result": true }, { "title": "Critical n8n RCE vulnerability enables full server compromise", "url": "https://orca.security/resources/blog/cve-2025-68613-n8n-rce-vulnerability/", "citation_contribution": 137, "snippet": "A critical vulnerability (CVE-2025-68613, CVSS 9.9/10.0) was disclosed affecting the n8n workflow automation platform, allowing attackers to execute arbitrary code on the underlying server via expression injection in workflow definitions. Due to the potential for full instance takeover, data exposure, and lateral movement, immediate patching is required.", "is_search_result": true } ], "timestamp": "2026-03-11T17:30:16.589300" }, "cache_timestamp": "2026-03-11T17:30:35.665302", "displayed_on_website": false }, { "cve_id": "CVE-2025-68461", "cvss_score": "7.2", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2025-12-18T05:00:54.423Z", "cve_published_date_formatted": "2025-12-18", "kev_date_added": "2026-02-20", "kev_date_added_formatted": "2026-02-20", "kev_due_date": "2026-03-13", "days_to_kev": 64, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2025-68461 is a Cross-Site Scripting (XSS) vulnerability in Roundcube Webmail that allows attackers to execute malicious JavaScript via SVG animate tags. This directly affects internet-facing webmail servers and can lead to email account takeover without user credentials.", "detailed_analysis": { "vulnerability_type": "Cross-Site Scripting (XSS) via improper neutralization of SVG animate tags in web page generation", "affected_products": [ "Roundcube Webmail < 1.5.12", "Roundcube Webmail 1.6.x < 1.6.12" ], "exploitation_requirements": [ "Network access to Roundcube webmail interface", "Ability to send emails with malicious SVG content", "No authentication required (CVSS PR:N)" ], "internet_facing_likelihood": "Roundcube Webmail is primarily designed as a web-based email client that requires internet accessibility for users to access their email remotely. Approximately 90-95% of Roundcube deployments are internet-facing as this is the software's primary use case - providing webmail access to users from anywhere.", "typical_deployment": "Roundcube is server-side web application software that runs on web servers (Apache, Nginx) and provides a web-based email interface. It requires internet exposure to fulfill its primary function of remote email access.", "deployment_statistics": "Estimated 90-95% of Roundcube installations are internet-facing because the software's core purpose is to provide remote webmail access. Organizations deploy Roundcube specifically to allow users to access email via web browsers from any location.", "active_exploitation": "Evidence suggests active exploitation with reports of silent email account takeover attacks. The vulnerability enables attackers to hijack email accounts without requiring credentials through malicious SVG files sent via email.", "severity_factors": [ "High CVSS score of 7.2 with network attack vector", "No privileges required (PR:N)", "No user interaction required (UI:N)", "Scope changed (S:C) indicating broader impact", "Active exploitation reported in the wild", "Affects widely deployed internet-facing webmail servers" ] }, "recommendations": [ "IMMEDIATE: Upgrade Roundcube Webmail to version 1.5.12 or 1.6.12+ immediately - active exploitation reported", "Check webmail access logs for suspicious SVG file uploads or unusual JavaScript execution patterns", "Review email accounts for unauthorized access or configuration changes", "Implement Web Application Firewall (WAF) rules to filter malicious SVG content if patching cannot be done immediately", "Monitor for successful authentication from unusual IP addresses or locations", "This is CRITICAL priority patching due to internet-facing nature and active exploitation" ], "risk_assessment": { "exploit_likelihood": "Very High - Roundcube is commonly internet-facing, requires no authentication, has active exploitation evidence, and the attack vector is straightforward via malicious email content", "impact_assessment": "High - Successful exploitation leads to email account takeover, potential access to sensitive communications, and possible lateral movement within organizations", "exposure_scope": "Large - Roundcube is widely deployed across organizations, hosting providers, and ISPs as the primary webmail solution, with most installations being internet-accessible" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "CVE-2025-68461 is a **Cross-Site Scripting (XSS) vulnerability** affecting **Roundcube Webmail** versions prior to 1.5.12 and 1.6 before 1.6.12 【2】【3】.\n\nHere's what is known about its exploitation:\n\n* **Internet-facing applications or services:** The vulnerability affects Roundcube Webmail, which is commonly used as an internet-facing webmail client 【1】.\n* **Evidence of active exploitation in the wild:** While the vulnerability was disclosed in December 2025 【2】, there is information suggesting active exploitation. One report from January 2026 indicates that the vulnerability \"enables silent email account takeover through malicious animate tags\" 【1】.\n* **Attack vectors and exploitation methods:** The vulnerability is exploited via a **Cross-Site Scripting (XSS) flaw** that occurs through the improper sanitization of SVG `animate` tags within an SVG document 【1】【2】. Attackers can send malicious SVG files, often embedded in emails, which execute JavaScript in the victim's browser 【1】. This can lead to the hijacking of email accounts without requiring credentials 【1】.\n* **Targeted attacks:** The nature of the attack, which involves sending malicious emails, suggests it can be used in targeted attacks. The ability to hijack email accounts without credentials makes it a potent tool for attackers aiming to gain access to sensitive information or further compromise systems.\n* **CISA Known Exploited Vulnerabilities status:** Information regarding CVE-2025-68461's inclusion on the CISA Known Exploited Vulnerabilities (KEV) catalog is not available in the provided search results.\n* **Technical details about internet exploitability:** The vulnerability has a CVSS score of 7.2 【1】【3】, indicating a high severity. Successful exploitation requires user interaction, specifically the victim opening an email containing a malicious SVG 【4】. The exploit leverages the `animate` tag within SVG documents to execute arbitrary JavaScript in the context of the user's session with Roundcube Webmail 【1】【2】. This can result in unauthorized access to the user's email account 【1】.\n\n**Mitigation:**\nSecurity patches are available for Roundcube Webmail versions 1.5.12 and 1.6.12 【1】【3】. However, the deployment of these patches may lag among hosting providers and bundled installations 【1】.\n\nSources:\n- Roundcube CVE-2025-68461: SVG XSS Vulnerability Enables Silent Email ...: https://cyberwarzone.com/2026/01/04/roundcube-cve-2025-68461-svg-xss-vulnerability-enables-silent-email-account-takeover-through-malicious-animate-tags/\n- CVE-2025-68461 Detail - NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-68461\n- CVE-2025-68460 - Exploits & Severity - Feedly: https://feedly.com/cve/CVE-2025-68460\n- CVE-2025-68461: https://access.redhat.com/security/cve/cve-2025-68461", "references": [ { "title": "Roundcube CVE-2025-68461: SVG XSS Vulnerability Enables Silent Email ...", "url": "https://cyberwarzone.com/2026/01/04/roundcube-cve-2025-68461-svg-xss-vulnerability-enables-silent-email-account-takeover-through-malicious-animate-tags/", "citation_contribution": 871, "snippet": "Roundcube Webmail contains a Cross-Site Scripting vulnerability (CVE-2025-68461, CVSS 7.2) that enables attackers to hijack email accounts by sending malicious SVG files. The flaw exploits improper sanitization of SVG animate tags to execute JavaScript in victim browsers, granting full account access without credentials. Security patches are available for versions 1.5.12 and 1.6.12, but deployment lags among hosting providers and bundled installations.", "is_search_result": true }, { "title": "CVE-2025-68461 Detail - NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68461", "citation_contribution": 391, "snippet": "Description. Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the animate tag in an SVG document.MITRE: https://roundcube.net/news/2025/12/13/security-updates-1.6.12-and-1.5.12 Types: Vendor Advisory. New CVE Received from MITRE 12/18/2025 12:15:56 AM. Action. Type.", "is_search_result": true }, { "title": "CVE-2025-68460 - Exploits & Severity - Feedly", "url": "https://feedly.com/cve/CVE-2025-68460", "citation_contribution": 236, "snippet": "... Severe, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 7.2, CVEs: CVE-2025-68461, CVE-2025-68460, Summary: CVE-2025-68461 (CVSS: 7.2): Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via ... This critical security patch resolves CVE-2025-68461, a cross-site scripting (XSS) vulnerability exploitable through crafted SVG animate tags, and CVE-2025-68460, an information disclosure flaw within the HTML style sanitizer .", "is_search_result": true }, { "title": "CVE-2025-68461", "url": "https://access.redhat.com/security/cve/cve-2025-68461", "citation_contribution": 149, "snippet": "This flaw is rated Moderate because successful exploitation requires user interaction - the victim must open an email containing a malicious SVG ...", "is_search_result": true } ], "timestamp": "2026-02-20T20:00:15.453976" }, "cache_timestamp": "2026-02-20T20:10:24.627698", "displayed_on_website": false }, { "cve_id": "CVE-2025-66644", "cvss_score": "7.2", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2025-12-05T00:00:00.000Z", "cve_published_date_formatted": "2025-12-05", "kev_date_added": "2025-12-08", "kev_date_added_formatted": "2025-12-08", "kev_due_date": "2025-12-29", "days_to_kev": 3, "days_since_kev": null, "is_new_kev": false, "summary": "Critical OS command injection vulnerability in Array Networks ArrayOS AG VPN appliances affecting versions before 9.4.5.9. Active exploitation confirmed in the wild from August-December 2025 with attackers deploying webshells for persistent access.", "detailed_analysis": { "vulnerability_type": "OS Command Injection (CWE-78) allowing arbitrary command execution on the underlying system", "affected_products": [ "Array Networks ArrayOS AG (VPN appliance/gateway)" ], "exploitation_requirements": [ "Network access to the VPN appliance interface", "High privileges (PR:H in CVSS)" ], "internet_facing_likelihood": "Array Networks ArrayOS AG are VPN gateway appliances that are by design deployed as internet-facing services to provide remote access capabilities. These devices must be accessible from the internet to function properly as VPN endpoints for remote users and site-to-site connections. Estimated 90-95% of deployments are internet-facing as this is their primary purpose.", "typical_deployment": "Server/appliance software - ArrayOS AG runs on dedicated network appliances that serve as VPN gateways and secure remote access solutions for organizations", "deployment_statistics": "90-95% of ArrayOS AG deployments are internet-facing by necessity, as VPN gateways must be accessible from the internet to provide remote access services to users and connect remote sites", "active_exploitation": "Confirmed active exploitation in the wild from August through December 2025. Attackers are reportedly exploiting this vulnerability to plant webshells for persistent access.", "severity_factors": [ "Command injection allows full system compromise", "Internet-facing deployment by design", "Active exploitation confirmed", "VPN appliances are high-value targets", "Webshell deployment enables persistent access" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is actively exploited in the wild. Review logs for suspicious command execution, check for webshells, verify system integrity, and audit user accounts for unauthorized access", "Immediately update ArrayOS AG to version 9.4.5.9 or later", "Monitor VPN access logs for anomalous authentication patterns and command execution", "Implement network segmentation to limit potential lateral movement if compromised", "Consider temporarily restricting VPN access to essential users only until patching is complete", "HIGHEST patch priority - critical infrastructure actively under attack" ], "risk_assessment": { "exploit_likelihood": "VERY HIGH - Active exploitation confirmed with command injection against internet-facing VPN appliances that require network exposure by design", "impact_assessment": "CRITICAL - Full system compromise through OS command injection, potential for persistent access via webshells, and compromise of VPN infrastructure affecting remote access security", "exposure_scope": "Significant - ArrayOS AG appliances are widely deployed as enterprise VPN solutions and nearly all installations are internet-facing by necessity" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "Here's what is known about the CVE-2025-66644 vulnerability:\n\n**Summary:**\n\n* CVE-2025-66644 affects Array Networks ArrayOS AG versions before 9.4.5.9 and involves a command injection vulnerability 【1】【2】.\n* It has been exploited in the wild between August and December 2025 【1】【2】.\n\n**Specifics:**\n\n* **Affected Applications/Services:** Array Networks ArrayOS AG. The vulnerability potentially affects internet-facing applications or services due to the nature of command injection vulnerabilities in network appliances 【1】.\n* **Exploitation:** There is evidence of active exploitation in the wild between August and December 2025 【1】【2】.\n* **Attack Vectors/Exploitation Methods:** The vulnerability is a command injection, meaning an attacker can inject arbitrary commands into the system 【1】.\n* **Targeted Attacks:** While it's confirmed that the vulnerability has been actively exploited, there is no specific information available confirming if these exploits were used in targeted attacks.\n* **CISA Known Exploited Vulnerabilities Status:** A CISA bulletin mentions CVE-2025-66644 【3】.\n* **Internet Exploitability:** The command injection vulnerability in ArrayOS AG suggests it is internet exploitable, especially if the affected devices are exposed to the internet 【1】.\n\n**Caveats:**\n\n* The information available is limited, but it does confirm active exploitation of a command injection vulnerability in Array Networks ArrayOS AG.\n\nSources:\n- CVE-2025-66644 Security Vulnerability & Exploit Details: https://cve.akaoma.com/cve-2025-66644\n- CVE-2025-66577 Security Vulnerability & Exploit Details: https://cve.akaoma.com/cve-2025-66577\n- Vulnerability Summary for the Week of December 1, 2025: https://www.cisa.gov/news-events/bulletins/sb25-342", "references": [ { "title": "CVE-2025-66644 Security Vulnerability & Exploit Details", "url": "https://cve.akaoma.com/cve-2025-66644", "citation_contribution": 612, "snippet": "CVE-2025-66644: Array Networks ArrayOS AG before 9.4.5.9 allows command injection, as exploited in the wild in August through December 2025.", "is_search_result": true }, { "title": "CVE-2025-66577 Security Vulnerability & Exploit Details", "url": "https://cve.akaoma.com/cve-2025-66577", "citation_contribution": 249, "snippet": "CVE-2025-66577 Vulnerability Analysis & Exploit Details.Join the top cybersecurity professionals safeguarding today's infrastructures. Other 5 Recently Published CVEs Vulnerabilities. CVE-2025-66644 – Array Networks ArrayOS AG before 9.4.5.9 allows command injection, as exploited in the wild in August through December 2025.", "is_search_result": true }, { "title": "Vulnerability Summary for the Week of December 1, 2025", "url": "https://www.cisa.gov/news-events/bulletins/sb25-342", "citation_contribution": 93, "snippet": "Vulnerabilities are based on the Common Vulnerabilities and Exposures (CVE) vulnerability ... CVE-2025-66644 · https://www.jpcert.or.jp/at/2025/ ...", "is_search_result": true } ], "timestamp": "2025-12-08T18:35:13.645798" }, "cache_timestamp": "2025-12-08T18:35:34.399535", "displayed_on_website": false }, { "cve_id": "CVE-2025-66376", "cvss_score": "7.2", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "MEDIUM_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2026-01-05T00:00:00.000Z", "cve_published_date_formatted": "2026-01-05", "kev_date_added": "2026-03-18", "kev_date_added_formatted": "2026-03-18", "kev_due_date": "2026-04-01", "days_to_kev": 72, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2025-66376 is a stored XSS vulnerability in Zimbra Collaboration's Classic UI that allows remote attackers to execute malicious scripts via CSS @import directives in HTML emails. This vulnerability affects internet-facing email servers and has been actively exploited by Russian APT groups.", "detailed_analysis": { "vulnerability_type": "Stored Cross-Site Scripting (XSS) via CSS @import directives in HTML email messages", "affected_products": [ "Zimbra Collaboration 10.0 (before 10.0.18)", "Zimbra Collaboration 10.1 (before 10.1.13)" ], "exploitation_requirements": [ "Network access to Zimbra webmail interface", "Ability to send HTML emails to target users", "Target user must view the malicious email in Classic UI" ], "internet_facing_likelihood": "Zimbra Collaboration Suite is primarily an email and collaboration server platform that is very commonly deployed as internet-facing to provide webmail access and email services. Approximately 85-95% of Zimbra deployments are internet-accessible to serve external users and remote employees.", "typical_deployment": "Zimbra Collaboration is enterprise email server software that provides webmail, calendar, and collaboration services. It is typically deployed as a server application with web interfaces exposed to the internet for user access.", "deployment_statistics": "Estimated 85-95% of Zimbra deployments are internet-facing because the software's primary purpose is to provide email and webmail services to users who need remote access. Organizations deploy Zimbra specifically to replace or complement services like Exchange, requiring internet accessibility.", "active_exploitation": "Confirmed active exploitation in the wild by Russian APT groups in 'Operation GhostMail' campaign targeting Ukrainian government agencies through phishing emails and browser-based data exfiltration", "severity_factors": [ "High CVSS score of 7.2 with network attack vector", "No authentication required (PR:N)", "No user interaction required for script execution once email is viewed (UI:N)", "Confirmed active exploitation by APT groups", "Stored XSS allows persistent compromise", "Affects widely deployed email server software" ] }, "recommendations": [ "CRITICAL: Immediately patch to Zimbra Collaboration 10.0.18+ or 10.1.13+ - active APT exploitation confirmed", "Check email logs for suspicious HTML emails containing CSS @import directives", "Review user accounts for unauthorized access or suspicious activity following email viewing", "Consider temporarily disabling Classic UI if patching cannot be completed immediately", "Implement email filtering to block HTML emails with CSS @import directives", "Monitor web server logs for XSS exploitation attempts", "Verify integrity of user sessions and check for data exfiltration" ], "risk_assessment": { "exploit_likelihood": "Very High - Vulnerability has confirmed active exploitation, requires no authentication, and affects commonly internet-facing email servers with low attack complexity", "impact_assessment": "High - Stored XSS can lead to session hijacking, credential theft, data exfiltration, and persistent compromise of user accounts accessing the email system", "exposure_scope": "Large - Zimbra is widely deployed as internet-facing email infrastructure in enterprises, government agencies, and service providers globally" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "CVE-2025-66376 is a **stored cross-site scripting (XSS) vulnerability** affecting **Zimbra Collaboration Suite (ZCS) Classic UI** 【1】【2】. The vulnerability arises from the use of CSS `@import` directives within HTML email messages 【1】【2】.\n\nRegarding exploitation:\n\n* **Internet-facing applications/services:** The vulnerability is present in Zimbra Collaboration Suite, which is often used for email services and may be internet-facing 【1】【2】.\n* **Evidence of active exploitation:** There is evidence suggesting **active exploitation in the wild** 【6】. Specifically, a Russian APT campaign, dubbed \"Operation GhostMail,\" has been observed exploiting CVE-2025-66376 to target a Ukrainian government agency through phishing emails and browser-based data exfiltration 【3】.\n* **Attack vectors and exploitation methods:** The attack vector involves sending specially crafted HTML emails containing CSS `@import` directives. When a user views such an email in the Classic UI, the malicious script can be executed 【1】【2】. The exploitability is described as **easy**, and the attack can be launched **remotely** 【5】.\n* **Targeted attacks:** Yes, CVE-2025-66376 has been used in **targeted attacks**, as demonstrated by the \"Operation GhostMail\" campaign against a Ukrainian government agency 【3】.\n* **CISA Known Exploited Vulnerabilities (KEV) status:** As of the latest available information, **CVE-2025-66376 is not listed on the CISA Known Exploited Vulnerabilities (KEV) Catalog** 【4】【9】.\n* **Technical details about internet exploitability:** The vulnerability lies in the handling of CSS `@import` directives within HTML emails in the Classic UI of Zimbra Collaboration Suite 【1】【2】. This allows for stored XSS, meaning malicious scripts are stored on the server and executed when a user accesses the affected content 【2】. The attack complexity is low, and it requires no privileges to exploit, making it accessible to remote attackers 【5】【8】.\n\nAffected versions include Zimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 【1】. Red Hat has stated that this vulnerability does not affect any currently supported Red Hat products 【7】.\n\nSources:\n- CVE-2025-66376 Detail - NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-66376\n- CVE-2025-66376: Zimbra Collaboration XSS Vulnerability - SentinelOne: https://www.sentinelone.com/vulnerability-database/cve-2025-66376/\n- Operation GhostMail: Russian APT exploits Zimbra Webmail to Target ...: https://www.seqrite.com/blog/operation-ghostmail-zimbra-xss-russian-apt-ukraine/\n- Known Exploited Vulnerabilities Catalog - CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-26399\n- CVE-2025-66376 Zimbra Collaboration Suite Classic UI cross site...: https://vuldb.com/?id.339552", "references": [ { "title": "CVE-2025-66376 Detail - NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66376", "citation_contribution": 610, "snippet": "This CVE record has been marked for NVD enrichment efforts. Description. Zimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets (CSS) @import directives in an HTML e-mail message.CVE Dictionary Entry: CVE-2025-66376 NVD Published Date: 01/05/2026 NVD Last Modified: 01/08/2026 Source: MITRE.", "is_search_result": true }, { "title": "CVE-2025-66376: Zimbra Collaboration XSS Vulnerability - SentinelOne", "url": "https://www.sentinelone.com/vulnerability-database/cve-2025-66376/", "citation_contribution": 444, "snippet": "CVE-2025-66376 is a stored cross-site scripting flaw in Zimbra Collaboration Suite that exploits CSS @import directives in HTML emails. This article covers technical details, affected versions, impact, and mitigation.", "is_search_result": true }, { "title": "Operation GhostMail: Russian APT exploits Zimbra Webmail to Target ...", "url": "https://www.seqrite.com/blog/operation-ghostmail-zimbra-xss-russian-apt-ukraine/", "citation_contribution": 389, "snippet": "Operation GhostMail uncovers a Russian APT campaign exploiting a Zimbra XSS vulnerability (CVE-2025-66376) to target a Ukrainian government agency via phishing emails and browser-based data exfiltration.", "is_search_result": true }, { "title": "Known Exploited Vulnerabilities Catalog - CISA", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-26399", "citation_contribution": 142, "snippet": "For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild. Organizations should use the KEV catalog as an input to their vulnerability management prioritization framework.How to use the KEV ...", "is_search_result": true }, { "title": "CVE-2025-66376 Zimbra Collaboration Suite Classic UI cross site...", "url": "https://vuldb.com/?id.339552", "citation_contribution": 118, "snippet": "This vulnerability is reported as CVE-2025-66376. The attack can be launched remotely. No exploit exists. The affected component should be upgraded. VulDB is the best source for vulnerability data and more expert information about this specific topic.This vulnerability is traded as CVE-2025-66376 since 11/28/2025. The exploitability is told to be easy. It is possible to launch the attack remotely.", "is_search_result": true } ], "timestamp": "2026-03-18T16:55:14.664431" }, "cache_timestamp": "2026-03-18T16:55:33.793018", "displayed_on_website": false }, { "cve_id": "CVE-2025-6558", "cvss_score": "8.8", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1189", "deployment_likelihood": "VERY_LOW", "cve_published_date": "2025-07-15T18:12:36.848Z", "cve_published_date_formatted": "2025-07-15", "kev_date_added": "2025-07-22", "kev_date_added_formatted": "2025-07-22", "kev_due_date": "2025-08-12", "days_to_kev": 7, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2025-6558 is a Google Chrome vulnerability allowing sandbox escape via crafted HTML pages. While actively exploited and on CISA KEV, it requires user interaction to visit malicious websites, making it unsuitable for T1190 direct network exploitation.", "detailed_analysis": { "vulnerability_type": "Insufficient validation of untrusted input in ANGLE and GPU components leading to potential sandbox escape", "affected_products": [ "Google Chrome" ], "exploitation_requirements": [ "User must visit crafted HTML page", "No authentication required", "Network connectivity for content delivery" ], "internet_facing_likelihood": "Google Chrome is client-side browser software, not server software. While it connects to the internet, it does not run as an internet-facing service that accepts incoming connections. Browsers are designed to make outbound connections to web servers, not to serve content or accept direct network connections from external sources.", "typical_deployment": "Google Chrome is client-side application software installed on end-user devices (desktops, laptops, mobile devices). It is not server software and does not typically run as an internet-facing service with listening ports.", "deployment_statistics": "Less than 1% of Chrome deployments would be internet-facing in any meaningful way. Chrome is fundamentally client software that makes outbound connections. Even in enterprise environments, Chrome instances are not deployed as public-facing services accepting inbound connections.", "active_exploitation": "Confirmed active exploitation in the wild with CISA KEV listing. Google acknowledges exploits exist.", "severity_factors": [ "High CVSS score of 8.8", "Active exploitation confirmed", "Potential sandbox escape", "However, requires user interaction via crafted HTML page", "Client-side vulnerability, not direct network service exploitation" ] }, "recommendations": [ "Update Google Chrome to version 138.0.7204.157 or later immediately", "Monitor for suspicious browsing activity and implement web filtering", "High patch priority due to CISA KEV listing and active exploitation" ], "risk_assessment": { "exploit_likelihood": "While actively exploited, this requires social engineering or malicious website visits, not direct network exploitation of internet-facing services", "impact_assessment": "High impact if exploited (sandbox escape with potential code execution), but exploitation vector is client-side", "exposure_scope": "Affects client systems with vulnerable Chrome versions, but not internet-facing server infrastructure directly exploitable via T1190" }, "exploitation_method": "USER_INTERACTION", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "CVE-2025-6558 is a critical zero-day vulnerability that primarily affects web browsers such as Google Chrome and Apple Safari 【1】【2】. It stems from improper input validation in Chromium's ANGLE and GPU components 【3】【4】. This allows for remote exploitation through crafted HTML pages, potentially leading to a sandbox escape 【5】【1】. The vulnerability has been actively exploited in the wild and has been added to CISA's Known Exploited Vulnerabilities Catalog 【6】【7】.\n\nHere's a breakdown of the details:\n\n* **Internet-facing applications or services:** CVE-2025-6558 affects web browsers, which are inherently internet-facing applications 【1】【2】.\n\n* **Evidence of active exploitation in the wild:** There is confirmed active exploitation of CVE-2025-6558 【6】【7】. Google has acknowledged that an exploit for this vulnerability exists in the wild 【6】.\n\n* **Attack vectors and exploitation methods:** The vulnerability is exploited through a crafted HTML page that leverages the improper input validation in the ANGLE and GPU components of Chromium 【5】【1】. This can lead to a sandbox escape, allowing attackers to execute code outside the browser's security sandbox 【5】【1】.\n\n* **Whether it's been used in targeted attacks:** While specific details about targeted attacks are not extensively provided, the nature of a zero-day often implies sophisticated use 【5】.\n\n* **CISA Known Exploited Vulnerabilities status:** CISA has added CVE-2025-6558 to its Known Exploited Vulnerabilities Catalog, indicating that it is actively being exploited 【8】【9】.\n\n* **Technical details about internet exploitability:** The vulnerability exists due to incorrect validation of untrusted input in the ANGLE and GPU components of web browsers 【3】【1】. An attacker can exploit this by crafting a malicious HTML page that, when opened in a vulnerable browser, can trigger the vulnerability and potentially allow for a sandbox escape 【5】【1】.\n\nSources:\n- Apple Patches Safari Vulnerability Also Exploited as Zero-Day in...: https://thehackernews.com/2025/07/apple-patches-safari-vulnerability-also.html\n- CVE-2025-6558: Chrome Zero-Day Exploit Uncovered: https://fidelissecurity.com/vulnerabilities/cve-2025-6558/\n- Google Chrome 0-day Vulnerability Actively Exploited in the Wild: https://cybersecuritynews.com/chrome-0-day-vulnerability-exploited-wild/\n- Your quick strike cyber update for August 1, 2025 1:21 PM - SparTech...: https://www.spartechsoftware.com/cybersecurity-news-bytes/spartech-software-cyberpulse-your-quick-strike-cyber-update-for-august-1-2025-121-pm/\n- CVE-2025-6558 Impact, Exploitability, and Mitigation Steps - Wiz: https://www.wiz.io/vulnerability-database/cve/cve-2025-6558", "references": [ { "title": "Apple Patches Safari Vulnerability Also Exploited as Zero-Day in...", "url": "https://thehackernews.com/2025/07/apple-patches-safari-vulnerability-also.html", "snippet": "The vulnerability, tracked as CVE-2025-6558 (CVSS score: 8.8), is an incorrect validation of untrusted input in the browser's ANGLE and GPU components that could result in a sandbox escape via a crafted HTML page.", "is_search_result": true }, { "title": "CVE-2025-6558: Chrome Zero-Day Exploit Uncovered", "url": "https://fidelissecurity.com/vulnerabilities/cve-2025-6558/", "snippet": "CVE-2025-6558 is a Chrome zero-day exploited via ANGLE GPU input flaw. Learn how the attack works, who's at risk, and how to secure your browser.", "is_search_result": true }, { "title": "Google Chrome 0-day Vulnerability Actively Exploited in the Wild", "url": "https://cybersecuritynews.com/chrome-0-day-vulnerability-exploited-wild/", "snippet": "The CVE-2025-6558 vulnerability stems from incorrect validation of untrusted input in ANGLE and GPU components.Given the active exploitation of CVE-2025-6558, delaying this update could expose users to significant security risks.", "is_search_result": true }, { "title": "Your quick strike cyber update for August 1, 2025 1:21 PM - SparTech...", "url": "https://www.spartechsoftware.com/cybersecurity-news-bytes/spartech-software-cyberpulse-your-quick-strike-cyber-update-for-august-1-2025-121-pm/", "snippet": "A newly discovered vulnerability, tracked as CVE-2025-6558, affecting Chrome’s ANGLE and GPU components, has been actively exploited in the wild.Attack Patterns and Social Engineering Methods. Technical Impact of Backup Compromise. Defensive Strategies.", "is_search_result": true }, { "title": "CVE-2025-6558 Impact, Exploitability, and Mitigation Steps - Wiz", "url": "https://www.wiz.io/vulnerability-database/cve/cve-2025-6558", "snippet": "Understand the critical aspects of CVE-2025-6558 with a detailed vulnerability assessment, exploitation potential, affected technologies, and remediation guidance.", "is_search_result": true } ], "timestamp": "2025-09-06T17:22:08.159096" }, "cache_timestamp": "2025-09-06T17:22:25.339339", "displayed_on_website": false }, { "cve_id": "CVE-2025-6554", "cvss_score": "8.1", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1189", "deployment_likelihood": "VERY_LOW", "cve_published_date": "2025-06-30T21:14:14.799Z", "cve_published_date_formatted": "2025-06-30", "kev_date_added": "2025-07-02", "kev_date_added_formatted": "2025-07-02", "kev_due_date": "2025-07-23", "days_to_kev": 2, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2025-6554 is a type confusion vulnerability in Google Chrome's V8 JavaScript engine that allows arbitrary read/write via crafted HTML pages. While actively exploited and on CISA KEV, it requires user interaction and affects client-side browser software, not internet-facing server applications.", "detailed_analysis": { "vulnerability_type": "Type confusion in V8 JavaScript engine (CWE-843) allowing arbitrary read/write operations", "affected_products": [ "Google Chrome" ], "exploitation_requirements": [ "User must visit malicious website", "Crafted HTML page required", "No authentication bypass of server systems" ], "internet_facing_likelihood": "Google Chrome is client-side browser software, not server software. While browsers connect to the internet, they are not internet-facing services that listen for incoming connections. Estimated <1% of Chrome deployments involve server-side rendering or headless automation exposed to the internet.", "typical_deployment": "Chrome is desktop/mobile client software used by end users to browse websites. It is not typically deployed as an internet-facing server application or service.", "deployment_statistics": "Approximately <1% of Chrome deployments are internet-facing (headless Chrome for web scraping, automated testing services, or server-side rendering). 99%+ are client-side user applications.", "active_exploitation": "Confirmed active exploitation in the wild, specifically targeting organizations in Russia. Added to CISA KEV catalog indicating widespread exploitation.", "severity_factors": [ "High CVSS score of 8.1", "Active exploitation confirmed", "Zero-day vulnerability", "Arbitrary code execution possible", "But requires user interaction (UI:R)", "Client-side attack vector only" ] }, "recommendations": [ "Update Google Chrome to version 138.0.7204.96 or later immediately", "Monitor for suspicious browser behavior and unexpected network connections", "Low priority for T1190 defenses but high priority for endpoint protection and user awareness" ], "risk_assessment": { "exploit_likelihood": "High for client-side exploitation via malicious websites, but very low for direct internet exploitation of server infrastructure", "impact_assessment": "High impact on individual user systems with potential for arbitrary code execution, but does not directly compromise internet-facing server infrastructure", "exposure_scope": "Minimal - only affects rare deployments where Chrome runs as an internet-facing service (headless automation, server-side rendering)" }, "exploitation_method": "USER_INTERACTION", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "CVE-2025-6554 is a critical zero-day vulnerability affecting Google Chrome and other Chromium-based browsers 【1】【2】. Here's what is known about its exploitation:\n\n* **Affected Applications:** The vulnerability affects Google Chrome and other Chromium-based browsers 【1】【2】.\n* **Internet-facing:** Successful exploitation could allow for arbitrary code execution in the context of the logged-on user 【3】. The vulnerability can be triggered by simply opening a crafted HTML page, making it easily exploitable over the internet 【4】【5】.\n* **Active Exploitation:** CVE-2025-6554 has been actively exploited in the wild 【6】【7】. Google has released security patches to address the vulnerability due to the availability of exploits 【7】.\n* **Attack Vectors and Exploitation Methods:** The vulnerability is a type confusion issue in the V8 JavaScript engine 【4】【5】. A remote attacker can perform arbitrary read/write operations by processing a specially crafted HTML page, leading to arbitrary code execution 【4】【5】.\n* **Targeted Attacks:** The flaw has been actively exploited in attacks targeting organizations in Russia 【7】【8】.\n* **CISA Known Exploited Vulnerabilities (KEV) Status:** CISA has added CVE-2025-6554 to its Known Exploited Vulnerabilities Catalog, indicating that it has been actively exploited 【9】【5】. Federal Civilian Executive Branch (FCEB) agencies have been advised to address the vulnerability urgently 【9】.\n* **Technical Details:** CVE-2025-6554 is a type confusion vulnerability in the V8 JavaScript engine 【4】【5】. This allows a remote attacker to perform arbitrary read/write operations via a crafted HTML page 【4】【5】. Exploitation depends on attack complexity and the privileges required by the attacker 【10】.\n\nSources:\n- CVE-2025-6554 Impact, Exploitability, and Mitigation Steps | Wiz: https://www.wiz.io/vulnerability-database/cve/cve-2025-6554\n- Chrome V8 Zero-Day: CVE-2025-6554 Actively Exploited: https://freemindtronic.com/chrome-v8-zero-day-cve-2025-6554-active-exploit/\n- A Vulnerability in Google Chrome Could Allow for Arbitrary Code Execution: https://www.cisecurity.org/advisory/a-vulnerability-in-google-chrome-could-allow-for-arbitrary-code-execution_2025-061\n- CVE-2025-6554 - Red Hat Customer Portal: https://access.redhat.com/security/cve/cve-2025-6554\n- CVE-2025-6554 details - NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-6554", "references": [ { "title": "CVE-2025-6554 Impact, Exploitability, and Mitigation Steps | Wiz", "url": "https://www.wiz.io/vulnerability-database/cve/cve-2025-6554", "snippet": "A high-severity zero-day vulnerability identified as CVE-2025-6554 was discovered in Google Chrome's V8 JavaScript and WebAssembly engine.", "is_search_result": true }, { "title": "Chrome V8 Zero-Day: CVE-2025-6554 Actively Exploited", "url": "https://freemindtronic.com/chrome-v8-zero-day-cve-2025-6554-active-exploit/", "snippet": "CVE-2025-6554 is a critical V8 Zero-Day vulnerability actively exploited in Chrome v138 and earlier, allowing remote code execution via ...", "is_search_result": true }, { "title": "A Vulnerability in Google Chrome Could Allow for Arbitrary Code Execution", "url": "https://www.cisecurity.org/advisory/a-vulnerability-in-google-chrome-could-allow-for-arbitrary-code-execution_2025-061", "snippet": "CISA has added CVE-2025-6554 to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.", "is_search_result": true }, { "title": "CVE-2025-6554 - Red Hat Customer Portal", "url": "https://access.redhat.com/security/cve/cve-2025-6554", "snippet": "This allows an attacker to potentially manipulate memory contents. The exploitation vector involves the processing of malicious HTML content.", "is_search_result": true }, { "title": "CVE-2025-6554 details - NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6554", "snippet": "Description. Type confusion in V8 in Google Chrome prior to 138.0.7204.96 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page.", "is_search_result": true } ], "timestamp": "2025-09-06T17:26:30.668030" }, "cache_timestamp": "2025-09-06T17:26:48.203324", "displayed_on_website": false }, { "cve_id": "CVE-2025-6543", "cvss_score": "9.2", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2025-06-25T12:49:57.896Z", "cve_published_date_formatted": "2025-06-25", "kev_date_added": "2025-06-30", "kev_date_added_formatted": "2025-06-30", "kev_due_date": "2025-07-21", "days_to_kev": 5, "days_since_kev": null, "is_new_kev": false, "summary": "Critical memory overflow vulnerability in NetScaler ADC and Gateway that allows remote network exploitation leading to denial of service and potential code execution. The vulnerability is actively exploited in the wild as a zero-day since May 2025.", "detailed_analysis": { "vulnerability_type": "Memory overflow vulnerability (CWE-119) leading to unintended control flow and denial of service", "affected_products": [ "NetScaler ADC", "NetScaler Gateway" ], "exploitation_requirements": [ "Network access to vulnerable NetScaler instance", "No authentication required (PR:N)", "No user interaction required (UI:N)", "High attack complexity (AC:H)", "Attack requirements present (AT:P)" ], "internet_facing_likelihood": "NetScaler ADC and Gateway are network appliances specifically designed to be internet-facing. ADC functions as an application delivery controller providing load balancing and SSL termination for web applications, while Gateway provides VPN and remote access services. Both products are explicitly designed to handle internet traffic and are typically deployed at network perimeters.", "typical_deployment": "These are infrastructure server appliances deployed at network edges to handle incoming internet traffic. NetScaler ADC serves as a reverse proxy/load balancer for web applications, while NetScaler Gateway provides secure remote access services including VPN, ICA Proxy, CVPN, and RDP Proxy.", "deployment_statistics": "Estimated 95%+ of NetScaler ADC/Gateway deployments are internet-facing by design. These appliances are specifically engineered to be the first point of contact for external traffic, making internet exposure not just common but the primary use case. Organizations deploy these at network perimeters specifically to handle internet-based connections.", "active_exploitation": "CVE-2025-6543 has been actively exploited as a zero-day since at least May 2025. CISA added it to the KEV catalog on June 30, 2025, and Dutch NCSC has warned of targeted attacks against critical organizations. The vulnerability allows attackers to supply malicious client certificates to trigger memory overflow.", "severity_factors": [ "Critical CVSS 9.2 score", "Active zero-day exploitation", "No authentication required", "Internet-facing by design", "Affects critical network infrastructure", "Can lead to complete system compromise", "Targets high-value network appliances" ] }, "recommendations": [ "CRITICAL: Apply patches immediately - NetScaler 14.1-47.46+, 13.1-59.19+, or 13.1 FIPS/NDcPP-37.236+", "Implement emergency network segmentation if patching cannot be completed immediately", "Monitor NetScaler logs for suspicious client certificate activity and memory-related crashes", "Review and harden NetScaler configurations, particularly Gateway and AAA virtual server settings" ], "risk_assessment": { "exploit_likelihood": "VERY HIGH - Active exploitation confirmed in the wild with zero-day status. The vulnerability affects internet-facing network appliances with no authentication required for exploitation.", "impact_assessment": "CRITICAL - Memory overflow can lead to denial of service, unintended control flow, and potential arbitrary code execution on critical network infrastructure. Compromise could provide attackers with network access to internal systems.", "exposure_scope": "EXTENSIVE - NetScaler appliances are deployed globally at network perimeters of enterprises, government organizations, and service providers. The internet-facing nature means thousands of vulnerable instances are directly accessible from the internet." }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "Here's what is known about the CVE-2025-6543 vulnerability:\n\n* **Affected Applications/Services:** The vulnerability affects **NetScaler ADC** and **NetScaler Gateway**, particularly when configured as a Gateway (VPN) 【1】【2】.\n\n* **Active Exploitation:** CVE-2025-6543 has been actively exploited in the wild as a zero-day since at least May 2025 【3】【4】.\n\n* **Attack Vectors/Exploitation Methods:**\n * It is a memory overflow vulnerability 【1】【2】.\n * An attacker can supply a client certificate to overwrite memory 【3】.\n * Exploitation leads to unintended control flow and Denial of Service (DoS) 【1】【2】.\n\n* **Targeted Attacks:** The Dutch NCSC has warned of attacks exploiting CVE-2025-6543 against critical organizations 【5】.\n\n* **CISA KEV Status:** CISA added CVE-2025-6543 to its Known Exploited Vulnerabilities Catalog on June 30, 2025 【6】. This indicates that CISA has evidence of active exploitation and considers it a significant risk 【6】.\n\n* **Technical Details/Internet Exploitability:** CVE-2025-6543 is a critical memory overflow vulnerability that can be exploited to cause a denial of service or potentially achieve arbitrary code execution. It is internet exploitable because it affects network appliances like NetScaler ADC and Gateway, which are often exposed to the internet.\n\nSources:\n- NVD - CVE-2025-6543: https://nvd.nist.gov/vuln/detail/CVE-2025-6543\n- CVE-2025-6543 - Vulnerability Details - OpenCVE: https://app.opencve.io/cve/CVE-2025-6543\n- Citrix forgot to tell you CVE-2025–6543 has been used as a zero ...: https://doublepulsar.com/citrix-forgot-to-tell-you-cve-2025-6543-has-been-used-as-a-zero-day-since-may-2025-d76574e2dd2c\n- CVE-2025-6543: Zero Day Exploitation of NetScaler ADC and ...: https://www.rapid7.com/blog/post/etr-zero-day-exploitation-of-netscaler-adc-and-netscaler-gateway/\n- Dutch NCSC Confirms Active Exploitation of Citrix NetScaler CVE ...: https://thehackernews.com/2025/08/dutch-ncsc-confirms-active-exploitation.html", "references": [ { "title": "NVD - CVE-2025-6543", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6543", "snippet": "Memory overflow vulnerability leading to unintended control flow and Denial of Service in NetScaler ADC and NetScaler Gateway when configured as Gateway.", "is_search_result": true }, { "title": "CVE-2025-6543 - Vulnerability Details - OpenCVE", "url": "https://app.opencve.io/cve/CVE-2025-6543", "snippet": "CVE-2025-6543 - Memory overflow vulnerability leading to unintended control flow and Denial of Service. Sign in.Netscaler Application Delivery Controller.", "is_search_result": true }, { "title": "Citrix forgot to tell you CVE-2025–6543 has been used as a zero ...", "url": "https://doublepulsar.com/citrix-forgot-to-tell-you-cve-2025-6543-has-been-used-as-a-zero-day-since-may-2025-d76574e2dd2c", "snippet": "CVE-2025–6543 is a vulnerability which allows an attacker to supply a client certificate, which overwrites memory. This then allows code ...", "is_search_result": true }, { "title": "CVE-2025-6543: Zero Day Exploitation of NetScaler ADC and ...", "url": "https://www.rapid7.com/blog/post/etr-zero-day-exploitation-of-netscaler-adc-and-netscaler-gateway/", "snippet": "Zero day exploitation in the wild of NetScaler ADC and NetScaler Gateway has been disclosed, due to a new vulnerability CVE-2025-6543.", "is_search_result": true }, { "title": "Dutch NCSC Confirms Active Exploitation of Citrix NetScaler CVE ...", "url": "https://thehackernews.com/2025/08/dutch-ncsc-confirms-active-exploitation.html", "snippet": "Dutch NCSC warns of CVE-2025-6543 Citrix attacks on critical organizations, urging urgent patches to prevent further breaches.", "is_search_result": true } ], "timestamp": "2025-09-06T17:39:37.789576" }, "cache_timestamp": "2025-09-06T17:40:00.701973", "displayed_on_website": false }, { "cve_id": "CVE-2025-64446", "cvss_score": "9.1", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2025-11-14T15:50:52.778Z", "cve_published_date_formatted": "2025-11-14", "kev_date_added": "2025-11-14", "kev_date_added_formatted": "2025-11-14", "kev_due_date": "2025-11-21", "days_to_kev": 0, "days_since_kev": null, "is_new_kev": false, "summary": "Critical path traversal vulnerability in Fortinet FortiWeb web application firewalls allows remote execution of administrative commands via crafted HTTP/HTTPS requests. Active exploitation is occurring in the wild with attackers creating administrative accounts for persistent access.", "detailed_analysis": { "vulnerability_type": "Relative path traversal (CWE-23) leading to privilege escalation and remote command execution", "affected_products": [ "Fortinet FortiWeb 7.0.0-7.0.11", "Fortinet FortiWeb 7.2.0-7.2.11", "Fortinet FortiWeb 7.4.0-7.4.9", "Fortinet FortiWeb 7.6.0-7.6.4", "Fortinet FortiWeb 8.0.0-8.0.1" ], "exploitation_requirements": [ "Network access to FortiWeb appliance", "Ability to send crafted HTTP/HTTPS requests", "No authentication required (PR:N)", "No user interaction required (UI:N)" ], "internet_facing_likelihood": "FortiWeb is a web application firewall (WAF) appliance designed specifically to protect web applications and services. By its very nature as a security appliance that inspects and filters HTTP/HTTPS traffic, it is deployed inline between the internet and protected web applications, making nearly 100% of deployments internet-accessible.", "typical_deployment": "FortiWeb is enterprise security infrastructure software - specifically a web application firewall appliance that sits at network perimeters to protect web applications from attacks", "deployment_statistics": "Approximately 95-100% of FortiWeb deployments are internet-facing, as the primary function of a WAF is to inspect incoming web traffic from the internet before it reaches backend web applications", "active_exploitation": "Confirmed active exploitation in the wild since early November 2025. Attackers are creating administrative accounts and gaining persistent access to compromised FortiWeb appliances", "severity_factors": [ "Critical CVSS score of 9.1", "No authentication required for exploitation", "Remote administrative command execution possible", "Active exploitation confirmed in the wild", "Nearly all deployments are internet-facing by design", "Can lead to complete compromise of WAF appliance" ] }, "recommendations": [ "CRITICAL: Immediately check for indicators of compromise - active exploitation confirmed. Review FortiWeb logs for suspicious HTTP/HTTPS requests with path traversal patterns, check for unauthorized administrative accounts, verify system integrity and configuration changes", "Apply patches immediately: Upgrade to FortiWeb 8.0.2+, 7.6.5+, 7.4.10+, 7.2.12+, or 7.0.12+ depending on your version branch", "Monitor FortiWeb access logs for unusual administrative commands and account creation activities", "Consider temporarily blocking external access to FortiWeb management interfaces if operationally feasible", "HIGHEST patch priority - this is a critical internet-facing vulnerability with active exploitation" ], "risk_assessment": { "exploit_likelihood": "VERY HIGH - Active exploitation confirmed in the wild against internet-facing FortiWeb appliances with no authentication required", "impact_assessment": "CRITICAL - Complete administrative compromise of WAF appliance, potential for persistent access, ability to modify security policies and potentially pivot to protected applications", "exposure_scope": "All internet-facing FortiWeb deployments running affected versions are at immediate risk, representing potentially thousands of enterprise WAF appliances globally" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "CVE-2025-64446 is a critical relative path traversal vulnerability affecting **Fortinet FortiWeb** that allows for remote execution of administrative commands 【2】. Here's a breakdown of what is known about its exploitation:\n\n* **Affected Applications/Services:** The vulnerability affects internet-facing applications and services, specifically **FortiWeb appliances** 【1】.\n* **Active Exploitation:** There is evidence of active, indiscriminate exploitation in the wild since early November 2025 【4】【1】. Attackers are creating administrative accounts and gaining persistent access to affected systems 【1】.\n* **Attack Vectors/Exploitation Methods:** The attack vector is network-based, leading to full administrative compromise 【1】. The vulnerability is a relative path traversal, enabling remote execution of administrative commands 【2】.\n* **Targeted Attacks:** While not explicitly stated, the nature of the exploitation suggests it could be used in targeted attacks 【1】.\n* **CISA KEV Status:** As of now, CVE-2025-64446 is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog 【3】. However, CISA has added other Fortinet vulnerabilities to the KEV catalog in the past 【6】【5】.\n* **Technical Details:** It is a relative path traversal vulnerability that allows for remote execution of administrative commands 【2】.\n\nSources:\n- Threat Advisory : Fortinet FortiWeb active exploit (Nov 2025): https://insights.integrity360.com/threat-advisories/threat-advisory-fortinet-fortiweb-active-exploit-nov-2025\n- CVE-2025-64446 : A relative path traversal vulnerability in Fortinet ...: https://www.cvedetails.com/cve/CVE-2025-64446/\n- Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog\n- Now-Patched Fortinet FortiWeb Flaw Exploited in Attacks to Create Admin ...: https://thehackernews.com/2025/11/fortinet-fortiweb-flaw-actively.html\n- CISA Adds Three Known Exploited Vulnerabilities to Catalog: https://www.cisa.gov/news-events/alerts/2025/11/12/cisa-adds-three-known-exploited-vulnerabilities-catalog", "references": [ { "title": "Threat Advisory : Fortinet FortiWeb active exploit (Nov 2025)", "url": "https://insights.integrity360.com/threat-advisories/threat-advisory-fortinet-fortiweb-active-exploit-nov-2025", "citation_contribution": 518, "snippet": "Summary (TL;DR) A Fortinet FortiWeb vulnerability is being actively exploited in the wild to create administrative accounts and gain persistent access to Internet-exposed FortiWeb appliances. Public proof-of-concept / exploit activity and weaponized code have appeared, and multiple monitoring/honeypot teams report exploitation since early November 2025. Exploitation yields full administrative ...", "is_search_result": true }, { "title": "CVE-2025-64446 : A relative path traversal vulnerability in Fortinet ...", "url": "https://www.cvedetails.com/cve/CVE-2025-64446/", "citation_contribution": 393, "snippet": "Vulnerability Details : CVE-2025-64446 Fortinet FortiWeb Relative Path Traversal Vulnerability Allows Remote Execution of Administrative Commands", "is_search_result": true }, { "title": "Known Exploited Vulnerabilities Catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "citation_contribution": 123, "snippet": "CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild. Organizations should use the KEV catalog as an input to their ...", "is_search_result": true }, { "title": "Now-Patched Fortinet FortiWeb Flaw Exploited in Attacks to Create Admin ...", "url": "https://thehackernews.com/2025/11/fortinet-fortiweb-flaw-actively.html", "citation_contribution": 103, "snippet": "Cybersecurity researchers are sounding the alert about an authentication bypass vulnerability in Fortinet Fortiweb WAF that could allow an attacker to take over admin accounts and completely compromise a device. \"The watchTowr team is seeing active, indiscriminate in-the-wild exploitation of what appears to be a silently patched vulnerability in Fortinet's FortiWeb product,\" Benjamin Harris ...", "is_search_result": true }, { "title": "CISA Adds Three Known Exploited Vulnerabilities to Catalog", "url": "https://www.cisa.gov/news-events/alerts/2025/11/12/cisa-adds-three-known-exploited-vulnerabilities-catalog", "citation_contribution": 43, "snippet": "CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.", "is_search_result": true } ], "timestamp": "2025-11-14T16:55:14.841983" }, "cache_timestamp": "2025-11-14T16:55:35.216957", "displayed_on_website": false }, { "cve_id": "CVE-2025-64328", "cvss_score": "8.6", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2025-11-07T03:32:20.670Z", "cve_published_date_formatted": "2025-11-07", "kev_date_added": "2026-02-03", "kev_date_added_formatted": "2026-02-03", "kev_due_date": "2026-02-24", "days_to_kev": 88, "days_since_kev": null, "is_new_kev": false, "summary": "FreePBX Administration GUI contains an authenticated OS command injection vulnerability that allows attackers to execute arbitrary commands on the system. This vulnerability is actively exploited in the wild and listed in CISA KEV catalog.", "detailed_analysis": { "vulnerability_type": "OS Command Injection (CWE-78) in web-based administration interface", "affected_products": [ "FreePBX Endpoint Manager", "FreePBX Administration GUI" ], "exploitation_requirements": [ "Network access to FreePBX web interface", "Valid authentication credentials", "High privileges on the system" ], "internet_facing_likelihood": "FreePBX systems are commonly deployed as internet-facing services since they are VoIP/telephony server platforms that need to handle external SIP traffic, remote extensions, and administrative access. Estimated 60-70% of deployments have some level of internet exposure for legitimate business functionality.", "typical_deployment": "FreePBX is server software - a complete PBX (Private Branch Exchange) telephony system that runs on Linux servers. It provides web-based administration interfaces and handles VoIP communications.", "deployment_statistics": "Approximately 60-70% of FreePBX deployments are internet-facing due to business requirements for remote workers, external SIP trunks, and remote administration. Many small-to-medium businesses expose these systems directly to the internet.", "active_exploitation": "CONFIRMED - Added to CISA KEV catalog on February 3, 2026. Active exploitation observed since December 2025 with deployment of EncystPHP web shells. Targeted attacks documented from Brazil to India.", "severity_factors": [ "High CVSS score of 8.6", "Active exploitation confirmed by CISA", "Complete system compromise possible", "Commonly internet-facing service", "Used to deploy persistent web shells" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity, scan for EncystPHP web shells", "IMMEDIATE: Update FreePBX security-reporting module to version 17.0.3 or later", "URGENT: Review all user accounts and authentication logs for unauthorized access", "Monitor for suspicious SSH connections, cron jobs, and web shell activities", "Consider restricting administrative interface access to trusted networks only", "Priority: CRITICAL - Patch immediately due to confirmed active exploitation" ], "risk_assessment": { "exploit_likelihood": "VERY HIGH - Confirmed active exploitation in the wild with published exploitation techniques and web shell deployment", "impact_assessment": "HIGH - Complete system compromise possible with command execution as asterisk user, potential for privilege escalation and persistent access", "exposure_scope": "SIGNIFICANT - FreePBX is widely deployed globally with many internet-facing instances for legitimate VoIP services" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "**CVE-2025-64328** is an **OS command injection vulnerability** affecting **Sangoma FreePBX Endpoint Manager** 【2】【5】.\n\nHere's what is known about its exploitation:\n\n- **Internet-Facing Applications/Services**: The vulnerability exists within the FreePBX Endpoint Manager's administrative interface, specifically in the `testconnection -> check_ssh_connect()` function of the Filestore module 【1】【2】. While not explicitly stated as internet-facing, FreePBX systems are often used for communication services and can be exposed to the internet.\n\n- **Evidence of Active Exploitation**: There is clear evidence of active exploitation. CISA added CVE-2025-64328 to its **Known Exploited Vulnerabilities (KEV) Catalog** on February 3, 2026, based on evidence of active exploitation 【2】【5】. Reports indicate that threat actors have been exploiting this vulnerability since early December 2025 【6】.\n\n- **Attack Vectors and Exploitation Methods**: The vulnerability allows for **post-authentication command injection** by an authenticated user 【1】【2】. Attackers can leverage this to gain **remote access** to the system as an asterisk user 【1】. It has been used to deploy a **weaponized web shell** called EncystPHP, enabling Remote Code Execution (RCE), privileged user access, SSH key injection, and cron persistence 【3】【7】.\n\n- **Targeted Attacks**: Evidence suggests targeted attacks. One incident involved a web shell delivered via CVE-2025-64328, originating from Brazil and targeting a victim in India managed by a cloud solutions and IT infrastructure company 【3】.\n\n- **CISA Known Exploited Vulnerabilities Status**: **CVE-2025-64328 is listed in the CISA Known Exploited Vulnerabilities (KEV) Catalog** 【2】【5】. This means CISA has confirmed evidence of its exploitation in the wild and requires U.S. federal agencies to apply available vendor patches or mitigations by a specific deadline.\n\n- **Technical Details about Internet Exploitability**: The vulnerability requires **authentication** to be exploited, meaning an attacker must first gain access to a legitimate user account on the FreePBX system 【1】【2】. Once authenticated, the attacker can inject OS commands through the vulnerable function. The Exploit Prediction Scoring System (EPSS) indicated an 11.03% probability of exploitation activity in the 30 days prior to November 7, 2025 【4】. The vulnerability is fixed in version 17.0.3 of FreePBX Endpoint Manager 【1】.\n\nSources:\n- CVE-2025-64328 Security Vulnerability & Exploit Details: https://cve.akaoma.com/cve-2025-64328\n- Known Exploited Vulnerabilities Catalog - CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog\n- Unveiling the Weaponized Web Shell EncystPHP: https://www.fortinet.com/blog/threat-research/unveiling-the-weaponized-web-shell-encystphp\n- CVE-2025-64328 : FreePBX Endpoint Manager is a module for managing ...: https://www.cvedetails.com/cve/CVE-2025-64328/\n- CISA Adds Four Known Exploited Vulnerabilities to Catalog: https://www.cisa.gov/news-events/alerts/2026/02/03/cisa-adds-four-known-exploited-vulnerabilities-catalog", "references": [ { "title": "CVE-2025-64328 Security Vulnerability & Exploit Details", "url": "https://cve.akaoma.com/cve-2025-64328", "citation_contribution": 571, "snippet": "CVE-2025-64328 Vulnerability Analysis & Exploit Details.CVE-2025-64328: FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. In versions 17.0.2.36 and above before 17.0.3, the filestore module within the Administrative interface is vulnerable to a post-authentication command injection by an authenticated known user via the testconnection -> check_ssh_connect() function. An attacker can leverage this vulnerability to obtain remote access to the system as an asterisk user. This issue is fixed in version 17.0.3.", "is_search_result": true }, { "title": "Known Exploited Vulnerabilities Catalog - CISA", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "citation_contribution": 529, "snippet": "For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild. ... https://www.solarwinds.com/trust-center/security-advisories/cve-2025-40551 ; https://nvd ... https://github.com/FreePBX/security-reporting/security/advisories/GHSA-vm9p-46mv-5xvw ; https://nvd.nist.gov/vuln/detail/CVE-2025-64328", "is_search_result": true }, { "title": "Unveiling the Weaponized Web Shell EncystPHP", "url": "https://www.fortinet.com/blog/threat-research/unveiling-the-weaponized-web-shell-encystphp", "citation_contribution": 336, "snippet": "Incidents The web shell was delivered via CVE-2025-64328, a post-authentication command-injection vulnerability in the administrative interface of the FreePBX Endpoint Manager. The exploit originated from Brazil and targeted a victim environment managed by an Indian technology company specializing in cloud solutions, communication services, and IT infrastructure.", "is_search_result": true }, { "title": "CVE-2025-64328 : FreePBX Endpoint Manager is a module for managing ...", "url": "https://www.cvedetails.com/cve/CVE-2025-64328/", "citation_contribution": 232, "snippet": "Exploit prediction scoring system (EPSS) score for CVE-2025-64328 EPSS FAQ 11.03% Probability of exploitation activity in the next 30 days EPSS Score History", "is_search_result": true }, { "title": "CISA Adds Four Known Exploited Vulnerabilities to Catalog", "url": "https://www.cisa.gov/news-events/alerts/2026/02/03/cisa-adds-four-known-exploited-vulnerabilities-catalog", "citation_contribution": 132, "snippet": "CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2019-19006", "is_search_result": true } ], "timestamp": "2026-02-05T16:10:15.457604" }, "cache_timestamp": "2026-02-05T16:10:32.393068", "displayed_on_website": false }, { "cve_id": "CVE-2025-6264", "cvss_score": "5.5", "attack_vector": "NETWORK", "cisa_kev_listed": false, "internet_exploitable": "MEDIUM_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "MEDIUM", "cve_published_date": "2025-06-20T02:01:33.993Z", "cve_published_date_formatted": null, "kev_date_added": null, "kev_date_added_formatted": null, "kev_due_date": null, "days_to_kev": null, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2025-6264 is a privilege escalation vulnerability in Rapid7 Velociraptor that allows users with COLLECT_CLIENT permissions to execute arbitrary commands and take over endpoints. The vulnerability has been actively exploited in ransomware attacks and affects internet-facing Velociraptor server deployments.", "detailed_analysis": { "vulnerability_type": "Privilege escalation via insufficient permission enforcement in artifact collection", "affected_products": [ "Rapid7 Velociraptor < 0.74.3" ], "exploitation_requirements": [ "Network access to Velociraptor server", "Valid user account with COLLECT_CLIENT permissions (Investigator role)", "High privileges required (PR:H)" ], "internet_facing_likelihood": "Velociraptor is frequently deployed as an internet-facing server application for incident response and endpoint monitoring. Many organizations expose Velociraptor servers to the internet to enable remote endpoint management and forensic collection across distributed networks. Estimated 40-60% of enterprise deployments are internet-accessible.", "typical_deployment": "Velociraptor is primarily server software designed for digital forensics and incident response (DFIR). It operates as a centralized server that manages and collects artifacts from distributed endpoints across networks.", "deployment_statistics": "Approximately 50% of Velociraptor deployments are internet-facing, as organizations commonly need remote access for incident response teams, managed security service providers (MSSPs), and distributed workforce monitoring. The nature of incident response often requires immediate external access during security events.", "active_exploitation": "CISA ADP data indicates active exploitation in the wild. Web search confirms the vulnerability has been leveraged in ransomware attacks, with threat actors using Velociraptor as a remote access tool.", "severity_factors": [ "Active exploitation in ransomware campaigns", "Leads to arbitrary command execution", "Affects internet-facing DFIR infrastructure", "Requires existing privileged access", "High attack complexity (AC:H)" ] }, "recommendations": [ "Immediately update Velociraptor to version 0.74.3 or later", "Implement basic artifacts mechanism to restrict artifact execution", "Monitor for unauthorized use of Admin.Client.UpdateClientConfig artifact", "Review and audit user permissions, especially COLLECT_CLIENT assignments", "Enable artifact verifier to detect privilege escalation attempts" ], "risk_assessment": { "exploit_likelihood": "Medium - requires authenticated access with specific permissions, but active exploitation observed in ransomware attacks targeting internet-facing Velociraptor servers", "impact_assessment": "High - successful exploitation leads to arbitrary command execution and complete endpoint takeover with elevated privileges", "exposure_scope": "Medium - affects organizations using Velociraptor for incident response and endpoint monitoring, particularly those with internet-accessible deployments" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "CVE-2025-6264 is a privilege escalation vulnerability found in Rapid7's Velociraptor. Here's what is known about its exploitation:\n\n* **Affected Applications/Services:** Velociraptor installations on Windows, MacOS, and Linux platforms before version 0.74.3 are affected 【1】.\n* **Active Exploitation:** The vulnerability has been actively exploited in the wild, including being leveraged in ransomware attacks 【5】【2】.\n* **Attack Vectors/Exploitation Methods:**\n * The vulnerability allows for arbitrary command execution and endpoint takeover 【1】.\n * To exploit it, an attacker needs `COLLECT_CLIENT` permissions, typically associated with the \"Investigator\" role 【3】.\n * The vulnerability stems from the `Admin.Client` component and involves updating the configuration 【1】.\n* **Targeted Attacks:** Velociraptor has been observed being used in ransomware attacks 【2】.\n* **CISA KEV Status:** CVE-2025-6264 is not listed in the CISA Known Exploited Vulnerabilities Catalog.\n* **Internet Exploitability:** The attack vector is more severe the more remote an attacker can be to exploit it 【4】.\n\nSources:\n- CVE-2025-6264 Impact, Exploitability, and Mitigation Steps | Wiz: https://www.wiz.io/vulnerability-database/cve/cve-2025-6264\n- Velociraptor leveraged in ransomware attacks: https://blog.talosintelligence.com/velociraptor-leveraged-in-ransomware-attacks/\n- NVD - CVE-2025-6264: https://nvd.nist.gov/vuln/detail/CVE-2025-6264/change-record?changeRecordedOn=06/19/2025T23:15:27.893-0400\n- Velociraptor vulnerable to privilege escalation via UpdateConfig artifact...: https://github.com/advisories/GHSA-gpfc-mph4-qm24\n- CVE-2025-21707 | CyberSecurityBoard: https://cybersecurityboard.com/cve/cve-2025-21707", "references": [ { "title": "CVE-2025-6264 Impact, Exploitability, and Mitigation Steps | Wiz", "url": "https://www.wiz.io/vulnerability-database/cve/cve-2025-6264", "citation_contribution": 334, "snippet": "The vulnerability affects Rapid7 Velociraptor installations on Windows, MacOS, and Linux platforms before version 0.74.3. The issue stems from the Admin.Client.", "is_search_result": true }, { "title": "Velociraptor leveraged in ransomware attacks", "url": "https://blog.talosintelligence.com/velociraptor-leveraged-in-ransomware-attacks/", "citation_contribution": 133, "snippet": "In August 2025, Talos responded to a ransomware attack ... 2025-6264) that could lead to arbitrary command execution and endpoint takeover.", "is_search_result": true }, { "title": "NVD - CVE-2025-6264", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6264/change-record?changeRecordedOn=06/19/2025T23:15:27.893-0400", "citation_contribution": 121, "snippet": "National Vulnerability Database.Change History. New CVE Received from Rapid7, Inc. 6/19/2025 11:15:27 PM. Action. Type.", "is_search_result": true }, { "title": "Velociraptor vulnerable to privilege escalation via UpdateConfig artifact...", "url": "https://github.com/advisories/GHSA-gpfc-mph4-qm24", "citation_contribution": 115, "snippet": "CVSS v3 base metrics. Attack vector: More severe the more the remote (logically and physically) an attacker can be in order to exploit the ...", "is_search_result": true }, { "title": "CVE-2025-21707 | CyberSecurityBoard", "url": "https://cybersecurityboard.com/cve/cve-2025-21707", "citation_contribution": 92, "snippet": "... security update for its Chrome browser to address a critical zero-day vulnerability, CVE-2025-6558, that is being actively exploited in the wild.", "is_search_result": true } ], "timestamp": "2025-10-14T17:55:17.673085" }, "cache_timestamp": "2025-10-14T17:55:34.584879", "displayed_on_website": false }, { "cve_id": "CVE-2025-62221", "cvss_score": "7.8", "attack_vector": "LOCAL", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1068", "deployment_likelihood": "LOW", "cve_published_date": "2025-12-09T17:56:10.169Z", "cve_published_date_formatted": "2025-12-09", "kev_date_added": "2025-12-09", "kev_date_added_formatted": "2025-12-09", "kev_due_date": "2025-12-30", "days_to_kev": 0, "days_since_kev": null, "is_new_kev": false, "summary": "A use-after-free vulnerability in Windows Cloud Files Mini Filter Driver allows local privilege escalation. Despite being in CISA KEV indicating active exploitation, this requires local authenticated access and cannot be exploited directly from the internet.", "detailed_analysis": { "vulnerability_type": "Use-after-free in Windows Cloud Files Mini Filter Driver leading to privilege escalation", "affected_products": [ "Windows 10 (all versions)", "Windows 11 (all versions)", "Windows Server 2019", "Windows Server 2022", "Windows Server 2025" ], "exploitation_requirements": [ "Local authenticated access", "Ability to interact with Cloud Files Mini Filter Driver" ], "internet_facing_likelihood": "This is a local driver vulnerability that cannot be directly exploited over the internet. While Windows Servers may be internet-facing, the vulnerable component (mini filter driver) requires local system access to trigger the use-after-free condition.", "typical_deployment": "The Cloud Files Mini Filter Driver is a local system component that handles cloud file synchronization operations. It is not a network service that accepts connections.", "deployment_statistics": "0% - This vulnerability cannot be exploited remotely as it requires local access to trigger the driver vulnerability.", "active_exploitation": "Listed in CISA KEV catalog indicating active exploitation in the wild, likely used by attackers who have already gained initial access to escalate privileges", "severity_factors": [ "High CVSS score of 7.8", "Active exploitation confirmed by CISA KEV listing", "Allows complete system compromise once exploited", "Requires only low privileges to exploit" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Apply security updates immediately to patch the Cloud Files Mini Filter Driver vulnerability", "Monitor for unusual privilege escalation activities and unauthorized administrative access", "Review access controls and implement principle of least privilege to limit potential impact", "Priority: HIGH for patching due to active exploitation, but not critical for internet-facing exposure since local access is required" ], "risk_assessment": { "exploit_likelihood": "High for systems where attackers have already gained initial access, but cannot be exploited directly from the internet", "impact_assessment": "Complete system compromise and privilege escalation from low-privileged user to administrator/system level access", "exposure_scope": "Limited to scenarios where attackers have already compromised user accounts or gained local access through other means" }, "exploitation_method": "OTHER", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:24:23.174600", "displayed_on_website": false }, { "cve_id": "CVE-2025-62215", "cvss_score": "7.0", "attack_vector": "LOCAL", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1068", "deployment_likelihood": "VERY_LOW", "cve_published_date": "2025-11-11T17:59:48.205Z", "cve_published_date_formatted": "2025-11-11", "kev_date_added": "2025-11-12", "kev_date_added_formatted": "2025-11-12", "kev_due_date": "2025-12-03", "days_to_kev": 1, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2025-62215 is a Windows kernel race condition vulnerability that allows local privilege escalation. While it affects Windows Server products, the CVSS attack vector is LOCAL (AV:L) requiring existing system access, making it unsuitable for direct internet exploitation.", "detailed_analysis": { "vulnerability_type": "Race condition in Windows Kernel leading to privilege escalation (CWE-362, CWE-415)", "affected_products": [ "Windows Server 2019", "Windows Server 2022", "Windows Server 2025", "Windows 10 (various versions)", "Windows 11 (various versions)" ], "exploitation_requirements": [ "Local system access required", "Authenticated user session", "Ability to execute code on target system", "Low-privilege user account" ], "internet_facing_likelihood": "While Windows Server products are commonly internet-facing, this specific vulnerability requires LOCAL attack vector (AV:L in CVSS), meaning the attacker must already have access to the system. The vulnerability cannot be exploited directly over the network against internet-facing Windows servers.", "typical_deployment": "Windows Server products are frequently deployed as internet-facing servers (web servers, application servers, domain controllers), but this kernel vulnerability specifically requires local access to exploit", "deployment_statistics": "Estimated 0% of deployments are directly exploitable over the internet due to LOCAL attack vector requirement. However, ~80% of Windows Server deployments may be internet-facing for their primary services, making this a valuable post-compromise escalation vector.", "active_exploitation": "Listed in CISA KEV catalog indicating active exploitation in the wild, likely used as a privilege escalation component in multi-stage attacks", "severity_factors": [ "HIGH CVSS base score of 7.0", "Active exploitation confirmed (CISA KEV)", "Affects multiple Windows versions including latest", "Race condition can be difficult to detect", "Requires local access (reduces immediate internet risk)" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs for suspicious privilege escalation activity, check for unauthorized administrative access, verify system integrity", "Apply Microsoft security updates immediately for all affected Windows systems", "Monitor for unusual process creation or privilege changes on Windows systems", "Implement enhanced logging for privilege escalation attempts", "Priority: HIGH for patching due to active exploitation, though not directly internet-exploitable" ], "risk_assessment": { "exploit_likelihood": "LOW for direct internet exploitation (requires local access first), but HIGH for post-compromise privilege escalation given active exploitation", "impact_assessment": "HIGH impact once exploited - allows complete system compromise through kernel-level privilege escalation", "exposure_scope": "No internet-facing systems directly vulnerable, but all Windows systems with local user access are at risk for privilege escalation" }, "exploitation_method": "OTHER", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:21:56.817263", "displayed_on_website": false }, { "cve_id": "CVE-2025-6218", "cvss_score": "7.8", "attack_vector": "LOCAL", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1203", "deployment_likelihood": "VERY_LOW", "cve_published_date": "2025-06-21T00:09:02.884Z", "cve_published_date_formatted": "2025-06-21", "kev_date_added": "2025-12-09", "kev_date_added_formatted": "2025-12-09", "kev_due_date": "2025-12-30", "days_to_kev": 171, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2025-6218 is a directory traversal vulnerability in RARLAB WinRAR that allows remote code execution when a user opens a malicious archive file. Despite being on CISA KEV, this is a client-side vulnerability requiring user interaction and does not affect internet-facing services.", "detailed_analysis": { "vulnerability_type": "Directory Traversal Remote Code Execution in archive processing", "affected_products": [ "WinRAR" ], "exploitation_requirements": [ "User must open a malicious archive file", "No authentication required", "Local file access needed" ], "internet_facing_likelihood": "WinRAR is a desktop client application for archive file management, not a server application. It is not designed to be deployed as an internet-facing service and has no business use case for internet exposure. Essentially 0% of WinRAR installations are internet-accessible services.", "typical_deployment": "WinRAR is exclusively client software - a desktop application for creating and extracting archive files. It runs on end-user workstations and is not server software.", "deployment_statistics": "Less than 0.1% likelihood of internet-facing deployment. WinRAR is not designed for server deployment and has no legitimate business case for internet exposure.", "active_exploitation": "Listed in CISA KEV catalog indicating active exploitation in the wild, likely through phishing campaigns delivering malicious RAR files", "severity_factors": [ "High impact RCE when exploited", "Requires user interaction to open malicious file", "Client-side vulnerability only", "No authentication bypass of internet services", "Limited to compromising individual user workstations" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Update WinRAR to the latest version immediately on all workstations", "Implement email security controls to block malicious archive attachments", "Train users on the risks of opening unknown archive files", "Consider application allowlisting to prevent unauthorized executable deployment", "Monitor for suspicious file extraction activities and unexpected process execution" ], "risk_assessment": { "exploit_likelihood": "High likelihood through phishing/social engineering, but virtually zero likelihood of direct internet exploitation since WinRAR is not server software", "impact_assessment": "High impact on individual workstations - full user context code execution, but limited scope per incident", "exposure_scope": "No internet-facing systems affected as WinRAR is client software not designed for server deployment" }, "exploitation_method": "USER_INTERACTION", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:24:01.756844", "displayed_on_website": false }, { "cve_id": "CVE-2025-6205", "cvss_score": "9.1", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2025-08-04T09:14:42.308Z", "cve_published_date_formatted": "2025-08-04", "kev_date_added": "2025-10-28", "kev_date_added_formatted": "2025-10-28", "kev_due_date": "2025-11-18", "days_to_kev": 85, "days_since_kev": null, "is_new_kev": false, "summary": "Critical missing authorization vulnerability in DELMIA Apriso manufacturing execution system allows unauthenticated attackers to gain privileged access over the network. CISA coordinator notes active exploitation is occurring in the wild.", "detailed_analysis": { "vulnerability_type": "Missing Authorization (CWE-862) - allows bypassing access controls to gain privileged application access", "affected_products": [ "DELMIA Apriso (Releases 2020-2025)" ], "exploitation_requirements": [ "Network access to DELMIA Apriso application", "No authentication required (PR:N)", "No user interaction required (UI:N)" ], "internet_facing_likelihood": "DELMIA Apriso is a manufacturing execution system (MES) that commonly requires internet connectivity for multi-site manufacturing operations, supply chain integration, remote monitoring, and mobile workforce access. Manufacturing companies frequently expose MES systems to the internet to enable connectivity between facilities, remote access for engineers and managers, and integration with cloud-based analytics platforms.", "typical_deployment": "Server-side enterprise application deployed as web-based manufacturing execution system with database backend, typically running on Windows/Linux servers with web interfaces", "deployment_statistics": "Estimated 60-70% of DELMIA Apriso deployments are internet-facing due to the distributed nature of modern manufacturing operations requiring remote site connectivity, mobile access, and cloud integration", "active_exploitation": "CISA ADP analysis indicates active exploitation with 'Exploitation: active' status, suggesting attackers are actively targeting this vulnerability in the wild", "severity_factors": [ "Critical CVSS 9.1 score", "No authentication required", "Network-based attack vector", "High confidentiality and integrity impact", "Active exploitation confirmed by CISA", "Affects multiple recent releases (2020-2025)" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - CISA coordinator indicates active exploitation. Immediately review access logs for unauthorized privileged access, verify user accounts and permissions, check for data exfiltration or unauthorized modifications", "Apply security patches immediately for affected DELMIA Apriso releases 2020-2025", "Implement network segmentation to limit internet exposure if possible", "Enable comprehensive logging and monitor for privilege escalation attempts", "Review and audit all user accounts and access permissions", "Consider temporary network isolation until patching is complete" ], "risk_assessment": { "exploit_likelihood": "Very High - Active exploitation confirmed by CISA with no authentication required and network-based attack vector", "impact_assessment": "Critical - Allows complete compromise of manufacturing execution system with high confidentiality and integrity impact, potentially disrupting production operations", "exposure_scope": "Significant - Manufacturing companies globally using DELMIA Apriso with internet-facing deployments are at immediate risk" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": {}, "cache_timestamp": "2025-10-28T17:35:53.637893", "displayed_on_website": false }, { "cve_id": "CVE-2025-6204", "cvss_score": "8.0", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "MEDIUM_RISK", "confidence": "MEDIUM", "mitre_technique": "T1190", "deployment_likelihood": "MEDIUM", "cve_published_date": "2025-08-04T09:14:08.343Z", "cve_published_date_formatted": "2025-08-04", "kev_date_added": "2025-10-28", "kev_date_added_formatted": "2025-10-28", "kev_due_date": "2025-11-18", "days_to_kev": 85, "days_since_kev": null, "is_new_kev": false, "summary": "Code injection vulnerability in Dassault Systèmes DELMIA Apriso manufacturing operations management platform allows arbitrary code execution. Requires high privileges but exploitable over network without user interaction.", "detailed_analysis": { "vulnerability_type": "Code Injection (CWE-94) - Improper Control of Generation of Code allowing arbitrary code execution", "affected_products": [ "Dassault DELMIA Apriso (Release 2020-2025)" ], "exploitation_requirements": [ "High privileges required", "Network access to Apriso system", "High attack complexity" ], "internet_facing_likelihood": "DELMIA Apriso is a manufacturing operations management platform that is commonly deployed as a web-based enterprise application accessible to factory floor systems, supply chain partners, and remote workers. While not universally internet-facing like traditional web servers, many deployments expose Apriso interfaces to the internet for partner integration and remote access. Estimated 40-60% of enterprise deployments have some internet-accessible components.", "typical_deployment": "Server-based enterprise manufacturing software typically deployed as web applications with databases, often requiring integration with external partners and remote access capabilities", "deployment_statistics": "Estimated 50% of deployments have internet-facing components due to business requirements for partner integration, remote monitoring, and supply chain connectivity in modern manufacturing environments", "active_exploitation": "CISA ADP analysis indicates 'active' exploitation according to SSVC scoring, suggesting this vulnerability may be seeing exploitation in the wild", "severity_factors": [ "High CVSS score of 8.0", "Network attack vector", "No user interaction required", "Changed scope allowing broader system access", "Active exploitation indicated by CISA analysis", "High privilege requirement reduces immediate risk" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - CISA analysis indicates active exploitation. Review Apriso system logs for unusual administrative activity, unauthorized code execution, or suspicious file modifications", "Apply security patches immediately for affected DELMIA Apriso versions (2020-2025)", "Restrict network access to Apriso systems and implement network segmentation", "Monitor for unusual administrative activities and code execution patterns", "Audit user privileges and remove unnecessary high-privilege accounts", "HIGH priority patching due to active exploitation evidence" ], "risk_assessment": { "exploit_likelihood": "Medium - Network exploitable code injection with active exploitation evidence, but requires high privileges which limits immediate attack surface", "impact_assessment": "High - Complete system compromise possible with confidentiality, integrity, and availability impact across manufacturing operations", "exposure_scope": "Medium - Manufacturing enterprises with internet-facing Apriso deployments, estimated thousands of potential targets globally" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": {}, "cache_timestamp": "2025-10-28T17:35:35.018612", "displayed_on_website": false }, { "cve_id": "CVE-2025-61932", "cvss_score": "9.8", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "MEDIUM_RISK", "confidence": "MEDIUM", "mitre_technique": "T1190", "deployment_likelihood": "MEDIUM", "cve_published_date": "2025-10-20T07:25:39.916Z", "cve_published_date_formatted": "2025-10-20", "kev_date_added": "2025-10-22", "kev_date_added_formatted": "2025-10-22", "kev_due_date": "2025-11-12", "days_to_kev": 2, "days_since_kev": null, "is_new_kev": false, "summary": "Critical vulnerability in Motex Lanscope Endpoint Manager allowing remote code execution through improper verification of incoming network requests. Active exploitation confirmed with CISA KEV listing.", "detailed_analysis": { "vulnerability_type": "Improper Verification of Source of a Communication Channel (CWE-940) leading to remote code execution", "affected_products": [ "Motex Lanscope Endpoint Manager On-Premises v9.4.7.1 and earlier" ], "exploitation_requirements": [ "Network access to endpoint manager service", "No authentication required", "No user interaction required" ], "internet_facing_likelihood": "Endpoint management systems are commonly deployed with internet-facing components for remote management capabilities, particularly management consoles and agent communication endpoints. However, security best practices recommend restricting such access.", "typical_deployment": "Enterprise endpoint management server software that manages client endpoints and detection agents across corporate networks. Often includes web-based management interfaces and agent communication services.", "deployment_statistics": "Estimated 30-50% of deployments may have internet-facing components, as organizations often need remote management capabilities for distributed workforces, though many implement VPN or other access controls", "active_exploitation": "Confirmed active exploitation in the wild according to web search results and CISA KEV listing", "severity_factors": [ "CVSS 9.8 Critical score", "No authentication required", "Remote code execution capability", "Active exploitation confirmed", "Low attack complexity", "Network-based attack vector" ] }, "recommendations": [ "CRITICAL: Immediately update to patched version above v9.4.7.1", "Restrict network access to endpoint manager services from internet if possible", "Monitor for suspicious network traffic and unauthorized access attempts", "Implement network segmentation to limit exposure of management interfaces" ], "risk_assessment": { "exploit_likelihood": "HIGH - Active exploitation confirmed, no authentication required, and straightforward network-based attack", "impact_assessment": "CRITICAL - Remote code execution with potential for complete system compromise and lateral movement through managed endpoints", "exposure_scope": "MODERATE - Limited to organizations using Motex Lanscope Endpoint Manager with internet-facing deployments, but high impact where present" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "CVE-2025-61932 is a critical vulnerability affecting **Motex LANSCOPE Endpoint Manager (On-Premises)**, with a CVSS score of 9.8, indicating a severe risk 【2】【5】.\n\nHere's a breakdown of what is known about its exploitation:\n\n* **Affected Applications/Services**: The vulnerability affects internet-facing applications and services, specifically the **Client program (MR)** and **Detection agent (DA)** of the on-premise edition of LANSCOPE Endpoint Manager 【3】【1】. The Cloud Edition is not affected 【5】.\n* **Active Exploitation**: There is evidence of **active exploitation in the wild** 【6】【7】.\n* **Attack Vectors/Exploitation Methods**: The vulnerability stems from **improper verification of the origin of incoming network requests** 【1】【3】. Attackers can exploit this by sending **specially crafted packets** to execute arbitrary code 【3】. The attack does not require user interaction or special privileges 【5】【2】.\n* **Targeted Attacks**: While the provided information confirms active exploitation, it **does not specifically detail whether CVE-2025-61932 has been used in targeted attacks**.\n* **CISA KEV Status**: CVE-2025-61932 has been added to the **CISA Known Exploited Vulnerabilities Catalog**, demanding immediate intervention 【4】【7】.\n* **Technical Details/Internet Exploitability**: The vulnerability is due to **improper verification of communication channel sources (CWE-940)** 【4】【6】. It has low attack complexity and requires no privileges, making it an easy target for cybercriminals 【2】.\n\nSources:\n- CVE-2025-61932 - Exploits & Severity - Feedly: https://feedly.com/cve/CVE-2025-61932\n- CVE-2025-61932 Security Vulnerability & Exploit Details: https://cve.akaoma.com/cve-2025-61932\n- CVE-2025-61932 : Lanscope Endpoint Manager (On-Premises) (Client ...: https://www.cvedetails.com/cve/CVE-2025-61932/\n- Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog\n- LANSCOPE Endpoint Manager Flaw Allows Remote Code Execution: https://gbhackers.com/lanscope-endpoint-manager-flaw/", "references": [ { "title": "CVE-2025-61932 - Exploits & Severity - Feedly", "url": "https://feedly.com/cve/CVE-2025-61932", "citation_contribution": 267, "snippet": "NVD published the first details for CVE-2025-61932.CVE-2025-61932 9.8 Lanscope Endpoint Manager (On-Premises) (Client program (MR) and Detection agent (DA)) improperly verifies the origin of incoming requests, allowing attackers to perform unauthorized actions. CVE-2025-11948 9.8 Document Management System developed by Excellent Infotek has an Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload arbitrary files.", "is_search_result": true }, { "title": "CVE-2025-61932 Security Vulnerability & Exploit Details", "url": "https://cve.akaoma.com/cve-2025-61932", "citation_contribution": 218, "snippet": "The exploitability of CVE-2025-61932 depends on two key factors: attack complexity (the level of effort required to execute an exploit) and privileges required (the access level an attacker needs). Exploitability Analysis for CVE-2025-61932 With low attack complexity and no required privileges, CVE-2025-61932 is an easy target for cybercriminals. Organizations should prioritize immediate ...", "is_search_result": true }, { "title": "CVE-2025-61932 : Lanscope Endpoint Manager (On-Premises) (Client ...", "url": "https://www.cvedetails.com/cve/CVE-2025-61932/", "citation_contribution": 203, "snippet": "Lanscope Endpoint Manager (On-Premises) (Client program (MR) and Detection agent (DA)) improperly verifies the origin of incoming requests, allowing an attacker to execute arbitrary code by sending specially crafted packets.", "is_search_result": true }, { "title": "Known Exploited Vulnerabilities Catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "citation_contribution": 203, "snippet": "CVE-2025-61932. Motex LANSCOPE Endpoint Manager Improper Verification of Source of a Communication Channel Vulnerability: · Related CWE: CWE-940. Known To Be ...", "is_search_result": true }, { "title": "LANSCOPE Endpoint Manager Flaw Allows Remote Code Execution", "url": "https://gbhackers.com/lanscope-endpoint-manager-flaw/", "citation_contribution": 138, "snippet": "The attack does not require user interaction, meaning systems are at risk even if no one clicks on a suspicious link or opens an email attachment. For organizations using Endpoint Manager On-Premise Edition, the risk is urgent, while users of the Cloud Edition remain unaffected. The vulnerability carries a CVSS 3.0 score of 9.8, placing it in the “emergency” category due to its potential impact and ease of exploitation. Below is a summary of the affected components: CVE ID. Product. CVSS 3.0 Score. CVE-2025-61932. LANSCOPE Endpoint Manager On-Premise Edition.", "is_search_result": true } ], "timestamp": "2025-10-22T17:35:18.731846" }, "cache_timestamp": "2025-10-22T17:35:34.830377", "displayed_on_website": false }, { "cve_id": "CVE-2025-61884", "cvss_score": "7.5", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2025-10-12T02:34:51.603Z", "cve_published_date_formatted": "2025-10-12", "kev_date_added": "2025-10-20", "kev_date_added_formatted": "2025-10-20", "kev_due_date": "2025-11-10", "days_to_kev": 8, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2025-61884 is a high-severity vulnerability in Oracle E-Business Suite Configurator that allows unauthenticated remote attackers to access critical data via HTTP. The vulnerability has been actively exploited in the wild and added to CISA's KEV catalog.", "detailed_analysis": { "vulnerability_type": "Authentication bypass leading to unauthorized data access in web application component", "affected_products": [ "Oracle E-Business Suite Configurator 12.2.3-12.2.14" ], "exploitation_requirements": [ "Network access via HTTP", "No authentication required", "No user interaction needed", "Access to /configurator/UiServlet endpoint" ], "internet_facing_likelihood": "Oracle E-Business Suite is enterprise business application software that is very commonly deployed as internet-facing web applications. The Configurator component is part of the web-based user interface that customers and employees access remotely. Estimated 70-80% of E-Business Suite deployments have some internet-facing components for remote user access.", "typical_deployment": "Oracle E-Business Suite is server-side enterprise application software deployed on web servers with database backends. It provides web-based business applications accessed by users through browsers.", "deployment_statistics": "Approximately 70-80% of Oracle E-Business Suite deployments are internet-facing to support remote employees, customers, and business partners accessing business applications and self-service portals.", "active_exploitation": "Confirmed active exploitation in the wild. CISA added to KEV catalog. Proof-of-concept exploit leaked by ShinyHunters group targeting the /configurator/UiServlet endpoint.", "severity_factors": [ "No authentication required", "Network-accessible via HTTP", "Active exploitation confirmed", "Easily exploitable (low complexity)", "Complete data access possible", "Commonly internet-facing deployment" ] }, "recommendations": [ "Apply Oracle emergency patch immediately for all internet-facing E-Business Suite instances", "Monitor /configurator/UiServlet endpoint for suspicious access attempts", "Implement network segmentation to limit E-Business Suite exposure", "Review access logs for potential compromise indicators", "CRITICAL patch priority - exploit code is public and actively used" ], "risk_assessment": { "exploit_likelihood": "Very high - exploit code is publicly available, no authentication required, and active exploitation confirmed in the wild", "impact_assessment": "High - complete access to Oracle Configurator data, potential for data theft and business disruption", "exposure_scope": "Large - Oracle E-Business Suite is widely deployed in enterprises globally with many internet-facing instances" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Known", "ransomware_first_seen_date": "2026-02-14", "ransomware_days_after_kev": 117, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "CVE-2025-61884 is a high-severity vulnerability affecting Oracle E-Business Suite, specifically the Oracle Configurator component 【6】. Here's what is known about its exploitation:\n\n* **Internet-facing applications or services:** The vulnerability affects internet-facing applications and services. It is remotely exploitable over a network without needing a username or password 【10】【3】.\n* **Evidence of active exploitation in the wild:** CVE-2025-61884 has been actively exploited in the wild 【8】.\n* **Attack vectors and exploitation methods:** The vulnerability can be exploited via HTTP, allowing an unauthenticated attacker with network access to compromise the Oracle Configurator 【7】【4】. A proof-of-concept exploit was leaked by the ShinyHunters group and targets the `/configurator/UiServlet` endpoint in Oracle E-Business Suite as part of the attack chain 【5】【11】.\n* **Targeted attacks:** While not explicitly stated, the active exploitation of this vulnerability suggests it may be used in targeted attacks 【1】.\n* **CISA Known Exploited Vulnerabilities status:** CISA has added CVE-2025-61884 to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation 【1】【9】.\n* **Technical details about internet exploitability:** The vulnerability is easily exploitable, requiring only network access via HTTP. Successful exploitation can lead to unauthorized access to critical data or complete access to the Oracle Configurator 【7】【2】.\n\nSources:\n- CISA Adds Five Known Exploited Vulnerabilities to Catalog: https://www.cisa.gov/news-events/alerts/2025/10/20/cisa-adds-five-known-exploited-vulnerabilities-catalog\n- CVE-2025-61884 Detail - NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-61884\n- Oracle releases emergency patch for new E-Business Suite flaw: https://www.bleepingcomputer.com/news/security/oracle-releases-emergency-patch-for-new-e-business-suite-flaw/\n- CVE-2025-61884 - Vulnerability Details - OpenCVE: https://app.opencve.io/cve/CVE-2025-61884\n- Oracles silently fixes zero-day exploit leaked by ShinyHunters: https://www.bleepingcomputer.com/news/security/oracles-silently-fixes-zero-day-exploit-leaked-by-shinyhunters/", "references": [ { "title": "CISA Adds Five Known Exploited Vulnerabilities to Catalog", "url": "https://www.cisa.gov/news-events/alerts/2025/10/20/cisa-adds-five-known-exploited-vulnerabilities-catalog", "citation_contribution": 225, "snippet": "CVE-2025 ... These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal ...", "is_search_result": true }, { "title": "CVE-2025-61884 Detail - NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61884", "citation_contribution": 164, "snippet": "Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Configurator ...", "is_search_result": true }, { "title": "Oracle releases emergency patch for new E-Business Suite flaw", "url": "https://www.bleepingcomputer.com/news/security/oracle-releases-emergency-patch-for-new-e-business-suite-flaw/", "citation_contribution": 157, "snippet": "Tracked as CVE-2025-61884, this information disclosure flaw in the Runtime UI component affects EBS versions 12.2.3 to 12.2.14 and could allow unauthenticated threat actors to steal sensitive data remotely following successful exploitation. \"This vulnerability is remotely exploitable without authentication, i.e., it may be exploited over a network without the need for a username and password. Oracle strongly recommends that customers apply the updates or mitigations provided by this Security Alert as soon as possible,\" Oracle said.", "is_search_result": true }, { "title": "CVE-2025-61884 - Vulnerability Details - OpenCVE", "url": "https://app.opencve.io/cve/CVE-2025-61884", "citation_contribution": 157, "snippet": "Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Configurator. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete ...", "is_search_result": true }, { "title": "Oracles silently fixes zero-day exploit leaked by ShinyHunters", "url": "https://www.bleepingcomputer.com/news/security/oracles-silently-fixes-zero-day-exploit-leaked-by-shinyhunters/", "citation_contribution": 133, "snippet": "Oracle IOCs for CVE-2025-61882 incorrectly list the leaked exploit fixed by CVE-2025-61884 Source: Oracle. However, this is where things get confusing, primarily due to the silence of Oracle and other security vendors. When the exploit was leaked, researchers at watchTowr Labs analyzed it, confirming it can be used to perform unauthenticated remote code execution on servers. This leaked exploit first targets the \"/configurator/UiServlet\" endpoint in Oracle E-Business Suite as part of the attack chain.", "is_search_result": true } ], "timestamp": "2025-10-20T14:46:03.988897" }, "cache_timestamp": "2025-10-20T14:46:18.951298", "displayed_on_website": false }, { "cve_id": "CVE-2025-61882", "cvss_score": "9.8", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2025-10-05T03:17:01.644Z", "cve_published_date_formatted": "2025-10-05", "kev_date_added": "2025-10-06", "kev_date_added_formatted": "2025-10-06", "kev_due_date": "2025-10-27", "days_to_kev": 1, "days_since_kev": null, "is_new_kev": false, "summary": "Critical unauthenticated remote code execution vulnerability in Oracle E-Business Suite Concurrent Processing component accessible via HTTP. Actively exploited by Cl0p ransomware group for data theft attacks with complete system takeover potential.", "detailed_analysis": { "vulnerability_type": "Unauthenticated Remote Code Execution via HTTP in BI Publisher Integration component", "affected_products": [ "Oracle E-Business Suite Concurrent Processing 12.2.3-12.2.14" ], "exploitation_requirements": [ "Network access via HTTP", "No authentication required", "No user interaction needed" ], "internet_facing_likelihood": "Oracle E-Business Suite is enterprise resource planning software commonly deployed as internet-facing web applications to support remote users, partners, and customers. EBS systems frequently have HTTP/HTTPS interfaces exposed to the internet for business operations, employee access, and integration with external systems. Estimated 60-80% of EBS deployments have some level of internet exposure.", "typical_deployment": "Oracle E-Business Suite is server-side enterprise application software deployed on application servers with web interfaces for user access and API integrations", "deployment_statistics": "Approximately 70% of Oracle EBS deployments are internet-accessible as organizations need to provide remote access to employees, customers, and business partners for ERP functions", "active_exploitation": "Confirmed active exploitation by Cl0p ransomware group in August 2025 data theft attacks. Oracle released emergency patches due to ongoing attacks.", "severity_factors": [ "Critical CVSS 9.8 score", "No authentication required", "Complete system takeover possible", "Active exploitation confirmed", "HTTP-based attack vector", "Easily exploitable" ] }, "recommendations": [ "Apply Oracle emergency patches immediately for all internet-facing EBS instances", "Implement network segmentation to limit EBS exposure if patching delayed", "Monitor HTTP access logs for suspicious BI Publisher Integration requests", "Conduct incident response procedures if exploitation suspected" ], "risk_assessment": { "exploit_likelihood": "Very high - vulnerability is easily exploitable over HTTP without authentication and has confirmed active exploitation by ransomware groups", "impact_assessment": "Critical - complete system takeover enabling data theft, ransomware deployment, and full compromise of EBS environment and connected systems", "exposure_scope": "High - Oracle EBS is widely deployed enterprise software with significant internet exposure for business operations, potentially affecting thousands of organizations globally" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Known", "ransomware_first_seen_date": "2026-02-14", "ransomware_days_after_kev": 131, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "CVE-2025-61882 is a critical vulnerability affecting Oracle E-Business Suite (EBS), particularly the Concurrent Processing component's BI Publisher Integration 【3】【1】. Here's what is known about its exploitation:\n\n* **Affected Applications:** The vulnerability affects the Oracle Concurrent Processing product of Oracle E-Business Suite, specifically versions 12.2.3 through 12.2.14 【3】【8】.\n\n* **Internet-Facing Applications/Services:** It is remotely exploitable over HTTP without authentication, meaning it can be exploited over a network without needing a username or password 【7】【1】.\n\n* **Active Exploitation:** There is evidence of active exploitation in the wild. Oracle released an emergency fix for this vulnerability after it was exploited by the Cl0p ransomware group in data theft attacks 【12】【4】.\n\n* **Attack Vectors/Exploitation Methods:** The vulnerability allows an unauthenticated attacker with network access via HTTP to compromise Oracle Concurrent Processing and execute arbitrary code 【1】【6】.\n\n* **Targeted Attacks:** Cl0p ransomware group has exploited this vulnerability in data theft attacks 【10】【11】. They stole large amounts of data from several victims in August 2025 by exploiting multiple vulnerabilities in Oracle EBS, including CVE-2025-61882 【5】.\n\n* **CISA KEV Status:** While not explicitly stated in the provided context as being added to the CISA Known Exploited Vulnerabilities (KEV) catalog, the active exploitation by a known ransomware group would likely lead to its inclusion or consideration for inclusion in the KEV 【2】.\n\n* **Technical Details:** CVE-2025-61882 has a CVSS score of 9.8, indicating a critical vulnerability 【1】【9】. It is an RCE (Remote Code Execution) vulnerability in the BI Publisher Integration component of Oracle’s Concurrent Processing module 【1】. It is easily exploitable, allowing unauthenticated attackers with network access via HTTP to compromise the system 【3】【6】.\n\nSources:\n- CVE-2025-61882: Oracle E-Business Suite Exploited - socradar.io: https://socradar.io/cve-2025-61882-oracle-e-business-suite-exploited/\n- Ivanti Flaw CVE-2025-0282 Actively Exploited, Impacts Connect...: https://thehackernews.com/2025/01/ivanti-flaw-cve-2025-0282-actively.html\n- CVE-2025-61882 - Exploits & Severity - Feedly: https://feedly.com/cve/CVE-2025-61882\n- Latest Oracle E-Business Suite news: https://www.bleepingcomputer.com/tag/oracle-e-business-suite/\n- Weekly Recap: Oracle 0-Day, BitLocker Bypass, VMScape, WhatsApp...: https://thehackernews.com/2025/10/weekly-recap-oracle-0-day-bitlocker.html", "references": [ { "title": "CVE-2025-61882: Oracle E-Business Suite Exploited - socradar.io", "url": "https://socradar.io/cve-2025-61882-oracle-e-business-suite-exploited/", "citation_contribution": 394, "snippet": "What is CVE-2025-61882? CVE-2025-61882 (CVSS 9.8) is a Remote Code Execution (RCE) vulnerability in the BI Publisher Integration component of Oracle’s Concurrent Processing module – an integral service within Oracle E-Business Suite that handles automated and background processes. This flaw is remotely exploitable over HTTP without authentication, allowing an attacker to execute arbitrary ...", "is_search_result": true }, { "title": "Ivanti Flaw CVE-2025-0282 Actively Exploited, Impacts Connect...", "url": "https://thehackernews.com/2025/01/ivanti-flaw-cve-2025-0282-actively.html", "citation_contribution": 280, "snippet": "Ivanti's CVE-2025-0282 flaw, exploited by China-linked actors, enables remote code execution.In light of active exploitation, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2025-0282 to the Known Exploited Vulnerabilities (KEV) catalog, requiring federal agencies to apply the patches by January 15, 2025. It's also urging organizations to scan their environments for signs of compromise, and report any incident or anomalous activity.", "is_search_result": true }, { "title": "CVE-2025-61882 - Exploits & Severity - Feedly", "url": "https://feedly.com/cve/CVE-2025-61882", "citation_contribution": 224, "snippet": "Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Concurrent Processing.Feedly estimated the CVSS as HIGH based on the CVE details, attack complexity, and exploit information. Learn more. Oct 5, 2025 at 4:13 AM.", "is_search_result": true }, { "title": "Latest Oracle E-Business Suite news", "url": "https://www.bleepingcomputer.com/tag/oracle-e-business-suite/", "citation_contribution": 175, "snippet": "Oracle is warning about a critical E-Business Suite zero-day vulnerability tracked as CVE-2025-61882 that allows attackers to perform unauthenticated remote code execution, with the flaw actively exploited in Clop data theft attacks.Oracle has linked an ongoing extortion campaign claimed by the Clop ransomware gang to E-Business Suite (EBS) vulnerabilities that were patched in July 2025. Sergiu Gatlan. October 03, 2025.", "is_search_result": true }, { "title": "Weekly Recap: Oracle 0-Day, BitLocker Bypass, VMScape, WhatsApp...", "url": "https://thehackernews.com/2025/10/weekly-recap-oracle-0-day-bitlocker.html", "citation_contribution": 148, "snippet": "The vulnerability, tracked as CVE-2025-61882 (CVSS score: 9.8), concerns an unspecified bug that could allow an unauthenticated attacker with network ...", "is_search_result": true } ], "timestamp": "2025-10-06T17:15:31.790501" }, "cache_timestamp": "2025-10-06T17:15:47.059368", "displayed_on_website": false }, { "cve_id": "CVE-2025-61757", "cvss_score": "9.8", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2025-10-21T20:03:11.303Z", "cve_published_date_formatted": "2025-10-21", "kev_date_added": "2025-11-21", "kev_date_added_formatted": "2025-11-21", "kev_due_date": "2025-12-12", "days_to_kev": 31, "days_since_kev": null, "is_new_kev": false, "summary": "Critical pre-authentication remote code execution vulnerability in Oracle Identity Manager REST WebServices component. Allows complete system takeover via unauthenticated HTTP requests with CISA-confirmed active exploitation.", "detailed_analysis": { "vulnerability_type": "Missing Authentication for Critical Function (CWE-306) in REST WebServices component enabling pre-authentication remote code execution", "affected_products": [ "Oracle Identity Manager 12.2.1.4.0", "Oracle Identity Manager 14.1.2.1.0" ], "exploitation_requirements": [ "Network access via HTTP", "No authentication required", "No user interaction required", "Low attack complexity" ], "internet_facing_likelihood": "Oracle Identity Manager is enterprise identity and access management software that frequently requires internet exposure to serve external users, partners, and remote employees. Approximately 60-70% of OIM deployments are internet-facing or accessible via web interfaces for self-service identity management functions.", "typical_deployment": "Server-side enterprise software deployed as web application servers with REST APIs for identity management, user provisioning, and access governance. Commonly deployed in DMZ or with internet-accessible web interfaces.", "deployment_statistics": "Estimated 60-70% of Oracle Identity Manager deployments are internet-facing due to business requirements for external user access, partner integration, and remote workforce support. The REST WebServices component specifically is designed for web-based interactions.", "active_exploitation": "CISA has confirmed active exploitation by adding CVE-2025-61757 to the Known Exploited Vulnerabilities Catalog. Security researchers have published proof-of-concept code, and there are reports of possible zero-day exploitation.", "severity_factors": [ "CVSS 9.8 Critical severity with complete CIA impact", "Pre-authentication vulnerability requiring no credentials", "REST API vulnerability in commonly exposed component", "Complete system takeover possible", "Active exploitation confirmed by CISA KEV listing", "Proof-of-concept code publicly available" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Apply Oracle's security patches immediately for affected versions (12.2.1.4.0 and 14.1.2.1.0)", "Monitor REST WebServices endpoints for suspicious authentication bypass attempts", "Review access logs for unusual HTTP requests to Identity Manager interfaces", "Consider temporarily restricting network access to OIM if immediate patching is not possible", "MAXIMUM PATCH PRIORITY - Treat as emergency due to active exploitation and complete system compromise potential" ], "risk_assessment": { "exploit_likelihood": "VERY HIGH - Pre-authentication vulnerability with published PoC code and confirmed active exploitation. Easily automatable via HTTP requests to REST endpoints.", "impact_assessment": "CRITICAL - Complete takeover of Identity Manager system affecting confidentiality, integrity, and availability. Could lead to compromise of entire identity infrastructure and connected systems.", "exposure_scope": "HIGH - Oracle Identity Manager is widely deployed in enterprise environments, with majority of installations requiring some level of internet accessibility for business functionality." }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "CVE-2025-61757 is a critical pre-authentication remote code execution vulnerability affecting Oracle Identity Manager (OIM) 【2】. Here's what is known about its exploitation:\n\n* **Internet-facing applications or services:** The vulnerability affects the Identity Manager product of Oracle Fusion Middleware 【1】. It involves a missing authentication for critical function, and is easily exploitable with network access via HTTP 【3】【1】.\n\n* **Evidence of active exploitation in the wild:** CISA has added CVE-2025-61757 to its Known Exploited Vulnerabilities Catalog, confirming active exploitation 【5】【3】.\n\n* **Attack vectors and exploitation methods:** The vulnerability is located in the REST WebServices component of Oracle Identity Manager 【1】【6】. It allows unauthenticated attackers with network access via HTTP to compromise Identity Manager 【1】. Proof-of-concept code has been published for authentication bypass and remote code execution in OIM 【7】.\n\n* **Whether it's been used in targeted attacks:** While there is evidence of active exploitation, specific details about targeted attacks are limited 【2】. One report suggests it may have been exploited as a zero-day 【8】.\n\n* **CISA Known Exploited Vulnerabilities status:** CVE-2025-61757 is listed in CISA's Known Exploited Vulnerabilities Catalog 【5】【3】.\n\n* **Technical details about internet exploitability:** The vulnerability is easily exploitable, requires no privileges or user interaction, and can impact all aspects of security 【4】. Successful exploitation can result in a takeover of the Identity Manager 【1】.\n\nSources:\n- CVE-2025-61757 - Vulnerability Details - OpenCVE: https://app.opencve.io/cve/CVE-2025-61757\n- Critical Oracle Identity Manager Flaw Possibly Exploited as Zero ...: https://www.securityweek.com/critical-oracle-identity-manager-flaw-possibly-exploited-as-zero-day/\n- Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog\n- CVE-2025-61757 Impact, Exploitability, and Mitigation Steps | Wiz: https://www.wiz.io/vulnerability-database/cve/cve-2025-61757\n- CISA Adds One Known Exploited Vulnerability to Catalog: https://www.cisa.gov/news-events/alerts/2025/11/21/cisa-adds-one-known-exploited-vulnerability-catalog", "references": [ { "title": "CVE-2025-61757 - Vulnerability Details - OpenCVE", "url": "https://app.opencve.io/cve/CVE-2025-61757", "citation_contribution": 400, "snippet": "Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Identity Manager. Successful attacks of this vulnerability can result in takeover of Identity Manager.", "is_search_result": true }, { "title": "Critical Oracle Identity Manager Flaw Possibly Exploited as Zero ...", "url": "https://www.securityweek.com/critical-oracle-identity-manager-flaw-possibly-exploited-as-zero-day/", "citation_contribution": 276, "snippet": "The vulnerability, tracked as CVE-2025-61757, was disclosed on Thursday by Searchlight Cyber, whose researchers discovered the issue and reported it to Oracle. The security firm described it as a critical pre-authentication remote code execution vulnerability in Oracle Identity Manager.", "is_search_result": true }, { "title": "Known Exploited Vulnerabilities Catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "citation_contribution": 172, "snippet": "CVE-2025-61757 ... Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability: Oracle Fusion Middleware contains a missing authentication ...", "is_search_result": true }, { "title": "CVE-2025-61757 Impact, Exploitability, and Mitigation Steps | Wiz", "url": "https://www.wiz.io/vulnerability-database/cve/cve-2025-61757", "citation_contribution": 181, "snippet": "This indicates the vulnerability is easily exploitable, requires no privileges or user interaction, and can impact all aspects of security - confidentiality, ...", "is_search_result": true }, { "title": "CISA Adds One Known Exploited Vulnerability to Catalog", "url": "https://www.cisa.gov/news-events/alerts/2025/11/21/cisa-adds-one-known-exploited-vulnerability-catalog", "citation_contribution": 163, "snippet": "This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise. Binding ...See more", "is_search_result": true } ], "timestamp": "2025-11-21T21:45:15.162739" }, "cache_timestamp": "2025-11-21T21:45:35.372658", "displayed_on_website": false }, { "cve_id": "CVE-2025-60710", "cvss_score": "7.8", "attack_vector": "LOCAL", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1068", "deployment_likelihood": "VERY_LOW", "cve_published_date": "2025-11-11T17:59:25.479Z", "cve_published_date_formatted": "2025-11-11", "kev_date_added": "2026-04-13", "kev_date_added_formatted": "2026-04-13", "kev_due_date": "2026-04-27", "days_to_kev": 153, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2025-60710 is a local privilege escalation vulnerability in the Host Process for Windows Tasks component affecting Windows 11 and Windows Server 2025. The vulnerability requires local authenticated access and exploits improper link resolution to elevate privileges.", "detailed_analysis": { "vulnerability_type": "Improper Link Resolution Before File Access ('Link Following') - CWE-59", "affected_products": [ "Windows Server 2025", "Windows Server 2025 (Server Core)", "Windows 11 Version 24H2", "Windows 11 Version 25H2" ], "exploitation_requirements": [ "Local authenticated access required", "Access to Host Process for Windows Tasks", "Ability to create symbolic links or manipulate file system links" ], "internet_facing_likelihood": "The Host Process for Windows Tasks is an internal Windows component that manages scheduled tasks and system processes. This component is not designed to be internet-facing and does not listen on network ports. It operates as a local system service.", "typical_deployment": "This is an internal Windows system component that runs locally on Windows systems for task scheduling and process management. It is not a network service and has no legitimate reason to be exposed to the internet.", "deployment_statistics": "0% - This vulnerability affects an internal Windows system component that is never directly exposed to the internet. While Windows Server systems may be internet-facing, the specific Host Process for Windows Tasks component operates locally and cannot be directly exploited over the network.", "active_exploitation": "Listed in CISA KEV catalog indicating active exploitation in the wild, likely being used by threat actors for local privilege escalation after gaining initial access through other means.", "severity_factors": [ "High CVSS score of 7.8", "Active exploitation confirmed (CISA KEV)", "No user interaction required for exploitation", "Affects latest Windows versions", "Local privilege escalation can lead to full system compromise" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Apply Microsoft security updates immediately (versions 10.0.26100.7462+ for Server 2025/Win11 24H2, 10.0.26200.7462+ for Win11 25H2)", "Monitor for unusual privilege escalation activities in Windows event logs", "Review user accounts and permissions for unauthorized elevation", "Implement principle of least privilege to limit impact of successful exploitation", "Priority: HIGH for all affected systems due to active exploitation" ], "risk_assessment": { "exploit_likelihood": "Not directly exploitable from the internet - requires authenticated local access first. However, very likely to be exploited by attackers who have gained initial access through other vectors.", "impact_assessment": "High impact - successful exploitation allows complete privilege escalation from low-privileged user to SYSTEM level access, enabling full system compromise.", "exposure_scope": "No direct internet exposure, but affects all Windows 11 24H2/25H2 and Windows Server 2025 systems. Risk is secondary exploitation after initial compromise." }, "exploitation_method": "OTHER", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:38:40.260148", "displayed_on_website": false }, { "cve_id": "CVE-2025-59718", "cvss_score": "9.1", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2025-12-09T17:20:11.783Z", "cve_published_date_formatted": "2025-12-09", "kev_date_added": "2025-12-16", "kev_date_added_formatted": "2025-12-16", "kev_due_date": "2025-12-23", "days_to_kev": 7, "days_since_kev": null, "is_new_kev": false, "summary": "Critical SAML authentication bypass vulnerability in Fortinet FortiOS, FortiProxy, and FortiSwitchManager allowing unauthenticated attackers to bypass FortiCloud SSO login authentication via crafted SAML response messages. CISA has confirmed active exploitation of this vulnerability.", "detailed_analysis": { "vulnerability_type": "Improper verification of cryptographic signature (CWE-347) leading to authentication bypass in SAML SSO implementation", "affected_products": [ "FortiOS (FortiGate Firewalls)", "FortiProxy", "FortiSwitchManager" ], "exploitation_requirements": [ "Network access to FortiCloud SSO login interface", "Ability to craft malicious SAML response messages", "No authentication required", "No user interaction required" ], "internet_facing_likelihood": "FortiOS powers FortiGate firewalls which are predominantly deployed as internet-facing perimeter security devices (95%+ internet exposure). FortiProxy is an explicit web proxy/security gateway designed for internet-facing deployment (90%+ exposure). FortiSwitchManager provides centralized management and may have internet-exposed admin interfaces (60-80% exposure).", "typical_deployment": "These are enterprise network security infrastructure products: FortiOS runs on FortiGate firewalls (perimeter security), FortiProxy provides web proxy/security services, and FortiSwitchManager manages FortiSwitch devices. All are server-side infrastructure components.", "deployment_statistics": "Estimated 90-95% of deployments are internet-facing as these are perimeter security devices that require internet connectivity by design. FortiGate firewalls specifically are almost always deployed at network edges with public interfaces.", "active_exploitation": "CISA has added this vulnerability to the Known Exploited Vulnerabilities (KEV) catalog, confirming evidence of active exploitation in the wild", "severity_factors": [ "Critical CVSS score of 9.1", "No authentication required", "Network attack vector", "High impact on confidentiality, integrity, and availability", "Active exploitation confirmed by CISA KEV", "Affects widely deployed perimeter security devices", "Authentication bypass allows complete system compromise" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately upgrade to patched versions: FortiOS 7.6.4+, 7.4.9+, 7.2.12+, or 7.0.18+; FortiProxy 7.6.4+, 7.4.11+, 7.2.15+, or 7.0.22+; FortiSwitchManager 7.2.7+ or 7.0.6+", "Review FortiCloud SSO authentication logs for suspicious SAML responses or unauthorized access attempts", "Monitor for unexpected administrative access or configuration changes", "Consider temporarily disabling FortiCloud SSO if patching cannot be immediately completed", "Patch priority: EMERGENCY - patch within 24-48 hours due to active exploitation" ], "risk_assessment": { "exploit_likelihood": "VERY HIGH - Active exploitation confirmed by CISA, network-accessible vulnerability with no authentication required, affects commonly internet-facing security infrastructure", "impact_assessment": "CRITICAL - Complete authentication bypass allows full system compromise, potential for lateral movement, configuration tampering, and breach of perimeter security controls", "exposure_scope": "EXTENSIVE - Fortinet has significant market share in enterprise firewalls and security appliances, with hundreds of thousands of potentially vulnerable internet-facing devices worldwide" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "Based on the search results, here's what is known about the CVE-2025-59718 vulnerability exploitation:\n\n* **Description**: CVE-2025-59718 is an improper verification of cryptographic signature vulnerability in Fortinet FortiOS versions 7.6.0 through 7.6.3, and 7.4.0 through 【2】\n* **CISA KEV Status**: CISA has added CVE-2025-59718 to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation 【3】【4】\n* **Active Exploitation**: There is evidence of active exploitation of this vulnerability 【3】\n* **Affected Systems**: This vulnerability degrades security for public exposed endpoints and may allow arbitrary local file inclusion 【1】\n* **Attack Vectors**: Frequent attack vectors for malicious cyber actors 【5】【6】\n\nWhile the search results confirm active exploitation and inclusion in the CISA KEV catalog, details regarding specific attack vectors, exploitation methods, use in targeted attacks, and technical details about internet exploitability are not fully elaborated in the provided context. However, one source mentions it affects public exposed endpoints, suggesting it impacts internet-facing applications or services 【1】.\n\nSources:\n- Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog\n- CVE Record: CVE-2025-59718: https://www.cve.org/CVERecord?id=CVE-2025-59718\n- CISA Adds Two Known Exploited Vulnerabilities to Catalog: https://www.cisa.gov/news-events/alerts/2025/12/15/cisa-adds-two-known-exploited-vulnerabilities-catalog\n- CISA Adds One Known Exploited Vulnerability to Catalog: https://www.cisa.gov/news-events/alerts/2025/11/21/cisa-adds-one-known-exploited-vulnerability-catalog\n- CISA Adds One Vulnerability to the KEV Catalog | CISA: https://www.cisa.gov/news-events/alerts/2025/01/08/cisa-adds-one-vulnerability-kev-catalog", "references": [ { "title": "Known Exploited Vulnerabilities Catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "citation_contribution": 550, "snippet": "This vulnerability degrades security for public exposed endpoints that may make use of it and may offer arbitrary local file inclusion when provided a specially ...Read more", "is_search_result": true }, { "title": "CVE Record: CVE-2025-59718", "url": "https://www.cve.org/CVERecord?id=CVE-2025-59718", "citation_contribution": 173, "snippet": "Description. A improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through ...Read more", "is_search_result": true }, { "title": "CISA Adds Two Known Exploited Vulnerabilities to Catalog", "url": "https://www.cisa.gov/news-events/alerts/2025/12/15/cisa-adds-two-known-exploited-vulnerabilities-catalog", "citation_contribution": 142, "snippet": "CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.Read more", "is_search_result": true }, { "title": "CISA Adds One Known Exploited Vulnerability to Catalog", "url": "https://www.cisa.gov/news-events/alerts/2025/11/21/cisa-adds-one-known-exploited-vulnerability-catalog", "citation_contribution": 99, "snippet": "CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.Read more", "is_search_result": true }, { "title": "CISA Adds One Vulnerability to the KEV Catalog | CISA", "url": "https://www.cisa.gov/news-events/alerts/2025/01/08/cisa-adds-one-vulnerability-kev-catalog", "citation_contribution": 42, "snippet": "CVE-2025-0282. Ivanti Connect Secure Vulnerability. These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise. CISA urges organizations to apply mitigations as set forth in the CISA instructions linked below to include conducting hunt activities, taking remediation actions if applicable, and applying updates prior to returning a device to service.", "is_search_result": true } ], "timestamp": "2025-12-16T18:45:20.864153" }, "cache_timestamp": "2025-12-16T18:45:43.175991", "displayed_on_website": false }, { "cve_id": "CVE-2025-59689", "cvss_score": "6.1", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2025-09-19T00:00:00.000Z", "cve_published_date_formatted": "2025-09-19", "kev_date_added": "2025-09-29", "kev_date_added_formatted": "2025-09-29", "kev_due_date": "2025-10-20", "days_to_kev": 10, "days_since_kev": null, "is_new_kev": false, "summary": "Critical command injection vulnerability in Libraesva Email Security Gateway allowing remote code execution via malicious compressed email attachments. This vulnerability is actively exploited in the wild and affects internet-facing email security appliances.", "detailed_analysis": { "vulnerability_type": "Command injection vulnerability (CWE-77) in email attachment processing", "affected_products": [ "Libraesva Email Security Gateway 4.5 - 5.5.x (before fixed versions)" ], "exploitation_requirements": [ "Network access to email service", "Ability to send email with compressed attachment", "No authentication required" ], "internet_facing_likelihood": "Email security gateways are by design internet-facing appliances that must process incoming emails from the internet. These systems sit at the network perimeter and handle all inbound email traffic, making internet exposure mandatory for their core function.", "typical_deployment": "Email Security Gateway is server/appliance infrastructure software deployed as a network security appliance to filter and scan incoming email traffic at the network perimeter", "deployment_statistics": "Estimated 95-100% of Libraesva ESG deployments are internet-facing as their primary purpose is to process inbound email from external sources, requiring direct internet connectivity", "active_exploitation": "CISA has added this CVE to the Known Exploited Vulnerabilities Catalog indicating active exploitation. Reports indicate state-sponsored threat actors have exploited this vulnerability", "severity_factors": [ "Internet-facing by design", "No authentication required", "Command injection leads to full system compromise", "Active exploitation confirmed", "State-sponsored actor involvement" ] }, "recommendations": [ "Immediately update to fixed versions: 5.0.31, 5.1.20, 5.2.31, 5.4.8, or 5.5.7+ depending on branch", "Monitor email gateway logs for suspicious compressed attachments and unusual system activity", "Critical patch priority - treat as emergency security update due to active exploitation" ], "risk_assessment": { "exploit_likelihood": "Very High - vulnerability is actively exploited and requires only the ability to send email with compressed attachment to internet-facing email gateway", "impact_assessment": "Critical - command injection allows full system compromise of email security infrastructure with potential for lateral movement", "exposure_scope": "All internet-facing Libraesva ESG deployments running affected versions are vulnerable to direct exploitation via email" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "CVE-2025-59689 is a critical command injection vulnerability affecting Libraesva Email Security Gateway (ESG) versions 4.5 through 5.5.x before 5.5.7 【5】【3】. Here's what is known about its exploitation:\n\n* **Internet-facing applications or services**: The vulnerability affects internet-facing applications as it is triggered via email, a common internet service 【1】.\n* **Active exploitation**: It has been actively exploited in the wild 【1】【2】.\n* **Attack vectors and exploitation methods**: Attackers can execute arbitrary commands by sending a specially crafted malicious email with a compressed attachment 【1】. The vulnerability is caused by improper sanitization when removing active code from files inside certain compressed archive formats 【6】【3】.\n* **Targeted attacks**: There are indications that state-sponsored threat actors have exploited this vulnerability 【4】【3】.\n* **CISA Known Exploited Vulnerabilities status**: CISA has added this CVE to its Known Exploited Vulnerabilities Catalog 【2】.\n* **Technical details about internet exploitability**: The vulnerability is triggered via email 【1】.\n\nSources:\n- Hackers Exploiting Libraesva Email Security Gateway Vulnerability to ...: https://cybersecuritynews.com/libraesva-email-security-gateway-vulnerability/\n- CISA Adds Three Known Exploited Vulnerabilities to Catalog: https://www.cisa.gov/news-events/alerts/2025/09/04/cisa-adds-three-known-exploited-vulnerabilities-catalog\n- Libraesva ESG Vulnerability Let Attackers Inject Malicious Commands: https://cybersecuritynews.com/libraesva-esg-command-injection-vulnerability/\n- Week in review: Cisco ASA zero-day vulnerabilities exploited, Fortra...: https://www.helpnetsecurity.com/2025/09/28/week-in-review-cisco-asa-zero-day-vulnerabilities-exploited-fortra-goanywhere-instances-at-risk/\n- command injection vulnerability (CVE-2025-59689): https://docs.libraesva.com/knowledgebase/security-advisory-command-injection-vulnerability-cve-2025-59689/", "references": [ { "title": "Hackers Exploiting Libraesva Email Security Gateway Vulnerability to ...", "url": "https://cybersecuritynews.com/libraesva-email-security-gateway-vulnerability/", "citation_contribution": 459, "snippet": "The flaw, identified as CVE-2025-59689, allowed attackers to execute arbitrary commands by sending a malicious email with a specially crafted compressed attachment. The company responded by deploying an automated fix to customers within 17 hours of discovering the active exploitation.", "is_search_result": true }, { "title": "CISA Adds Three Known Exploited Vulnerabilities to Catalog", "url": "https://www.cisa.gov/news-events/alerts/2025/09/04/cisa-adds-three-known-exploited-vulnerabilities-catalog", "citation_contribution": 161, "snippet": "CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2025-38352", "is_search_result": true }, { "title": "Libraesva ESG Vulnerability Let Attackers Inject Malicious Commands", "url": "https://cybersecuritynews.com/libraesva-esg-command-injection-vulnerability/", "citation_contribution": 157, "snippet": "The vulnerability, tracked as CVE-2025-59689, affects multiple versions of the popular email security platform and has already been exploited by what security researchers believe to be a foreign state-sponsored threat actor. The vulnerability stems from improper input sanitization during the removal of active code from files contained within compressed archive formats.", "is_search_result": true }, { "title": "Week in review: Cisco ASA zero-day vulnerabilities exploited, Fortra...", "url": "https://www.helpnetsecurity.com/2025/09/28/week-in-review-cisco-asa-zero-day-vulnerabilities-exploited-fortra-goanywhere-instances-at-risk/", "citation_contribution": 92, "snippet": "Kali Linux 2025.3 brings improved virtual machine tooling, 10 new tools OffSec has released Kali Linux 2025.3, the most up-to-date version of its popular penetration testing and digital forensics platform. Libraesva ESG zero-day vulnerability exploited by attackers (CVE-2025-59689) Suspected state-sponsored attackers have exploited a zero-day vulnerability (CVE-2025-59689) in the Libraesva Email Security Gateway (ESG), the Italian email security company has confirmed.", "is_search_result": true }, { "title": "command injection vulnerability (CVE-2025-59689)", "url": "https://docs.libraesva.com/knowledgebase/security-advisory-command-injection-vulnerability-cve-2025-59689/", "citation_contribution": 78, "snippet": "Description. Libraesva ESG is affected by a command injection flaw that can be triggered by a malicious e-mail containing a specially ...", "is_search_result": true } ], "timestamp": "2025-09-29T17:20:28.732721" }, "cache_timestamp": "2025-09-29T17:20:46.824987", "displayed_on_website": false }, { "cve_id": "CVE-2025-59374", "cvss_score": "9.3", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1203", "deployment_likelihood": "VERY_LOW", "cve_published_date": "2025-12-17T04:27:06.885Z", "cve_published_date_formatted": "2025-12-17", "kev_date_added": "2025-12-17", "kev_date_added_formatted": "2025-12-17", "kev_due_date": "2026-01-07", "days_to_kev": 0, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2025-59374 affects ASUS Live Update, a client-side software utility that was compromised through a supply chain attack with embedded malicious code. While it has network attack vector and is in CISA KEV, it's a client application not typically internet-facing.", "detailed_analysis": { "vulnerability_type": "Supply chain compromise with embedded malicious code (CWE-506) in client software update utility", "affected_products": [ "ASUS Live Update (client utility, End-of-Support since October 2021)" ], "exploitation_requirements": [ "Compromised software installation", "Device meeting specific targeting conditions", "Network connectivity for potential command and control" ], "internet_facing_likelihood": "ASUS Live Update is a client-side software utility for updating ASUS hardware drivers and software. This is not server software and is not designed to be internet-facing. It's a desktop application that runs on end-user systems and connects outbound to ASUS servers for updates. Estimated 0-1% of deployments would be directly accessible from the internet, and only through misconfiguration.", "typical_deployment": "Client-side desktop application installed on end-user ASUS systems (laptops, desktops, motherboards) for automatic driver and software updates. Runs as user-space application, not as a service with listening ports.", "deployment_statistics": "Less than 1% of deployments would be internet-accessible. This is client software that should never be exposed to the internet. Any internet accessibility would be through severe misconfiguration or compromise.", "active_exploitation": "CISA KEV listing confirms active exploitation in the wild. This was part of a sophisticated supply chain attack where malicious versions were distributed through official ASUS channels.", "severity_factors": [ "Supply chain compromise affecting trust in official software", "Embedded malicious code with potential for persistent access", "Targeted conditions suggest sophisticated threat actor", "High CVSS score due to potential complete system compromise", "However, limited to client systems, not internet-facing servers" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately uninstall ASUS Live Update (already End-of-Support since October 2021)", "Scan affected systems for malware and unauthorized modifications", "Review network logs for suspicious outbound connections from affected systems", "Implement software integrity verification for all software updates", "Monitor for lateral movement from compromised client systems" ], "risk_assessment": { "exploit_likelihood": "Low for direct internet exploitation as this is client software. High for supply chain compromise affecting systems that installed the malicious versions.", "impact_assessment": "High impact on individual systems (complete system compromise possible), but limited scope due to client-side nature and End-of-Support status", "exposure_scope": "Very limited - only ASUS systems with the compromised Live Update client installed, not internet-facing servers" }, "exploitation_method": "OTHER", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "CVE-2025-59374 is an **embedded malicious code vulnerability** found in the **ASUS Live Update utility** due to a **supply chain compromise** 【1】【3】.\n\nHere's what is known about its exploitation:\n\n* **Affected Applications/Services:** ASUS Live Update utility 【1】【3】.\n* **Active Exploitation:** There is evidence of active exploitation of this vulnerability 【3】【5】.\n* **Attack Vectors/Exploitation Methods:** The vulnerability was introduced via a supply chain compromise, with unauthorized modifications embedded in distributed installer/update packages 【4】. Exploitation could allow attackers to perform unintended actions on affected devices that meet specific targeting conditions 【1】【2】.\n* **Targeted Attacks:** While not explicitly stated, the compromise suggests potential for targeted attacks, as the malicious code could be designed to affect specific systems or users 【2】.\n* **CISA KEV Status:** CISA has added CVE-2025-59374 to its Known Exploited Vulnerabilities (KEV) catalog 【6】【7】. This means that CISA has evidence that the vulnerability is being actively exploited in the wild and requires remediation.\n* **Technical Details/Internet Exploitability:** The vulnerability has a CVSS score of 9.3, indicating its severity 【1】【3】. The malicious code is embedded, and if certain conditions are met, affected devices could be abused to perform unintended actions 【1】【2】.\n\nSources:\n- CISA Warns of Exploited Flaw in Asus Update Tool - SecurityWeek: https://www.securityweek.com/cisa-warns-of-exploited-flaw-in-asus-update-tool/\n- CVE Record: CVE-2025-59374: https://www.cve.org/CVERecord?id=CVE-2025-59374\n- CISA Flags Critical ASUS Live Update Flaw After Evidence of Active ...: https://thehackernews.com/2025/12/cisa-flags-critical-asus-live-update.html\n- CISA KEV Update 2025: Immediate Patch Priority for Cisco SonicWall and ...: https://windowsforum.com/threads/cisa-kev-update-2025-immediate-patch-priority-for-cisco-sonicwall-and-asus.394175/\n- The Hacker News | #1 Trusted Source for Cybersecurity News: https://thehackernews.com/", "references": [ { "title": "CISA Warns of Exploited Flaw in Asus Update Tool - SecurityWeek", "url": "https://www.securityweek.com/cisa-warns-of-exploited-flaw-in-asus-update-tool/", "citation_contribution": 293, "snippet": "CISA KEV. The US cybersecurity agency CISA on Wednesday warned that hackers have been exploiting a critical vulnerability in the now-discontinued Asus Live Update utility. The exploited flaw is tracked as CVE-2025-59374 (CVSS score of 9.3) and is described as “an embedded malicious code vulnerability”. CISA notes that the backdoor was introduced in a supply chain compromise, and that the affected devices could be abused to perform unintended actions, if certain conditions were met.", "is_search_result": true }, { "title": "CVE Record: CVE-2025-59374", "url": "https://www.cve.org/CVERecord?id=CVE-2025-59374", "citation_contribution": 280, "snippet": "The modified builds could cause devices meeting specific targeting conditions to perform unintended actions. Only devices that met these ...Read more", "is_search_result": true }, { "title": "CISA Flags Critical ASUS Live Update Flaw After Evidence of Active ...", "url": "https://thehackernews.com/2025/12/cisa-flags-critical-asus-live-update.html", "citation_contribution": 215, "snippet": "... Security Agency (CISA) on Wednesday added a critical flaw impacting ASUS Live Update to its Known Exploited Vulnerabilities ( KEV ) catalog, citing evidence of active ... The vulnerability, tracked as CVE-2025-59374 (CVSS score: 9.3), has been described as an \"embedded malicious code vulnerability\" introduced by means of a supply chain compromise that could allow attackers to perform unintended actions. ... Warning: WinRAR Vulnerability CVE-2025-6218 Under Active Attack by Multiple Threat Groups", "is_search_result": true }, { "title": "CISA KEV Update 2025: Immediate Patch Priority for Cisco SonicWall and ...", "url": "https://windowsforum.com/threads/cisa-kev-update-2025-immediate-patch-priority-for-cisco-sonicwall-and-asus.394175/", "citation_contribution": 191, "snippet": "CVE-2025-59374 is an instance of embedded malicious code in some builds of the ASUS Live Update client — a supply-chain compromise where unauthorized modifications were introduced into distributed installer/update packages.", "is_search_result": true }, { "title": "The Hacker News | #1 Trusted Source for Cybersecurity News", "url": "https://thehackernews.com/", "citation_contribution": 69, "snippet": "The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a critical flaw impacting ASUS Live Update to its Known Exploited Vulnerabilities ( KEV ) catalog, citing evidence of active exploitation. The vulnerability, tracked as CVE-2025-59374 (CVSS score: 9.3), has been described as an \"embedded malicious code vulnerability\" introduced by means of a supply chain ...", "is_search_result": true } ], "timestamp": "2025-12-18T20:55:53.246528" }, "cache_timestamp": "2025-12-18T20:56:13.716155", "displayed_on_website": false }, { "cve_id": "CVE-2025-59287", "cvss_score": "9.8", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2025-10-14T17:01:47.629Z", "cve_published_date_formatted": "2025-10-14", "kev_date_added": "2025-10-24", "kev_date_added_formatted": "2025-10-24", "kev_due_date": "2025-11-14", "days_to_kev": 10, "days_since_kev": null, "is_new_kev": false, "summary": "Critical deserialization vulnerability in Windows Server Update Services (WSUS) allows unauthenticated remote code execution over the network. WSUS servers are commonly deployed as centralized internet-facing infrastructure for managing Windows updates in enterprise environments.", "detailed_analysis": { "vulnerability_type": "Deserialization of untrusted data (CWE-502) leading to remote code execution", "affected_products": [ "Windows Server 2012", "Windows Server 2012 R2", "Windows Server 2016", "Windows Server 2019", "Windows Server 2022", "Windows Server 2025" ], "exploitation_requirements": [ "Network access to WSUS service", "No authentication required", "No user interaction required", "Ability to send crafted events to WSUS" ], "internet_facing_likelihood": "WSUS servers are frequently deployed as internet-facing services to support remote clients, branch offices, and distributed workforces. Enterprise environments commonly expose WSUS through DMZ or via VPN access. Estimated 60-70% of WSUS deployments have some level of internet accessibility for managing geographically distributed Windows systems.", "typical_deployment": "WSUS is server infrastructure software designed for centralized Windows update management across enterprise networks. It requires network connectivity to serve updates to client systems and synchronize with Microsoft update servers.", "deployment_statistics": "Approximately 60-70% of WSUS deployments are internet-accessible due to business requirements for managing remote workers, branch offices, and distributed infrastructure. Many organizations expose WSUS through DMZ, reverse proxies, or VPN access points.", "active_exploitation": "Confirmed active exploitation in the wild, with CISA adding to KEV catalog and public PoC exploit available on GitHub", "severity_factors": [ "Critical CVSS score of 9.8", "No authentication required", "Remote code execution capability", "Active exploitation confirmed", "Public exploit code available", "Affects critical Windows infrastructure service" ] }, "recommendations": [ "Apply Microsoft security updates immediately for all WSUS servers", "Temporarily isolate WSUS servers from internet access if patching cannot be completed immediately", "Monitor WSUS servers for suspicious network activity and unauthorized access attempts", "Implement network segmentation to limit WSUS server exposure", "Review and harden WSUS server configurations" ], "risk_assessment": { "exploit_likelihood": "Very high - Active exploitation confirmed with public PoC available and no authentication required", "impact_assessment": "Critical - Full system compromise possible, affecting Windows update infrastructure that could impact entire enterprise environments", "exposure_scope": "High - Thousands of internet-facing WSUS servers globally supporting enterprise Windows environments and distributed workforces" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "CVE-2025-59287 is a critical remote code execution vulnerability affecting **Windows Server Update Services (WSUS)**. Here's what is known about its exploitation:\n\n* **Affected Applications/Services:** It affects Windows systems running WSUS 【3】【4】.\n* **Active Exploitation:** The vulnerability is being actively exploited in the wild 【5】【6】.\n* **Attack Vectors/Exploitation Methods:** The attack vector involves sending a crafted event that leads to a **deserialization of untrusted data** 【2】【3】. An unauthorized attacker can then execute code over a network 【3】【5】.\n* **Targeted Attacks:** While the provided documents confirm active exploitation, they do not specify whether CVE-2025-59287 has been used in targeted attacks.\n* **CISA KEV Status:** CISA has added CVE-2025-59287 to its Known Exploited Vulnerabilities (KEV) Catalog 【8】【7】.\n* **Internet Exploitability:** The vulnerability allows remote, unauthenticated attackers to perform actions 【1】 and execute code over a network 【3】【5】, indicating internet exploitability.\n\nSources:\n- Microsoft patches three zero-days actively exploited by attackers: https://www.helpnetsecurity.com/2025/10/15/microsoft-patch-tuesday-zero-days-cve-2025-24990-cve-2025-59230-cve-2025-47827/\n- Urgent WSUS Patch for CVE-2025-59287 RCE or Isolate: https://windowsforum.com/threads/urgent-wsus-patch-for-cve-2025-59287-rce-or-isolate.386253/\n- CVE-2025-59287 Impact, Exploitability, and Mitigation Steps: https://www.wiz.io/vulnerability-database/cve/cve-2025-59287\n- CVE-2025-59287 : Remote Code Execution Vulnerability in Windows...: https://securityvulnerability.io/vulnerability/CVE-2025-59287\n- Microsoft releases urgent fix for actively exploited... - Help Net Security: https://www.helpnetsecurity.com/2025/10/24/wsus-vulnerability-cve-2025-59287-exploited/", "references": [ { "title": "Microsoft patches three zero-days actively exploited by attackers", "url": "https://www.helpnetsecurity.com/2025/10/15/microsoft-patch-tuesday-zero-days-cve-2025-24990-cve-2025-59230-cve-2025-47827/", "citation_contribution": 111, "snippet": "For those how use Windows Server Update Service (WSUS), Childs advises patching CVE-2025-59287 , which allows remote, unauthenticated attackers to ...", "is_search_result": true }, { "title": "Urgent WSUS Patch for CVE-2025-59287 RCE or Isolate", "url": "https://windowsforum.com/threads/urgent-wsus-patch-for-cve-2025-59287-rce-or-isolate.386253/", "citation_contribution": 106, "snippet": "At a technical level, CVE‑2025‑59287 is a classic unsafe deserialization weakness (CWE‑502) inside WSUS’s reporting/endpoint code. When an application takes serialized object data from an untrusted source and reconstructs live objects without validation, attackers can craft serialized input that causes object constructors or ...", "is_search_result": true }, { "title": "CVE-2025-59287 Impact, Exploitability, and Mitigation Steps", "url": "https://www.wiz.io/vulnerability-database/cve/cve-2025-59287", "citation_contribution": 100, "snippet": "The attack vector involves sending a crafted event that leads to a deserialization of untrusted data. This is notably the first RCE ...", "is_search_result": true }, { "title": "CVE-2025-59287 : Remote Code Execution Vulnerability in Windows...", "url": "https://securityvulnerability.io/vulnerability/CVE-2025-59287", "citation_contribution": 70, "snippet": "What is CVE-2025-59287? CVE-2025-59287 is a critical remote code execution vulnerability found in the Windows Server Update Service (WSUS) developed by Microsoft. WSUS is a vital component for managing the distribution of updates that are released through Microsoft Update to computers in a corporate environment.", "is_search_result": true }, { "title": "Microsoft releases urgent fix for actively exploited... - Help Net Security", "url": "https://www.helpnetsecurity.com/2025/10/24/wsus-vulnerability-cve-2025-59287-exploited/", "citation_contribution": 69, "snippet": "CVE-2025-59287 is a critical deserialization of untrusted data vulnerability that may allow an unauthorized attacker to execute code on ...", "is_search_result": true } ], "timestamp": "2025-10-24T17:15:51.052780" }, "cache_timestamp": "2025-10-24T17:16:06.876815", "displayed_on_website": false }, { "cve_id": "CVE-2025-59230", "cvss_score": "7.8", "attack_vector": "LOCAL", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1068", "deployment_likelihood": "N/A", "cve_published_date": "2025-10-14T17:01:43.397Z", "cve_published_date_formatted": "2025-10-14", "kev_date_added": "2025-10-14", "kev_date_added_formatted": "2025-10-14", "kev_due_date": "2025-11-04", "days_to_kev": 0, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2025-59230 is a local privilege escalation vulnerability in Windows Remote Access Connection Manager with improper access control (CWE-284). The CVSS vector shows AV:L (Local attack vector) requiring an authorized attacker to be locally authenticated, making this not directly exploitable over the internet.", "detailed_analysis": { "vulnerability_type": "Local privilege escalation due to improper access control in Windows Remote Access Connection Manager", "affected_products": [ "Windows Server 2019", "Windows Server 2022", "Windows Server 2016", "Windows Server 2025", "Windows 10", "Windows 11" ], "exploitation_requirements": [ "Local system access", "Valid user credentials", "Ability to interact with Remote Access Connection Manager locally" ], "internet_facing_likelihood": "This vulnerability affects the Windows Remote Access Connection Manager component locally on systems. While Windows Servers can be internet-facing, this specific vulnerability requires local access to exploit. The attack vector is explicitly LOCAL (AV:L) in the CVSS string, requiring an authenticated user on the local system.", "typical_deployment": "The affected products include both client systems (Windows 10/11) and server systems (Windows Server versions). However, the vulnerability is in a local component that manages remote access connections, not an internet-facing service itself.", "deployment_statistics": "While Windows Servers are commonly internet-facing (estimated 70-80% in enterprise environments), this vulnerability cannot be exploited directly over the internet due to its local attack vector requirement. Exploitation requires prior local system access.", "active_exploitation": "Listed in CISA KEV catalog indicating active exploitation in the wild, likely as part of attack chains where attackers have already gained initial access to systems", "severity_factors": [ "High CVSS score of 7.8", "Active exploitation confirmed by CISA KEV listing", "Affects wide range of Windows versions", "Requires only low-level privileges to exploit", "Local attack vector limits direct internet exploitation" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Apply Microsoft security updates immediately for all affected Windows versions", "Monitor for unusual privilege escalation activities and unauthorized administrative access", "Implement principle of least privilege to limit potential impact of local privilege escalation", "Review access controls and audit local user permissions on critical systems" ], "risk_assessment": { "exploit_likelihood": "HIGH for systems where attackers have already gained local access through other means (phishing, malware, etc.). Cannot be directly exploited over the internet.", "impact_assessment": "High impact once exploited - allows elevation to higher privileges (C:H/I:H/A:H), potentially leading to full system compromise", "exposure_scope": "Limited to scenarios where attackers have already compromised systems through other attack vectors. Not directly internet-exploitable despite affecting server products." }, "exploitation_method": "OTHER", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:19:22.946912", "displayed_on_website": false }, { "cve_id": "CVE-2025-58360", "cvss_score": "8.2", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2025-11-25T20:17:35.254Z", "cve_published_date_formatted": "2025-11-25", "kev_date_added": "2025-12-11", "kev_date_added_formatted": "2025-12-11", "kev_due_date": "2026-01-01", "days_to_kev": 16, "days_since_kev": null, "is_new_kev": false, "summary": "GeoServer has an unauthenticated XML External Entity (XXE) vulnerability in the WMS GetMap feature that can be exploited directly over the network. CISA has confirmed active exploitation in the wild.", "detailed_analysis": { "vulnerability_type": "Unauthenticated XML External Entity (XXE) injection via WMS GetMap endpoint", "affected_products": [ "GeoServer (versions before 2.25.6 and 2.26.0-2.26.1)" ], "exploitation_requirements": [ "Network access to GeoServer WMS endpoint", "No authentication required", "No user interaction required" ], "internet_facing_likelihood": "GeoServer is commonly deployed as an internet-facing web mapping server. As an open-source geospatial server designed to share and edit geographic data, it frequently requires internet accessibility for public mapping services, APIs, and web applications. Estimated 70-80% of GeoServer deployments are internet-facing.", "typical_deployment": "GeoServer is web server software that provides geospatial web services and APIs. It typically runs as an internet-facing application server to serve map data and spatial services to web applications and clients.", "deployment_statistics": "Approximately 70-80% of GeoServer deployments are internet-facing because the software's primary purpose is to serve geospatial data and web mapping services to users and applications over HTTP/HTTPS protocols.", "active_exploitation": "CISA has added this vulnerability to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild.", "severity_factors": [ "No authentication required", "Network-based attack vector", "High confidentiality impact", "Low attack complexity", "Confirmed active exploitation", "Internet-facing deployment common" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately update GeoServer to version 2.25.6, 2.26.2, or 2.27.0+", "Monitor WMS GetMap requests for suspicious XML payloads containing external entity references", "Review server logs for XXE exploitation attempts and unauthorized file access", "Implement XML input validation and disable external entity processing if patching is not immediately possible", "HIGHEST patch priority - actively exploited unauthenticated vulnerability" ], "risk_assessment": { "exploit_likelihood": "VERY HIGH - Unauthenticated network-based XXE with confirmed active exploitation and low attack complexity", "impact_assessment": "HIGH - Can lead to sensitive file disclosure, internal network reconnaissance, and potential server-side request forgery attacks", "exposure_scope": "VERY HIGH - GeoServer is widely deployed as internet-facing mapping infrastructure across government, commercial, and academic organizations" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "Here's what is known about the CVE-2025-58360 vulnerability exploitation, based on the provided search results:\n\n* **CISA KEV Status:** CISA has added CVE-2025-58360 to its Known Exploited Vulnerabilities (KEV) Catalog, indicating active exploitation in the wild 【1】【2】. CISA maintains the KEV catalog as an authoritative source of vulnerabilities that have been exploited 【3】.\n* **Active Exploitation:** The addition to the KEV catalog is based on evidence of active exploitation 【1】【2】.\n* **Targeted Attacks:** While the search results confirm active exploitation, they do not explicitly state whether CVE-2025-58360 has been used in targeted attacks.\n* **Internet-facing applications:** While the search results confirm active exploitation, they do not explicitly state whether CVE-2025-58360 affects internet-facing applications.\n* **Attack Vectors and Exploitation Methods:** The search results do not provide specific details on the attack vectors or exploitation methods used for this vulnerability.\n* **Technical Details:** The search results lack specific technical details regarding the exploitability of this vulnerability.\n\nSources:\n- CISA Adds Five Known Exploited Vulnerabilities to Catalog: https://www.cisa.gov/news-events/alerts/2025/10/14/cisa-adds-five-known-exploited-vulnerabilities-catalog\n- CISA Adds Two Known Exploited Vulnerabilities to Catalog: https://www.cisa.gov/news-events/alerts/2025/12/09/cisa-adds-two-known-exploited-vulnerabilities-catalog\n- Known Exploited Vulnerabilities Catalog - CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "references": [ { "title": "CISA Adds Five Known Exploited Vulnerabilities to Catalog", "url": "https://www.cisa.gov/news-events/alerts/2025/10/14/cisa-adds-five-known-exploited-vulnerabilities-catalog", "citation_contribution": 134, "snippet": "CISA has added five new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2016 ...See more", "is_search_result": true }, { "title": "CISA Adds Two Known Exploited Vulnerabilities to Catalog", "url": "https://www.cisa.gov/news-events/alerts/2025/12/09/cisa-adds-two-known-exploited-vulnerabilities-catalog", "citation_contribution": 122, "snippet": "CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.See more", "is_search_result": true }, { "title": "Known Exploited Vulnerabilities Catalog - CISA", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "citation_contribution": 102, "snippet": "CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild. Organizations should use the KEV catalog as an input to their ...See more", "is_search_result": true } ], "timestamp": "2025-12-11T20:05:13.775345" }, "cache_timestamp": "2025-12-11T20:05:31.599180", "displayed_on_website": false }, { "cve_id": "CVE-2025-58034", "cvss_score": "6.7", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2025-11-18T17:01:13.513Z", "cve_published_date_formatted": "2025-11-18", "kev_date_added": "2025-11-18", "kev_date_added_formatted": "2025-11-18", "kev_due_date": "2025-11-25", "days_to_kev": 0, "days_since_kev": null, "is_new_kev": false, "summary": "OS command injection vulnerability in Fortinet FortiWeb allowing authenticated attackers to execute unauthorized code via crafted HTTP requests or CLI commands. FortiWeb is a web application firewall that is almost universally deployed as an internet-facing service to protect web applications.", "detailed_analysis": { "vulnerability_type": "OS Command Injection (CWE-78) - Improper neutralization of special elements used in OS commands", "affected_products": [ "Fortinet FortiWeb 7.0.2-7.0.11", "Fortinet FortiWeb 7.2.0-7.2.11", "Fortinet FortiWeb 7.4.0-7.4.8", "Fortinet FortiWeb 7.6.0-7.6.4" ], "exploitation_requirements": [ "Authentication required (Privileges Required: HIGH)", "Network access to FortiWeb management interface or web service", "Ability to craft malicious HTTP requests or CLI commands" ], "internet_facing_likelihood": "FortiWeb is a web application firewall (WAF) specifically designed to protect web applications from attacks. By its core function, it sits between the internet and protected web applications, making it inherently internet-facing. Approximately 95-98% of FortiWeb deployments are internet-facing as this is the product's primary use case.", "typical_deployment": "FortiWeb is enterprise security infrastructure software deployed as a reverse proxy/web application firewall. It is positioned at network perimeters to inspect and filter HTTP/HTTPS traffic before it reaches protected web applications and servers.", "deployment_statistics": "Estimated 95-98% of FortiWeb deployments are internet-facing. The product's core function as a WAF requires it to receive and process internet traffic to protect backend web applications. Only a small minority might be deployed in internal-only environments for protecting internal web applications.", "active_exploitation": "Confirmed active exploitation in the wild according to web search results. Fortinet has acknowledged this as a zero-day vulnerability being exploited in attacks.", "severity_factors": [ "INCREASING: Active exploitation confirmed", "INCREASING: OS command injection allows full system compromise", "INCREASING: FortiWeb typically internet-facing by design", "INCREASING: Network attack vector with low complexity", "DECREASING: Requires high privileges/authentication", "DECREASING: No user interaction required once authenticated" ] }, "recommendations": [ "CRITICAL: Immediately check for indicators of compromise - review FortiWeb logs for suspicious HTTP requests, unauthorized CLI access, or evidence of command execution. Verify system integrity and check for persistence mechanisms", "URGENT: Apply patches immediately - upgrade to FortiWeb 8.0.2+, 7.6.6+, 7.4.11+, 7.2.12+, or 7.0.12+ depending on current version branch", "Monitor FortiWeb access logs closely for unusual authentication patterns, failed login attempts, and suspicious HTTP request patterns that could indicate exploitation attempts", "PATCH PRIORITY: CRITICAL - This should be treated as emergency patching due to active exploitation and internet-facing nature of the product" ], "risk_assessment": { "exploit_likelihood": "Very High - Active exploitation confirmed in the wild combined with the inherently internet-facing nature of FortiWeb deployments creates immediate risk for unpatched systems", "impact_assessment": "Critical - OS command injection with high privileges can lead to complete system compromise, allowing attackers to execute arbitrary commands, access sensitive data, modify configurations, or use the compromised WAF as a pivot point into protected networks", "exposure_scope": "High - FortiWeb is widely deployed by enterprises and service providers as internet-facing infrastructure. Thousands of internet-exposed FortiWeb instances are potentially vulnerable across multiple version branches spanning several years of releases" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "CVE-2025-58034 is a high-severity **OS command injection vulnerability** affecting **Fortinet FortiWeb** 【2】. Here's what is known about its exploitation:\n\n* **Affected Applications/Services**: The vulnerability affects FortiWeb, a web application firewall designed to protect web applications from various attacks 【2】.\n* **Active Exploitation**: It is being actively exploited in attacks 【3】.\n* **Attack Vectors/Exploitation Methods**: Authenticated attackers can achieve code execution by exploiting this OS command injection vulnerability through crafted HTTP requests or CLI commands 【3】【1】. The attacks are considered low complexity 【3】.\n* **Targeted Attacks**: While the provided information confirms active exploitation, it does not specifically detail whether the vulnerability has been used in targeted attacks.\n* **CISA KEV Status**: As of November 18, 2025, this CVE is not listed on CISA's Known Exploited Vulnerabilities Catalog.\n* **Technical Details**: CVE-2025-58034 involves improper neutralization of special elements used in an OS command, allowing authenticated attackers to execute unauthorized code on the underlying system 【1】.\n\nFortinet has released security updates to address this zero-day vulnerability 【3】.\n\nSources:\n- CVE-2025-58034 — Fortiweb | dbugs: https://dbugs.ptsecurity.com/vulnerability/PT-2025-47361\n- Fortinet FortiWeb CVE-2025-58034 OS Command Injection – Brief Summary ...: https://zeropath.com/blog/cve-2025-58034-fortinet-fortiweb-os-command-injection\n- Fortinet warns of new FortiWeb zero-day exploited in attacks: https://www.bleepingcomputer.com/news/security/fortinet-warns-of-new-fortiweb-zero-day-exploited-in-attacks/", "references": [ { "title": "CVE-2025-58034 — Fortiweb | dbugs", "url": "https://dbugs.ptsecurity.com/vulnerability/PT-2025-47361", "citation_contribution": 355, "snippet": "Details on CVE-2025-58034: Fortiweb. Includes CVSS score, affected versions, and references.An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4.0 through 7.4.10, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11. may allow an authenticated attacker to execute unauthorized code on the underlying system via crafted HTTP requests or CLI commands. Fix.", "is_search_result": true }, { "title": "Fortinet FortiWeb CVE-2025-58034 OS Command Injection – Brief Summary ...", "url": "https://zeropath.com/blog/cve-2025-58034-fortinet-fortiweb-os-command-injection", "citation_contribution": 266, "snippet": "CVE-2025-58034 is a high-severity OS command injection vulnerability in Fortinet FortiWeb, potentially allowing authenticated attackers to run arbitrary commands on the underlying system. FortiWeb is Fortinet's dedicated web application firewall, widely deployed to protect web applications from a range of attacks.", "is_search_result": true }, { "title": "Fortinet warns of new FortiWeb zero-day exploited in attacks", "url": "https://www.bleepingcomputer.com/news/security/fortinet-warns-of-new-fortiweb-zero-day-exploited-in-attacks/", "citation_contribution": 236, "snippet": "Today, Fortinet released security updates to patch a new FortiWeb zero-day vulnerability that threat actors are actively exploiting in attacks. Tracked as CVE-2025-58034, this web application ...", "is_search_result": true } ], "timestamp": "2025-11-18T20:20:15.284688" }, "cache_timestamp": "2025-11-18T20:20:39.062126", "displayed_on_website": false }, { "cve_id": "CVE-2025-57819", "cvss_score": "10.0", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2025-08-28T16:45:18.749Z", "cve_published_date_formatted": "2025-08-28", "kev_date_added": "2025-08-29", "kev_date_added_formatted": "2025-08-29", "kev_due_date": "2025-09-19", "days_to_kev": 1, "days_since_kev": null, "is_new_kev": false, "summary": "FreePBX security-reporting module contains an authentication bypass vulnerability leading to SQL injection and RCE. This web-based PBX management interface is commonly exposed to the internet for remote administration and has been actively exploited since August 2025.", "detailed_analysis": { "vulnerability_type": "Authentication bypass (CWE-288) combined with SQL injection (CWE-89) leading to remote code execution", "affected_products": [ "FreePBX security-reporting < 15.0.66", "FreePBX security-reporting < 16.0.89", "FreePBX security-reporting < 17.0.3" ], "exploitation_requirements": [ "Network access to FreePBX web interface", "No authentication required", "No user interaction required" ], "internet_facing_likelihood": "FreePBX is a web-based PBX management system that organizations routinely expose to the internet for remote administration, vendor support, and user self-service portals. Estimated 70-80% of FreePBX deployments are internet-accessible due to business requirements for remote management and VoIP services.", "typical_deployment": "FreePBX is server software that runs as a web-based management interface for Asterisk PBX systems. It provides web GUI access for administrators and users to manage phone systems, requiring HTTP/HTTPS network connectivity.", "deployment_statistics": "Approximately 70-80% of FreePBX systems are internet-facing because: 1) Remote administration needs, 2) User portals for voicemail/settings access, 3) Integration with cloud services, 4) Vendor remote support requirements, 5) Multi-site deployments requiring centralized management", "active_exploitation": "CISA has confirmed active exploitation since August 21, 2025, and added this CVE to the Known Exploited Vulnerabilities catalog", "severity_factors": [ "CVSS 10.0 Critical severity", "No authentication required", "Remote code execution capability", "Active exploitation confirmed", "Wide deployment base", "Business-critical PBX systems" ] }, "recommendations": [ "IMMEDIATE: Update FreePBX to patched versions (15.0.66+, 16.0.89+, 17.0.3+)", "URGENT: Implement network-level access controls to limit FreePBX admin interface exposure", "Monitor for indicators of compromise including unauthorized database access and system modifications", "CRITICAL patch priority due to active exploitation and RCE capability" ], "risk_assessment": { "exploit_likelihood": "VERY HIGH - Vulnerability is being actively exploited, requires no authentication, and has maximum CVSS score with network attack vector", "impact_assessment": "CRITICAL - Full system compromise possible through RCE, affecting business-critical PBX infrastructure and potentially allowing lateral movement", "exposure_scope": "HIGH - Large number of internet-exposed FreePBX systems globally, with estimated thousands to tens of thousands of vulnerable instances accessible from the internet" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "Here's what is known about the CVE-2025-57819 vulnerability:\n\n* **Affected Applications/Services:** The vulnerability affects **FreePBX versions 15, 16, and 17** 【1】【2】. FreePBX is an open-source web-based graphical user interface 【1】【3】.\n* **Internet-Facing:** The vulnerability affects internet-facing applications and services 【4】【5】.\n* **Active Exploitation:** There is evidence of **active exploitation** of this vulnerability in the wild 【6】【2】. It has been actively exploited since August 21, 2025 【7】.\n* **Attack Vectors/Exploitation Methods:** The vulnerability allows **unauthenticated access** due to insufficiently sanitized user-supplied data 【3】【7】. This can lead to **SQL injection** and **remote code execution (RCE)** 【2】.\n* **Targeted Attacks:** While there is evidence of active exploitation, there is **no specific information** available indicating that CVE-2025-57819 has been used in **targeted attacks** 【8】.\n* **CISA KEV Status:** CISA has added CVE-2025-57819 to its **Known Exploited Vulnerabilities (KEV) Catalog** 【6】.\n* **Technical Details:** The vulnerability has a **CVSS score of 10.0**, indicating maximum severity 【7】【9】. The attack vector is network-based with low complexity, requiring no privileges or user interaction 【10】【11】.\n\nSources:\n- CVE-2025-57819 - Exploits & Severity - Feedly: https://feedly.com/cve/CVE-2025-57819\n- Critical FreePBX Vulnerability (CVE-2025-57819) Under Active Exploitation: https://www.cirt.gov.bd/wp-content/uploads/2025/09/Critical-FreePBX-Vulnerability-CVE-2025-57819.pdf\n- CVE-2025-57819 Detail - NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-57819\n- CVE-2025-57819 | Tenable®: https://www.tenable.com/cve/CVE-2025-57819\n- Exploited! Ivanti EPMM Authentication Bypass &: https://www.ionix.io/blog/ivanti-epmm-rce-cve-2025-4427-4428/", "references": [ { "title": "CVE-2025-57819 - Exploits & Severity - Feedly", "url": "https://feedly.com/cve/CVE-2025-57819", "snippet": "Summary. A critical vulnerability in FreePBX, an open-source web-based graphical user interface, affects versions 15, 16, and 17.", "is_search_result": true }, { "title": "Critical FreePBX Vulnerability (CVE-2025-57819) Under Active Exploitation", "url": "https://www.cirt.gov.bd/wp-content/uploads/2025/09/Critical-FreePBX-Vulnerability-CVE-2025-57819.pdf", "snippet": "Executive Summary: A critical flaw (CVE-2025-57819) in FreePBX versions 15, 16, and 17 enables unauthenticated attackers to perform SQL injection and remote code execution (RCE), with 25 vulnerable IP addresses found in Bangladesh. Immediate patching, system updates, and access restrictions are crucial to prevent exploitation.", "is_search_result": true }, { "title": "CVE-2025-57819 Detail - NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-57819", "snippet": "FreePBX 15, 16, and 17 endpoints are vulnerable due to insufficiently sanitized user-supplied data allowing unauthenticated access to FreePBX ...", "is_search_result": true }, { "title": "CVE-2025-57819 | Tenable®", "url": "https://www.tenable.com/cve/CVE-2025-57819", "snippet": "FreePBX 15, 16, and 17 endpoints are vulnerable due to insufficiently sanitized user-supplied data allowing unauthenticated access to FreePBX ...", "is_search_result": true }, { "title": "Exploited! Ivanti EPMM Authentication Bypass &", "url": "https://www.ionix.io/blog/ivanti-epmm-rce-cve-2025-4427-4428/", "snippet": "Use the IONIX Exposure Management Platform to validate exploitability across Internet-facing hosts and prioritise RCE chains that truly work in ...", "is_search_result": true } ], "timestamp": "2025-09-06T17:15:43.227969" }, "cache_timestamp": "2025-09-06T17:16:00.102931", "displayed_on_website": false }, { "cve_id": "CVE-2025-5777", "cvss_score": "9.3", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2025-06-17T12:29:34.506Z", "cve_published_date_formatted": "2025-06-17", "kev_date_added": "2025-07-10", "kev_date_added_formatted": "2025-07-10", "kev_due_date": "2025-07-11", "days_to_kev": 23, "days_since_kev": null, "is_new_kev": false, "summary": "Critical memory overread vulnerability in NetScaler ADC/Gateway allowing unauthenticated remote attackers to read sensitive memory contents including session tokens. Actively exploited in the wild with CISA KEV listing.", "detailed_analysis": { "vulnerability_type": "Out-of-bounds read (CWE-125) due to insufficient input validation leading to memory overread", "affected_products": [ "NetScaler ADC", "NetScaler Gateway" ], "exploitation_requirements": [ "Network access to NetScaler service", "No authentication required (PR:NONE)", "No user interaction required (UI:NONE)", "Target must be configured as Gateway or AAA virtual server" ], "internet_facing_likelihood": "NetScaler ADC and Gateway are enterprise application delivery controllers and secure remote access solutions that are specifically designed to be deployed as internet-facing infrastructure. ADC provides load balancing and application delivery services that require internet exposure, while Gateway provides VPN and remote access services that must be accessible from the internet by design.", "typical_deployment": "These are server-side infrastructure appliances deployed at network perimeters to provide application delivery, load balancing, and secure remote access services to internet users", "deployment_statistics": "Estimated 85-95% of NetScaler ADC/Gateway deployments are internet-facing as their primary business function requires serving external users, remote workers, and customers accessing applications and services", "active_exploitation": "Confirmed active exploitation in the wild since mid-June 2025, with CISA adding to KEV catalog on July 10, 2025. Multiple security vendors report ongoing exploitation campaigns including ransomware attacks", "severity_factors": [ "Critical CVSS 9.3 score with network attack vector", "No authentication or user interaction required", "Active exploitation confirmed with CISA KEV listing", "Allows session hijacking and MFA bypass", "Can lead to remote code execution", "High likelihood of internet exposure for affected products" ] }, "recommendations": [ "IMMEDIATE: Apply security patches - upgrade to NetScaler ADC/Gateway 14.1-43.56 or 13.1-58.32 or later", "Monitor for indicators of compromise and unusual authentication patterns", "CRITICAL priority patching due to active exploitation and CISA KEV listing" ], "risk_assessment": { "exploit_likelihood": "VERY HIGH - Confirmed active exploitation in the wild with no authentication required and readily available on internet-facing services", "impact_assessment": "CRITICAL - Memory disclosure leading to session token theft, authentication bypass, potential RCE, and full system compromise", "exposure_scope": "Thousands of internet-facing NetScaler deployments globally, particularly targeting enterprise networks and critical infrastructure" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Known", "ransomware_first_seen_date": "2026-02-14", "ransomware_days_after_kev": 219, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "CVE-2025-5777, also known as \"**CitrixBleed 2**,\" is a critical vulnerability affecting Citrix NetScaler ADC and Gateway systems 【1】【2】.\n\nHere's a breakdown of what is known about its exploitation:\n\n1. **Affected Applications/Services:** The vulnerability primarily affects **internet-facing NetScaler ADC and Gateway systems** 【3】【4】, especially when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server 【5】.\n\n2. **Active Exploitation:** There is strong evidence of **active exploitation in the wild** 【6】【1】, with reports indicating exploitation even before public proof-of-concept (PoC) exploits were released 【1】【7】.\n\n3. **Attack Vectors and Exploitation Methods:**\n - The vulnerability is an **out-of-bounds read or memory overread** due to insufficient input validation 【8】【6】.\n - This allows **unauthenticated attackers to retrieve sensitive memory contents**, including session tokens 【9】【10】, enabling session hijacking and MFA bypass 【10】.\n - Exploitation can also lead to **remote code execution (RCE)** and denial of service 【11】.\n - Attackers identify internet-exposed NetScaler devices to exploit this vulnerability 【4】.\n\n4. **Targeted Attacks:** The vulnerability has been **leveraged in targeted attacks** 【12】 and is associated with ransomware campaigns 【13】.\n\n5. **CISA KEV Status:** **CVE-2025-5777 was added to CISA's Known Exploited Vulnerabilities (KEV) Catalog on July 10, 2025** 【13】【14】. Federal Civilian Executive Branch (FCEB) agencies were required to implement mitigations by the end of July 11, 2025 【15】.\n\n6. **Technical Details:**\n - It is a **pre-authentication remote memory disclosure vulnerability** 【16】 with a CVSS score of 9.3 (Critical) 【17】.\n - Exploitation involves identifying internet-exposed NetScaler devices and leveraging the memory leak to gain unauthorized access 【4】.\n\nSources:\n- Check for CitrixBleed 2 exploitation even if you... - Help Net Security: https://www.helpnetsecurity.com/2025/07/08/cve-2025-5777-indicators-of-compromise/\n- Critical Citrix NetScaler bug fixed, upgrade ASAP! (CVE-2025-5777): https://www.helpnetsecurity.com/2025/06/23/critical-citrix-netscaler-bug-fixed-upgrade-asap-cve-2025-5777/\n- CVE-2025-5777 Detection: A New Critical Vulnerability Dubbed ...: https://socprime.com/blog/detect-cve-2025-5777-exploitation/\n- CitrixBleed 2 (CVE-2025-5777) Mitigation: A Guide to Detecting Exposed ...: https://blog.criminalip.io/2025/07/25/cve-2025-5777/\n- CVE-2025-5777 Detail - NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-5777", "references": [ { "title": "Check for CitrixBleed 2 exploitation even if you... - Help Net Security", "url": "https://www.helpnetsecurity.com/2025/07/08/cve-2025-5777-indicators-of-compromise/", "snippet": "With PoC exploits for CVE-2025-5777 (aka CitrixBleed 2) now public and reports of active exploitation of the flaw since mid-June, you should check whether your Citrix NetScaler ADC and/or Gateway instances have been probed and compromised by attackers.", "is_search_result": true }, { "title": "Critical Citrix NetScaler bug fixed, upgrade ASAP! (CVE-2025-5777)", "url": "https://www.helpnetsecurity.com/2025/06/23/critical-citrix-netscaler-bug-fixed-upgrade-asap-cve-2025-5777/", "snippet": "Citrix has fixed a critical vulnerability (CVE-2025-5777) in NetScaler ADC and Gateway that's reminiscent of the infamous CitrixBleed flaw.", "is_search_result": true }, { "title": "CVE-2025-5777 Detection: A New Critical Vulnerability Dubbed ...", "url": "https://socprime.com/blog/detect-cve-2025-5777-exploitation/", "snippet": "It addresses Initial Access tactics, with the primary technique being the Exploitation of Public-Facing Applications (T1190). Additionally ...", "is_search_result": true }, { "title": "CitrixBleed 2 (CVE-2025-5777) Mitigation: A Guide to Detecting Exposed ...", "url": "https://blog.criminalip.io/2025/07/25/cve-2025-5777/", "snippet": "To exploit the CVE-2025-5777 vulnerability, cyber attackers first identify NetScaler devices exposed on the internet.", "is_search_result": true }, { "title": "CVE-2025-5777 Detail - NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5777", "snippet": "CVE-2025-5777 Detail. Description. Insufficient input validation leading to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ...", "is_search_result": true } ], "timestamp": "2025-09-06T17:25:58.949749" }, "cache_timestamp": "2025-09-06T17:26:16.269604", "displayed_on_website": false }, { "cve_id": "CVE-2025-55182", "cvss_score": "10.0", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2025-12-03T15:40:56.894Z", "cve_published_date_formatted": "2025-12-03", "kev_date_added": "2025-12-05", "kev_date_added_formatted": "2025-12-05", "kev_due_date": "2025-12-12", "days_to_kev": 2, "days_since_kev": null, "is_new_kev": false, "summary": "Critical pre-authentication remote code execution vulnerability in React Server Components allowing arbitrary code execution through unsafe deserialization of HTTP requests. Multiple threat actors are actively exploiting this vulnerability against internet-facing React applications.", "detailed_analysis": { "vulnerability_type": "Unsafe deserialization of untrusted data (CWE-502) in React Server Components", "affected_products": [ "React Server Components (versions 19.0.0-19.2.0)", "Next.js applications with App Router and Server Actions", "react-server-dom-webpack", "react-server-dom-turbopack", "react-server-dom-parcel" ], "exploitation_requirements": [ "Network access to Server Function endpoints", "No authentication required (pre-auth vulnerability)", "No user interaction required", "Target must use React Server Components with vulnerable versions" ], "internet_facing_likelihood": "React Server Components are specifically designed for server-side rendering and API endpoints in web applications. These components run on web servers that process HTTP requests and are inherently internet-facing by design. Estimated 95%+ of RSC deployments are internet-accessible as they serve web applications to end users.", "typical_deployment": "Server-side web application framework components that handle HTTP requests and render dynamic content. These run on web servers (Node.js) and provide API endpoints and server-side rendering functionality.", "deployment_statistics": "Approximately 95-98% of React Server Components deployments are internet-facing, as their primary purpose is to serve web applications and handle client requests over HTTP/HTTPS. The affected packages are server-side bundlers that process client requests.", "active_exploitation": "Multiple China-linked threat actors are actively exploiting this vulnerability in the wild within hours of disclosure. Production Next.js applications have been targeted with attempts to download and execute Linux backdoor trojans. Amazon and other cloud providers are actively investigating exploitation attempts.", "severity_factors": [ "CVSS 10.0 Critical severity", "Pre-authentication remote code execution", "No user interaction required", "Network attack vector with low complexity", "Active exploitation by multiple threat actors", "Affects widely-used React framework", "Complete system compromise possible (C:H/I:H/A:H with scope change)" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise immediately - active exploitation is occurring in the wild. Review web server logs for suspicious POST requests to Server Function endpoints, check for unauthorized processes, verify system integrity", "IMMEDIATE: Upgrade React to version 19.2.1 or later, or apply vendor patches for Next.js applications using App Router with Server Actions", "URGENT: Implement Web Application Firewall (WAF) rules to block malicious deserialization payloads targeting RSC endpoints as temporary mitigation", "Monitor HTTP requests to Server Function endpoints for unusual payloads or deserialization attempts", "Priority Level: CRITICAL - Patch within 24-48 hours due to active exploitation and perfect CVSS score" ], "risk_assessment": { "exploit_likelihood": "VERY HIGH - Active exploitation by multiple threat actors with public proof-of-concept code available. Simple HTTP requests can trigger the vulnerability with no authentication required.", "impact_assessment": "CRITICAL - Complete system compromise possible including arbitrary code execution with server privileges, potential for data theft, system backdooring, and lateral movement within networks.", "exposure_scope": "EXTENSIVE - Affects all internet-facing React applications using Server Components versions 19.0.0-19.2.0, including popular Next.js applications created with default settings. Millions of web applications potentially affected globally." }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Known", "ransomware_first_seen_date": "2026-02-14", "ransomware_days_after_kev": 71, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "CVE-2025-55182, also known as React2Shell, is a critical remote code execution (RCE) vulnerability affecting React Server Components (RSC) in React versions 19.0, 19.1, and 19.2, as well as Next.js applications using App Router with Server Actions 【1】【4】.\n\nHere's what is known about its exploitation:\n\n* **Affected Applications/Services:** The vulnerability affects internet-facing applications and services built on recent versions of React with default settings, such as applications on Next.js built using `create-next-app` 【3】【15】. Web applications that heavily rely on React Server Components and Server Functions are particularly at risk 【8】.\n\n* **Active Exploitation:** Multiple China-linked threat actors have been actively exploiting this vulnerability in the wild, just hours after its disclosure 【11】【12】. Amazon threat intelligence teams are also actively investigating exploitation attempts to protect AWS infrastructure 【7】.\n\n* **Attack Vectors and Exploitation Methods:** CVE-2025-55182 is an unsafe deserialization vulnerability in RSC 【16】【19】. An unauthenticated, remote attacker can exploit it by sending a specially crafted request to an RSC \"Server Function\" endpoint, potentially executing arbitrary code on the server 【5】【14】. The vulnerability exists in the Flight protocol deserialization process, allowing attackers to achieve arbitrary code execution through prototype pollution 【1】. Exploitation involves sending a simple HTTP request to the server, which can initiate a process on the server with React privileges even before authentication 【6】.\n\n* **Targeted Attacks:** On December 5, 2025, a production Next.js application was targeted by attackers exploiting CVE-2025-55182, attempting to download and execute a Linux backdoor trojan on the server 【2】.\n\n* **CISA Known Exploited Vulnerabilities (KEV) Status:** While the provided search results mention CISA adding other vulnerabilities to its KEV catalog 【17】【18】, it's not explicitly stated whether CVE-2025-55182 has been added. However, given the active exploitation, it is likely to be added to the KEV catalog.\n\n* **Technical Details on Internet Exploitability:** CVE-2025-55182 is classified as critical with a CVSS score of 10.0 【10】. It is a pre-authentication remote code execution vulnerability 【20】【21】. A remote, unauthenticated attacker can execute arbitrary code on an affected server 【14】【16】. The attack vector is remote, the attack complexity is low, no privileges are required, and no user interaction is required 【9】. The vulnerability allows arbitrary argument injection into server-side functions 【13】.\n\nSources:\n- GitHub - Spritualkb/CVE-2025-55182-exp: CVE-2025-55182 React...: https://github.com/Spritualkb/CVE-2025-55182-exp\n- CVE-2025-55182 Attack Analysis: React Server Components RCE - GitHub: https://github.com/ngvcanh/CVE-2025-55182-Attack-Analysis\n- Dangerous RCE Flaw in React, Next.js Threatens Cloud Environments ...: https://securityboulevard.com/2025/12/dangerous-rce-flaw-in-react-next-js-threatens-cloud-environments-apps/\n- CVE-2025-55182: RCE in React Server Components: https://aws.amazon.com/security/security-bulletins/AWS-2025-030/\n- Protect against React RSC CVE-2025-55182 with Azure Web Application ...: https://techcommunity.microsoft.com/blog/azurenetworksecurityblog/protect-against-react-rsc-cve-2025-55182-with-azure-web-application-firewall-waf/4475291", "references": [ { "title": "GitHub - Spritualkb/CVE-2025-55182-exp: CVE-2025-55182 React...", "url": "https://github.com/Spritualkb/CVE-2025-55182-exp", "citation_contribution": 234, "snippet": "CVE-2025-55182 is a critical Remote Code Execution (RCE) vulnerability in React Server Components (RSC) affecting Next.js applications using App Router with Server Actions. The vulnerability exists in the Flight protocol deserialization process, allowing attackers to achieve arbitrary code execution through prototype pollution.", "is_search_result": true }, { "title": "CVE-2025-55182 Attack Analysis: React Server Components RCE - GitHub", "url": "https://github.com/ngvcanh/CVE-2025-55182-Attack-Analysis", "citation_contribution": 207, "snippet": "Executive Summary On December 5, 2025, our production Next.js application was targeted by attackers exploiting CVE-2025-55182 (React2Shell), a critical Remote Code Execution vulnerability in React Server Components. The attack attempted to download and execute a Linux backdoor trojan on our server.", "is_search_result": true }, { "title": "Dangerous RCE Flaw in React, Next.js Threatens Cloud Environments ...", "url": "https://securityboulevard.com/2025/12/dangerous-rce-flaw-in-react-next-js-threatens-cloud-environments-apps/", "citation_contribution": 150, "snippet": "Google wrote that it rolled out a new rule for its Cloud Armor web application firewall created to detect and block CVE-2025-55182-related exploitation attempts. Available now, it aims to protect internet-facing applications and services that use global or regional application load balancers.", "is_search_result": true }, { "title": "CVE-2025-55182: RCE in React Server Components", "url": "https://aws.amazon.com/security/security-bulletins/AWS-2025-030/", "citation_contribution": 169, "snippet": "AWS is aware of the recently disclosed CVE-2025-55182 which affects the React Server Flight protocol in React versions 19.0, 19.1, and 19.2, as well as in Next.js versions 15.x, 16.x, Next.js 14.3.0-canary.77 and later canary releases when using App Router. This issue may permit unauthorized remote code execution (RCE) on affected applications servers.", "is_search_result": true }, { "title": "Protect against React RSC CVE-2025-55182 with Azure Web Application ...", "url": "https://techcommunity.microsoft.com/blog/azurenetworksecurityblog/protect-against-react-rsc-cve-2025-55182-with-azure-web-application-firewall-waf/4475291", "citation_contribution": 148, "snippet": "On December 3, 2025, the React team disclosed a critical remote code execution (RCE) vulnerability in React Server Components (RSC), tracked as CVE-2025-55182. The vulnerability allows an unauthenticated attacker to send a specially crafted request to an RSC “Server Function” endpoint and potentially execute arbitrary code on the server.", "is_search_result": true } ], "timestamp": "2025-12-05T14:40:16.753545" }, "cache_timestamp": "2025-12-05T14:40:39.291311", "displayed_on_website": false }, { "cve_id": "CVE-2025-55177", "cvss_score": "5.4", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1203", "deployment_likelihood": "VERY_LOW", "cve_published_date": "2025-08-29T15:50:28.578Z", "cve_published_date_formatted": "2025-08-29", "kev_date_added": "2025-09-02", "kev_date_added_formatted": "2025-09-02", "kev_due_date": "2025-09-23", "days_to_kev": 4, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2025-55177 affects WhatsApp client applications on iOS and macOS, allowing unauthorized processing of content from arbitrary URLs through crafted synchronization messages. While it has network attack vector and active exploitation evidence, it targets client applications rather than internet-facing servers.", "detailed_analysis": { "vulnerability_type": "Incomplete authorization of linked device synchronization messages (CWE-863)", "affected_products": [ "WhatsApp Desktop for Mac", "WhatsApp Business for iOS", "WhatsApp for iOS" ], "exploitation_requirements": [ "Low privilege authentication required (PR:L)", "Network connectivity to target device", "No user interaction required (UI:N)", "Low attack complexity (AC:L)" ], "internet_facing_likelihood": "The affected products are client-side messaging applications installed on end-user devices (iOS and macOS). These are not server applications and are not designed to accept direct incoming connections from the internet. Estimated <1% of deployments would be directly internet-accessible as these are consumer/business messaging clients.", "typical_deployment": "WhatsApp applications are client-side software installed on individual user devices (smartphones, desktop computers) for messaging purposes. They connect outbound to WhatsApp's servers but do not typically run as internet-facing services accepting inbound connections.", "deployment_statistics": "Less than 1% of WhatsApp client installations would be directly internet-facing. The vast majority are deployed on end-user devices behind NAT, firewalls, or mobile networks. There are no common business reasons to expose these client applications directly to the internet.", "active_exploitation": "Evidence indicates active exploitation in sophisticated, targeted attacks. CISA has added this to the Known Exploited Vulnerabilities catalog. The vulnerability has been exploited as zero-click attacks in combination with Apple OS-level vulnerability CVE-2025-43300.", "severity_factors": [ "Active exploitation in the wild", "Zero-click exploitation capability", "CISA KEV listing", "Targets client applications rather than servers", "Requires specific attack scenario against individual devices", "Limited direct internet exposure of affected products" ] }, "recommendations": [ "Update WhatsApp applications immediately to patched versions", "Monitor for suspicious WhatsApp synchronization activities", "High patch priority due to CISA KEV listing and active exploitation" ], "risk_assessment": { "exploit_likelihood": "While actively exploited, direct internet exploitation likelihood is low due to client-side nature of affected applications. Exploitation typically requires targeted attacks against specific devices rather than mass internet scanning.", "impact_assessment": "Medium impact allowing unauthorized content processing and potential for further exploitation when chained with OS vulnerabilities. Can lead to remote code execution in sophisticated attack scenarios.", "exposure_scope": "Very limited internet-facing exposure as these are client applications. Risk is primarily to individual devices rather than internet-facing infrastructure." }, "exploitation_method": "OTHER", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "CVE-2025-55177 is a vulnerability that primarily affects **WhatsApp** on **iOS** and **macOS** devices 【1】. Here's what is known about its exploitation:\n\n* **Affected Applications/Services**: The vulnerability affects WhatsApp for iOS (prior to version 2.25.21.73), WhatsApp Business for iOS, and WhatsApp for Mac (prior to version 2.25.21.78) 【2】.\n\n* **Active Exploitation**: There is evidence of active exploitation of CVE-2025-55177 in the wild 【3】【4】.\n\n* **Attack Vectors/Exploitation Methods**:\n * It is a **zero-click exploit**, meaning it can be exploited without any user interaction 【1】【5】.\n * The vulnerability involves **insufficient authorization of linked device synchronization messages** 【6】【5】.\n * Attackers can exploit memory corruption flaws to potentially crash processes or execute their own code 【7】.\n * The vulnerability allows unauthorized processing of remote content on a victim's device via crafted synchronization messages 【2】.\n\n* **Targeted Attacks**: CVE-2025-55177 has been likely used in sophisticated, targeted attacks 【8】【9】. These attacks are suspected to be spyware-related and targeted specific users 【8】【5】.\n\n* **CISA KEV Status**: CISA has added CVE-2025-55177 to its **Known Exploited Vulnerabilities Catalog**, requiring mitigation by September 23, 2025 【10】. This addition is based on evidence of active exploitation 【3】【4】 and because it is a frequent attack vector for malicious actors 【3】.\n\n* **Technical Details/Internet Exploitability**:\n * The vulnerability has a CVSS score of 5.4 【5】【11】 and 8.0 【5】.\n * Exploitability depends on attack complexity and required privileges 【12】.\n * It has been exploited in combination with an OS-level vulnerability on Apple platforms (CVE-2025-43300) 【8】【5】.\n\nSources:\n- CVE-2025-55177: Vulnerability in WhatsApp iOS & macOS ...: https://socprime.com/blog/latest-threats/cve-2025-55177-vulnerability/\n- WhatsApp vulnerability exploited in targeted zero-click attacks: https://fieldeffect.com/blog/whatsapp-vulnerability-exploited-in-zero-click-attacks\n- WhatsApp Flaw Added to CISA’s Known Exploited Vulnerabilities...: https://www.securitymagazine.com/articles/101882-whatsapp-flaw-added-to-cisas-known-exploited-vulnerabilities-catalog\n- Known Exploited Vulnerabilities Catalog - CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog\n- WhatsApp Patches Zero-Click Exploit Targeting iOS and macOS ...: https://thehackernews.com/2025/08/whatsapp-issues-emergency-update-for.html", "references": [ { "title": "CVE-2025-55177: Vulnerability in WhatsApp iOS & macOS ...", "url": "https://socprime.com/blog/latest-threats/cve-2025-55177-vulnerability/", "snippet": "Explore details for CVE-2025-55177, a zero-day vulnerability in WhatsApp iOS and macOS messaging clients, with insights on the SOC Prime ...", "is_search_result": true }, { "title": "WhatsApp vulnerability exploited in targeted zero-click attacks", "url": "https://fieldeffect.com/blog/whatsapp-vulnerability-exploited-in-zero-click-attacks", "snippet": "CVE-2025-55177 allows unauthorized processing of remote content on a victim's device via crafted synchronization messages . It impacts WhatsApp for iOS prior to version 2.25. 21.73, WhatsApp Business for iOS, and WhatsApp for Mac prior to version 2.25. 21.78.", "is_search_result": true }, { "title": "WhatsApp Flaw Added to CISA’s Known Exploited Vulnerabilities...", "url": "https://www.securitymagazine.com/articles/101882-whatsapp-flaw-added-to-cisas-known-exploited-vulnerabilities-catalog", "snippet": "These were added due to evidence of active exploitation and are frequent attack vectors for malicious actors. CISA believes these flaws present ...", "is_search_result": true }, { "title": "Known Exploited Vulnerabilities Catalog - CISA", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "snippet": "... vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.", "is_search_result": true }, { "title": "WhatsApp Patches Zero-Click Exploit Targeting iOS and macOS ...", "url": "https://thehackernews.com/2025/08/whatsapp-issues-emergency-update-for.html", "snippet": "The vulnerability, CVE-2025-55177 (CVSS score: 8.0), relates to a case of insufficient authorization of linked device synchronization messages.", "is_search_result": true } ], "timestamp": "2025-09-06T17:15:24.621524" }, "cache_timestamp": "2025-09-06T17:15:41.148081", "displayed_on_website": false }, { "cve_id": "CVE-2025-54948", "cvss_score": "9.4", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2025-08-05T13:00:19.905Z", "cve_published_date_formatted": "2025-08-05", "kev_date_added": "2025-08-18", "kev_date_added_formatted": "2025-08-18", "kev_due_date": "2025-09-08", "days_to_kev": 13, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2025-54948 is a critical OS command injection vulnerability in Trend Micro Apex One on-premise management console that allows pre-authenticated remote attackers to upload malicious code and execute arbitrary commands. CISA has added this vulnerability to the KEV catalog due to active exploitation in the wild.", "detailed_analysis": { "vulnerability_type": "OS Command Injection (CWE-78) in web-based management console", "affected_products": [ "Trend Micro Apex One 2019 (14.0) versions < 14.0.0.14039" ], "exploitation_requirements": [ "Network access to management console", "No authentication required", "No user interaction needed" ], "internet_facing_likelihood": "Trend Micro Apex One management consoles are enterprise security management platforms that are very commonly exposed to the internet. These web-based consoles are designed to provide centralized management of endpoint security across organizations and are frequently deployed as internet-accessible services to allow remote administration by IT teams, MSPs, and distributed organizations. Based on typical enterprise security deployments, an estimated 70-80% of Apex One management consoles are likely internet-facing.", "typical_deployment": "Server-side web application deployed as centralized management infrastructure for enterprise endpoint security. The management console runs as a web server application that administrators access through browsers for security policy management, monitoring, and reporting.", "deployment_statistics": "Approximately 70-80% of deployments are estimated to be internet-facing due to business requirements for remote administration, managed service provider access, and multi-location enterprise management needs.", "active_exploitation": "Confirmed active exploitation in the wild - CISA has added this CVE to the Known Exploited Vulnerabilities catalog, indicating evidence of real-world attacks", "severity_factors": [ "Critical CVSS score of 9.4", "No authentication required", "Remote code execution capability", "Active exploitation confirmed", "Enterprise security infrastructure target", "Command injection allows full system compromise" ] }, "recommendations": [ "IMMEDIATE: Apply security patches to all Trend Micro Apex One installations (upgrade to 14.0.0.14039 or later)", "URGENT: Isolate or restrict network access to Apex One management consoles until patched", "Monitor for indicators of compromise including unauthorized file uploads, suspicious command execution, and unusual administrative activities", "Implement network segmentation to limit management console exposure", "Review access logs for evidence of exploitation attempts" ], "risk_assessment": { "exploit_likelihood": "VERY HIGH - The vulnerability requires no authentication, has low attack complexity, active exploitation is confirmed by CISA KEV listing, and technical details suggest straightforward exploitation against commonly internet-exposed management interfaces", "impact_assessment": "CRITICAL - Successful exploitation provides remote code execution on enterprise security infrastructure, potentially compromising the entire endpoint security management system and providing attackers with elevated access to organizational security controls", "exposure_scope": "HIGH - Enterprise security management platforms like Apex One are widely deployed across organizations globally, with a significant percentage likely internet-accessible for remote administration purposes" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "CVE-2025-54948 is a critical vulnerability affecting **Trend Micro Apex One (on-premise) management console** 【1】【2】. Here's what is known about its exploitation:\n\n* **Affected Applications/Services:** The vulnerability affects the **on-premise management console** of Trend Micro Apex One 【1】【2】. This component is likely to be **internet-facing** in many deployments.\n* **Active Exploitation:** There is evidence of **active exploitation in the wild** 【3】【4】.\n* **Attack Vectors/Exploitation Methods:**\n * It is a **command injection vulnerability** 【5】.\n * It allows a **pre-authenticated remote attacker to upload malicious code and execute commands** on affected installations 【1】【6】.\n * The attack complexity is low, and no privileges are required, making it an easy target 【7】.\n * Unauthenticated remote threat actors can execute arbitrary code on vulnerable systems 【5】.\n* **Targeted Attacks:** While not explicitly stated as \"targeted attacks,\" the active exploitation in the wild suggests it is being used in real-world attacks 【3】【4】.\n* **CISA KEV Status:** CISA has added CVE-2025-54948 to its **Known Exploited Vulnerabilities (KEV) Catalog** 【3】【8】. This means that CISA has determined that this vulnerability is being actively exploited and poses a significant risk 【3】.\n* **Technical Details/Internet Exploitability:**\n * The vulnerability has a CVSS score of 9.4, indicating its severity 【9】【10】.\n * It is an OS command injection vulnerability in the Trend Micro Apex One on-premise management console 【8】【11】.\n * The vulnerability allows unauthenticated remote attackers to upload malicious code and execute arbitrary commands 【10】.\n * The vulnerability is essentially the same as CVE-2025-54987 but targets different CPU architectures 【12】【13】.\n\nSources:\n- ITW CRITICAL SECURITY BULLETIN: Trend Micro Apex One (On-Premise ...: https://success.trendmicro.com/en-US/solution/KA-0020652\n- CVE-2025-54948 | Tenable®: https://www.tenable.com/cve/CVE-2025-54948\n- CISA Adds One Known Exploited Vulnerability to Catalog: https://www.cisa.gov/news-events/alerts/2025/08/18/cisa-adds-one-known-exploited-vulnerability-catalog\n- CISA Warns of Trend Micro Apex One OS Command Injection Vulnerability ...: https://cybersecuritynews.com/cisa-warns-trend-micro-apex-one-flaw/\n- CVE-2025-54948 & CVE-2025-54987 | Arctic Wolf: https://arcticwolf.com/resources/blog/cve-2025-54948-cve-2025-54987/", "references": [ { "title": "ITW CRITICAL SECURITY BULLETIN: Trend Micro Apex One (On-Premise ...", "url": "https://success.trendmicro.com/en-US/solution/KA-0020652", "snippet": "This vulnerability is essentially the same as CVE-2025-54948 but targets a different CPU architecture. Mitigating Factors. Exploiting these type of ...", "is_search_result": true }, { "title": "CVE-2025-54948 | Tenable®", "url": "https://www.tenable.com/cve/CVE-2025-54948", "snippet": "A vulnerability in Trend Micro Apex One (on-premise) management console could allow a pre-authenticated remote attacker to upload malicious code ...", "is_search_result": true }, { "title": "CISA Adds One Known Exploited Vulnerability to Catalog", "url": "https://www.cisa.gov/news-events/alerts/2025/08/18/cisa-adds-one-known-exploited-vulnerability-catalog", "snippet": "CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.", "is_search_result": true }, { "title": "CISA Warns of Trend Micro Apex One OS Command Injection Vulnerability ...", "url": "https://cybersecuritynews.com/cisa-warns-trend-micro-apex-one-flaw/", "snippet": "The vulnerability, tracked as CVE-2025-54948 and classified under CWE-78, poses significant risks to organizations running on-premise installations of the enterprise security platform. Key Takeaways 1. CISA confirms CVE-2025-54948 attacks on Trend Micro Apex One.", "is_search_result": true }, { "title": "CVE-2025-54948 & CVE-2025-54987 | Arctic Wolf", "url": "https://arcticwolf.com/resources/blog/cve-2025-54948-cve-2025-54987/", "snippet": "Both stem from a command injection issue that allows unauthenticated, remote threat actors to execute arbitrary code on vulnerable systems.", "is_search_result": true } ], "timestamp": "2025-09-06T17:17:08.532975" }, "cache_timestamp": "2025-09-06T17:17:26.707548", "displayed_on_website": false }, { "cve_id": "CVE-2025-54313", "cvss_score": "7.5", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1195", "deployment_likelihood": "LOW", "cve_published_date": "2025-07-19T00:00:00.000Z", "cve_published_date_formatted": "2025-07-19", "kev_date_added": "2026-01-22", "kev_date_added_formatted": "2026-01-22", "kev_due_date": "2026-02-12", "days_to_kev": 187, "days_since_kev": null, "is_new_kev": false, "summary": "eslint-config-prettier package was compromised with embedded malicious code that executes during installation. This is a supply chain attack that affects development environments rather than production internet-facing servers.", "detailed_analysis": { "vulnerability_type": "Supply chain compromise with embedded malicious code (CWE-506)", "affected_products": [ "eslint-config-prettier (npm package)", "Node.js development environments" ], "exploitation_requirements": [ "Installation of compromised npm package", "Windows operating system for malware execution", "npm install process execution" ], "internet_facing_likelihood": "eslint-config-prettier is an ESLint configuration package used in development environments and CI/CD pipelines. While some CI/CD systems may be internet-accessible, the primary deployment is in developer workstations and build systems that are not typically internet-facing. The exploitation occurs during package installation, not through network services.", "typical_deployment": "This is a development tool package, not server software. It's used by developers and in build pipelines to configure ESLint code linting rules.", "deployment_statistics": "Less than 5% of deployments would be internet-facing, as this is primarily a development dependency used in local environments and internal CI/CD systems", "active_exploitation": "CISA KEV listing indicates active exploitation. The compromised packages contain malware that executes during installation.", "severity_factors": [ "Supply chain attack affecting popular development tool", "Executes malware during package installation", "Targets Windows systems specifically", "No network service exploitation required" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately audit all systems where eslint-config-prettier versions 8.10.1, 9.1.1, 10.1.6, or 10.1.7 were installed", "Scan for node-gyp.dll malware on Windows systems", "Update to legitimate versions of eslint-config-prettier and verify package integrity", "Review npm audit logs and package-lock.json files for suspicious installations", "Implement package verification and integrity checking in CI/CD pipelines" ], "risk_assessment": { "exploit_likelihood": "High for environments that installed the compromised packages, but this is not direct network exploitation", "impact_assessment": "High impact on affected development environments with potential for lateral movement and credential theft", "exposure_scope": "Limited to systems that installed the specific compromised package versions, primarily development environments rather than production servers" }, "exploitation_method": "OTHER", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:27:02.266945", "displayed_on_website": false }, { "cve_id": "CVE-2025-54309", "cvss_score": "9.0", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2025-07-18T00:00:00.000Z", "cve_published_date_formatted": "2025-07-18", "kev_date_added": "2025-07-22", "kev_date_added_formatted": "2025-07-22", "kev_due_date": "2025-08-12", "days_to_kev": 4, "days_since_kev": null, "is_new_kev": false, "summary": "Critical vulnerability in CrushFTP file transfer server allows remote attackers to obtain admin access via HTTPS through mishandled AS2 validation. Actively exploited in the wild with large numbers of internet-facing instances vulnerable.", "detailed_analysis": { "vulnerability_type": "Authentication bypass/privilege escalation via mishandled AS2 validation in file transfer server", "affected_products": [ "CrushFTP CrushFTP versions 10 before 10.8.5", "CrushFTP CrushFTP versions 11 before 11.3.4_23" ], "exploitation_requirements": [ "Network access to CrushFTP HTTPS interface", "No authentication required", "No user interaction needed" ], "internet_facing_likelihood": "CrushFTP is a managed file transfer (MFT) server software specifically designed to facilitate secure file transfers between organizations, partners, and customers. By its core business function, CrushFTP servers are intentionally deployed as internet-facing services to enable external access for file transfers. Estimated 85-95% of CrushFTP deployments are internet-accessible.", "typical_deployment": "CrushFTP is enterprise file transfer server software deployed as internet-facing services with web interfaces accessible via HTTPS. Organizations use it to provide secure file transfer capabilities to external partners, customers, and remote users.", "deployment_statistics": "Approximately 85-95% of CrushFTP deployments are internet-facing, as the primary business use case requires external access for file transfers. Web search confirms 'large number of exposed, internet-facing instances are vulnerable.'", "active_exploitation": "Confirmed active exploitation in the wild as of July 2025. CISA added to KEV catalog, ReliaQuest observed attempted exploitation, and multiple security vendors report ongoing attacks.", "severity_factors": [ "Critical CVSS 9.0 score", "No authentication required", "Admin access obtained", "Active exploitation confirmed", "Large attack surface due to internet-facing nature", "High deployment likelihood on internet" ] }, "recommendations": [ "IMMEDIATE: Update CrushFTP to version 10.8.5+ or 11.3.4_23+ immediately", "URGENT: If patching not immediately possible, implement DMZ proxy feature as recommended by vendor", "Monitor CrushFTP access logs for suspicious admin access attempts via HTTPS", "Conduct forensic analysis of any CrushFTP instances for signs of compromise", "This is CRITICAL priority patching due to CISA KEV listing and active exploitation" ], "risk_assessment": { "exploit_likelihood": "VERY HIGH - Vulnerability is under active exploitation with confirmed attacks against internet-facing CrushFTP instances. Attackers can send crafted HTTP requests to gain administrative control.", "impact_assessment": "CRITICAL - Complete administrative compromise of file transfer server, potentially exposing sensitive data, enabling data exfiltration, and providing persistent access to corporate networks.", "exposure_scope": "HIGH - Large number of internet-facing CrushFTP instances confirmed vulnerable according to security research. Given the enterprise nature of CrushFTP and its internet-facing deployment requirement, significant number of organizations at risk." }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "Here's what is known about the CVE-2025-54309 vulnerability:\n\n* **Affected Applications/Services:** The vulnerability affects the CrushFTP managed file transfer software web interface 【1】.\n* **Internet-Facing:** A large number of exposed, internet-facing instances are vulnerable 【2】.\n* **Active Exploitation:** CVE-2025-54309 is under active exploitation in the wild 【3】【1】. ReliaQuest observed attempted exploitation of this zero-day vulnerability 【4】.\n* **Attack Vectors/Exploitation Methods:**\n * Attackers can gain administrative control by sending crafted HTTP requests to internet-facing CrushFTP instances 【3】.\n * To exploit this vulnerability, an attacker identifies a target CrushFTP instance 【5】.\n* **Targeted Attacks:** While not explicitly stated, the nature of the vulnerability allows unauthenticated attackers to gain administrative control, suggesting it could be used in targeted attacks.\n* **CISA KEV Status:** CISA has added CVE-2025-54309 to its Known Exploited Vulnerabilities (KEV) catalog 【6】.\n* **Technical Details:**\n * CVE-2025-54309 is a critical vulnerability with a CVSS score of 9.0 【3】【7】.\n * The vulnerability exists in CrushFTP versions 10 before 10.8.5 and 11 before 11.3.4_23 【3】.\n\nSources:\n- CVE-2025-54309: Crush FTP Vulnerability Exploited in the Wild: https://www.rapid7.com/blog/post/crushftp-zero-day-exploited-in-the-wild/\n- eSentire | CrushFTP Zero-Day Vulnerability CVE-2025-54309: https://www.esentire.com/security-advisories/crushftp-zero-day-vulnerability-cve-2025-54309\n- Hackers Exploit Critical CrushFTP Flaw to Gain Admin Access on ...: https://thehackernews.com/2025/07/hackers-exploit-critical-crushftp-flaw.html\n- First Look at CVE-2025-54309: Dissecting the Latest CrushFTP Exploit: https://reliaquest.com/blog/threat-spotlight-cve-2025-54309-crushftp-exploit/\n- CVE-2025-54309: Critical Admin Access Vulnerability in... - IONIX: https://www.ionix.io/blog/cve-2025-54309-critical-admin-access-vulnerability-in-crushftp-what-you-need-to-know-and-do/", "references": [ { "title": "CVE-2025-54309: Crush FTP Vulnerability Exploited in the Wild", "url": "https://www.rapid7.com/blog/post/crushftp-zero-day-exploited-in-the-wild/", "snippet": "This vulnerability in the CrushFTP managed file transfer software web interface is being exploited in the wild.", "is_search_result": true }, { "title": "eSentire | CrushFTP Zero-Day Vulnerability CVE-2025-54309", "url": "https://www.esentire.com/security-advisories/crushftp-zero-day-vulnerability-cve-2025-54309", "snippet": "Given the large number of exposed, internet-facing vulnerable instances and ongoing exploitation of the CVE-2025-54309, organizations are strongly urged to ...", "is_search_result": true }, { "title": "Hackers Exploit Critical CrushFTP Flaw to Gain Admin Access on ...", "url": "https://thehackernews.com/2025/07/hackers-exploit-critical-crushftp-flaw.html", "snippet": "A newly disclosed critical security flaw in CrushFTP has come under active exploitation in the wild. Assigned the CVE identifier CVE-2025-54309, the vulnerability carries a CVSS score of 9.0. \"CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not...", "is_search_result": true }, { "title": "First Look at CVE-2025-54309: Dissecting the Latest CrushFTP Exploit", "url": "https://reliaquest.com/blog/threat-spotlight-cve-2025-54309-crushftp-exploit/", "snippet": "ReliaQuest observed an attempted exploitation of CVE-2025-54309—a zero-day vulnerability in CrushFTP’s file transfer software.", "is_search_result": true }, { "title": "CVE-2025-54309: Critical Admin Access Vulnerability in... - IONIX", "url": "https://www.ionix.io/blog/cve-2025-54309-critical-admin-access-vulnerability-in-crushftp-what-you-need-to-know-and-do/", "snippet": "Exploitation Methods CVE-2025-54309. To exploit this vulnerability, an attacker: Identifies a target CrushFTP instance that", "is_search_result": true } ], "timestamp": "2025-09-06T17:22:36.433196" }, "cache_timestamp": "2025-09-06T17:22:53.641550", "displayed_on_website": false }, { "cve_id": "CVE-2025-54253", "cvss_score": "10.0", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2025-08-05T16:53:40.742Z", "cve_published_date_formatted": "2025-08-05", "kev_date_added": "2025-10-15", "kev_date_added_formatted": "2025-10-15", "kev_due_date": "2025-11-05", "days_to_kev": 71, "days_since_kev": null, "is_new_kev": false, "summary": "Critical misconfiguration vulnerability in Adobe Experience Manager Forms on JEE allowing pre-authentication remote code execution via OGNL injection. The vulnerability requires no user interaction and can be exploited directly over the network against internet-facing AEM instances.", "detailed_analysis": { "vulnerability_type": "Misconfiguration leading to OGNL injection and arbitrary code execution", "affected_products": [ "Adobe Experience Manager (AEM) Forms on JEE versions 6.5.23 and earlier" ], "exploitation_requirements": [ "Network access to AEM instance", "No authentication required", "No user interaction needed" ], "internet_facing_likelihood": "Adobe Experience Manager is enterprise content management and digital experience platform software that is frequently deployed as internet-facing web applications. AEM Forms on JEE is specifically designed to serve web-based forms and document services to end users, making internet exposure very common for business functionality. Estimated 70-80% of AEM deployments have some internet-facing components.", "typical_deployment": "Server-side enterprise web application platform deployed on application servers (JEE environment) to deliver digital experiences, content management, and form processing services to users", "deployment_statistics": "Approximately 70-80% of AEM Forms deployments are internet-facing as the primary business purpose is to serve web forms, documents, and digital experiences to customers and partners over the internet", "active_exploitation": "Public proof-of-concept exists and attackers can scan for vulnerable endpoints on port 443. Adobe reports no current awareness of active exploitation in the wild, but the vulnerability is considered high-value for automated attacks.", "severity_factors": [ "CVSS 10.0 Critical severity", "No authentication required", "No user interaction needed", "Complete system compromise possible", "Internet-scannable endpoints", "Changed scope impact", "Public PoC available" ] }, "recommendations": [ "Apply security patches immediately - this is a critical priority vulnerability", "Monitor AEM Forms instances for suspicious OGNL injection attempts and unauthorized access", "Consider temporarily restricting network access to AEM Forms if patching cannot be completed immediately", "Scan for indicators of compromise on existing AEM Forms systems" ], "risk_assessment": { "exploit_likelihood": "Very High - Pre-authentication RCE with public PoC, no user interaction required, and easily discoverable internet-facing targets", "impact_assessment": "Complete system compromise including confidentiality, integrity, and availability impact with changed scope allowing potential lateral movement", "exposure_scope": "Thousands of internet-facing Adobe Experience Manager Forms instances globally, particularly in enterprise environments serving customer-facing digital services" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "CVE-2025-54253 is a critical misconfiguration vulnerability affecting **Adobe Experience Manager (AEM) Forms on JEE** versions 6.5.23 and earlier 【4】【6】. It allows for pre-authentication remote code execution (RCE) via OGNL injection 【1】【9】.\n\nHere's a breakdown of what is known about its exploitation:\n\n* **Internet-facing applications/services:** The vulnerability is exposed over the network and is considered internet-facing 【3】. Attackers can scan the internet for vulnerable endpoints on port 443 or use tools like Shodan and Censys to find targets 【1】.\n* **Active exploitation in the wild:** While a public proof-of-concept (PoC) exists, Adobe is not currently aware of active exploitation in the wild 【5】.\n* **Attack vectors and exploitation methods:** The vulnerability is triggered by improper configuration within AEM, allowing attackers to bypass security mechanisms and execute arbitrary code 【4】【3】. This is achieved through OGNL injection, and exploitation requires no user interaction or authentication 【3】【7】.\n* **Targeted attacks:** Due to the ease of exploitation and potential for automation, CVE-2025-54253 is considered a high-value target that could be used in scaled attacks against multiple AEM instances 【2】.\n* **CISA Known Exploited Vulnerabilities (KEV) status:** This vulnerability is not listed in the CISA KEV catalog.\n* **Technical details about internet exploitability:** CVE-2025-54253 has a CVSS score of 10.0, indicating its critical severity 【1】. It can be exploited remotely without authentication, making it highly dangerous 【8】.\n\nSources:\n- CVE-2025-54253: Adobe AEM Forms on JEE OGNL: https://firecompass.com/cve-2025-54253-pre-auth-rce-adobe-aem-forms-on-jee-critical-ognl-injection/\n- CVE-2025-54253: Critical Zero-Day Vulnerability in Adobe Experience...: https://www.linkedin.com/pulse/cve-2025-54253-critical-zero-day-vulnerability-adobe-experience-tbxzc\n- Adobe Experience Manager Forms CVE-2025-54253 ...: https://zeropath.com/blog/cve-2025-54253-adobe-experience-manager-forms-misconfiguration-summary\n- CVE-2025-54253 : Adobe Experience Manager versions 6.5.23 and earlier ...: https://www.cvedetails.com/cve/CVE-2025-54253/\n- APSB25-82 : Security update available for Adobe AEM Forms: https://helpx.adobe.com/security/products/aem-forms/apsb25-82.html", "references": [ { "title": "CVE-2025-54253: Adobe AEM Forms on JEE OGNL", "url": "https://firecompass.com/cve-2025-54253-pre-auth-rce-adobe-aem-forms-on-jee-critical-ognl-injection/", "citation_contribution": 291, "snippet": "CVE-2025-54253 is a critical OGNL injection vulnerability (CVSS 10.0) affecting Adobe AEM Forms on JEE, up to version 6.5.23.0. The flaw results ...", "is_search_result": true }, { "title": "CVE-2025-54253: Critical Zero-Day Vulnerability in Adobe Experience...", "url": "https://www.linkedin.com/pulse/cve-2025-54253-critical-zero-day-vulnerability-adobe-experience-tbxzc", "citation_contribution": 205, "snippet": "This attack chain makes CVE-2025-54253 a high-value target for exploitation, particularly given that it can be automated and scaled against multiple vulnerable AEM instances.", "is_search_result": true }, { "title": "Adobe Experience Manager Forms CVE-2025-54253 ...", "url": "https://zeropath.com/blog/cve-2025-54253-adobe-experience-manager-forms-misconfiguration-summary", "citation_contribution": 184, "snippet": "No user interaction or authentication required; Exploitation is possible over the network; The root cause is improper configuration within AEM ...", "is_search_result": true }, { "title": "CVE-2025-54253 : Adobe Experience Manager versions 6.5.23 and earlier ...", "url": "https://www.cvedetails.com/cve/CVE-2025-54253/", "citation_contribution": 192, "snippet": "Adobe Experience Manager versions 6.5.23 and earlier are affected by a Misconfiguration vulnerability that could result in arbitrary code execution. An attacker could leverage this vulnerability to bypass security mechanisms and execute code. Exploitation of this issue does not require user interaction and scope is changed.", "is_search_result": true }, { "title": "APSB25-82 : Security update available for Adobe AEM Forms", "url": "https://helpx.adobe.com/security/products/aem-forms/apsb25-82.html", "citation_contribution": 151, "snippet": "Adobe is aware that CVE-2025-54253 and CVE-2025-54254 have a publicly available proof-of-concept. Adobe is not aware of these issues being ...", "is_search_result": true } ], "timestamp": "2025-10-15T18:15:18.398065" }, "cache_timestamp": "2025-10-15T18:15:37.266703", "displayed_on_website": false }, { "cve_id": "CVE-2025-54236", "cvss_score": "9.1", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2025-09-09T13:20:17.939Z", "cve_published_date_formatted": "2025-09-09", "kev_date_added": "2025-10-24", "kev_date_added_formatted": "2025-10-24", "kev_due_date": "2025-11-14", "days_to_kev": 45, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2025-54236 is a critical improper input validation vulnerability in Adobe Commerce (Magento) that enables session takeover and potentially remote code execution without user interaction. This vulnerability is being actively exploited in the wild against internet-facing e-commerce platforms.", "detailed_analysis": { "vulnerability_type": "Improper Input Validation (CWE-20) in Web API ServiceInputProcessor leading to session takeover and potential remote code execution", "affected_products": [ "Adobe Commerce 2.4.4-p15 and earlier", "Magento Open Source (all versions)" ], "exploitation_requirements": [ "Network access to Adobe Commerce/Magento web application", "No authentication required", "No user interaction required" ], "internet_facing_likelihood": "Adobe Commerce and Magento are e-commerce platforms designed specifically to be internet-facing web applications. These are server-side applications that must be accessible to customers over the internet to function as online stores. Virtually 100% of deployments are internet-facing by design and business necessity.", "typical_deployment": "Adobe Commerce and Magento are e-commerce server applications that host online stores and shopping websites. They are web-based platforms that require internet connectivity to serve customers, process orders, and handle payments.", "deployment_statistics": "Estimated 95-100% of deployments are internet-facing, as these are e-commerce platforms that must be publicly accessible for customers to browse products and make purchases. Private/internal deployments would be extremely rare and defeat the business purpose.", "active_exploitation": "Confirmed active exploitation in the wild with hundreds of attack attempts blocked by security firm Sansec. Known as 'SessionReaper' vulnerability.", "severity_factors": [ "CVSS 9.1 Critical severity", "No authentication required", "No user interaction needed", "Active exploitation confirmed", "Direct network attack vector", "High confidentiality and integrity impact", "Affects widely-deployed e-commerce platforms" ] }, "recommendations": [ "Apply emergency patches immediately - this is a critical priority given active exploitation", "Implement Web Application Firewall (WAF) rules to block exploitation attempts", "Monitor for unusual session activity and unauthorized account access", "Review access logs for potential compromise indicators", "Consider temporarily restricting access if patching cannot be completed immediately" ], "risk_assessment": { "exploit_likelihood": "Very High - Active exploitation confirmed in the wild with published exploit code and detailed technical analysis available. The vulnerability requires no authentication or user interaction.", "impact_assessment": "Critical - Successful exploitation leads to session takeover with high confidentiality and integrity impact, potentially allowing attackers to compromise customer accounts and execute arbitrary code on e-commerce servers.", "exposure_scope": "Very High - Adobe Commerce and Magento power hundreds of thousands of e-commerce websites globally, with virtually all deployments being internet-facing by business necessity." }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "CVE-2025-54236, also known as \"**SessionReaper**,\" is a critical vulnerability affecting **Adobe Commerce** and **Magento Open Source** platforms 【2】【6】. Here's what is known about its exploitation:\n\n* **Affected Applications/Services**: The vulnerability affects **internet-facing applications and services** using Adobe Commerce and Magento Open Source 【1】.\n* **Active Exploitation**: There is evidence of **active exploitation in the wild** 【2】【5】. Security firm **Sansec** reported blocking hundreds of exploitation attempts 【2】【5】.\n* **Attack Vectors/Exploitation Methods**: The vulnerability stems from **improper input validation** in the **Web API ServiceInputProcessor**, potentially leading to unauthorized code execution without user interaction 【1】【3】. Successful exploitation can lead to **customer account takeover** and potentially **remote code execution (RCE)** 【7】【10】.\n* **Targeted Attacks**: While specific details on targeted attacks are not available, the active exploitation suggests it could be used in such attacks 【2】【5】.\n* **CISA KEV Status**: **CVE-2025-54236 is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog** 【4】.\n* **Technical Details**: The vulnerability can be exploited through the **Web API ServiceInputProcessor** 【1】【3】. While RCE may require file-based session storage, other forms of abuse are possible 【8】.\n\nAdobe has released an emergency patch and deployed web application firewall (WAF) rules to protect Adobe Commerce on Cloud 【1】【9】.\n\nSources:\n- CVE-2025-54236 - Exploits & Severity - Feedly: https://feedly.com/cve/CVE-2025-54236\n- Urgent: Critical SessionTakeover Flaw (CVE-2025-54236) in Adobe ...: https://www.secpod.com/blog/urgent-critical-sessiontakeover-flaw-cve-2025-54236-in-adobe-commerce-magento/\n- CVE-2025-54236 : Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7 ...: https://www.cvedetails.com/cve/CVE-2025-54236/\n- Magento & Adobe Commerce - Account Takeover (CVE-2025-54236): https://pentest-tools.com/vulnerabilities-exploits/magento-and-adobe-commerce-account-takeover_27942\n- Hackers exploiting critical \"SessionReaper\" flaw in Adobe Magento: https://www.bleepingcomputer.com/news/security/hackers-exploiting-critical-sessionreaper-flaw-in-adobe-magento/", "references": [ { "title": "CVE-2025-54236 - Exploits & Severity - Feedly", "url": "https://feedly.com/cve/CVE-2025-54236", "citation_contribution": 379, "snippet": "Threat Intelligence Report CVE-2025-54236 is a critical improper input validation vulnerability in Adobe Commerce and Magento that allows unauthenticated attackers to exploit the Web API ServiceInputProcessor, potentially leading to unauthorized code execution without user interaction. Adobe has released an emergency patch to address this vulnerability, which primarily affects systems using ...", "is_search_result": true }, { "title": "Urgent: Critical SessionTakeover Flaw (CVE-2025-54236) in Adobe ...", "url": "https://www.secpod.com/blog/urgent-critical-sessiontakeover-flaw-cve-2025-54236-in-adobe-commerce-magento/", "citation_contribution": 273, "snippet": "A critical vulnerability, CVE-2025-54236, dubbed SessionReaper, is currently under active exploitation in Adobe Commerce and Magento Open-Source platforms. The flaw arises from improper input validation and can lead to customer account takeover and remote code execution. Security firm Sansec has reported blocking over 250 exploitation attempts, underscoring the urgency for administrators to ...", "is_search_result": true }, { "title": "CVE-2025-54236 : Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7 ...", "url": "https://www.cvedetails.com/cve/CVE-2025-54236/", "citation_contribution": 158, "snippet": "Vulnerability Details : CVE-2025-54236. Adobe Commerce | Improper Input Validation (CWE-20).Exploitation of this issue does not require user interaction. Published 2025-09-09 14:15:47.", "is_search_result": true }, { "title": "Magento & Adobe Commerce - Account Takeover (CVE-2025-54236)", "url": "https://pentest-tools.com/vulnerabilities-exploits/magento-and-adobe-commerce-account-takeover_27942", "citation_contribution": 126, "snippet": "Cisa Kev. This CVE is not part of the CISA Known Exploited Vulnerabilities Catalog.", "is_search_result": true }, { "title": "Hackers exploiting critical \"SessionReaper\" flaw in Adobe Magento", "url": "https://www.bleepingcomputer.com/news/security/hackers-exploiting-critical-sessionreaper-flaw-in-adobe-magento/", "citation_contribution": 101, "snippet": "Hackers are actively exploiting the critical SessionReaper vulnerability (CVE-2025-54236) in Adobe Commerce (formerly Magento) platforms, with hundreds of attempts recorded.", "is_search_result": true } ], "timestamp": "2025-10-24T17:15:25.580952" }, "cache_timestamp": "2025-10-24T17:15:42.985997", "displayed_on_website": false }, { "cve_id": "CVE-2025-5419", "cvss_score": "8.8", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1203", "deployment_likelihood": "VERY_LOW", "cve_published_date": "2025-06-02T23:36:53.221Z", "cve_published_date_formatted": "2025-06-02", "kev_date_added": "2025-06-05", "kev_date_added_formatted": "2025-06-05", "kev_due_date": "2025-06-26", "days_to_kev": 3, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2025-5419 is an out-of-bounds read/write vulnerability in Chrome's V8 engine that allows remote code execution via crafted HTML pages. While severe for client security, this is a browser vulnerability requiring user interaction and does not qualify as T1190 since Chrome is client software, not a public-facing server application.", "detailed_analysis": { "vulnerability_type": "Out-of-bounds read and write in V8 JavaScript engine leading to heap corruption and potential RCE", "affected_products": [ "Chrome" ], "exploitation_requirements": [ "User must visit a malicious website", "Crafted HTML page delivery", "No authentication required", "User interaction (visiting webpage) required" ], "internet_facing_likelihood": "Chrome is client-side browser software, not server software. While it connects to the internet, it is not deployed as an internet-facing service that accepts incoming connections. Chrome runs on end-user devices and initiates outbound connections to web servers.", "typical_deployment": "Chrome is client software installed on end-user devices (desktops, laptops, mobile devices) for web browsing. It is not server software and does not listen for incoming network connections.", "deployment_statistics": "0% of Chrome deployments are internet-facing services. Chrome is exclusively client software that makes outbound connections to web servers, but never accepts incoming connections as a server.", "active_exploitation": "Listed in CISA KEV catalog, indicating active exploitation in the wild. CISA notes active exploitation with technical impact marked as 'total'.", "severity_factors": [ "High CVSS score of 8.8", "Active exploitation confirmed", "Potential for complete system compromise", "Heap corruption can lead to RCE", "Affects widely deployed browser", "No authentication required", "BUT: Requires user to visit malicious site" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review browser activity logs, check for unauthorized downloads or system changes, verify system integrity", "Immediately update Chrome to version 137.0.7151.68 or later on all systems", "Deploy browser security policies to restrict access to untrusted websites", "Monitor for suspicious browser processes or unexpected system behavior", "URGENT patch priority due to active exploitation and high severity" ], "risk_assessment": { "exploit_likelihood": "High for targeted attacks via malicious websites, but not exploitable as internet-facing service since Chrome is client software", "impact_assessment": "Complete compromise of affected client systems possible through heap corruption leading to RCE", "exposure_scope": "All unpatched Chrome installations, but requires social engineering or drive-by attacks to deliver malicious content - not directly exploitable over internet as Chrome is not server software" }, "exploitation_method": "USER_INTERACTION", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:04:40.471881", "displayed_on_website": false }, { "cve_id": "CVE-2025-54068", "cvss_score": "9.2", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2025-07-17T18:16:56.099Z", "cve_published_date_formatted": "2025-07-17", "kev_date_added": "2026-03-20", "kev_date_added_formatted": "2026-03-20", "kev_due_date": "2026-04-03", "days_to_kev": 246, "days_since_kev": null, "is_new_kev": false, "summary": "Livewire v3 contains a critical remote command execution vulnerability during property update hydration that requires no authentication or user interaction. The vulnerability allows unauthenticated attackers to achieve RCE against web applications built with this Laravel framework component.", "detailed_analysis": { "vulnerability_type": "Remote Command Execution via Code Injection (CWE-94) during component property hydration", "affected_products": [ "Livewire for Laravel (v3.0.0-beta.1 to v3.6.3)", "Laravel Web Applications using Livewire" ], "exploitation_requirements": [ "Network access to vulnerable web application", "Livewire component mounted in specific configuration", "No authentication required", "No user interaction required" ], "internet_facing_likelihood": "VERY HIGH - Livewire is a full-stack web framework for Laravel specifically designed for building interactive web applications. By definition, web applications built with Laravel/Livewire are deployed as internet-facing services to serve users over HTTP/HTTPS. Estimated 95%+ of Livewire deployments are internet-accessible.", "typical_deployment": "Server-side web application framework component that runs on web servers to handle HTTP requests and responses. Livewire creates interactive web components that communicate between frontend and backend over AJAX/WebSocket connections.", "deployment_statistics": "Approximately 95%+ of Livewire deployments are internet-facing since it's a web application framework designed for public web services, e-commerce sites, SaaS platforms, and interactive web applications that require internet access by design.", "active_exploitation": "CISA KEV listed with active exploitation by Iranian threat actors according to additional references. Vulnerability discovered and patched, indicating real-world exploitation scenarios.", "severity_factors": [ "Critical CVSS 9.2 score", "No authentication required", "No user interaction needed", "Full system compromise possible", "Active exploitation in wild", "Wide deployment of Laravel/Livewire in web applications" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "IMMEDIATE: Upgrade to Livewire v3.6.4 or later immediately", "Audit all Laravel applications using Livewire v3 components", "Review web application logs for suspicious property update requests", "Implement additional web application firewall rules if patching is delayed", "Monitor for unusual command execution or file system changes" ], "risk_assessment": { "exploit_likelihood": "VERY HIGH - Unauthenticated RCE with no user interaction required against commonly internet-facing web applications, with confirmed active exploitation", "impact_assessment": "CRITICAL - Full remote command execution allows complete server compromise, data theft, lateral movement, and potential ransomware deployment", "exposure_scope": "Potentially thousands of Laravel web applications worldwide using vulnerable Livewire v3 versions, predominantly internet-facing by design" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:36:28.395737", "displayed_on_website": false }, { "cve_id": "CVE-2025-53770", "cvss_score": "9.8", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2025-07-20T01:06:33.607Z", "cve_published_date_formatted": "2025-07-20", "kev_date_added": "2025-07-20", "kev_date_added_formatted": "2025-07-20", "kev_due_date": "2025-07-21", "days_to_kev": 0, "days_since_kev": null, "is_new_kev": false, "summary": "Critical deserialization vulnerability in on-premises SharePoint Server allowing unauthenticated remote code execution over the network. Actively exploited in the wild with public exploits available.", "detailed_analysis": { "vulnerability_type": "Deserialization of untrusted data (CWE-502) enabling remote code execution", "affected_products": [ "Microsoft SharePoint Enterprise Server 2016", "Microsoft SharePoint Server 2019", "Microsoft SharePoint Server Subscription Edition" ], "exploitation_requirements": [ "Network access to SharePoint server", "No authentication required (CVSS PR:N)", "No user interaction required (CVSS UI:N)" ], "internet_facing_likelihood": "SharePoint Server is enterprise collaboration software designed to be accessed by multiple users across organizations. Many deployments expose SharePoint to the internet for remote employee access, partner collaboration, and external customer portals. Estimated 40-60% of SharePoint deployments have some level of internet exposure through direct access or web application firewalls.", "typical_deployment": "SharePoint Server is server-side application software that runs on Windows Server and provides web-based collaboration, document management, and intranet portals. It operates as a web application server listening on HTTP/HTTPS ports.", "deployment_statistics": "Approximately 50% of SharePoint Server deployments are internet-accessible based on business requirements for remote access, though security best practices recommend using VPN or reverse proxy solutions for protection.", "active_exploitation": "Microsoft confirmed active exploitation in the wild. CISA added to KEV catalog. China-based threat actor Storm-2603 actively exploiting for ransomware deployment. Public exploit code available on GitHub.", "severity_factors": [ "CVSS 9.8 Critical severity", "Unauthenticated remote code execution", "Active exploitation confirmed", "Public exploit code available", "Part of 'ToolShell' exploit chain", "Can extract cryptographic secrets", "High business impact due to SharePoint's role in enterprise environments" ] }, "recommendations": [ "Apply Microsoft's interim mitigation immediately while awaiting comprehensive patch", "Block external access to SharePoint servers if not business-critical", "Monitor for indicators of compromise and unusual SharePoint activity", "Use Microsoft Defender EASM to identify exposed SharePoint instances", "Implement network segmentation to limit SharePoint server exposure", "HIGHEST patch priority when comprehensive update becomes available" ], "risk_assessment": { "exploit_likelihood": "VERY HIGH - Active exploitation confirmed with public exploit code and threat actor campaigns targeting internet-facing SharePoint servers", "impact_assessment": "CRITICAL - Complete system compromise with potential for data theft, ransomware deployment, and lateral movement within enterprise networks", "exposure_scope": "LARGE - SharePoint is widely deployed in enterprise environments with significant percentage of internet-facing instances for business collaboration needs" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Known", "ransomware_first_seen_date": "2026-02-14", "ransomware_days_after_kev": 209, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "Here's what is known about the CVE-2025-53770 vulnerability, focusing on the aspects you've specified:\n\n* **Affected Applications/Services:**\n\n * CVE-2025-53770 affects **on-premises Microsoft SharePoint Servers** 【1】【2】. It does not impact SharePoint Online in Microsoft 365 【2】. Microsoft Defender External Attack Surface Management (Defender EASM) can provide visibility into exposed, internet-facing SharePoint instances 【3】.\n* **Active Exploitation:**\n\n * Microsoft is aware of **active attacks** exploiting this vulnerability in on-premises SharePoint Servers 【2】. It is being actively exploited in the wild 【4】【5】.\n* **Attack Vectors and Exploitation Methods:**\n\n * The vulnerability is due to **deserialization of untrusted data**, allowing an unauthorized attacker to execute code over a network 【6】.\n * It allows **unauthenticated remote code execution** through advanced deserialization and ViewState abuse 【1】【7】.\n * This vulnerability is part of the \"**ToolShell**\" exploit chain 【8】.\n* **Targeted Attacks:**\n\n * A China-based threat actor, tracked as **Storm-2603**, has been observed exploiting this vulnerability to deploy ransomware 【3】.\n* **CISA Known Exploited Vulnerabilities (KEV) Status:**\n\n * **CISA has added CVE-2025-53770 to its Known Exploited Vulnerabilities catalog** 【9】【10】. This was done on July 20, 2025 【9】【10】.\n* **Technical Details and Internet Exploitability:**\n\n * The vulnerability allows attackers to **execute code over a network** 【6】.\n * Successful exploitation could **expose MachineKey configuration details** from a vulnerable SharePoint Server 【7】【11】. This can ultimately enable unauthenticated remote code execution 【7】【11】.\n * Attackers can exploit this vulnerability to **upload malicious files and extract cryptographic secrets** 【12】.\n\nSources:\n- Proactive Security Insights for SharePoint Attacks (CVE-2025-53770 ...: https://www.trendmicro.com/en_us/research/25/g/cve-2025-53770-and-cve-2025-53771-sharepoint-attacks.html\n- Customer guidance for SharePoint vulnerability CVE-2025-53770: https://msrc.microsoft.com/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770/\n- Disrupting active exploitation of on-premises SharePoint ... - Microsoft: https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/\n- Critical SharePoint RCE: CVE-2025-53770 and the Perils of ...: https://zeropath.com/blog/cve-2025-53770-sharepoint-deserialization-rce\n- cve-2025-53770 sharepoint rce vulnerability exposed: https://foresiet.com/blog/sharepoint-rce-cve-2025-53770-exploited/", "references": [ { "title": "Proactive Security Insights for SharePoint Attacks (CVE-2025-53770 ...", "url": "https://www.trendmicro.com/en_us/research/25/g/cve-2025-53770-and-cve-2025-53771-sharepoint-attacks.html", "snippet": "Accelerate your learning with Trend Campus, an easy-to-use education platform that offers personalized technical guidance", "is_search_result": true }, { "title": "Customer guidance for SharePoint vulnerability CVE-2025-53770", "url": "https://msrc.microsoft.com/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770/", "snippet": "Microsoft is aware of active attacks targeting on-premises SharePoint Server customers by exploiting vulnerabilities partially addressed by the ...", "is_search_result": true }, { "title": "Disrupting active exploitation of on-premises SharePoint ... - Microsoft", "url": "https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/", "snippet": "Microsoft has released security updates that fully protect customers using all supported versions of SharePoint affected by CVE-2025-53770 and ...", "is_search_result": true }, { "title": "Critical SharePoint RCE: CVE-2025-53770 and the Perils of ...", "url": "https://zeropath.com/blog/cve-2025-53770-sharepoint-deserialization-rce", "snippet": "A critical deserialization flaw (CVE-2025-53770) in Microsoft SharePoint Server is being actively exploited, enabling remote code execution by unauthenticated attackers. This post dissects the technical root cause, affected versions, and exploitation vectors for security teams.", "is_search_result": true }, { "title": "cve-2025-53770 sharepoint rce vulnerability exposed", "url": "https://foresiet.com/blog/sharepoint-rce-cve-2025-53770-exploited/", "snippet": "CVE-2025-53770 is a critical sharepoint rce flaw actively exploited. Learn about risks, attack vectors, iocs, and patching strategies now.", "is_search_result": true } ], "timestamp": "2025-09-06T17:24:10.329559" }, "cache_timestamp": "2025-09-06T17:24:26.298455", "displayed_on_website": false }, { "cve_id": "CVE-2025-53690", "cvss_score": "9.0", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2025-09-03T20:04:48.223Z", "cve_published_date_formatted": "2025-09-03", "kev_date_added": "2025-09-04", "kev_date_added_formatted": "2025-09-04", "kev_due_date": "2025-09-25", "days_to_kev": 1, "days_since_kev": null, "is_new_kev": false, "summary": "Critical ViewState deserialization vulnerability in Sitecore Experience Manager/Platform allowing remote code execution. Actively exploited in the wild since December 2024, affecting internet-facing Sitecore deployments using default sample machine keys.", "detailed_analysis": { "vulnerability_type": "ViewState Deserialization of Untrusted Data (CWE-502) leading to Code Injection", "affected_products": [ "Sitecore Experience Manager (XM) to 9.0", "Sitecore Experience Platform (XP) to 9.0" ], "exploitation_requirements": [ "Network access to vulnerable Sitecore instance", "Target must use sample/default machine keys", "No authentication required", "No user interaction required" ], "internet_facing_likelihood": "Sitecore XM and XP are enterprise web content management and digital experience platforms specifically designed to serve websites and web applications. These are server-side applications that require internet connectivity for their primary function of delivering web content to users. The vast majority of Sitecore deployments are internet-facing by design.", "typical_deployment": "Server software - Sitecore XM/XP are enterprise web application servers that host websites, manage digital content, and provide customer experience platforms. They are designed to be accessed by end users via web browsers.", "deployment_statistics": "Estimated 95%+ of Sitecore deployments are internet-facing, as these are web content management and digital experience platforms whose primary purpose is to serve public websites and customer-facing applications.", "active_exploitation": "Confirmed active exploitation in the wild since December 2024. CISA has added this to the Known Exploited Vulnerabilities catalog and ordered immediate patching.", "severity_factors": [ "CVSS 9.0 Critical severity", "No authentication required", "No user interaction needed", "Remote code execution capability", "Confirmed zero-day exploitation", "Affects widely deployed enterprise platform", "Simple exploitation technique (ViewState deserialization)" ] }, "recommendations": [ "CRITICAL: Immediately patch affected Sitecore installations or implement workarounds per Sitecore KB1003865", "Replace default/sample machine keys with unique cryptographically strong keys", "Monitor for suspicious ViewState manipulation and deserialization attacks", "Implement web application firewall rules to detect malicious ViewState payloads" ], "risk_assessment": { "exploit_likelihood": "VERY HIGH - Vulnerability is already being actively exploited in the wild with confirmed zero-day usage. Attack complexity is rated HIGH in CVSS but exploitation is technically straightforward for attackers with ViewState deserialization knowledge.", "impact_assessment": "CRITICAL - Remote code execution with potential for complete system compromise, data theft, and lateral movement. CVSS impact ratings are all HIGH (Confidentiality, Integrity, Availability) with Changed scope.", "exposure_scope": "Potentially thousands of internet-facing Sitecore installations globally, particularly those following older deployment guides that used sample machine keys. Sitecore is widely used by enterprise organizations for public websites." }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "Here's what is known about the CVE-2025-53690 vulnerability:\n\n* **Impact on Internet-Facing Applications/Services**:\n * CVE-2025-53690 affects internet-facing deployments of Sitecore solutions 【1】【2】.\n * The vulnerability allows a threat actor to breach these internet-facing systems 【2】.\n\n* **Evidence of Active Exploitation in the Wild**:\n * CVE-2025-53690 has been actively exploited in the wild since December 2024 【3】.\n * It is a zero-day vulnerability, meaning it was exploited before a patch was available 【2】.\n\n* **Attack Vectors and Exploitation Methods**:\n * The vulnerability is a ViewState Deserialization vulnerability 【1】.\n * It involves the deserialization of untrusted data in Sitecore Experience Manager (XM) and Sitecore Experience Platform (XP) 【4】.\n * Exploitation leads to code injection 【4】.\n * Attackers can achieve remote code execution (RCE) through this vulnerability 【1】.\n\n* **Use in Targeted Attacks**:\n * While not explicitly stated as \"targeted attacks,\" the vulnerability has been used to breach Sitecore deployments, suggesting specific targeting 【2】.\n\n* **CISA Known Exploited Vulnerabilities (KEV) Status**:\n * CISA has ordered immediate patching of this critical Sitecore vulnerability 【3】.\n\n* **Technical Details about Internet Exploitability**:\n * CVE-2025-53690 is a critical flaw with a CVSS score of 9.0 out of 10.0, indicating high severity 【3】【5】.\n * The vulnerability allows for remote code execution and data theft 【3】.\n\nSources:\n- ViewState Deserialization Zero-Day Vulnerability in Sitecore ...: https://cloud.google.com/blog/topics/threat-intelligence/viewstate-deserialization-zero-day-vulnerability\n- Sitecore zero-day vulnerability exploited by: https://www.helpnetsecurity.com/2025/09/04/sitecore-zero-day-vulnerability-cve-2025-53690-exploited/\n- CISA Orders Immediate Patch of Critical Sitecore Vulnerability Under ...: https://thehackernews.com/2025/09/cisa-orders-immediate-patch-of-critical.html\n- CVE-2025-53690 Detail - NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-53690\n- Vulnerability — Latest News, Reports & Analysis | The Hacker News: https://thehackernews.com/search/label/Vulnerability?max-results=20", "references": [ { "title": "ViewState Deserialization Zero-Day Vulnerability in Sitecore ...", "url": "https://cloud.google.com/blog/topics/threat-intelligence/viewstate-deserialization-zero-day-vulnerability", "snippet": "An active ViewState deserialization attack affecting Sitecore products, where attackers achieved remote code execution.", "is_search_result": true }, { "title": "Sitecore zero-day vulnerability exploited by", "url": "https://www.helpnetsecurity.com/2025/09/04/sitecore-zero-day-vulnerability-cve-2025-53690-exploited/", "snippet": "A threat actor is leveraging a zero-day vulnerability (CVE-2025-53690) to breach internet-facing, on-prem deployments of Sitecore solutions.", "is_search_result": true }, { "title": "CISA Orders Immediate Patch of Critical Sitecore Vulnerability Under ...", "url": "https://thehackernews.com/2025/09/cisa-orders-immediate-patch-of-critical.html", "snippet": "CVE-2025-53690, a critical Sitecore flaw (CVSS 9.0), exploited since Dec 2024, enables RCE and data theft.", "is_search_result": true }, { "title": "CVE-2025-53690 Detail - NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53690", "snippet": "Information Technology Laboratory National Vulnerability DatabaseVulnerabilities", "is_search_result": true }, { "title": "Vulnerability — Latest News, Reports & Analysis | The Hacker News", "url": "https://thehackernews.com/search/label/Vulnerability?max-results=20", "snippet": "The vulnerability , tracked as CVE-2025-53690 , carries a CVSS score of 9.0 out of a maximum of 10.0, indicating critical severity.Apple Patches CVE-2025-43300 Zero-Day in iOS, iPadOS, and macOS Exploited in Targeted Attacks.", "is_search_result": true } ], "timestamp": "2025-09-06T17:14:37.192730" }, "cache_timestamp": "2025-09-06T17:14:55.624178", "displayed_on_website": false }, { "cve_id": "CVE-2025-53521", "cvss_score": "9.8", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2025-10-15T13:55:52.694Z", "cve_published_date_formatted": "2025-10-15", "kev_date_added": "2026-03-27", "kev_date_added_formatted": "2026-03-27", "kev_due_date": "2026-03-30", "days_to_kev": 163, "days_since_kev": null, "is_new_kev": false, "summary": "Critical remote code execution vulnerability in F5 BIG-IP APM that can be exploited via network traffic without authentication. BIG-IP systems are commonly deployed as internet-facing load balancers and application delivery controllers.", "detailed_analysis": { "vulnerability_type": "Resource allocation without limits (CWE-770) leading to Remote Code Execution in BIG-IP Access Policy Manager", "affected_products": [ "F5 BIG-IP APM (versions 17.5.0-17.5.1.2, 17.1.0-17.1.2, 16.1.0-16.1.6.0, 15.1.0-15.1.10.7)" ], "exploitation_requirements": [ "Network access to BIG-IP APM virtual server", "APM access policy configured on target virtual server", "No authentication required", "No user interaction required" ], "internet_facing_likelihood": "F5 BIG-IP systems are primarily application delivery controllers and load balancers designed to sit at network perimeters and handle incoming traffic. APM (Access Policy Manager) is specifically used for remote access and authentication services. Approximately 85-90% of BIG-IP deployments are internet-facing by design, as their core function is to manage and distribute incoming web traffic from the internet to backend servers.", "typical_deployment": "BIG-IP is enterprise network infrastructure software deployed as dedicated appliances or virtual machines at network edges to handle load balancing, SSL termination, and application access management", "deployment_statistics": "Estimated 85-90% of BIG-IP APM deployments are internet-facing, as APM is specifically designed for remote access scenarios where external users need to authenticate and access internal resources through the internet", "active_exploitation": "Listed in CISA KEV catalog indicating confirmed active exploitation in the wild. F5 has also disclosed a security incident involving nation-state actors accessing their environment and source code, potentially amplifying exploitation risks.", "severity_factors": [ "Critical CVSS 9.8 score", "No authentication required", "Remote code execution impact", "Internet-facing deployment likelihood", "Active exploitation confirmed by CISA KEV listing", "Nation-state interest due to F5 security incident" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately update to patched versions: 17.5.1.3+, 17.1.3+, 16.1.6.1+, or 15.1.10.8+", "Monitor BIG-IP APM access logs for suspicious traffic patterns or unexpected TMM process restarts", "Consider temporarily disabling APM access policies if patching cannot be performed immediately", "HIGHEST patch priority - treat as emergency security update" ], "risk_assessment": { "exploit_likelihood": "Very High - Network-accessible vulnerability with no authentication required, confirmed active exploitation, and straightforward attack vector against commonly internet-facing infrastructure", "impact_assessment": "Critical - Remote code execution allows complete system compromise, potential lateral movement into internal networks, and disruption of application delivery services", "exposure_scope": "High - F5 BIG-IP has significant market presence in enterprise environments, with most APM deployments being internet-accessible by design for remote access functionality" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "CVE-2025-53521 is a **denial-of-service (DoS) vulnerability** affecting **F5 BIG-IP Access Policy Manager (APM)**. The vulnerability arises from a resource allocation issue (CWE-770) that occurs when an APM access policy is configured on a virtual server 【1】【2】.\n\nHere's a breakdown of what is known about its exploitation:\n\n- **Internet-facing applications or services:** The vulnerability affects F5 BIG-IP APM systems, which are often used to manage access to internet-facing applications and services 【1】【3】. Exploitation can lead to traffic disruption while the Traffic Management Microkernel (TMM) process restarts 【3】.\n\n- **Evidence of active exploitation in the wild:** There is no direct evidence in the provided search results indicating active exploitation of CVE-2025-53521 in the wild. However, F5 has disclosed a significant security incident involving a nation-state threat actor gaining access to its environment, which could potentially amplify the risk of zero-day exploits 【4】【5】.\n\n- **Attack vectors and exploitation methods:** An attacker can exploit this vulnerability by sending **specially crafted, undisclosed traffic** to an affected virtual server configured with an APM access policy 【1】【7】. This traffic causes the TMM process to terminate and restart, leading to a denial-of-service condition 【1】【3】. The attack vector is described as \"Network\" with \"Low\" attack complexity and requiring \"None\" for privileges or user interaction 【6】.\n\n- **Targeted attacks:** While the vulnerability itself allows for a denial-of-service, the context of a nation-state actor having access to F5's environment and source code raises concerns about the potential for more sophisticated attacks, including targeted exploitation 【4】【5】.\n\n- **CISA Known Exploited Vulnerabilities status:** CVE-2025-53521 is **not currently listed** on the CISA Known Exploited Vulnerabilities (KEV) Catalog based on the provided search results 【8】【9】.\n\n- **Technical details about internet exploitability:** The vulnerability is a resource allocation flaw (CWE-770) that can be triggered by sending specific network traffic to a BIG-IP APM virtual server 【1】【2】. This leads to the termination of the TMM process, which is responsible for data plane traffic 【1】【3】. The exploitability is characterized by a network attack vector, low complexity, and no required privileges or user interaction 【6】. It is important to note that F5 only evaluates software versions that have not reached their End of Technical Support (EoTS) 【3】【10】.\n\nSources:\n- F5 BIG-IP APM CVE-2025-53521: Brief Summary of ... - ZeroPath: https://zeropath.com/blog/cve-2025-53521-f5-big-ip-apm-dos-summary\n- CVE Analysis | ZeroPath Security Blog - Vulnerability... | ZeroPath: https://zeropath.com/blog/cve-analysis?page=5\n- K000156741: BIG-IP APM vulnerability CVE-2025-53521 - My F5: https://my.f5.com/manage/s/article/K000156741\n- F5 BIG-IP Source Code Leak Tied to State-Linked Campaigns Using ...: https://www.resecurity.com/blog/article/f5-big-ip-source-code-leak-tied-to-state-linked-campaigns-using-brickstorm-backdoor\n- FAQ on F5 Security Incident - Blog | Tenable®: https://www.tenable.com/blog/frequently-asked-questions-about-the-august-2025-f5-security-incident", "references": [ { "title": "F5 BIG-IP APM CVE-2025-53521: Brief Summary of ... - ZeroPath", "url": "https://zeropath.com/blog/cve-2025-53521-f5-big-ip-apm-dos-summary", "citation_contribution": 327, "snippet": "CVE-2025-53521 is a resource allocation vulnerability classified as CWE-770 (Allocation of Resources Without Limits or Throttling). The flaw is present when a BIG-IP Access Policy Manager (APM) access policy is configured on a virtual server. If an attacker sends specially crafted but undisclosed traffic to the affected virtual server, the Traffic Management Microkernel (TMM) process will terminate and restart.", "is_search_result": true }, { "title": "CVE Analysis | ZeroPath Security Blog - Vulnerability... | ZeroPath", "url": "https://zeropath.com/blog/cve-analysis?page=5", "citation_contribution": 340, "snippet": "In-depth CVE analysis and vulnerability research from ZeroPath security experts. Understand critical vulnerabilities, exploit techniques, and mitigation strategies.Short review of CVE-2025-53521 affecting F5 BIG-IP APM: a denial of service flaw caused by resource allocation issues in specific versions. Includes affected versions, technical details, and vendor security context. ZeroPath CVE Analysis.", "is_search_result": true }, { "title": "K000156741: BIG-IP APM vulnerability CVE-2025-53521 - My F5", "url": "https://my.f5.com/manage/s/article/K000156741", "citation_contribution": 345, "snippet": "(CVE-2025-53521) Impact Traffic is disrupted while the TMM process restarts. This vulnerability allows an unauthenticated attacker to cause a denial-of-service (DoS) on the BIG-IP APM system.1F5 evaluates only software versions that have not yet reached the End of Technical Support (EoTS) phase of their lifecycle. For more information, refer to the Security hotfixes section of K4602: Overview of the F5 security vulnerability response policy.", "is_search_result": true }, { "title": "F5 BIG-IP Source Code Leak Tied to State-Linked Campaigns Using ...", "url": "https://www.resecurity.com/blog/article/f5-big-ip-source-code-leak-tied-to-state-linked-campaigns-using-brickstorm-backdoor", "citation_contribution": 324, "snippet": "On October 15, 2025 , CISA issued Emergency Directive ED-26-01 , warning of an imminent threat to federal networks and ordering urgent inventory, hardening, and patching of affected F5 devices. The stolen code raises the risk of rapid 0-day discovery and weaponization against internet-exposed management services. ... Compromise of internet-exposed BIG-IP management/services to gain code execution (risk amplified by stolen source and vuln intel).", "is_search_result": true }, { "title": "FAQ on F5 Security Incident - Blog | Tenable®", "url": "https://www.tenable.com/blog/frequently-asked-questions-about-the-august-2025-f5-security-incident", "citation_contribution": 317, "snippet": "Frequently asked questions about the August 2025 security incident at F5 and the release of multiple BIG-IP product patches. ... Starting August 9 , 2025 , F5 learned that a nation-state threat actor gained and maintained access to certain systems within their environment. ... With access to vulnerability reports and source code, the threat actor could use that information to develop exploits for issues that have not yet been patched or remediated.", "is_search_result": true } ], "timestamp": "2026-03-27T20:30:22.502023" }, "cache_timestamp": "2026-03-27T20:30:41.422099", "displayed_on_website": false }, { "cve_id": "CVE-2025-52691", "cvss_score": "10.0", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2025-12-29T02:15:58.200Z", "cve_published_date_formatted": "2025-12-29", "kev_date_added": "2026-01-26", "kev_date_added_formatted": "2026-01-26", "kev_due_date": "2026-02-16", "days_to_kev": 28, "days_since_kev": null, "is_new_kev": false, "summary": "Critical unauthenticated file upload vulnerability in SmarterMail email servers allowing arbitrary file upload to any server location, leading to remote code execution. Active exploitation is occurring in the wild against internet-facing mail servers.", "detailed_analysis": { "vulnerability_type": "Unrestricted Upload of File with Dangerous Type (CWE-434) - Unauthenticated arbitrary file upload leading to remote code execution", "affected_products": [ "SmarterMail Build 9406 and earlier" ], "exploitation_requirements": [ "No authentication required", "Network access to SmarterMail web interface", "HTTP POST capability" ], "internet_facing_likelihood": "SmarterMail is a business email server software designed as an alternative to Microsoft Exchange. Email servers require internet connectivity by design to send/receive emails and provide webmail access. Estimated 90-95% of SmarterMail deployments are internet-facing as the primary business function requires external email communication and user access.", "typical_deployment": "SmarterMail is enterprise email server software deployed on Windows servers to provide email services, webmail access, and collaboration features for businesses. It functions as a mail server with web-based management and user interfaces.", "deployment_statistics": "Approximately 90-95% of SmarterMail deployments are internet-facing because: 1) Email servers must accept inbound mail from the internet (SMTP port 25), 2) Users require webmail access from external locations, 3) Mobile devices need to connect via IMAP/POP3/ActiveSync, 4) Administrative interfaces are often accessible remotely. Only small isolated networks might run SmarterMail internally only.", "active_exploitation": "Confirmed active exploitation in the wild. Exploitation began shortly after patch release. Public proof-of-concept exploits are available demonstrating simple HTTP requests for arbitrary file upload escalating to RCE via ASPX webshells. Over 8,000 vulnerable hosts identified as internet-accessible.", "severity_factors": [ "CVSS 10.0 Critical severity", "No authentication required", "Remote code execution achievable", "Active exploitation in wild", "Public PoC exploits available", "Pre-authentication vulnerability", "Simple HTTP-based exploitation", "Scope changed (S:C) indicating potential lateral movement" ] }, "recommendations": [ "CRITICAL: Immediately upgrade to SmarterMail Build 9413 or later - active exploitation is occurring in the wild", "URGENT: Check for indicators of compromise including unauthorized file uploads, webshells (especially ASPX files), suspicious processes, and review web server logs for unusual POST requests to file upload handlers", "Implement network segmentation and restrict administrative access to SmarterMail interfaces from trusted networks only", "Monitor for suspicious file uploads and implement file upload restrictions/validation as additional defense", "This is CRITICAL priority patching due to unauthenticated RCE with active exploitation" ], "risk_assessment": { "exploit_likelihood": "VERY HIGH - Unauthenticated network-accessible vulnerability with public PoCs and confirmed active exploitation against internet-facing email servers", "impact_assessment": "CRITICAL - Complete system compromise possible through remote code execution, potential for data exfiltration, email system disruption, and lateral movement within corporate networks", "exposure_scope": "HIGH - Over 8,000 internet-accessible SmarterMail instances identified as vulnerable, with email servers being high-value targets for attackers" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Known", "ransomware_first_seen_date": "2026-04-21", "ransomware_days_after_kev": 85, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "**CVE-2025-52691** is a critical vulnerability affecting **SmarterTools SmarterMail** email server software.\n\nHere's what is known about its exploitation:\n\n* **Internet-Facing Applications/Services:** The vulnerability specifically impacts **internet-facing SmarterMail instances** 【1】【8】. SmarterMail is described as a business email and collaboration server, often used as an alternative to Microsoft Exchange 【7】.\n\n* **Evidence of Active Exploitation:** There is **evidence of active exploitation in the wild** 【3】. Reports indicate that exploitation began shortly after a patch was released 【3】. Public Proofs of Concept (PoCs) are available, demonstrating how attackers can exploit the vulnerability 【1】.\n\n* **Attack Vectors and Exploitation Methods:** The vulnerability allows an **unauthenticated attacker to upload arbitrary files to any location on the mail server** 【5】【6】. This is achieved through a file upload handler that lacks authorization and validation, enabling POST requests to place files in arbitrary paths 【2】. Successful exploitation can lead to **remote code execution (RCE)** 【6】【9】. Public PoCs show simple HTTP requests for file uploads, escalating to RCE via ASPX webshells 【1】.\n\n* **Targeted Attacks:** While widespread exploitation is not yet confirmed, the public availability of exploits increases the risk for unpatched, internet-facing mail servers, suggesting potential for both mass scanning and targeted attacks 【1】.\n\n* **CISA Known Exploited Vulnerabilities (KEV) Status:** As of the provided information, **CVE-2025-52691 is not listed on the CISA Known Exploited Vulnerabilities (KEV) Catalog** 【4】【14】. CISA maintains this catalog of vulnerabilities that have been exploited in the wild to help organizations prioritize their vulnerability management.\n\n* **Technical Details about Internet Exploitability:** The vulnerability is a **pre-authentication RCE** 【11】【13】. This means an attacker does not need to authenticate to the SmarterMail server to exploit it, significantly lowering the barrier to entry for exploitation 【2】【10】. The affected versions are SmarterMail Build 9406 and earlier, with fixes available in Build 9413 and later 【9】【12】. The vulnerability has a **CVSS Base Score of 10.0**, indicating its critical severity 【5】【15】.\n\nSources:\n- 8000+ SmarterMail Hosts Vulnerable to RCE Attack - PoC Exploit Released: https://cybersecuritynews.com/8000-smartermail-hosts-vulnerable/\n- CVE-2025-52691: Critical Unauthenticated RCE in: https://thecyberthrone.in/2026/01/01/cve-2025-52691-critical-unauthenticated-rce-in-smartermail/\n- SmarterMail Auth Bypass Exploited in the Wild Two Days After Patch Release: https://thehackernews.com/2026/01/smartermail-auth-bypass-exploited-in.html\n- Known Exploited Vulnerabilities Catalog - CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog\n- Security Vulnerability CVE-2025-52691 - Complete Analysis and Details: https://www.redhotcyber.com/en/cve-details/?cve_id=CVE-2025-52691", "references": [ { "title": "8000+ SmarterMail Hosts Vulnerable to RCE Attack - PoC Exploit Released", "url": "https://cybersecuritynews.com/8000-smartermail-hosts-vulnerable/", "citation_contribution": 467, "snippet": "CVE-2025-52691 stems from an unauthenticated arbitrary file upload flaw in SmarterMail versions Build 9406 and earlier.Public PoCs on platforms like Sploitus demonstrate simple HTTP requests for file uploads, escalating to RCE via ASPX webshells. No widespread in-the-wild exploitation is confirmed yet, but the public exploits heighten risks for unpatched mail servers directly internet-facing. Administrators must upgrade to SmarterMail Build 9413 or later, ideally the newest Build 9483, for remediation.", "is_search_result": true }, { "title": "CVE-2025-52691: Critical Unauthenticated RCE in", "url": "https://thecyberthrone.in/2026/01/01/cve-2025-52691-critical-unauthenticated-rce-in-smartermail/", "citation_contribution": 199, "snippet": " ... CVE-2025-52691 stems from a .NET file upload handler lacking authorization and validation, allowing POST requests to place files in arbitrary paths like /App_Data/ or web roots. ... Affected versions : SmarterMail Build 9406 and earlier ; fixed in Build 9413 (Oct 9, 2025), latest 9483 (Dec 18, 2025). ... Attack surface : Thousands of internet-facing SmarterMail instances; no auth lowers barrier to mass scanning/exploitation.", "is_search_result": true }, { "title": "SmarterMail Auth Bypass Exploited in the Wild Two Days After Patch Release", "url": "https://thehackernews.com/2026/01/smartermail-auth-bypass-exploited-in.html", "citation_contribution": 174, "snippet": "A new security flaw in SmarterTools SmarterMail email software has come under active exploitation in the wild, two days after the release of a patch.The Hacker News has reached out to SmarterTools for comment, and we will update the story if we hear back. The development comes less than a month after the Cyber Security Agency of Singapore (CSA) disclosed details of a maximum-severity security flaw in SmarterMail (CVE-2025-52691, CVSS score: 10.0) that could be exploited to achieve remote code execution.", "is_search_result": true }, { "title": "Known Exploited Vulnerabilities Catalog - CISA", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "citation_contribution": 150, "snippet": "For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild. Organizations should use the KEV catalog as an input to their vulnerability management prioritization framework.How to use the KEV ...", "is_search_result": true }, { "title": "Security Vulnerability CVE-2025-52691 - Complete Analysis and Details", "url": "https://www.redhotcyber.com/en/cve-details/?cve_id=CVE-2025-52691", "citation_contribution": 130, "snippet": "CVE-2025-52691. View the latest critical CVEs issued This is a free service offered by Red Hot Cyber to the community.Description: Successful exploitation of the vulnerability could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution. CVSS Base Score: 10.0 (v3.1).", "is_search_result": true } ], "timestamp": "2026-01-26T20:15:28.913819" }, "cache_timestamp": "2026-01-26T20:15:51.291109", "displayed_on_website": false }, { "cve_id": "CVE-2025-5086", "cvss_score": "9.0", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2025-06-02T17:42:42.620Z", "cve_published_date_formatted": "2025-06-02", "kev_date_added": "2025-09-11", "kev_date_added_formatted": "2025-09-11", "kev_due_date": "2025-10-02", "days_to_kev": 101, "days_since_kev": null, "is_new_kev": false, "summary": "Critical deserialization vulnerability in DELMIA Apriso manufacturing execution system allowing remote code execution without authentication. Active exploitation observed in the wild targeting internet-facing instances.", "detailed_analysis": { "vulnerability_type": "Deserialization of untrusted data (CWE-502) leading to remote code execution", "affected_products": [ "DELMIA Apriso Release 2020-2025" ], "exploitation_requirements": [ "Network access to DELMIA Apriso service", "No authentication required", "No user interaction needed" ], "internet_facing_likelihood": "DELMIA Apriso is a manufacturing execution system (MES) commonly deployed as a web-based server application accessible to factory floor systems, supply chain partners, and remote management interfaces. Enterprise deployments frequently expose these systems to the internet for remote monitoring, vendor support, and multi-site connectivity. Estimated 60-70% of deployments have some level of internet accessibility.", "typical_deployment": "Server-side enterprise manufacturing execution system deployed as web application with database backend, typically running on Windows servers with IIS/application server components", "deployment_statistics": "Approximately 60-70% of DELMIA Apriso deployments are internet-facing due to business requirements for remote access, vendor support, supply chain integration, and multi-site manufacturing coordination", "active_exploitation": "Confirmed exploit attempts observed in the wild with attackers using reconnaissance and scanning techniques to identify vulnerable instances", "severity_factors": [ "Critical CVSS 9.0 score", "No authentication required", "Remote code execution impact", "Active exploitation confirmed", "High attack complexity somewhat limits exploitation", "Scope change allows broader system compromise" ] }, "recommendations": [ "Apply vendor patches immediately for all internet-facing DELMIA Apriso instances", "Implement network segmentation to restrict internet access if possible", "Monitor for deserialization attack patterns and unusual network traffic to DELMIA Apriso services", "CRITICAL patch priority - treat as emergency due to active exploitation" ], "risk_assessment": { "exploit_likelihood": "HIGH - Active exploitation confirmed with no authentication barriers, though high attack complexity may limit some attackers", "impact_assessment": "CRITICAL - Remote code execution with scope change allows complete system compromise and potential lateral movement in manufacturing environments", "exposure_scope": "HIGH - Manufacturing execution systems are commonly internet-accessible for business operations, affecting potentially thousands of installations globally" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "CVE-2025-5086 is a critical vulnerability affecting **Dassault DELMIA Apriso** (Release 2020 through 2025) that could lead to **remote code execution** due to deserialization of untrusted data 【1】【2】. Here's a breakdown of what is known about its exploitation:\n\n* **Affected Applications/Services:** DELMIA Apriso is affected by this vulnerability 【1】【2】.\n* **Internet-Facing:** This vulnerability affects internet-facing applications and services 【3】.\n* **Active Exploitation:** There have been observed exploit attempts in the wild targeting this vulnerability 【2】【4】. However, recent telemetry suggests that exploitation has significantly declined, with attack volumes falling below the long-term average 【5】.\n* **Attack Vectors/Exploitation Methods:** The vulnerability is a deserialization issue, meaning it arises from the application's failure to properly validate data received from untrusted sources 【1】【2】. Exploitation involves sending malicious serialized data to the DELMIA Apriso application, which, when deserialized, leads to remote code execution 【1】【2】.\n* **Targeted Attacks:** Attackers include both opportunistic and targeted actors, employing reconnaissance and indiscriminate scanning techniques 【3】.\n* **CISA KEV Status:** There is no explicit confirmation that CVE-2025-5086 has been added to the CISA Known Exploited Vulnerabilities (KEV) catalog 【6】【7】.\n* **Technical Details/Internet Exploitability:** While the attack complexity is considered high, the fact that it requires no privileges makes it a viable target 【8】. The more remote an attacker can be (logically and physically), the more severe the vulnerability 【3】. Successful exploitation could allow attackers to execute arbitrary code remotely without requiring user interaction, potentially leading to complete system compromise 【9】.\n\nSources:\n- Exploit Attempts for Dassault DELMIA Apriso. CVE-2025- ...: https://isc.sans.edu/diary/Exploit+Attempts+for+Dassault+DELMIA+Apriso+CVE20255086/32256\n- Exploit Attempts for Dassault DELMIA Apriso. CVE-2025-5086: https://isc.sans.edu/diary/32256\n- A deserialization of untrusted data vulnerability... · CVE-2025-5086...: https://github.com/advisories/GHSA-7c63-xmgg-xrx5\n- CVE-2025-5086 (CVSS 9.0): A Critical RCE in DELMIA Apriso ...: https://securityonline.info/cve-2025-5086-cvss-9-0-a-critical-rce-in-delmia-apriso-with-exploit-attempts-seen-in-the-wild/\n- DELMIA Apriso - RCE (CVE-2025-5086): https://app.crowdsec.net/cti/cve-explorer/CVE-2025-5086", "references": [ { "title": "Exploit Attempts for Dassault DELMIA Apriso. CVE-2025- ...", "url": "https://isc.sans.edu/diary/Exploit+Attempts+for+Dassault+DELMIA+Apriso+CVE20255086/32256", "snippet": "A deserialization of untrusted data vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could lead to a remote code ...", "is_search_result": true }, { "title": "Exploit Attempts for Dassault DELMIA Apriso. CVE-2025-5086", "url": "https://isc.sans.edu/diary/32256", "snippet": "A deserialization of untrusted data vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could lead to a remote code execution. Either way, we are seeing exploits for DELMIA Apriso related issues.", "is_search_result": true }, { "title": "A deserialization of untrusted data vulnerability... · CVE-2025-5086...", "url": "https://github.com/advisories/GHSA-7c63-xmgg-xrx5", "snippet": "Attack vector: More severe the more the remote (logically and physically) an attacker can be in order to exploit the vulnerability. · Attack ...", "is_search_result": true }, { "title": "CVE-2025-5086 (CVSS 9.0): A Critical RCE in DELMIA Apriso ...", "url": "https://securityonline.info/cve-2025-5086-cvss-9-0-a-critical-rce-in-delmia-apriso-with-exploit-attempts-seen-in-the-wild/", "snippet": "A critical deserialization flaw (CVE-2025-5086) in DELMIA Apriso could allow remote code execution. Exploit attempts have been seen in the ...", "is_search_result": true }, { "title": "DELMIA Apriso - RCE (CVE-2025-5086)", "url": "https://app.crowdsec.net/cti/cve-explorer/CVE-2025-5086", "snippet": "CrowdSec network telemetry also shows that exploitation of CVE-2025-5086 has significantly declined over the past week. Attack volumes are well below the long-term average, suggesting attackers are rapidly losing interest. The vulnerability appears to be falling out of active use across most threat landscapes.", "is_search_result": true } ], "timestamp": "2025-09-11T17:50:20.861652" }, "cache_timestamp": "2025-09-11T17:50:35.994030", "displayed_on_website": false }, { "cve_id": "CVE-2025-49706", "cvss_score": "6.5", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2025-07-08T16:58:07.343Z", "cve_published_date_formatted": "2025-07-08", "kev_date_added": "2025-07-22", "kev_date_added_formatted": "2025-07-22", "kev_due_date": "2025-07-23", "days_to_kev": 14, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2025-49706 is an improper authentication vulnerability in Microsoft SharePoint Server that allows network-based spoofing attacks without authentication. The vulnerability is actively exploited in the wild and enables attackers to bypass authentication by manipulating HTTP headers.", "detailed_analysis": { "vulnerability_type": "Improper Authentication (CWE-287) - Authentication bypass leading to spoofing", "affected_products": [ "Microsoft SharePoint Enterprise Server 2016", "Microsoft SharePoint Server 2019", "Microsoft SharePoint Server Subscription Edition" ], "exploitation_requirements": [ "Network access to SharePoint server", "No authentication required (PR:N)", "No user interaction required (UI:N)", "Ability to manipulate HTTP requests/headers" ], "internet_facing_likelihood": "SharePoint Server is enterprise collaboration software designed to be accessed by users across organizations. Many SharePoint deployments are internet-facing to support remote workers, external partners, and distributed teams. Estimated 60-70% of SharePoint Server deployments have some level of internet exposure through web applications, extranets, or partner portals.", "typical_deployment": "SharePoint Server is server software that runs as a web application platform providing collaboration services, document management, and business applications. It typically runs on Windows Server with IIS and is accessed via web browsers.", "deployment_statistics": "Approximately 60-70% of SharePoint Server deployments are estimated to be internet-facing due to business requirements for remote access, partner collaboration, and external sharing. Large enterprises commonly expose SharePoint through secure web gateways or DMZ deployments.", "active_exploitation": "Confirmed active exploitation in the wild. Added to CISA KEV catalog on July 22, 2025. Attackers are exploiting this vulnerability alongside CVE-2025-53770 for web shell deployment and privilege escalation.", "severity_factors": [ "No authentication required for exploitation", "Network-accessible attack vector", "Active exploitation confirmed", "CISA KEV listed vulnerability", "Can lead to privilege escalation and web shell deployment", "Part of chained attacks with RCE vulnerabilities" ] }, "recommendations": [ "Apply Microsoft security updates immediately for all SharePoint Server versions", "Monitor SharePoint servers for suspicious HTTP requests to /ToolPane.aspx", "Implement network segmentation to limit SharePoint server exposure", "Review and audit SharePoint authentication configurations", "Deploy web application firewall rules to detect header manipulation attacks" ], "risk_assessment": { "exploit_likelihood": "Very High - Active exploitation confirmed with no authentication required and direct network access possible to internet-facing SharePoint servers", "impact_assessment": "High - Authentication bypass can lead to unauthorized access, data exposure, and when chained with other vulnerabilities, remote code execution and web shell deployment", "exposure_scope": "Significant - Large number of enterprise SharePoint Server deployments globally with estimated 60-70% having internet exposure for business functionality" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Known", "ransomware_first_seen_date": "2026-02-14", "ransomware_days_after_kev": 207, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "Here's what is known about the CVE-2025-49706 vulnerability:\n\n* **Affected Applications/Services:** CVE-2025-49706 affects **on-premises Microsoft SharePoint Server** versions 【1】.\n\n* **Active Exploitation:** There is evidence of **active exploitation in the wild** 【2】【3】.\n\n* **Attack Vectors/Exploitation Methods:**\n * The vulnerability is an **improper authentication issue** that allows an attacker to perform **spoofing over a network** 【4】.\n * Attackers can **manipulate HTTP requests**, specifically the **Referer header**, to bypass authentication and gain access to restricted SharePoint functionality 【5】【6】.\n\n* **Targeted Attacks:** CVE-2025-49706 is being exploited in attacks that lead to **stealthy web shell deployment and privilege escalation** 【3】.\n\n* **CISA KEV Status:** CISA added CVE-2025-49706 to its **Known Exploited Vulnerabilities Catalog** on July 22, 2025 【7】.\n\n* **Technical Details/Internet Exploitability:**\n * CVE-2025-49706 is related to a more critical vulnerability, **CVE-2025-53770**, which is a **zero-authentication remote code execution (RCE)** vulnerability in Microsoft SharePoint 【3】【8】. CVE-2025-53770 is a variant of CVE-2025-49706 【2】【8】.\n * Exploitation involves manipulating HTTP requests to ```/ToolPane.aspx```, specifically forging the ```Referer``` header 【5】.\n\nSources:\n- Active Exploitation of Microsoft SharePoint Vulnerabilities: https://unit42.paloaltonetworks.com/microsoft-sharepoint-cve-2025-49704-cve-2025-49706-cve-2025-53770/\n- GitHub - AdityaBhatt3010/CVE-2025-49706-SharePoint-Spoofing...: https://github.com/AdityaBhatt3010/CVE-2025-49706-SharePoint-Spoofing-Vulnerability-Under-Active-Exploitation\n- cve-2025-49706 · GitHub Topics · GitHub: https://github.com/topics/cve-2025-49706\n- CVE-2025-49706 Detail - NVD: https://nvd.nist.gov/vuln/detail/cve-2025-49706\n- ToolShell Unleashed: Decoding the SharePoint Attack Chain - Trellix: https://www.trellix.com/blogs/research/toolshell-unleashed-decoding-the-sharepoint-attack-chain/", "references": [ { "title": "Active Exploitation of Microsoft SharePoint Vulnerabilities", "url": "https://unit42.paloaltonetworks.com/microsoft-sharepoint-cve-2025-49704-cve-2025-49706-cve-2025-53770/", "snippet": "Active attacks are targeting on-premises SharePoint Server customers by exploiting a variant of CVE-2025-49706. This new variant has been ...", "is_search_result": true }, { "title": "GitHub - AdityaBhatt3010/CVE-2025-49706-SharePoint-Spoofing...", "url": "https://github.com/AdityaBhatt3010/CVE-2025-49706-SharePoint-Spoofing-Vulnerability-Under-Active-Exploitation", "snippet": "CVE‑2025‑49706, a spoofing vulnerability in SharePoint Server, has evolved from medium-severity to real-world weaponization, with a variant (CVE‑2025‑53770) now actively exploited in the wild.", "is_search_result": true }, { "title": "cve-2025-49706 · GitHub Topics · GitHub", "url": "https://github.com/topics/cve-2025-49706", "snippet": "A deep dive into CVE-2025-49706 — the SharePoint spoofing flaw now exploited in the wild for stealthy web shell deployment and privilege escalation.", "is_search_result": true }, { "title": "CVE-2025-49706 Detail - NVD", "url": "https://nvd.nist.gov/vuln/detail/cve-2025-49706", "snippet": "Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network. Metrics. CVSS Version 4.0. CVSS ...", "is_search_result": true }, { "title": "ToolShell Unleashed: Decoding the SharePoint Attack Chain - Trellix", "url": "https://www.trellix.com/blogs/research/toolshell-unleashed-decoding-the-sharepoint-attack-chain/", "snippet": "CVE-2025-49706: An authentication bypass (spoofing) vulnerability that allows unauthenticated attackers to access restricted SharePoint functionality. Attackers manipulate HTTP requests to the /ToolPane.aspx, specifically, by forging the Referer header.", "is_search_result": true } ], "timestamp": "2025-09-06T17:23:35.198362" }, "cache_timestamp": "2025-09-06T17:23:57.649610", "displayed_on_website": false }, { "cve_id": "CVE-2025-49704", "cvss_score": "8.8", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2025-07-08T16:58:05.908Z", "cve_published_date_formatted": "2025-07-08", "kev_date_added": "2025-07-22", "kev_date_added_formatted": "2025-07-22", "kev_due_date": "2025-07-23", "days_to_kev": 14, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2025-49704 is a critical code injection vulnerability in Microsoft SharePoint that allows remote code execution over the network with only low-privilege authentication required. SharePoint servers are commonly deployed as internet-facing enterprise applications, making this vulnerability highly exploitable via T1190.", "detailed_analysis": { "vulnerability_type": "Code Injection (CWE-94) leading to Remote Code Execution", "affected_products": [ "Microsoft SharePoint Enterprise Server 2016", "Microsoft SharePoint Server 2019" ], "exploitation_requirements": [ "Network access to SharePoint server", "Low-privilege authentication (PR:L)", "No user interaction required (UI:N)" ], "internet_facing_likelihood": "SharePoint is enterprise collaboration software designed to be accessed by users across organizations. As a web-based application server that provides document management, collaboration tools, and intranet functionality, SharePoint servers are routinely deployed as internet-facing services to enable remote access for employees, partners, and external users. Estimated 70-80% of SharePoint deployments are internet-accessible.", "typical_deployment": "SharePoint is server software that runs as a web application on Windows Server infrastructure. It functions as an enterprise collaboration platform hosting websites, document libraries, and business applications that users access through web browsers.", "deployment_statistics": "Approximately 70-80% of SharePoint deployments are internet-facing. Organizations commonly expose SharePoint to enable remote work, partner collaboration, and external user access. Many SharePoint sites serve as public-facing corporate intranets, extranets, and collaboration portals.", "active_exploitation": "Microsoft confirmed active exploitation in the wild since at least July 7, 2025. CISA added this to the Known Exploited Vulnerabilities catalog on July 22, 2025. Attackers use crafted POST requests to upload malicious scripts and often chain this with CVE-2025-49706 for unauthenticated access.", "severity_factors": [ "Active exploitation confirmed", "High CVSS score of 8.8", "Network-based attack vector", "No user interaction required", "Code injection leading to RCE", "Affects widely deployed enterprise software", "Often chained with authentication bypass" ] }, "recommendations": [ "Apply security patches immediately for affected SharePoint versions", "Monitor SharePoint servers for suspicious POST requests and uploaded files (especially spinstall0.aspx)", "Implement network segmentation to limit SharePoint server exposure", "Review authentication logs for unauthorized access attempts" ], "risk_assessment": { "exploit_likelihood": "Very High - Active exploitation confirmed with publicly available technical details and proof-of-concept methods. The vulnerability requires only low-privilege authentication and no user interaction.", "impact_assessment": "Critical - Successful exploitation allows complete system compromise with arbitrary code execution, potentially leading to data theft, lateral movement, and persistent access to enterprise environments.", "exposure_scope": "High - SharePoint is widely deployed in enterprise environments with an estimated 70-80% of installations being internet-accessible, representing thousands of potentially vulnerable servers globally." }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Known", "ransomware_first_seen_date": "2026-02-14", "ransomware_days_after_kev": 207, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "CVE-2025-49704 is a critical code injection vulnerability affecting **Microsoft SharePoint** and is often chained with **CVE-2025-49706** 【1】【2】.\n\nHere's a breakdown of what is known about its exploitation:\n\n* **Internet-facing applications or services:** CVE-2025-49704 impacts on-premises SharePoint servers, which are often internet-facing 【1】【3】.\n\n* **Active exploitation:** Microsoft has confirmed active exploitation of CVE-2025-49704 in the wild since at least July 7, 2025 【4】【3】.\n\n* **Attack vectors and exploitation methods:**\n * The vulnerability is a **code injection** flaw that allows attackers to execute code remotely 【1】【5】.\n * A crafted POST request is sent to the SharePoint server to upload a malicious script, often named ```spinstall0.aspx``` 【4】.\n * The vulnerability is often exploited in conjunction with CVE-2025-49706, an improper authentication vulnerability, to allow unauthenticated threat actors to gain control of servers 【1】【6】. This exploit chain is sometimes referred to as \"ToolShell\" 【6】.\n\n* **Targeted attacks:** Cyber threat actors use CVE-2025-49704 and CVE-2025-49706 to gain unauthorized access to on-premises SharePoint servers 【6】.\n\n* **CISA Known Exploited Vulnerabilities (KEV) status:** CISA added CVE-2025-49704 to its Known Exploited Vulnerabilities Catalog on July 22, 2025 【6】【5】. Federal agencies are required to remediate this vulnerability by a specific date 【5】.\n\n* **Technical details about internet exploitability:** CVE-2025-49704 can lead to remote code execution (RCE), allowing unauthenticated attackers to gain control of vulnerable SharePoint servers 【1】【3】. Successful exploitation allows attackers to execute arbitrary code on the server 【7】.\n\nSources:\n- Active Exploitation of Microsoft SharePoint Vulnerabilities: https://unit42.paloaltonetworks.com/microsoft-sharepoint-cve-2025-49704-cve-2025-49706-cve-2025-53770/\n- Known Exploited Vulnerabilities Catalog | CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?f%5B0%5D=vendor_project%3A804&f%5B1%5D=vendor_project%3A811&f%5B2%5D=vendor_project%3A822&f%5B3%5D=vendor_project%3A826&f%5B4%5D=vendor_project%3A877&f%5B5%5D=vendor_project%3A878&f%5B6%5D=vendor_project%3A880&f%5B7%5D=vendor_project%3A951&f%5B8%5D=vendor_project%3A1249&page=0\n- SharePoint Under Siege: ToolShell Exploit (CVE-2025-49706 & CVE-2025-49704): https://research.eye.security/sharepoint-under-siege/\n- Disrupting active exploitation of on-premises SharePoint ... - Microsoft: https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/\n- CISA Adds Two Known Exploited Vulnerabilities to Catalog: https://www.cisa.gov/news-events/alerts/2025/07/22/cisa-adds-two-known-exploited-vulnerabilities-catalog", "references": [ { "title": "Active Exploitation of Microsoft SharePoint Vulnerabilities", "url": "https://unit42.paloaltonetworks.com/microsoft-sharepoint-cve-2025-49704-cve-2025-49706-cve-2025-53770/", "snippet": "CVE-2025-49704 and CVE-2025-49706 are a critical set of vulnerabilities that impact Microsoft SharePoint, allowing unauthenticated threat actors to access ...", "is_search_result": true }, { "title": "Known Exploited Vulnerabilities Catalog | CISA", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?f%5B0%5D=vendor_project%3A804&f%5B1%5D=vendor_project%3A811&f%5B2%5D=vendor_project%3A822&f%5B3%5D=vendor_project%3A826&f%5B4%5D=vendor_project%3A877&f%5B5%5D=vendor_project%3A878&f%5B6%5D=vendor_project%3A880&f%5B7%5D=vendor_project%3A951&f%5B8%5D=vendor_project%3A1249&page=0", "snippet": "This vulnerability could be chained with CVE-2025-49706. The update for CVE-2025-53770 includes more robust protections than the update for CVE-2025-49704.", "is_search_result": true }, { "title": "SharePoint Under Siege: ToolShell Exploit (CVE-2025-49706 & CVE-2025-49704)", "url": "https://research.eye.security/sharepoint-under-siege/", "snippet": "CVE-2025-49706 and CVE-2025-49704, also referred to as ToolShell, are critical vulnerabilities in on-premises SharePoint that enable attackers to gain control of servers without authentication. Microsoft has confirmed active exploitation and released patches on July 8th 2025.", "is_search_result": true }, { "title": "Disrupting active exploitation of on-premises SharePoint ... - Microsoft", "url": "https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/", "snippet": "The following Attack Surface Insights may indicate vulnerable but not necessarily exploited services: CVE-2025-49704 – SharePoint RCE; CVE-2025- ...", "is_search_result": true }, { "title": "CISA Adds Two Known Exploited Vulnerabilities to Catalog", "url": "https://www.cisa.gov/news-events/alerts/2025/07/22/cisa-adds-two-known-exploited-vulnerabilities-catalog", "snippet": "CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2025-49704", "is_search_result": true } ], "timestamp": "2025-09-06T17:23:04.039452" }, "cache_timestamp": "2025-09-06T17:23:24.398163", "displayed_on_website": false }, { "cve_id": "CVE-2025-49113", "cvss_score": "9.9", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2025-06-02T00:00:00.000Z", "cve_published_date_formatted": "2025-06-02", "kev_date_added": "2026-02-20", "kev_date_added_formatted": "2026-02-20", "kev_due_date": "2026-03-13", "days_to_kev": 263, "days_since_kev": null, "is_new_kev": false, "summary": "Critical RCE vulnerability in Roundcube Webmail allowing authenticated users to achieve remote code execution via PHP object deserialization. This is actively exploited in the wild and affects internet-facing webmail servers globally.", "detailed_analysis": { "vulnerability_type": "PHP Object Deserialization leading to Remote Code Execution (CWE-502)", "affected_products": [ "Roundcube Webmail" ], "exploitation_requirements": [ "Authentication to webmail interface", "Network access to webmail server", "Crafted request to settings/upload.php endpoint" ], "internet_facing_likelihood": "Roundcube Webmail is specifically designed as a web-based email client that runs on web servers and is accessed via browsers. By its very nature as webmail software, it is almost always deployed as an internet-facing application to allow users to access email from anywhere. Estimated 95%+ of Roundcube deployments are internet-accessible.", "typical_deployment": "Server application - Roundcube is web-based email client software that runs on web servers (typically LAMP stack) and provides browser-based email access", "deployment_statistics": "95%+ of Roundcube deployments are internet-facing as webmail servers must be accessible to users from various locations to serve their primary function", "active_exploitation": "Listed in CISA KEV catalog indicating confirmed active exploitation in the wild. CISA SSVC assessment shows 'Exploitation: active'", "severity_factors": [ "Critical CVSS 9.9 score", "Remote code execution capability", "Wide deployment of Roundcube webmail", "Active exploitation confirmed", "Affects internet-facing email infrastructure" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately update to Roundcube 1.5.10 or 1.6.11+ depending on version branch", "Monitor web server logs for suspicious requests to /program/actions/settings/upload.php with malformed _from parameters", "Implement network segmentation and access controls for webmail servers", "Review user accounts for unauthorized administrative access or privilege escalation" ], "risk_assessment": { "exploit_likelihood": "Very High - Active exploitation confirmed by CISA KEV listing, affects widely deployed internet-facing webmail servers", "impact_assessment": "Critical - Remote code execution allows complete server compromise, potential email data theft, lateral movement, and use as attack infrastructure", "exposure_scope": "Global - Roundcube is widely used webmail software with thousands of internet-facing installations worldwide" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:32:46.175099", "displayed_on_website": false }, { "cve_id": "CVE-2025-48928", "cvss_score": "4.0", "attack_vector": "LOCAL", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1005", "deployment_likelihood": "HIGH", "cve_published_date": "2025-05-28T00:00:00.000Z", "cve_published_date_formatted": "2025-05-28", "kev_date_added": "2025-07-01", "kev_date_added_formatted": "2025-07-01", "kev_due_date": "2025-07-22", "days_to_kev": 34, "days_since_kev": null, "is_new_kev": false, "summary": "TeleMessage service exposes heap content similar to a core dump containing previously transmitted passwords. This is classified as CWE-528 (exposure of core dump file) with local attack vector, indicating the vulnerability requires local system access rather than direct internet exploitation.", "detailed_analysis": { "vulnerability_type": "Information disclosure through heap memory exposure (core dump equivalent)", "affected_products": [ "TeleMessage" ], "exploitation_requirements": [ "Local system access", "Access to heap/memory dumps", "Previous password transmission over HTTP" ], "internet_facing_likelihood": "While TeleMessage is a messaging service that would be internet-facing, the vulnerability itself has CVSS Attack Vector = LOCAL, meaning exploitation requires local system access rather than direct network exploitation. The core dump/heap exposure typically requires file system access or debugging privileges.", "typical_deployment": "TeleMessage is a messaging service that would typically be deployed as an internet-facing server application to provide messaging capabilities", "deployment_statistics": "Estimated 90%+ of TeleMessage deployments would be internet-facing for messaging functionality, but the vulnerability requires local access to exploit", "active_exploitation": "Listed in CISA KEV with active exploitation reported in May 2025. Referenced Wired article indicates the service was compromised in 20 minutes during active attack", "severity_factors": [ "Active exploitation in the wild", "Password exposure", "However limited by local attack vector requirement", "Medium CVSS base score of 4.0" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately update TeleMessage service to versions newer than 2025-05-05", "Review system access logs for unauthorized local access attempts", "Implement memory protection and core dump security controls", "Monitor for unusual heap memory access patterns", "Reset passwords that may have been transmitted over HTTP through the affected service" ], "risk_assessment": { "exploit_likelihood": "While actively exploited, the local attack vector significantly limits direct internet exploitation. Attackers would need to first gain local system access through other means", "impact_assessment": "Medium impact - password exposure can lead to credential theft and lateral movement, but requires initial local access", "exposure_scope": "Limited by local access requirement despite TeleMessage being internet-facing service. Primary risk is to systems where attackers have already gained local access" }, "exploitation_method": "OTHER", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:07:12.923622", "displayed_on_website": false }, { "cve_id": "CVE-2025-48927", "cvss_score": "5.3", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2025-05-28T00:00:00.000Z", "cve_published_date_formatted": "2025-05-28", "kev_date_added": "2025-07-01", "kev_date_added_formatted": "2025-07-01", "kev_due_date": "2025-07-22", "days_to_kev": 34, "days_since_kev": null, "is_new_kev": false, "summary": "TeleMessage service exposes an unauthenticated Spring Boot Actuator /heapdump endpoint that allows attackers to extract sensitive credentials remotely. This vulnerability is actively exploited in the wild and affects internet-facing enterprise messaging systems.", "detailed_analysis": { "vulnerability_type": "Exposed sensitive endpoint due to insecure default configuration (CWE-1188) - unauthenticated access to Spring Boot Actuator heap dump endpoint", "affected_products": [ "TeleMessage service (through 2025-05-05)" ], "exploitation_requirements": [ "Network access to /heapdump URI", "No authentication required", "No user interaction required" ], "internet_facing_likelihood": "TeleMessage is an enterprise messaging service specifically designed as a Signal-like communication platform for government agencies and enterprises. As a messaging service, it requires internet connectivity to function and facilitate communications between users across different locations. The service is explicitly described as 'exclusively-hosted-service' in the CVE tags, indicating it operates as a hosted internet-facing service.", "typical_deployment": "TeleMessage is server-side enterprise messaging software that operates as a hosted service, requiring internet exposure to serve its primary function of facilitating secure communications between users", "deployment_statistics": "Estimated 95-100% of TeleMessage deployments are internet-facing, as this is an enterprise messaging service that requires internet connectivity to function. The 'exclusively-hosted-service' tag confirms this is designed to be internet-accessible.", "active_exploitation": "CVE explicitly states this was 'exploited in the wild in May 2025' and CISA has added it to the Known Exploited Vulnerabilities Catalog. SSVC assessment shows 'Exploitation: active'.", "severity_factors": [ "Unauthenticated access", "Network accessible", "Active exploitation in wild", "Affects enterprise/government messaging systems", "Simple exploitation via HTTP GET request", "Exposes sensitive credentials including passwords" ] }, "recommendations": [ "CRITICAL: Immediately disable or secure Spring Boot Actuator endpoints, particularly /heapdump", "Monitor network traffic for requests to /heapdump and other actuator endpoints", "Patch to latest version immediately - this is actively exploited and on CISA KEV" ], "risk_assessment": { "exploit_likelihood": "VERY HIGH - Trivial unauthenticated HTTP request to exposed endpoint, actively exploited in wild, requires no specialized tools or techniques", "impact_assessment": "HIGH - Direct access to sensitive credentials and application memory contents, potential for full system compromise and lateral movement", "exposure_scope": "HIGH - All internet-facing TeleMessage deployments are vulnerable, affecting enterprise and government messaging systems" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "Here's what is known about the CVE-2025-48927 vulnerability:\n\n* **Internet-facing applications:** CVE-2025-48927 affects internet-facing applications, specifically **TeleMessage TM SGNL**, an enterprise messaging system modeled after Signal 【1】【2】. The vulnerability exists due to an exposed Spring Boot Actuator ```/heapdump``` endpoint 【1】.\n\n* **Active exploitation:** There is evidence of **active exploitation** of this vulnerability in the wild 【3】【4】. This active exploitation led to CISA adding it to the Known Exploited Vulnerabilities (KEV) Catalog 【3】【4】.\n\n* **Attack vectors and exploitation methods:** The vulnerability allows attackers to **trivially extract sensitive credentials** via an **unauthenticated**, exposed ```/heapdump``` endpoint 【5】【1】. It is remotely exploitable and requires no user interaction 【1】.\n\n* **Targeted attacks:** While it's not explicitly stated that CVE-2025-48927 has been used in \"targeted attacks\", the affected software, **TeleMessage TM SGNL**, is used by government agencies and enterprises for archiving secure communications, suggesting a potential for such attacks 【2】【6】.\n\n* **CISA Known Exploited Vulnerabilities (KEV) status:** CISA has added CVE-2025-48927 to its **Known Exploited Vulnerabilities Catalog** 【3】【4】.\n\n* **Technical details about internet exploitability:** CVE-2025-48927 is considered **remotely exploitable** 【1】. The vulnerability is due to the TeleMessage service configuring Spring Boot Actuator with an exposed heap dump endpoint at a ```/heapdump``` URI 【7】【8】. Attackers can extract sensitive credentials via this unauthenticated endpoint 【5】【1】.\n\nSources:\n- Checking the Scope of CVE-2025-48927 - GreyNoise Labs: https://www.labs.greynoise.io/grimoire/2025-07-16-checking-the-scope-of-cve-2025-48927/\n- Flaw in Signal App Clone Could Leak Passwords: https://www.greynoise.io/blog/active-exploit-attempts-signal-based-messaging-app\n- CISA Adds Two Known Exploited Vulnerabilities to Catalog: https://www.cisa.gov/news-events/alerts/2025/07/01/cisa-adds-two-known-exploited-vulnerabilities-catalog\n- Known Exploited Vulnerabilities Catalog | CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-48927\n- Checking the Scope of CVE-2025-48927 – GreyNoise Labs: https://www.labs.greynoise.io/grimoire/2025-07-16-checking-the-scope-of-cve-2025-48927/index.html", "references": [ { "title": "Checking the Scope of CVE-2025-48927 - GreyNoise Labs", "url": "https://www.labs.greynoise.io/grimoire/2025-07-16-checking-the-scope-of-cve-2025-48927/", "snippet": "However, CVE-2025-48927 is remotely exploitable and requires no user interaction. It exists in TeleMessage TM SGNL, a Signal clone that archives ...", "is_search_result": true }, { "title": "Flaw in Signal App Clone Could Leak Passwords", "url": "https://www.greynoise.io/blog/active-exploit-attempts-signal-based-messaging-app", "snippet": "A vulnerability disclosed in May 2025, CVE-2025-48927 , affects certain deployments of TeleMessage TM SGNL, an enterprise messaging system modeled ...", "is_search_result": true }, { "title": "CISA Adds Two Known Exploited Vulnerabilities to Catalog", "url": "https://www.cisa.gov/news-events/alerts/2025/07/01/cisa-adds-two-known-exploited-vulnerabilities-catalog", "snippet": "CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2025-48927 TeleMessage TM SGNL Initialization of a Resource with an Insecure Default Vulnerability.", "is_search_result": true }, { "title": "Known Exploited Vulnerabilities Catalog | CISA", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-48927", "snippet": "HireVue Applicant Reasonable Accommodations Process. Hiring. Resume & Application Tips. Students & Recent Graduates. Veteran and Military Spouses.CVE-2025-48927.", "is_search_result": true }, { "title": "Checking the Scope of CVE-2025-48927 – GreyNoise Labs", "url": "https://www.labs.greynoise.io/grimoire/2025-07-16-checking-the-scope-of-cve-2025-48927/index.html", "snippet": "Checking the Scope of CVE-2025-48927 CVE-2025-48927 found in TeleMessage TM SGNL in May, and reported by KEV in July, allows attackers to trivially extract sensitive credentials via an unauthenticated, exposed /heapdump endpoint.", "is_search_result": true } ], "timestamp": "2025-09-06T17:27:00.156100" }, "cache_timestamp": "2025-09-06T17:27:18.266405", "displayed_on_website": false }, { "cve_id": "CVE-2025-48703", "cvss_score": "9.0", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2025-09-19T00:00:00.000Z", "cve_published_date_formatted": "2025-09-19", "kev_date_added": "2025-11-04", "kev_date_added_formatted": "2025-11-04", "kev_due_date": "2025-11-25", "days_to_kev": 46, "days_since_kev": null, "is_new_kev": false, "summary": "Critical unauthenticated remote code execution vulnerability in CentOS Web Panel through OS command injection in the filemanager module. Actively exploited in the wild with public PoC exploits and Metasploit modules available.", "detailed_analysis": { "vulnerability_type": "OS Command Injection (CWE-78) leading to unauthenticated remote code execution", "affected_products": [ "CentOS Web Panel (CWP)", "Control Web Panel" ], "exploitation_requirements": [ "Network access to web panel", "Knowledge of valid non-root username", "No authentication required" ], "internet_facing_likelihood": "CentOS Web Panel is a web hosting control panel designed specifically to manage web hosting services over HTTP/HTTPS. By its core function, it must be accessible to users and administrators remotely, making internet exposure extremely common. Estimated 95%+ of deployments are internet-facing as this is the primary intended use case.", "typical_deployment": "Server application - CWP is a web-based control panel for managing web hosting services, running on port 2030/2031 (HTTP/HTTPS) and designed for remote administrative access", "deployment_statistics": "95%+ of CWP deployments are internet-facing as it's specifically designed as a web hosting control panel that requires remote access for administrators and potentially hosting customers to manage their services", "active_exploitation": "CISA has added this CVE to the KEV catalog indicating active exploitation. Public PoC exploits and Metasploit modules are available, significantly increasing exploitation risk", "severity_factors": [ "Unauthenticated access required", "Critical CVSS 9.0 score", "Active exploitation in wild", "Public exploit code available", "Command injection leads to full system compromise", "Targets commonly internet-exposed services" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately update CentOS Web Panel to version 0.9.8.1205 or later", "Review web server logs for suspicious filemanager changePerm requests with unusual t_total parameter values", "Consider temporarily blocking external access to CWP admin ports (2030/2031) until patching is complete", "Implement network segmentation to limit CWP exposure where possible", "Monitor for unexpected system processes or network connections from CWP servers" ], "risk_assessment": { "exploit_likelihood": "VERY HIGH - Unauthenticated RCE with active exploitation, public exploits, and Metasploit modules available against commonly internet-exposed services", "impact_assessment": "CRITICAL - Full system compromise with arbitrary command execution, potentially leading to complete hosting infrastructure takeover", "exposure_scope": "HIGH - CentOS Web Panel is widely used by hosting providers and system administrators, with the vast majority of installations internet-accessible by design" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "CVE-2025-48703 is a critical remote code execution (RCE) vulnerability affecting Control Web Panel (CWP), also known as CentOS Web Panel, versions prior to 0.9.8.1205 【4】【3】.\n\nHere's a breakdown of what is known about its exploitation:\n\n* **Affected Applications/Services:** The vulnerability affects web hosting control panels, specifically the filemanager module in CWP 【2】.\n* **Internet-Facing:** It allows an unauthenticated remote attacker to execute arbitrary commands on a CentOS Web Panel server 【5】.\n* **Active Exploitation:** The vulnerability is actively exploited in the wild 【9】【8】.\n* **Attack Vectors/Exploitation Methods:**\n * Unsanitized input handling in the `acc=changePerm` function within the filemanager module allows injection and execution of arbitrary system commands using the `t_total` parameter 【2】【7】.\n * The vulnerability can be exploited by unauthenticated attackers, potentially leading to full server compromise 【1】.\n * Public Proof-of-Concept (PoC) exploits and Metasploit modules are available, increasing the risk of exploitation 【6】【1】.\n* **Targeted Attacks:** While not explicitly stated, the active exploitation and the existence of public exploits and Metasploit modules suggest it could be used in targeted attacks 【6】【1】.\n* **CISA KEV Status:** CISA has added CVE-2025-48703 to its Known Exploited Vulnerabilities (KEV) Catalog, urging organizations to remediate it promptly 【6】【1】.\n* **Technical Details/Internet Exploitability:**\n * The vulnerability allows unauthenticated remote code execution via shell metacharacters in the `t_total` parameter of a filemanager `changePerm` request 【4】【3】.\n * Successful exploitation allows an attacker to execute arbitrary commands on affected systems 【1】.\n * Exploitation requires knowledge of a valid non-root username 【7】【10】.\n\nSources:\n- CVE-2022-44877 - Exploits & Severity - Feedly: https://feedly.com/cve/CVE-2022-44877\n- Skynoxk/CVE-2025-48703: Remote Code execution in CentOS web panel - GitHub: https://github.com/Skynoxk/CVE-2025-48703\n- CentOS Web Panel - RCE (CVE-2025-48703): https://app.crowdsec.net/cti/cve-explorer/CVE-2025-48703\n- CVE-2025-48703: https://www.tenable.com/cve/CVE-2025-48703\n- Remote code execution in CentOS Web Panel - CVE-2025 ...: https://fenrisk.com/rce-centos-webpanel", "references": [ { "title": "CVE-2022-44877 - Exploits & Severity - Feedly", "url": "https://feedly.com/cve/CVE-2022-44877", "citation_contribution": 554, "snippet": "CVE-2022-44877 is a critical unauthenticated Command Injection vulnerability in Control Web Panel, allowing remote attackers to execute arbitrary OS commands. The vulnerability has been flagged by CISA as a Known Exploited Vulnerability, with published PoCs available.The flaw, tracked as CVE-2025-48703, allows unauthenticated attackers to execute arbitrary commands on affected systems, potentially leading to full server compromise.", "is_search_result": true }, { "title": "Skynoxk/CVE-2025-48703: Remote Code execution in CentOS web panel - GitHub", "url": "https://github.com/Skynoxk/CVE-2025-48703", "citation_contribution": 232, "snippet": "CVE-2025-48703 is a Remote Code Execution (RCE) vulnerability in the filemanager module of a web hosting control panel (e.g., cPanel). It occurs due to unsanitized input handling in the acc=changePerm function, which allows an attacker to inject and execute arbitrary system commands using the t_total parameter.", "is_search_result": true }, { "title": "CentOS Web Panel - RCE (CVE-2025-48703)", "url": "https://app.crowdsec.net/cti/cve-explorer/CVE-2025-48703", "citation_contribution": 164, "snippet": "CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1205 allows unauthenticated remote code execution via shell metacharacters in ...", "is_search_result": true }, { "title": "CVE-2025-48703", "url": "https://www.tenable.com/cve/CVE-2025-48703", "citation_contribution": 164, "snippet": "CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1205 allows unauthenticated remote code execution via shell metacharacters in ...", "is_search_result": true }, { "title": "Remote code execution in CentOS Web Panel - CVE-2025 ...", "url": "https://fenrisk.com/rce-centos-webpanel", "citation_contribution": 129, "snippet": "This article addresses a vulnerability that permits an unauthenticated remote attacker to execute arbitrary commands on a CentOS Web Panel server.", "is_search_result": true } ], "timestamp": "2025-11-04T18:30:23.811527" }, "cache_timestamp": "2025-11-04T18:30:42.986439", "displayed_on_website": false }, { "cve_id": "CVE-2025-48700", "cvss_score": "6.1", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1203", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2025-06-23T00:00:00.000Z", "cve_published_date_formatted": "2025-06-23", "kev_date_added": "2026-04-20", "kev_date_added_formatted": "2026-04-20", "kev_due_date": "2026-04-23", "days_to_kev": 301, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2025-48700 is a Cross-Site Scripting (XSS) vulnerability in Zimbra Collaboration Suite that executes JavaScript in users' email sessions when viewing crafted emails. While Zimbra is widely deployed as an internet-facing email server, this XSS vulnerability compromises user sessions rather than the server itself, making it unsuitable for T1190 direct server exploitation.", "detailed_analysis": { "vulnerability_type": "Cross-Site Scripting (XSS) in email client interface", "affected_products": [ "Zimbra Collaboration Suite" ], "exploitation_requirements": [ "User must view crafted email message", "Victim must use Zimbra Classic UI", "No additional user interaction beyond opening email" ], "internet_facing_likelihood": "Zimbra is primarily deployed as an internet-facing email server with webmail access. Approximately 95% of Zimbra deployments are internet-accessible since email services require external connectivity for receiving/sending emails and providing webmail access to users.", "typical_deployment": "Zimbra is enterprise email server software that provides email, calendar, and collaboration services with web-based interfaces. It is typically deployed as an internet-facing server to enable email delivery and remote user access.", "deployment_statistics": "Nearly all Zimbra deployments (95%+) are internet-facing since the primary function is email services requiring external connectivity and webmail access.", "active_exploitation": "Listed in CISA KEV catalog indicating active exploitation in the wild", "severity_factors": [ "High deployment prevalence of internet-facing Zimbra servers", "No user interaction required beyond opening email", "Active exploitation confirmed by CISA KEV listing", "However, only compromises user sessions, not server infrastructure" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review email logs for suspicious messages, check user accounts for unauthorized access, monitor for credential theft", "Immediately update Zimbra Collaboration Suite to patched versions", "Monitor email gateway logs for suspicious HTML content and script injection attempts", "Consider temporarily disabling Classic UI if possible until patching is complete", "Review user accounts for signs of session hijacking or unauthorized access", "Patch priority: HIGH due to CISA KEV listing and wide internet exposure" ], "risk_assessment": { "exploit_likelihood": "High likelihood of exploitation targeting user sessions through phishing emails, but low likelihood of direct server compromise", "impact_assessment": "Medium impact - attackers can steal user credentials, access email data, and potentially pivot to other systems using compromised user sessions", "exposure_scope": "Very large - Zimbra is widely deployed in enterprise environments with internet-facing webmail interfaces" }, "exploitation_method": "USER_INTERACTION", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:41:34.061778", "displayed_on_website": false }, { "cve_id": "CVE-2025-48633", "cvss_score": "5.5", "attack_vector": "LOCAL", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1068", "deployment_likelihood": "VERY_LOW", "cve_published_date": "2025-12-08T16:57:49.260Z", "cve_published_date_formatted": "2025-12-08", "kev_date_added": "2025-12-02", "kev_date_added_formatted": "2025-12-02", "kev_due_date": "2025-12-23", "days_to_kev": -6, "days_since_kev": null, "is_new_kev": false, "summary": "A local privilege escalation vulnerability in Android's DevicePolicyManagerService allows adding a Device Owner after provisioning. This is a mobile OS vulnerability requiring local access and cannot be exploited over the internet despite being in CISA KEV.", "detailed_analysis": { "vulnerability_type": "Local privilege escalation via logic error in device policy management", "affected_products": [ "Android" ], "exploitation_requirements": [ "Local access to device", "Low-level privileges on device", "No user interaction required" ], "internet_facing_likelihood": "Android is a mobile operating system that is not deployed as internet-facing server infrastructure. While Android devices connect to the internet, they are client devices, not servers accepting inbound connections. The vulnerability affects device management functionality that is not exposed as a network service.", "typical_deployment": "Android is deployed as a client operating system on mobile phones, tablets, and some IoT devices. It is not server software and does not typically run internet-facing services that would be accessible via T1190 exploitation vectors.", "deployment_statistics": "0-1% of Android deployments would be internet-facing in any meaningful way for T1190 exploitation. The vast majority are mobile client devices behind NAT/firewalls.", "active_exploitation": "Listed in CISA KEV indicating active exploitation, likely through malware or physical access scenarios rather than remote network exploitation", "severity_factors": [ "CISA KEV listing indicates active threats", "Local attack vector limits remote exploitation", "Affects multiple Android versions", "No authentication required once local access obtained", "Privilege escalation to Device Owner level" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review device logs, check for unauthorized device administration apps, verify no unexpected Device Owner policies", "Apply Android security updates immediately when available for affected versions (13, 14, 15, 16)", "Monitor for suspicious device administration changes and unauthorized policy installations", "HIGH priority patching for enterprise Android deployments with device management" ], "risk_assessment": { "exploit_likelihood": "High for local attackers with device access, but very low for direct internet exploitation due to mobile client nature", "impact_assessment": "High local impact - Device Owner privileges provide extensive device control and data access", "exposure_scope": "Minimal internet-facing exposure - affects mobile client devices rather than server infrastructure" }, "exploitation_method": "OTHER", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:22:37.636228", "displayed_on_website": false }, { "cve_id": "CVE-2025-48595", "cvss_score": "8.4", "attack_vector": "LOCAL", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1068", "deployment_likelihood": "VERY_LOW", "cve_published_date": "2026-06-01T21:14:49.921Z", "cve_published_date_formatted": "2026-06-01", "kev_date_added": "2026-06-02", "kev_date_added_formatted": "2026-06-02", "kev_due_date": "2026-06-05", "days_to_kev": 1, "days_since_kev": 2, "is_new_kev": true, "summary": "CVE-2025-48595 is an integer overflow vulnerability in Android that allows local privilege escalation without user interaction. While listed in CISA KEV indicating active exploitation, this is a client-side mobile OS vulnerability not typically deployed as an internet-facing service.", "detailed_analysis": { "vulnerability_type": "Integer overflow leading to code execution and local privilege escalation", "affected_products": [ "Android 16-qpr2", "Android 16", "Android 15", "Android 14" ], "exploitation_requirements": [ "Local access to the device", "No additional execution privileges needed", "No user interaction required" ], "internet_facing_likelihood": "Android is primarily a mobile client operating system. While some Android devices may run server applications or be accessible remotely, the vast majority of Android deployments are consumer mobile devices not directly exposed to the internet as servers. Less than 1% of Android deployments would be considered internet-facing server applications.", "typical_deployment": "Android is deployed as a client-side mobile operating system on smartphones, tablets, and embedded devices. It is not typically deployed as server software.", "deployment_statistics": "Estimated <1% of Android deployments are internet-facing. Most Android devices are client endpoints behind NAT/firewalls, not public-facing servers.", "active_exploitation": "Listed in CISA KEV catalog, indicating active exploitation in the wild by threat actors", "severity_factors": [ "High CVSS score of 8.4", "No user interaction required", "Active exploitation confirmed", "Local privilege escalation", "Multiple Android versions affected" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review Android device logs, check for unauthorized access, verify system integrity", "Update Android devices to patched versions immediately when security updates become available", "Monitor Android devices for suspicious privilege escalation activities", "Implement mobile device management (MDM) solutions to ensure timely patching", "Priority: HIGH for organizational Android devices, CRITICAL for any Android devices used in server/infrastructure roles" ], "risk_assessment": { "exploit_likelihood": "High for local exploitation given CISA KEV listing and no user interaction requirement", "impact_assessment": "High impact for compromised devices - full device compromise with elevated privileges possible", "exposure_scope": "Limited internet exposure scope as Android is primarily client-side OS, but billions of devices potentially affected locally" }, "exploitation_method": "OTHER", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:48:58.076317", "displayed_on_website": false }, { "cve_id": "CVE-2025-48572", "cvss_score": "7.8", "attack_vector": "LOCAL", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1068", "deployment_likelihood": "LOW", "cve_published_date": "2025-12-08T16:57:07.461Z", "cve_published_date_formatted": "2025-12-08", "kev_date_added": "2025-12-02", "kev_date_added_formatted": "2025-12-02", "kev_due_date": "2025-12-23", "days_to_kev": -6, "days_since_kev": null, "is_new_kev": false, "summary": "This is a local privilege escalation vulnerability in Android that allows launching activities from the background due to a permissions bypass. While highly impactful on mobile devices and actively exploited according to CISA KEV, it cannot be exploited over the internet as it requires local access to the Android device.", "detailed_analysis": { "vulnerability_type": "Local privilege escalation via permissions bypass allowing background activity launching", "affected_products": [ "Android 16", "Android 15", "Android 14", "Android 13" ], "exploitation_requirements": [ "Local access to Android device", "Low-level privileges on the device", "No user interaction required" ], "internet_facing_likelihood": "Android is primarily a mobile operating system deployed on consumer devices (smartphones, tablets). While some Android devices may run server applications or be accessible remotely, the vast majority (~95%+) are client devices that are not directly internet-facing in a server capacity. Android is not designed as server infrastructure software.", "typical_deployment": "Android is client-side mobile operating system software deployed on consumer smartphones, tablets, and some embedded devices. It is not server software.", "deployment_statistics": "Less than 5% of Android deployments would be internet-facing in a server capacity, as Android is fundamentally client-side mobile OS software", "active_exploitation": "Listed in CISA KEV catalog indicating active exploitation in the wild, likely targeting mobile devices through malicious apps or local attack vectors", "severity_factors": [ "High CVSS score of 7.8", "No user interaction required", "Active exploitation confirmed", "Affects multiple Android versions", "Limited to local attack vector" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review device logs, check for unauthorized apps or activities, verify device integrity", "Update Android devices to patched versions immediately via December 2025 security update", "Review installed applications for suspicious permissions or background activity", "Monitor for unauthorized app installations or privilege escalations", "HIGH priority patching for mobile device management" ], "risk_assessment": { "exploit_likelihood": "Low for internet-based attacks due to local attack vector requirement, but high for targeted local attacks given active exploitation", "impact_assessment": "High impact on individual devices - full device compromise with escalated privileges allowing unauthorized access to sensitive data and device functions", "exposure_scope": "Minimal internet-facing exposure as Android is primarily client-side mobile OS, not server infrastructure" }, "exploitation_method": "OTHER", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:22:57.892868", "displayed_on_website": false }, { "cve_id": "CVE-2025-48543", "cvss_score": "8.8", "attack_vector": "LOCAL", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1068", "deployment_likelihood": "LOW", "cve_published_date": "2025-09-04T18:34:22.655Z", "cve_published_date_formatted": "2025-09-04", "kev_date_added": "2025-09-04", "kev_date_added_formatted": "2025-09-04", "kev_due_date": "2025-09-25", "days_to_kev": 0, "days_since_kev": null, "is_new_kev": false, "summary": "This is a local privilege escalation vulnerability in Android's Chrome sandbox that allows escaping to attack the system_server. While it has high impact and is actively exploited, it requires local access to the device and does not affect internet-facing services.", "detailed_analysis": { "vulnerability_type": "Use-after-free vulnerability allowing Chrome sandbox escape to attack Android system_server", "affected_products": [ "Android" ], "exploitation_requirements": [ "Local access to Android device", "Ability to execute code within Chrome sandbox", "No user interaction required" ], "internet_facing_likelihood": "Android is primarily a mobile operating system for end-user devices, not server infrastructure. While Android devices connect to the internet, they are not deployed as internet-facing servers that accept incoming connections. This is fundamentally a client-side operating system vulnerability.", "typical_deployment": "Android is deployed as a mobile operating system on smartphones, tablets, and some IoT devices. These are client devices, not servers. The affected Chrome component runs locally on user devices.", "deployment_statistics": "Less than 1% of Android deployments would be internet-facing in a server capacity. The vast majority are end-user mobile devices behind NAT/firewalls that do not accept incoming internet connections.", "active_exploitation": "Listed in CISA KEV catalog indicating active exploitation in the wild, likely through malicious apps or web content targeting mobile users", "severity_factors": [ "High CVSS score of 8.8", "No user interaction required", "Allows system-level privilege escalation", "Active exploitation confirmed", "Affects multiple Android versions", "However limited to local exploitation only" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review Android device logs, check for unauthorized apps, verify system integrity on managed Android devices", "Apply Android security updates immediately to affected devices (versions 13, 14, 15, 16)", "Implement mobile device management (MDM) to ensure patch deployment across organizational Android devices", "Monitor for suspicious app installations and unusual system behavior on Android devices", "Priority: HIGH for mobile device security, but not internet infrastructure priority due to local attack vector" ], "risk_assessment": { "exploit_likelihood": "High for targeted attacks against specific Android users, but very low for mass internet-based exploitation since this requires local device access", "impact_assessment": "Complete system compromise of Android devices, allowing attackers full control over device functionality, data access, and potential lateral movement within enterprise environments", "exposure_scope": "Millions of Android devices globally, but exploitation requires local access or malicious app installation rather than direct internet attack" }, "exploitation_method": "OTHER", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:13:14.398191", "displayed_on_website": false }, { "cve_id": "CVE-2025-48384", "cvss_score": "8.1", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1204", "deployment_likelihood": "LOW", "cve_published_date": "2025-07-08T18:23:48.710Z", "cve_published_date_formatted": "2025-07-08", "kev_date_added": "2025-08-25", "kev_date_added_formatted": "2025-08-25", "kev_due_date": "2025-09-15", "days_to_kev": 48, "days_since_kev": null, "is_new_kev": false, "summary": "Git vulnerability allowing arbitrary code execution through malicious repositories with crafted submodule paths. Requires user interaction (git clone --recursive) and primarily affects client-side Git operations rather than internet-facing server applications.", "detailed_analysis": { "vulnerability_type": "Configuration parsing vulnerability allowing arbitrary code execution through CRLF injection in Git submodule paths", "affected_products": [ "git git" ], "exploitation_requirements": [ "User must clone malicious repository", "User must use --recursive flag", "Malicious repository with crafted .gitmodules file", "Post-checkout hook execution capability" ], "internet_facing_likelihood": "Git is primarily a client-side version control tool. While Git can run as a server (git-daemon, HTTP/HTTPS Git servers), the vast majority of Git installations are client-side developer tools. Even when Git servers exist, this vulnerability specifically targets the clone operation which is a client-side action. Estimated <5% of Git installations are internet-facing servers, and this vulnerability doesn't directly exploit server-side Git services.", "typical_deployment": "Git is predominantly deployed as a client-side developer tool on workstations and development environments. Server deployments include Git hosting services, but the vulnerability targets client-side clone operations rather than server-side services.", "deployment_statistics": "Approximately 95% of Git installations are client-side tools. While Git servers exist (GitHub, GitLab, etc.), this vulnerability requires user interaction to clone a malicious repository rather than exploiting a server-side service directly.", "active_exploitation": "CISA has confirmed active exploitation in the wild and added CVE-2025-48384 to the KEV catalog on August 25, 2025, with a September 15, 2025 remediation deadline.", "severity_factors": [ "High CVSS score of 8.1", "Active exploitation confirmed by CISA", "Arbitrary code execution capability", "Requires user interaction (UI:R)", "Attack complexity is HIGH (AC:H)", "Affects client-side operations primarily" ] }, "recommendations": [ "Update Git to patched versions immediately (v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, or v2.50.1)", "Educate developers about risks of cloning untrusted repositories with --recursive flag", "HIGH patch priority due to CISA KEV listing and active exploitation" ], "risk_assessment": { "exploit_likelihood": "While actively exploited, this is primarily a client-side vulnerability requiring social engineering to trick users into cloning malicious repositories. Direct internet exploitation of server-side Git services is not the primary attack vector.", "impact_assessment": "High impact with arbitrary code execution capability, but limited to systems where users interact with malicious Git repositories rather than internet-facing services being directly compromised.", "exposure_scope": "Limited internet-facing exposure as this primarily affects client-side Git operations rather than server-side services that would be directly exploitable via T1190." }, "exploitation_method": "USER_INTERACTION", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "CVE-2025-48384 is a high-severity vulnerability in Git that allows for arbitrary code execution upon cloning a Git repository 【1】.\n\nHere's what is known about its exploitation:\n\n* **Internet-facing applications or services:** Successful exploitation could allow a remote attacker to execute arbitrary code upon cloning a Git repository 【1】. The vulnerability can be triggered by cloning repositories with submodules that use a ```recursive``` flag 【2】.\n\n* **Evidence of active exploitation in the wild:** CISA and other sources confirm that CVE-2025-48384 is being actively exploited by attackers 【3】【4】.\n\n* **Attack vectors and exploitation methods:** The vulnerability stems from Git's mishandling of carriage return characters in submodule paths during initialization 【5】【6】. An attacker can exploit this by creating a malicious Git repository containing a crafted ```.gitmodules``` file. When a user clones this repository with the ```--recursive``` option, Git incorrectly parses the submodule paths, leading to the execution of a post-checkout hook and, ultimately, arbitrary code execution 【5】【7】.\n\n* **Targeted attacks:** There is no specific information available regarding whether CVE-2025-48384 has been used in targeted attacks.\n\n* **CISA Known Exploited Vulnerabilities (KEV) status:** CISA added CVE-2025-48384 to its KEV catalog on August 25, 2025, with a remediation deadline of September 15, 2025, for U.S. federal agencies 【3】【8】. This means that CISA has determined that this vulnerability is being actively exploited in the wild and poses a significant risk 【9】.\n\n* **Technical details about internet exploitability:** The vulnerability allows arbitrary file write and, ultimately, code execution on Linux and macOS systems when using ```git clone --recursive``` on a weaponized repository 【7】. When reading a config value, Git strips any trailing carriage return and line feed (CRLF) 【10】.\n\nSources:\n- Exploitation of Git Vulnerability CVE-2025-48384 - NHS Digital: https://digital.nhs.uk/cyber-alerts/2025/cc-4696\n- Organizations Warned of Exploited Git Vulnerability: https://www.securityweek.com/organizations-warned-of-exploited-git-vulnerability/\n- Root - CVE-2025-48384: Critical Git Vulnerability Actively Exploited: https://www.root.io/news-media/cve-2025-48384-critical-git-vulnerability\n- Git vulnerability leading to RCE is being exploited by attackers (CVE ...: https://www.helpnetsecurity.com/2025/08/26/git-vulnerability-exploited-cve-2025-48384/\n- CVE-2025-48384 | SOCRadar Labs CVE Radar - SOCRadar: https://socradar.io/labs/app/cve-radar/cve-2025-48384", "references": [ { "title": "Exploitation of Git Vulnerability CVE-2025-48384 - NHS Digital", "url": "https://digital.nhs.uk/cyber-alerts/2025/cc-4696", "snippet": "Successful exploitation could allow a remote attacker to execute arbitrary code upon cloning a Git repository. CVE-2025-48384 stems from ...", "is_search_result": true }, { "title": "Organizations Warned of Exploited Git Vulnerability", "url": "https://www.securityweek.com/organizations-warned-of-exploited-git-vulnerability/", "snippet": "The US cybersecurity agency CISA on Monday warned that a recent vulnerability in Git has been exploited in attacks, urging its immediate patching. The flaw, tracked as CVE-2025-48384 (CVSS score of 8.1), is described as an arbitrary file write during the cloning of repositories with submodules that use a ‘recursive’ flag.", "is_search_result": true }, { "title": "Root - CVE-2025-48384: Critical Git Vulnerability Actively Exploited", "url": "https://www.root.io/news-media/cve-2025-48384-critical-git-vulnerability", "snippet": "Root Security Bulletin: CVE-2025-48384 – Critical Git Vulnerability Actively Exploited. Date: August 26, 2025 Severity: High (CVSS v3.1 Score: 8.0). Overview.Technical Details. The vulnerability arises from an inconsistency in Git's configuration parsing logic", "is_search_result": true }, { "title": "Git vulnerability leading to RCE is being exploited by attackers (CVE ...", "url": "https://www.helpnetsecurity.com/2025/08/26/git-vulnerability-exploited-cve-2025-48384/", "snippet": "CVE-2025-48384, a recently patched vulnerability in the popular distributed revision control system Git, is being exploited by attackers.", "is_search_result": true }, { "title": "CVE-2025-48384 | SOCRadar Labs CVE Radar - SOCRadar", "url": "https://socradar.io/labs/app/cve-radar/cve-2025-48384", "snippet": "Description. CVE-2025-48384 describes a vulnerability in Git related to the handling of trailing carriage return characters in submodule paths during initialization . This can lead to a scenario where a post-checkout hook is unintentionally executed, potentially allowing malicious code execution.", "is_search_result": true } ], "timestamp": "2025-09-06T17:16:25.798023" }, "cache_timestamp": "2025-09-06T17:16:48.043416", "displayed_on_website": false }, { "cve_id": "CVE-2025-47827", "cvss_score": "4.6", "attack_vector": "PHYSICAL", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1543", "deployment_likelihood": "LOW", "cve_published_date": "2025-06-05T00:00:00.000Z", "cve_published_date_formatted": "2025-06-05", "kev_date_added": "2025-10-14", "kev_date_added_formatted": "2025-10-14", "kev_due_date": "2025-11-04", "days_to_kev": 131, "days_since_kev": null, "is_new_kev": false, "summary": "IGEL OS Secure Boot bypass vulnerability that requires physical access to mount crafted root filesystem from unverified SquashFS image. This is a local boot-time security control bypass, not a network-exploitable vulnerability.", "detailed_analysis": { "vulnerability_type": "Secure Boot bypass vulnerability allowing mounting of unverified root filesystem", "affected_products": [ "IGEL OS (thin client operating system)" ], "exploitation_requirements": [ "Physical access to device", "Ability to modify boot media", "Knowledge of igel-flash-driver module exploitation" ], "internet_facing_likelihood": "IGEL OS is an endpoint operating system for thin clients, not server software. While thin clients connect to network services, the OS itself is not an internet-facing service. The vulnerability requires physical access to the device during boot process, making internet exploitation impossible.", "typical_deployment": "IGEL OS runs on thin client endpoints in corporate environments, connecting to virtual desktop infrastructure or remote applications. These are client devices, not servers.", "deployment_statistics": "0% of deployments are internet-facing as this affects the endpoint OS itself, not network services. The vulnerability requires physical device access.", "active_exploitation": "Listed in CISA KEV indicating active exploitation, likely in targeted attacks requiring physical access to devices", "severity_factors": [ "CISA KEV listing indicates real-world exploitation", "Physical access requirement significantly limits attack surface", "Affects boot process integrity", "Could lead to persistent system compromise" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Examine IGEL thin clients for signs of unauthorized boot modifications, unexpected system behavior, or integrity violations", "Upgrade IGEL OS to version 11 or later immediately", "Implement physical security controls to prevent unauthorized access to thin client devices", "Monitor boot logs and system integrity on IGEL devices for signs of compromise", "Review and enhance physical security procedures for device access" ], "risk_assessment": { "exploit_likelihood": "Low for opportunistic attacks due to physical access requirement, but elevated for targeted attacks with physical access capability", "impact_assessment": "High impact if exploited - complete bypass of Secure Boot leading to potential persistent system compromise and arbitrary code execution at boot level", "exposure_scope": "Limited to environments where attackers have physical access to IGEL thin client devices" }, "exploitation_method": "OTHER", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:18:36.752384", "displayed_on_website": false }, { "cve_id": "CVE-2025-47813", "cvss_score": "4.3", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1082", "deployment_likelihood": "HIGH", "cve_published_date": "2025-07-10T00:00:00.000Z", "cve_published_date_formatted": "2025-07-10", "kev_date_added": "2026-03-16", "kev_date_added_formatted": "2026-03-16", "kev_due_date": "2026-03-30", "days_to_kev": 249, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2025-47813 is an information disclosure vulnerability in Wing FTP Server that reveals the full local installation path through error messages when a long UID cookie value is used. While Wing FTP Server is commonly deployed as internet-facing infrastructure, this vulnerability only leaks path information and does not provide direct system compromise capabilities.", "detailed_analysis": { "vulnerability_type": "Information Disclosure - Error Message Containing Sensitive Information (CWE-209)", "affected_products": [ "Wing FTP Server" ], "exploitation_requirements": [ "Network access to FTP server", "Low-level authentication (PR:L)", "Ability to manipulate UID cookie values" ], "internet_facing_likelihood": "Wing FTP Server is file transfer server software designed to be accessed remotely. Approximately 70-80% of deployments would be internet-facing as the primary purpose is to provide file transfer services to external users, clients, or partners.", "typical_deployment": "Wing FTP Server is server software that typically runs as a network service listening on FTP/FTPS/SFTP ports (21, 990, 22) to provide file transfer capabilities for businesses, organizations, and service providers.", "deployment_statistics": "Estimated 75% of Wing FTP Server deployments are internet-facing, as file transfer servers are commonly used for external file sharing, client file exchanges, and remote access to company resources.", "active_exploitation": "Listed in CISA KEV catalog indicating active exploitation in the wild, though the vulnerability itself only provides reconnaissance value", "severity_factors": [ "Low CVSS score (4.3) reflects limited impact", "Only reveals installation path, no direct compromise", "May aid in reconnaissance for other attacks", "CISA KEV listing suggests value in attack chains" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Upgrade Wing FTP Server to version 7.4.4 or later immediately", "Monitor FTP server logs for unusual cookie manipulation or error message generation patterns", "Review access controls and authentication mechanisms for FTP services", "Consider implementing additional monitoring for reconnaissance activities", "PATCH PRIORITY: Medium - While not directly exploitable for RCE, CISA KEV listing indicates use in active attack campaigns" ], "risk_assessment": { "exploit_likelihood": "High for reconnaissance purposes - CISA KEV listing indicates attackers are actively using this for information gathering in attack chains", "impact_assessment": "Low direct impact - only exposes installation path information, but may facilitate subsequent attacks by providing system reconnaissance data", "exposure_scope": "Moderate - Wing FTP Server has significant deployment base in enterprise environments, with majority of installations being internet-accessible" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:35:43.434441", "displayed_on_website": false }, { "cve_id": "CVE-2025-47812", "cvss_score": "10.0", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2025-07-10T00:00:00.000Z", "cve_published_date_formatted": "2025-07-10", "kev_date_added": "2025-07-14", "kev_date_added_formatted": "2025-07-14", "kev_due_date": "2025-08-04", "days_to_kev": 4, "days_since_kev": null, "is_new_kev": false, "summary": "Critical RCE vulnerability in Wing FTP Server allowing arbitrary Lua code injection through null byte mishandling in web interfaces. Exploitable remotely without authentication, including via anonymous FTP accounts, leading to total server compromise.", "detailed_analysis": { "vulnerability_type": "Improper Neutralization of Null Byte or NUL Character (CWE-158) leading to Lua code injection and remote code execution", "affected_products": [ "wftpserver Wing FTP Server versions before 7.4.4" ], "exploitation_requirements": [ "Network access to FTP server", "No authentication required (exploitable via anonymous FTP)", "No user interaction required" ], "internet_facing_likelihood": "Wing FTP Server is enterprise FTP server software specifically designed to be deployed as an internet-facing service. FTP servers by their fundamental nature require network connectivity and are commonly exposed to the internet to facilitate file transfers for business operations. Estimated 80-90% of Wing FTP Server deployments are internet-accessible as this is the primary use case for commercial FTP server software.", "typical_deployment": "Wing FTP Server is commercial server software designed to run as a network service providing FTP, FTPS, SFTP, and HTTP/HTTPS file transfer capabilities. It runs as a daemon/service with listening ports and web-based administration interfaces.", "deployment_statistics": "Approximately 80-90% of Wing FTP Server instances are likely internet-facing, as the software is marketed for business file sharing, client file access, and web-based file management - all use cases that typically require internet accessibility. The presence of both FTP and web interfaces makes internet exposure very common.", "active_exploitation": "CISA has added this CVE to the Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Security researchers have documented ongoing attacks targeting internet-facing Wing FTP Server instances.", "severity_factors": [ "CVSS 10.0 Critical severity", "No authentication required", "Exploitable via anonymous FTP accounts", "Remote code execution with root/SYSTEM privileges", "Total server compromise possible", "Active exploitation confirmed", "Internet-facing by design" ] }, "recommendations": [ "IMMEDIATE: Upgrade Wing FTP Server to version 7.4.4 or later", "URGENT: If immediate patching is not possible, temporarily disable or restrict network access to Wing FTP Server instances", "Monitor for unauthorized access attempts and unusual system activity on FTP servers", "Implement network segmentation to limit exposure of FTP servers", "Review and harden FTP server configurations, disable anonymous access if not required" ], "risk_assessment": { "exploit_likelihood": "Very High - The vulnerability has a CVSS score of 10.0, requires no authentication, can be exploited via anonymous FTP accounts, and is actively being exploited in the wild according to CISA KEV listing.", "impact_assessment": "Critical - Successful exploitation leads to arbitrary code execution with root or SYSTEM privileges, resulting in complete server compromise. Attackers can gain full control of the affected system and potentially pivot to internal networks.", "exposure_scope": "High - Wing FTP Server is commercial server software commonly deployed internet-facing for business file transfer operations. The combination of FTP and web interfaces makes these systems highly visible to internet scanning and automated attacks." }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "CVE-2025-47812 is a critical remote code execution (RCE) vulnerability affecting Wing FTP Server. Here's what is known about its exploitation:\n\n* **Internet-facing applications/services:** Internet-facing Wing FTP Server instances are vulnerable to this exploit 【1】.\n\n* **Active exploitation:** CVE-2025-47812 is actively being exploited in the wild 【2】【1】.\n\n* **Attack vectors and exploitation methods:** The vulnerability is due to a Lua injection flaw 【2】. This allows attackers to execute arbitrary system commands with the privileges of the FTP service, potentially gaining root or SYSTEM privileges, leading to total server compromise 【3】【4】. The vulnerability can be exploited even via anonymous FTP accounts 【4】. A proof-of-concept exploit has been created to demonstrate how the vulnerability can be leveraged in attacks 【5】. The mishandling of null bytes within the user and administrator web interfaces also contributes to the vulnerability 【6】.\n\n* **Targeted attacks:** While not explicitly stated, vulnerabilities like CVE-2025-47812 are attractive targets for various malicious actors, including ransomware operators and advanced persistent threat (APT) groups, who routinely scan the internet for exposed instances of popular software packages 【7】.\n\n* **CISA Known Exploited Vulnerabilities (KEV) status:** CISA has added CVE-2025-47812 to its KEV catalog, indicating that it is a known exploited vulnerability and poses a significant risk to federal enterprises 【7】【8】.\n\n* **Technical details about internet exploitability:** The attack vector is more severe the more remote the attacker can be, both logically and physically 【9】. The vulnerability is also more severe for the least complex attacks, and if no privileges are required to exploit it 【9】.\n\nSources:\n- Vulnerability Alert: CVE-2025-47812: Wing FTP Server Remote Code...: https://www.kodemsecurity.com/resources/vulnerability-alert-cve-2025-47812\n- Critical Wing FTP Server Vulnerability (CVE-2025-47812) Actively Being ...: https://thehackernews.com/2025/07/critical-wing-ftp-server-vulnerability.html\n- Known Exploited Vulnerabilities Catalog | CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-47812\n- CVE-2025-47812 - Vulnerability Details - OpenCVE: https://app.opencve.io/cve/CVE-2025-47812\n- Hackers are exploiting critical RCE flaw in Wing FTP Server: https://www.bleepingcomputer.com/news/security/hackers-are-exploiting-critical-rce-flaw-in-wing-ftp-server/", "references": [ { "title": "Vulnerability Alert: CVE-2025-47812: Wing FTP Server Remote Code...", "url": "https://www.kodemsecurity.com/resources/vulnerability-alert-cve-2025-47812", "snippet": "... internet-facing Wing FTP Server instances are currently vulnerable ... Critical Wing FTP Server vulnerability exploited in the wild (CVE-2025-47812).", "is_search_result": true }, { "title": "Critical Wing FTP Server Vulnerability (CVE-2025-47812) Actively Being ...", "url": "https://thehackernews.com/2025/07/critical-wing-ftp-server-vulnerability.html", "snippet": "Critical vulnerability (CVE-2025-47812) in Wing FTP Server exposed to active exploitation via Lua injection. Immediate patching needed.", "is_search_result": true }, { "title": "Known Exploited Vulnerabilities Catalog | CISA", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-47812", "snippet": "CVE-2025-47812.This can be used to execute arbitrary system commands with the privileges of the FTP service (root or SYSTEM by default).", "is_search_result": true }, { "title": "CVE-2025-47812 - Vulnerability Details - OpenCVE", "url": "https://app.opencve.io/cve/CVE-2025-47812", "snippet": "This can be used to execute arbitrary system commands with the privileges of the FTP service (root or SYSTEM by default). This is thus a remote code execution vulnerability that guarantees a total server compromise. This is also exploitable via anonymous FTP accounts.", "is_search_result": true }, { "title": "Hackers are exploiting critical RCE flaw in Wing FTP Server", "url": "https://www.bleepingcomputer.com/news/security/hackers-are-exploiting-critical-rce-flaw-in-wing-ftp-server/", "snippet": "Threat researchers at managed cybersecurity platform Huntress created a proof-of-concept exploit for CVE-2025-47812 and show in the video below how hackers could leverage it in attacks:", "is_search_result": true } ], "timestamp": "2025-09-06T17:25:12.294008" }, "cache_timestamp": "2025-09-06T17:25:43.550776", "displayed_on_website": false }, { "cve_id": "CVE-2025-47729", "cvss_score": "1.9", "attack_vector": "LOCAL", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "MEDIUM", "mitre_technique": "T1005", "deployment_likelihood": "HIGH", "cve_published_date": "2025-05-08T00:00:00.000Z", "cve_published_date_formatted": "2025-05-08", "kev_date_added": "2025-05-12", "kev_date_added_formatted": "2025-05-12", "kev_due_date": "2025-06-02", "days_to_kev": 4, "days_since_kev": null, "is_new_kev": false, "summary": "TeleMessage archiving backend stores cleartext copies of encrypted messages, contrary to documentation claiming end-to-end encryption. This is a data exposure vulnerability rather than a traditional exploitable security flaw, requiring prior unauthorized access to the system.", "detailed_analysis": { "vulnerability_type": "Hidden functionality leading to cleartext data storage (CWE-912)", "affected_products": [ "TeleMessage archiving backend" ], "exploitation_requirements": [ "Local or administrative access to backend system", "Physical or remote access to storage systems", "Prior compromise or insider access" ], "internet_facing_likelihood": "While TeleMessage archiving backends may be internet-accessible for remote management, this vulnerability is not directly exploitable over the network. The CVSS vector (AV:L/AC:H/PR:H) indicates local access with high privileges is required. This is a design flaw where data is stored in cleartext rather than a traditional exploitable vulnerability.", "typical_deployment": "Enterprise archiving backend server software, typically deployed in corporate environments for message compliance and retention", "deployment_statistics": "Estimated 70-80% of deployments may have some internet connectivity for remote management, but the vulnerability itself requires local/administrative access and cannot be directly exploited remotely", "active_exploitation": "CISA KEV listing indicates active exploitation, likely through data exposure after systems were compromised via other means", "severity_factors": [ "Low CVSS score (1.9) indicates limited direct exploitability", "Requires high privileges and local access", "Active exploitation in wild", "Data confidentiality impact", "Affects encrypted messaging service" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately review TeleMessage backend configurations and data storage practices", "Verify actual encryption implementation versus documentation claims", "Implement additional access controls and monitoring for archiving systems", "Contact TeleMessage for security updates and proper encryption implementation", "Consider alternative archiving solutions with verified end-to-end encryption" ], "risk_assessment": { "exploit_likelihood": "Low for direct network exploitation - requires prior system compromise or insider access", "impact_assessment": "High confidentiality impact due to exposure of supposedly encrypted communications, but limited direct exploitability", "exposure_scope": "Limited to organizations using TeleMessage archiving backend, primarily affects data confidentiality rather than system compromise" }, "exploitation_method": "OTHER", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:55:39.659172", "displayed_on_website": false }, { "cve_id": "CVE-2025-4632", "cvss_score": "9.8", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2025-05-13T05:19:19.254Z", "cve_published_date_formatted": "2025-05-13", "kev_date_added": "2025-05-22", "kev_date_added_formatted": "2025-05-22", "kev_due_date": "2025-06-12", "days_to_kev": 9, "days_since_kev": null, "is_new_kev": false, "summary": "Critical path traversal vulnerability in Samsung MagicINFO 9 Server allows unauthenticated remote attackers to write arbitrary files with system authority. The vulnerability is actively exploited in the wild and listed in CISA KEV, with CAPEC-650 indicating web shell upload capability.", "detailed_analysis": { "vulnerability_type": "Path traversal (CWE-22) allowing arbitrary file write with system privileges", "affected_products": [ "Samsung MagicINFO 9 Server" ], "exploitation_requirements": [ "Network access to MagicINFO server", "No authentication required", "No user interaction needed" ], "internet_facing_likelihood": "Samsung MagicINFO is a digital signage management server platform designed to centrally manage displays across multiple locations. These servers are commonly deployed as internet-facing services to allow remote management of digital signage networks across geographically distributed locations. Estimated 60-70% of deployments are internet-accessible for remote management capabilities.", "typical_deployment": "MagicINFO Server is enterprise server software deployed to manage digital signage infrastructure. It typically runs as a web-based management platform that organizations expose to the internet for remote administration of display networks across multiple sites, retail locations, or corporate offices.", "deployment_statistics": "Approximately 60-70% of MagicINFO Server deployments are likely internet-facing, as the primary value proposition is centralized remote management of distributed digital signage infrastructure. Many organizations deploy these servers with internet connectivity to manage displays across multiple physical locations.", "active_exploitation": "Listed in CISA KEV catalog with active exploitation confirmed. CISA ADP analysis shows 'Exploitation: active' status, indicating verified real-world attacks.", "severity_factors": [ "CVSS 9.8 Critical severity", "No authentication required", "System-level file write privileges", "Active exploitation confirmed", "Can lead to web shell installation (CAPEC-650)", "Remote network exploitation possible" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately update Samsung MagicINFO 9 Server to version 21.1052 or later", "Scan for web shells or unauthorized files that may have been uploaded via path traversal", "Review server logs for suspicious file upload or path traversal attempts", "Consider temporarily restricting internet access to MagicINFO servers until patching is complete", "Implement network segmentation and access controls for MagicINFO servers", "Monitor file system integrity and unauthorized file modifications" ], "risk_assessment": { "exploit_likelihood": "Very High - Active exploitation confirmed with CISA KEV listing. CVSS indicates no authentication or user interaction required for exploitation.", "impact_assessment": "Critical - Arbitrary file write with system authority can lead to complete server compromise, web shell installation, data theft, and lateral movement within the network.", "exposure_scope": "Moderate to High - MagicINFO servers are commonly internet-facing for remote digital signage management, potentially exposing thousands of enterprise installations globally." }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:01:25.566455", "displayed_on_website": false }, { "cve_id": "CVE-2025-4428", "cvss_score": "7.2", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2025-05-13T15:46:55.176Z", "cve_published_date_formatted": "2025-05-13", "kev_date_added": "2025-05-19", "kev_date_added_formatted": "2025-05-19", "kev_due_date": "2025-06-09", "days_to_kev": 6, "days_since_kev": null, "is_new_kev": false, "summary": "Remote Code Execution vulnerability in Ivanti Endpoint Manager Mobile API component that allows authenticated attackers to execute arbitrary code via crafted API requests. This vulnerability is actively exploited and listed in CISA KEV.", "detailed_analysis": { "vulnerability_type": "Remote Code Execution via API parameter injection (CWE-94: Code Injection)", "affected_products": [ "Ivanti Endpoint Manager Mobile" ], "exploitation_requirements": [ "Authentication required", "Network access to API endpoint", "Ability to craft malicious API requests" ], "internet_facing_likelihood": "Ivanti Endpoint Manager Mobile is enterprise mobile device management (MDM) software that typically requires internet connectivity to manage mobile devices across distributed networks. These systems are commonly deployed as internet-facing services to support remote device management, BYOD policies, and mobile workforce management. Estimated 70-80% of deployments are internet-accessible.", "typical_deployment": "Server application - Enterprise MDM/EMM platform deployed as centralized management server with web-based administration console and API endpoints for mobile device communication", "deployment_statistics": "Approximately 70-80% of EPMM deployments are internet-facing to enable remote mobile device management, over-the-air enrollment, and distributed workforce support. Enterprise mobility management inherently requires internet connectivity for mobile devices to check in from various locations.", "active_exploitation": "Listed in CISA Known Exploited Vulnerabilities (KEV) catalog on 2025-05-19, indicating confirmed active exploitation in the wild. CISA SSVC assessment shows 'Exploitation: active' and 'Automatable: yes'.", "severity_factors": [ "Remote Code Execution capability", "Network-accessible attack vector", "Active exploitation confirmed", "Enterprise-critical MDM infrastructure", "High privileges required reduces likelihood but doesn't eliminate risk", "Affects API component commonly exposed to internet" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately upgrade to Ivanti Endpoint Manager Mobile version 12.5.0.1 or later", "Review API access logs for suspicious crafted requests or unusual authentication patterns", "Implement network segmentation to limit API endpoint exposure if possible", "Monitor for unauthorized code execution, file system changes, or privilege escalation", "PATCH PRIORITY: CRITICAL - Actively exploited RCE in enterprise-critical infrastructure" ], "risk_assessment": { "exploit_likelihood": "Very High - Active exploitation confirmed by CISA KEV listing, network-accessible RCE with automatable exploitation", "impact_assessment": "Critical - Full system compromise possible with RCE, potential access to enterprise mobile device management infrastructure and sensitive mobile device data", "exposure_scope": "High - Enterprise MDM systems are commonly internet-facing, affecting organizations with mobile device management deployments worldwide" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:00:26.767782", "displayed_on_website": false }, { "cve_id": "CVE-2025-4427", "cvss_score": "5.3", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2025-05-13T15:45:35.145Z", "cve_published_date_formatted": "2025-05-13", "kev_date_added": "2025-05-19", "kev_date_added_formatted": "2025-05-19", "kev_due_date": "2025-06-09", "days_to_kev": 6, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2025-4427 is an authentication bypass vulnerability in the API component of Ivanti Endpoint Manager Mobile that allows unauthenticated attackers to access protected resources. This vulnerability is actively being exploited in the wild and is listed in CISA's KEV catalog.", "detailed_analysis": { "vulnerability_type": "Authentication Bypass (CWE-288) in API component allowing unauthorized access to protected resources", "affected_products": [ "Ivanti Endpoint Manager Mobile" ], "exploitation_requirements": [ "Network access to API endpoint", "No authentication required", "No user interaction needed" ], "internet_facing_likelihood": "Ivanti Endpoint Manager Mobile (EPMM) is a mobile device management (MDM) solution that typically requires internet exposure to manage mobile devices across different networks. Approximately 80-90% of EPMM deployments are internet-facing to enable remote device management capabilities.", "typical_deployment": "Server-side enterprise mobile device management platform that requires internet connectivity to manage mobile devices remotely. The API component handles device enrollment, policy distribution, and management functions.", "deployment_statistics": "Estimated 85% of EPMM deployments are internet-facing as the primary use case is managing mobile devices that connect from various locations outside the corporate network", "active_exploitation": "CVE is listed in CISA KEV catalog with exploitation marked as 'active' and automatable marked as 'yes', indicating confirmed exploitation in the wild", "severity_factors": [ "Authentication bypass allows complete access to protected API resources", "No user interaction required", "Network-accessible vulnerability", "Active exploitation confirmed", "Affects enterprise mobile device management infrastructure" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately upgrade to Ivanti Endpoint Manager Mobile version 12.5.0.1 or later", "Review API access logs for suspicious activity or unauthorized access attempts", "Implement network segmentation to limit API exposure if possible", "Monitor for unusual device enrollment or configuration changes", "Verify integrity of mobile device policies and configurations", "Consider temporary API access restrictions until patching is complete" ], "risk_assessment": { "exploit_likelihood": "Very High - Authentication bypass with no user interaction required, confirmed active exploitation, and network accessibility make this highly exploitable", "impact_assessment": "High - Unauthorized access to mobile device management APIs could lead to device compromise, data exfiltration, policy manipulation, and enterprise mobile security bypass", "exposure_scope": "Significant - Most EPMM deployments are internet-facing, affecting enterprise mobile device management infrastructure globally" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:00:56.626281", "displayed_on_website": false }, { "cve_id": "CVE-2025-43529", "cvss_score": "9.8", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1189", "deployment_likelihood": "LOW", "cve_published_date": "2025-12-17T20:46:55.691Z", "cve_published_date_formatted": "2025-12-17", "kev_date_added": "2025-12-15", "kev_date_added_formatted": "2025-12-15", "kev_due_date": "2026-01-05", "days_to_kev": -2, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2025-43529 is a use-after-free vulnerability in WebKit that affects client applications (Safari browser, iOS/iPadOS, tvOS, visionOS) when processing malicious web content. While actively exploited and on CISA KEV, this requires user interaction to visit malicious websites rather than direct exploitation of internet-facing servers.", "detailed_analysis": { "vulnerability_type": "Use-after-free memory corruption vulnerability in WebKit browser engine", "affected_products": [ "Safari", "iOS and iPadOS", "macOS", "tvOS", "visionOS", "watchOS" ], "exploitation_requirements": [ "User must visit malicious website or view malicious web content", "No authentication required for the vulnerability itself", "Requires user interaction to trigger exploitation" ], "internet_facing_likelihood": "The affected products are primarily client-side operating systems and browsers, not server applications. These are end-user devices and applications that consume web content rather than serve it. Estimated 0-5% of deployments would be internet-facing as servers, and those would be non-standard configurations.", "typical_deployment": "Client-side software - iOS/iPadOS run on mobile devices, Safari is an end-user browser, tvOS runs on Apple TV devices, visionOS runs on Vision Pro headsets, watchOS runs on Apple Watch devices. These are consumer/enterprise client devices, not servers.", "deployment_statistics": "Less than 5% internet-facing deployment. While these devices connect to the internet, they function as clients consuming content rather than servers providing services. The vulnerability is in the web content processing engine, not in any server functionality.", "active_exploitation": "Apple confirms active exploitation in extremely sophisticated targeted attacks against specific individuals on iOS versions before iOS 26. Added to CISA KEV catalog indicating confirmed exploitation in the wild.", "severity_factors": [ "High CVSS score of 9.8", "Confirmed active exploitation (CISA KEV listed)", "Arbitrary code execution capability", "Affects widely deployed consumer devices", "Requires user interaction to exploit", "Targets client-side applications, not internet-facing servers" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review device logs, check for unauthorized access, verify system integrity on affected Apple devices", "Immediately update all affected Apple devices: iOS to 18.7.3/26.2, Safari to 26.2, macOS to Tahoe 26.2, tvOS to 26.2, visionOS to 26.2, watchOS to 26.2", "Monitor for suspicious web browsing activity and unusual network connections from Apple devices", "HIGHEST patch priority for all Apple devices due to confirmed active exploitation", "Consider restricting web browsing on critical systems until patches are applied" ], "risk_assessment": { "exploit_likelihood": "High for targeted attacks requiring user interaction, but low for direct internet exploitation as this affects client applications rather than internet-facing servers", "impact_assessment": "Critical - arbitrary code execution with full device compromise possible, but requires social engineering or watering hole attacks to deliver malicious content", "exposure_scope": "Affects millions of consumer Apple devices but does not directly impact internet-facing server infrastructure through T1190 exploitation vectors" }, "exploitation_method": "USER_INTERACTION", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "Here's what is known about the CVE-2025-43529 vulnerability exploitation:\n\n* **Description:** CVE-2025-43529 is a use-after-free vulnerability that exists in WebKit 【2】【3】.\n* **Impact:** Successful exploitation could lead to arbitrary code execution when processing maliciously crafted web content 【1】【2】.\n* **Attack Vectors and Exploitation Method:** An attacker can exploit this vulnerability by processing maliciously crafted web content 【1】【2】. The vulnerability is exploited through WebKit, the browser engine used by Safari and other applications 【1】【10】.\n* **Internet-Facing Applications/Services:** The vulnerability exists in WebKit, making it likely to affect internet-facing applications that utilize this engine 【2】【3】.\n* **Active Exploitation:** Apple is aware of reports that this issue has been actively exploited in targeted attacks 【1】【8】.\n* **Targeted Attacks:** CVE-2025-43529 has been exploited in \"extremely sophisticated attacks against specific targeted individuals\" 【6】【8】. These attacks targeted specific iPhone users running iOS versions prior to 26 【9】.\n* **CISA Known Exploited Vulnerabilities (KEV) Status:** CISA has added CVE-2025-43529 to its KEV catalog, indicating that it is a known exploited vulnerability and requires immediate attention 【5】【7】. They have set a deadline of January 5, 2026, for organizations to patch the vulnerability 【3】.\n* **Technical Details/Exploitability:** The vulnerability is considered easy to exploit remotely, without requiring authentication, but requires user interaction 【4】. An exploit is available, with an estimated price between $25,000 and $100,000 【4】. The CVSSv3.1 score is 9.8 out of 10 【1】. The vulnerability was addressed with improved memory management 【2】.\n\nSources:\n- Zero‑Day Vulnerabilities in Apple WebKit | Cyber Security Agency of...: https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2025-117/\n- CVE-2025-43529 – Qualys ThreatPROTECT: https://threatprotect.qualys.com/tag/cve-2025-43529/\n- Apple Warns of Zero-day Vulnerability Exploited in Attack (CVE-2025-43529): https://threatprotect.qualys.com/2025/12/16/apple-warns-of-zero-day-vulnerability-exploited-in-attack-cve-2025-43529/\n- CVE-2025-43529 Apple iOS/iPadOS WebKit use after free (ID 125884): https://vuldb.com/?id.336444\n- CISA Adds Two Known Exploited Vulnerabilities to Catalog: https://www.cisa.gov/news-events/alerts/2025/12/15/cisa-adds-two-known-exploited-vulnerabilities-catalog", "references": [ { "title": "Zero‑Day Vulnerabilities in Apple WebKit | Cyber Security Agency of...", "url": "https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2025-117/", "citation_contribution": 344, "snippet": "CVE-2025-43529 has a Common Vulnerability Scoring System (CVSSv3.1) score of 9.8 out of 10. Impact. Successful exploitation of the vulnerabilities could lead to the following: CVE‑2025‑43529: A use‑after‑free issue in WebKit that may allow remote code execution when processing maliciously crafted web content.Known Exploitation. Apple is aware that this vulnerability may have been exploited in targeted attacks. Affected Products.", "is_search_result": true }, { "title": "CVE-2025-43529 – Qualys ThreatPROTECT", "url": "https://threatprotect.qualys.com/tag/cve-2025-43529/", "citation_contribution": 258, "snippet": "Tracked as CVE-2025-43529, the use-after-free vulnerability exists in WebKit. An attacker may exploit the vulnerability by processing maliciously crafted web content, leading to arbitrary code execution. The vulnerability was addressed with improved memory management.", "is_search_result": true }, { "title": "Apple Warns of Zero-day Vulnerability Exploited in Attack (CVE-2025-43529)", "url": "https://threatprotect.qualys.com/2025/12/16/apple-warns-of-zero-day-vulnerability-exploited-in-attack-cve-2025-43529/", "citation_contribution": 237, "snippet": "CISA added the CVE-2025-43529 to its Known Exploited Vulnerabilities Catalog, urging users to patch the vulnerability before January 5, 2026. Apple also addressed a recent Chrome zero-day vulnerability that Google had patched. CVE-2025-41474 is a memory corruption flaw in WebKit.", "is_search_result": true }, { "title": "CVE-2025-43529 Apple iOS/iPadOS WebKit use after free (ID 125884)", "url": "https://vuldb.com/?id.336444", "citation_contribution": 242, "snippet": "This vulnerability is traded as CVE-2025-43529. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Successful exploitation requires user interaction by the victim. Technical details are unknown but an exploit is available. The current price for an exploit might be approx. USD $25k-$100k (estimation calculated on 12/15/2025).", "is_search_result": true }, { "title": "CISA Adds Two Known Exploited Vulnerabilities to Catalog", "url": "https://www.cisa.gov/news-events/alerts/2025/12/15/cisa-adds-two-known-exploited-vulnerabilities-catalog", "citation_contribution": 99, "snippet": "CVE-2025-43529 Apple Multiple Products Use-After-Free WebKit Vulnerability. These types of vulnerabilities are frequent attack vectors for ...Read more", "is_search_result": true } ], "timestamp": "2025-12-17T21:20:15.738038" }, "cache_timestamp": "2025-12-17T21:20:37.576003", "displayed_on_website": false }, { "cve_id": "CVE-2025-43520", "cvss_score": "5.5", "attack_vector": "LOCAL", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1068", "deployment_likelihood": "VERY_LOW", "cve_published_date": "2025-12-12T20:56:25.542Z", "cve_published_date_formatted": "2025-12-12", "kev_date_added": "2026-03-20", "kev_date_added_formatted": "2026-03-20", "kev_due_date": "2026-04-03", "days_to_kev": 98, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2025-43520 is a memory corruption vulnerability in Apple operating systems that allows malicious applications to cause system termination or write kernel memory. This is a local privilege escalation vulnerability requiring a malicious application to already be running on the device.", "detailed_analysis": { "vulnerability_type": "Memory corruption vulnerability allowing kernel memory write and system termination", "affected_products": [ "iOS and iPadOS", "macOS", "tvOS", "visionOS", "watchOS" ], "exploitation_requirements": [ "Malicious application must be installed and running on device", "Local access to the device required", "No network connectivity required for exploitation" ], "internet_facing_likelihood": "Apple consumer operating systems (iOS, macOS, tvOS, visionOS, watchOS) are client-side operating systems that are not designed to be internet-facing server platforms. While these devices connect to the internet for updates and services, they do not typically run public-facing server applications or accept incoming network connections from the internet.", "typical_deployment": "These are client-side consumer operating systems deployed on end-user devices (iPhones, iPads, Macs, Apple TVs, Apple Vision Pro, Apple Watches). They are not server operating systems and do not typically host internet-facing services.", "deployment_statistics": "Less than 1% of deployments would be internet-facing. The vast majority of these devices are consumer endpoints protected by NAT/firewalls. Even macOS servers are rare and typically not exposed directly to the internet.", "active_exploitation": "Listed in CISA KEV catalog indicating active exploitation in the wild. Referenced as part of the DarkSword iOS exploit chain according to Google Threat Intelligence.", "severity_factors": [ "CISA KEV listing indicates active exploitation", "Part of documented exploit chain (DarkSword)", "Kernel memory write capability", "Affects all major Apple platforms", "Requires local malicious application (limits attack surface)" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Update immediately to the latest versions: iOS/iPadOS 18.7.2+, macOS 14.8.2+/15.7.2+, and version 26.1+ for all platforms", "Monitor for suspicious application behavior and unauthorized kernel-level access", "Review installed applications and remove any suspicious or unnecessary software", "High priority patch - exploit chain actively used in the wild" ], "risk_assessment": { "exploit_likelihood": "High for targeted attacks where malicious applications can be delivered to devices, but low for direct internet exploitation since this requires local application execution", "impact_assessment": "High - successful exploitation can lead to kernel memory corruption, system crashes, and potential privilege escalation to kernel level", "exposure_scope": "Billions of Apple devices globally, but exploitation requires local malicious application deployment rather than direct internet access" }, "exploitation_method": "OTHER", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:37:14.773595", "displayed_on_website": false }, { "cve_id": "CVE-2025-43510", "cvss_score": "7.8", "attack_vector": "LOCAL", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1068", "deployment_likelihood": "VERY_LOW", "cve_published_date": "2025-12-12T20:56:38.131Z", "cve_published_date_formatted": "2025-12-12", "kev_date_added": "2026-03-20", "kev_date_added_formatted": "2026-03-20", "kev_due_date": "2026-04-03", "days_to_kev": 98, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2025-43510 is a memory corruption vulnerability in Apple's consumer operating systems that allows a malicious application to cause unexpected changes in shared memory. This requires local access and user interaction to install a malicious app, making it unsuitable for direct internet exploitation despite being actively exploited in the wild.", "detailed_analysis": { "vulnerability_type": "Memory corruption issue with improper lock state checking allowing shared memory manipulation", "affected_products": [ "iOS", "iPadOS", "macOS", "tvOS", "visionOS", "watchOS" ], "exploitation_requirements": [ "Local access to device", "User must install malicious application", "Application execution permissions" ], "internet_facing_likelihood": "The affected products are consumer operating systems and devices that are not typically deployed as internet-facing servers. While these devices connect to the internet, they function as clients rather than servers. Less than 1% of deployments would involve these OS platforms running internet-accessible server services.", "typical_deployment": "These are client operating systems running on consumer devices (phones, tablets, computers, watches, TVs) that primarily function as clients connecting to internet services rather than hosting server applications", "deployment_statistics": "Estimated <1% of deployments are internet-facing servers. The vast majority are consumer devices that may run limited services like file sharing or remote access, but these are typically behind NAT/firewalls and not directly accessible from the internet", "active_exploitation": "Listed in CISA KEV catalog indicating active exploitation in the wild, likely through malicious applications distributed via app stores, side-loading, or other local installation methods", "severity_factors": [ "High CVSS score of 7.8", "Active exploitation confirmed", "Affects shared memory between processes", "Requires local application installation", "Limited to consumer OS platforms" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review installed applications, check system logs for suspicious activity, and verify system integrity", "Update immediately to latest versions: iOS 18.7.2/26.1, iPadOS 18.7.2/26.1, macOS Sequoia 15.7.2/Sonoma 14.8.2/Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1", "Review recently installed applications and remove any suspicious or untrusted software", "Monitor for unusual application behavior or system performance issues", "PATCH PRIORITY: HIGH for all affected consumer devices due to active exploitation" ], "risk_assessment": { "exploit_likelihood": "Low for direct internet exploitation due to requirement for local application installation, but high likelihood of continued exploitation through malicious applications", "impact_assessment": "High impact on affected devices allowing memory corruption and potential privilege escalation, but limited scope for mass internet-based attacks", "exposure_scope": "Minimal internet-facing exposure as these are primarily consumer operating systems, though widespread device population makes local exploitation concerning" }, "exploitation_method": "USER_INTERACTION", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:36:52.155931", "displayed_on_website": false }, { "cve_id": "CVE-2025-43300", "cvss_score": "8.8", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1203", "deployment_likelihood": "VERY_LOW", "cve_published_date": "2025-08-21T00:27:21.442Z", "cve_published_date_formatted": "2025-08-21", "kev_date_added": "2025-08-21", "kev_date_added_formatted": "2025-08-21", "kev_due_date": "2025-09-11", "days_to_kev": 0, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2025-43300 is an out-of-bounds write vulnerability in Apple's Image I/O framework affecting macOS, iOS, and iPadOS that requires user interaction to process a malicious image file. While actively exploited as a zero-day, it primarily affects client-side operating systems rather than internet-facing server applications.", "detailed_analysis": { "vulnerability_type": "Out-of-bounds write (CWE-787) in Apple's Image I/O framework triggered by processing malicious image files", "affected_products": [ "Apple macOS", "Apple iOS and iPadOS", "Apple iPadOS" ], "exploitation_requirements": [ "User interaction required (UI:R)", "Processing of malicious image file", "No authentication required", "Network delivery possible" ], "internet_facing_likelihood": "The affected products (macOS, iOS, iPadOS) are primarily client-side operating systems, not server software. While these systems connect to the internet, they do not typically run as internet-facing servers with listening services. Estimated <1% of deployments would be configured as internet-accessible servers with exposed image processing services.", "typical_deployment": "Client-side operating systems deployed on end-user devices (laptops, desktops, tablets, phones). These are consumer and enterprise workstation operating systems, not server operating systems designed for internet-facing deployment.", "deployment_statistics": "Less than 1% of macOS/iOS/iPadOS deployments are internet-facing servers. The vast majority (>99%) are client devices behind NAT/firewalls. Even when these systems have internet connectivity, they typically do not expose image processing services directly to the internet.", "active_exploitation": "CISA has confirmed active exploitation in 'extremely sophisticated attacks against specific targeted individuals' according to Apple's advisory. Added to CISA KEV catalog on 2025-08-21.", "severity_factors": [ "High CVSS score of 8.8", "Active exploitation confirmed", "Memory corruption leading to potential RCE", "Requires user interaction", "Affects client OS not server applications", "Zero-day status" ] }, "recommendations": [ "Apply security updates immediately: macOS Sonoma 14.7.8, macOS Ventura 13.7.8, iPadOS 17.7.10, macOS Sequoia 15.6.1, iOS 18.6.2 and iPadOS 18.6.2", "Monitor for suspicious image files and implement email/web filtering for malicious images", "HIGH patch priority due to active exploitation and zero-day status" ], "risk_assessment": { "exploit_likelihood": "Low for direct internet exploitation via T1190 as this affects client operating systems that are not typically deployed as internet-facing servers. High likelihood for targeted attacks via malicious image delivery (T1566).", "impact_assessment": "High impact if successfully exploited - memory corruption can lead to arbitrary code execution with potential for full system compromise.", "exposure_scope": "Minimal internet-facing server exposure as affected products are client operating systems. Primary exposure is through phishing/social engineering attacks delivering malicious images to end users." }, "exploitation_method": "USER_INTERACTION", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "CVE-2025-43300 is an actively exploited zero-day vulnerability that affects Apple's Image I/O framework, which handles image processing across iOS, iPadOS, and macOS platforms 【1】【2】. Here's what is known about its exploitation:\n\n* **Internet-facing applications or services:** While not directly affecting internet-facing *services*, the vulnerability impacts devices that process images, making it potentially exploitable via malicious image files received over the internet 【3】.\n* **Active exploitation:** CVE-2025-43300 is being actively exploited in the wild 【2】.\n* **Attack vectors and exploitation methods:** The vulnerability is an out-of-bounds write issue triggered by specially crafted images, leading to memory corruption 【2】. It can be triggered when a device processes a specially crafted image file 【2】. The complexity of modern file formats, particularly when multiple standards interact (e.g., TIFF containers with JPEG data), can create unexpected attack surfaces 【4】.\n* **Targeted attacks:** This vulnerability has been used in \"extremely sophisticated\" and highly targeted attacks against specific individuals 【5】【3】.\n* **CISA Known Exploited Vulnerabilities (KEV) status:** CISA has warned of the active exploitation of this zero-day vulnerability and has added it to its Known Exploited Vulnerabilities Catalog 【1】.\n* **Technical details:** CVE-2025-43300 represents a serious security flaw within Apple’s Image I/O framework 【1】. It is a memory corruption issue that can be triggered by processing a specially crafted image file 【2】.\n\nSources:\n- CISA Warns of Actively Exploited 0-Day Vulnerability in Apple iOS...: https://gbhackers.com/cisa-warns-of-actively-exploited-0-day-vulnerability-in-apple/\n- Apple Zero-Day Vulnerability CVE-2025-43300: What You Need to...: https://www.linkedin.com/pulse/apple-zero-day-vulnerability-cve-2025-43300-what-you-need-6qqbc\n- CVE-2025-43300 Detail - NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-43300\n- PoC Exploit and Technical Analysis Published for Apple 0-Day RCE ...: https://gbhackers.com/poc-exploit-published-for-apple-0-day-rce-vulnerability/\n- About the security content of iOS 18.6.2 and iPadOS 18.6.2: https://support.apple.com/en-us/124925", "references": [ { "title": "CISA Warns of Actively Exploited 0-Day Vulnerability in Apple iOS...", "url": "https://gbhackers.com/cisa-warns-of-actively-exploited-0-day-vulnerability-in-apple/", "snippet": "The vulnerability, catalogued as CVE-2025-43300, represents a serious security flaw within Apple’s Image I/O framework, which handles image processing across iOS, iPadOS, and macOS platforms.", "is_search_result": true }, { "title": "Apple Zero-Day Vulnerability CVE-2025-43300: What You Need to...", "url": "https://www.linkedin.com/pulse/apple-zero-day-vulnerability-cve-2025-43300-what-you-need-6qqbc", "snippet": "The flaw, identified as CVE-2025-43300, is already being actively exploited in highly targeted attacks. The patches, delivered as iOS 18.6.2 and iPadOS 18.6.2, correct a memory corruption issue that can be triggered when a device processes a specially crafted image file.", "is_search_result": true }, { "title": "CVE-2025-43300 Detail - NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43300", "snippet": "Missing: internet- facing", "is_search_result": true }, { "title": "PoC Exploit and Technical Analysis Published for Apple 0-Day RCE ...", "url": "https://gbhackers.com/poc-exploit-published-for-apple-0-day-rce-vulnerability/", "snippet": "CVE-2025-43300 represents a continuation of Apple’s ongoing challenges with image processing security. The vulnerability highlights how the complexity of modern file formats, particularly when multiple standards interact (TIFF containers with JPEG data), can create unexpected attack surfaces.", "is_search_result": true }, { "title": "About the security content of iOS 18.6.2 and iPadOS 18.6.2", "url": "https://support.apple.com/en-us/124925", "snippet": "Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals.", "is_search_result": true } ], "timestamp": "2025-09-06T17:16:50.134413" }, "cache_timestamp": "2025-09-06T17:17:06.443286", "displayed_on_website": false }, { "cve_id": "CVE-2025-43200", "cvss_score": "4.8", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1203", "deployment_likelihood": "LOW", "cve_published_date": "2025-06-16T21:36:25.578Z", "cve_published_date_formatted": "2025-06-16", "kev_date_added": "2025-06-16", "kev_date_added_formatted": "2025-06-16", "kev_due_date": "2025-07-07", "days_to_kev": 0, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2025-43200 is a logic issue in Apple client operating systems (iOS, macOS, iPadOS, watchOS, visionOS) that processes malicious media shared via iCloud Links. While it has network attack vector and is actively exploited, it targets client devices rather than internet-facing server applications.", "detailed_analysis": { "vulnerability_type": "Logic issue in media processing when handling maliciously crafted photos or videos shared via iCloud Links", "affected_products": [ "Apple iOS and iPadOS", "Apple macOS", "Apple iPadOS", "Apple watchOS", "Apple visionOS" ], "exploitation_requirements": [ "Target must receive and process iCloud Link with malicious media", "Network connectivity to iCloud services", "Vulnerable version of Apple OS" ], "internet_facing_likelihood": "The affected products are consumer client operating systems, not server software. While these devices connect to the internet, they do not typically run internet-facing server applications or listening services that would be directly exploitable via T1190. Estimated <1% of deployments would involve these OS versions running as internet-facing servers.", "typical_deployment": "Consumer client devices (iPhones, iPads, Mac computers, Apple Watches, Vision Pro headsets) used by end users. These are not designed as server platforms and rarely deployed as internet-facing services.", "deployment_statistics": "Less than 1% - Apple consumer OS products are overwhelmingly deployed as client devices. While some Mac systems might run development servers or file sharing, the vast majority are client endpoints behind NAT/firewalls.", "active_exploitation": "Apple confirms awareness of reports of exploitation in sophisticated attacks against targeted individuals. CISA has added to KEV catalog. Used to deploy Paragon Graphite spyware against journalists and civil society members.", "severity_factors": [ "Zero-click exploitation capability", "Active exploitation in targeted attacks", "CISA KEV listed", "Affects client devices, not internet-facing servers", "Requires social engineering to deliver iCloud Link" ] }, "recommendations": [ "Immediately update all Apple devices to patched versions (iOS 18.3.1, macOS 15.3.1, etc.)", "Monitor for suspicious iCloud Link sharing activities", "High patch priority due to CISA KEV status and active exploitation" ], "risk_assessment": { "exploit_likelihood": "Low for direct internet exploitation - requires delivery of malicious iCloud Link to target, making this primarily a client-side attack vector rather than direct server exploitation", "impact_assessment": "High impact on individual devices when successfully exploited, but limited scope due to client-focused attack vector", "exposure_scope": "Minimal internet-facing server exposure - affects primarily client devices that are not typically exposed as internet-facing services" }, "exploitation_method": "USER_INTERACTION", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "Here's what is known about the CVE-2025-43200 vulnerability:\n\n* **Affected Applications/Services:**\n\n * CVE-2025-43200 affects **Apple products**, specifically iOS, iPadOS, macOS, watchOS, and visionOS 【1】.\n * The vulnerability is related to processing a maliciously crafted photo or video shared via an **iCloud Link** 【2】【1】.\n * It involves a logic issue that occurs when handling content shared through iCloud Links 【3】【4】.\n* **Active Exploitation:**\n\n * Apple is aware of reports indicating that this vulnerability has been **exploited in sophisticated attacks** against specific, targeted individuals 【2】【5】.\n * It was actively exploited in the wild to target civil society members 【6】.\n* **Attack Vectors and Exploitation Methods:**\n\n * The vulnerability is a **zero-click flaw**, meaning attackers can compromise devices without any user interaction 【7】.\n * The attack vector involves a maliciously crafted photo or video shared via an iCloud Link 【2】【1】.\n * The vulnerability lies in a logic issue within the Messages app related to how iCloud Links handle shared media 【8】.\n* **Targeted Attacks:**\n\n * CVE-2025-43200 has been used in **targeted attacks** to deploy spyware, such as Paragon's Graphite, onto the devices of journalists and civil society members 【6】【4】.\n * Apple began sending threat notifications to targeted individuals on April 29, 2025 【9】.\n* **CISA KEV Status:**\n\n * CISA has added CVE-2025-43200 to its **Known Exploited Vulnerabilities (KEV) Catalog**, indicating that it poses a significant risk and is actively being exploited 【10】【11】.\n * Federal Civilian Executive Branch (FCEB) agencies are advised to use the KEV catalog to prioritize their vulnerability management efforts 【12】【13】.\n* **Technical Details/Internet Exploitability:**\n\n * The vulnerability is triggered when processing a maliciously crafted photo or video shared via iCloud Link 【2】【1】.\n * It is described as a logic issue 【2】【5】.\n * The attack vector bypasses traditional user awareness and security measures due to its zero-click nature 【3】.\n * Successful exploitation allows attackers to compromise devices remotely without any user interaction 【7】.\n\nSources:\n- Known Exploited Vulnerabilities Catalog | CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-43200\n- CVE-2025-43200 Detail - NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-43200\n- CISA Warns of iOS 0-Click Vulnerability Exploited in the Wild: https://cybersecuritynews.com/cisa-warns-of-ios-0-click-vulnerability/\n- iOS zero-click attacks used to deliver Graphite spyware (CVE-2025 ...: https://www.helpnetsecurity.com/2025/06/13/ios-zero-click-attacks-used-to-deliver-graphite-spyware-cve-2025-43200/\n- CVE-2025-43200 - Tenable: https://www.tenable.com/cve/CVE-2025-43200", "references": [ { "title": "Known Exploited Vulnerabilities Catalog | CISA", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-43200", "snippet": "CVE-2025-43200. Apple Multiple Products Unspecified Vulnerability: Apple iOS, iPadOS, macOS, watchOS, and visionOS, contain an unspecified vulnerability when processing a maliciously crafted photo or video shared via an iCloud Link.", "is_search_result": true }, { "title": "CVE-2025-43200 Detail - NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43200", "snippet": "A logic issue existed when processing a maliciously crafted photo or video shared via an iCloud Link.", "is_search_result": true }, { "title": "CISA Warns of iOS 0-Click Vulnerability Exploited in the Wild", "url": "https://cybersecuritynews.com/cisa-warns-of-ios-0-click-vulnerability/", "snippet": "CVE-2025-43200 specifically targets Apple’s media processing functionality when handling content shared through iCloud Links, creating an attack vector that bypasses traditional user awareness and security measures. CISA added this vulnerability to the KEV catalog on June 16, 2025...", "is_search_result": true }, { "title": "iOS zero-click attacks used to deliver Graphite spyware (CVE-2025 ...", "url": "https://www.helpnetsecurity.com/2025/06/13/ios-zero-click-attacks-used-to-deliver-graphite-spyware-cve-2025-43200/", "snippet": "CVE-2025-43200 is a logic issue triggered when the Apple smartphone processed a maliciously crafted photo or video shared via an iCloud Link.", "is_search_result": true }, { "title": "CVE-2025-43200 - Tenable", "url": "https://www.tenable.com/cve/CVE-2025-43200", "snippet": "Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals.", "is_search_result": true } ], "timestamp": "2025-09-06T17:40:45.656265" }, "cache_timestamp": "2025-09-06T17:41:08.510080", "displayed_on_website": false }, { "cve_id": "CVE-2025-42999", "cvss_score": "9.1", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2025-05-13T00:17:43.710Z", "cve_published_date_formatted": "2025-05-13", "kev_date_added": "2025-05-15", "kev_date_added_formatted": "2025-05-15", "kev_due_date": "2025-06-05", "days_to_kev": 2, "days_since_kev": null, "is_new_kev": false, "summary": "Critical insecure deserialization vulnerability in SAP NetWeaver Visual Composer development server that allows privileged users to upload malicious content leading to complete system compromise. CISA KEV listing indicates active exploitation in the wild.", "detailed_analysis": { "vulnerability_type": "Insecure Deserialization (CWE-502) - malicious content upload with deserialization leading to system compromise", "affected_products": [ "SAP NetWeaver Visual Composer (VCFRAMEWORK 7.50)" ], "exploitation_requirements": [ "High privileges required", "Network access to Visual Composer development server", "Ability to upload content via metadata uploader" ], "internet_facing_likelihood": "SAP NetWeaver Visual Composer is a development platform component that is frequently deployed as internet-facing to support distributed development teams and external integrations. Development servers are commonly exposed to enable remote access for developers and business users creating visual applications.", "typical_deployment": "Server application - Visual Composer is a development server component within SAP NetWeaver that provides web-based visual development capabilities for creating business applications", "deployment_statistics": "Estimated 60-70% of Visual Composer deployments are internet-facing due to business requirements for remote development access, external partner integrations, and distributed team collaboration", "active_exploitation": "Listed in CISA KEV catalog on 2025-05-15, indicating confirmed active exploitation in the wild", "severity_factors": [ "Critical CVSS 9.1 score", "Complete system compromise possible", "Active exploitation confirmed", "Network-based attack vector", "Changed scope impact", "No user interaction required once authenticated" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Apply SAP security note 3604119 immediately to patch VCFRAMEWORK 7.50", "Audit privileged user accounts with upload permissions to Visual Composer", "Monitor metadata upload activities and file deserialization processes", "Implement network segmentation to limit access to Visual Composer development servers", "Review and restrict privileged access to Visual Composer metadata uploader functionality" ], "risk_assessment": { "exploit_likelihood": "Very High - CISA KEV listing confirms active exploitation, network-based attack vector with no user interaction required once authenticated", "impact_assessment": "Critical - Complete compromise of confidentiality, integrity, and availability with changed scope impact allowing potential lateral movement", "exposure_scope": "Medium to High - SAP NetWeaver Visual Composer deployments in enterprises globally, particularly those with internet-facing development environments" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:58:15.411744", "displayed_on_website": false }, { "cve_id": "CVE-2025-42599", "cvss_score": "9.8", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2025-04-18T03:52:48.607Z", "cve_published_date_formatted": "2025-04-18", "kev_date_added": "2025-04-28", "kev_date_added_formatted": "2025-04-28", "kev_due_date": "2025-05-19", "days_to_kev": 10, "days_since_kev": null, "is_new_kev": false, "summary": "Critical stack-based buffer overflow in Active! mail 6 email server allows remote unauthenticated code execution. This vulnerability is actively exploited in the wild and listed in CISA KEV catalog.", "detailed_analysis": { "vulnerability_type": "Stack-based buffer overflow (CWE-121) allowing arbitrary code execution", "affected_products": [ "Active! mail 6" ], "exploitation_requirements": [ "Network access to mail server", "No authentication required", "No user interaction needed" ], "internet_facing_likelihood": "Active! mail 6 is an email server that by design requires internet connectivity to send/receive emails. Most deployments would be internet-facing to function properly as corporate email infrastructure. Estimated 80-90% of deployments are internet-accessible.", "typical_deployment": "Server software - Active! mail 6 is an enterprise email server that handles SMTP, POP3, IMAP services and typically runs on dedicated server infrastructure", "deployment_statistics": "Approximately 80-90% of Active! mail deployments are internet-facing since email servers must accept connections from external mail servers to function. Even internal deployments often have internet-facing components for external email delivery.", "active_exploitation": "Listed in CISA Known Exploited Vulnerabilities (KEV) catalog as of April 28, 2025, indicating confirmed active exploitation in the wild", "severity_factors": [ "Critical CVSS score of 9.8", "Remote code execution without authentication", "Buffer overflow can lead to complete system compromise", "Active exploitation confirmed by CISA KEV listing", "Email servers are high-value targets" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "URGENT: Update Active! mail 6 to version newer than BuildInfo 6.60.05008561 immediately", "Implement network segmentation to limit exposure if patching cannot be done immediately", "Monitor email server logs for suspicious connection attempts or unusual activity", "Consider temporarily blocking external access until patching is complete if business operations allow", "Patch priority: CRITICAL - Due to active exploitation and internet-facing nature" ], "risk_assessment": { "exploit_likelihood": "VERY HIGH - Vulnerability is actively being exploited according to CISA KEV, requires no authentication, and affects internet-facing email servers", "impact_assessment": "CRITICAL - Complete server compromise possible through arbitrary code execution, potentially leading to data theft, lateral movement, and business disruption", "exposure_scope": "All internet-facing Active! mail 6 servers running BuildInfo 6.60.05008561 or earlier are vulnerable to immediate compromise" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:51:40.067849", "displayed_on_website": false }, { "cve_id": "CVE-2025-41244", "cvss_score": "7.8", "attack_vector": "LOCAL", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1068", "deployment_likelihood": "VERY_LOW", "cve_published_date": "2025-09-29T16:09:51.871Z", "cve_published_date_formatted": "2025-09-29", "kev_date_added": "2025-10-30", "kev_date_added_formatted": "2025-10-30", "kev_due_date": "2025-11-20", "days_to_kev": 31, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2025-41244 is a local privilege escalation vulnerability affecting VMware Aria Operations and VMware Tools. Despite being listed in CISA KEV, it requires local access to a VM with VMware Tools installed and is not directly exploitable over the internet.", "detailed_analysis": { "vulnerability_type": "Local privilege escalation vulnerability (CWE-267) allowing non-administrative users to escalate to root privileges", "affected_products": [ "VMware Tools", "VMware Aria Operations", "VMware Cloud Foundation", "VMware VCF Operations", "VMware Telco Cloud Platform", "VMware Telco Cloud Infrastructure" ], "exploitation_requirements": [ "Local access to VM", "Non-administrative user account on target VM", "VMware Tools installed on VM", "VM managed by Aria Operations with SDMP enabled" ], "internet_facing_likelihood": "The affected products are primarily infrastructure management tools and VM utilities that are rarely exposed directly to the internet. VMware Tools runs inside guest VMs and has no network-facing services. VMware Aria Operations is typically deployed in internal management networks with restricted access.", "typical_deployment": "VMware Tools is client software installed inside virtual machines for enhanced functionality. VMware Aria Operations is enterprise infrastructure management software deployed internally. VMware Cloud Foundation and Telco Cloud platforms are infrastructure orchestration tools used internally by organizations and service providers.", "deployment_statistics": "Less than 5% of deployments would be directly internet-facing. These are primarily internal infrastructure tools with VMware Tools having no network services and Aria Operations being management software typically protected behind firewalls and VPNs.", "active_exploitation": "Listed in CISA KEV catalog indicating active exploitation in the wild. Technical exploitation details published by NVISO security researchers.", "severity_factors": [ "High CVSS score of 7.8", "Listed in CISA KEV", "Published exploit details", "Requires only low privileges to exploit", "Results in full system compromise (root access)", "Limited to local access scenarios" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review VM logs for unauthorized privilege escalations, check for suspicious root-level activities, verify system integrity", "Immediately update VMware Tools to version 13.0.5.0 or later (13.x) and 12.5.4 or later (12.5.x)", "Update VMware Aria Operations to version 8.18.5 or later", "Monitor VM access logs for unusual local login patterns and privilege escalation attempts", "Implement additional access controls and monitoring for VMs managed by Aria Operations", "Patch priority: HIGH due to CISA KEV listing and available exploit code" ], "risk_assessment": { "exploit_likelihood": "High for attackers with existing local VM access, but very low for direct internet exploitation due to local attack vector requirement", "impact_assessment": "Complete system compromise with root-level access to affected VMs, potential for lateral movement within virtualized environments", "exposure_scope": "Limited to organizations using VMware virtualization infrastructure, primarily affects internal systems rather than internet-facing services" }, "exploitation_method": "OTHER", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:21:09.660413", "displayed_on_website": false }, { "cve_id": "CVE-2025-40602", "cvss_score": "6.6", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2025-12-18T10:58:41.668Z", "cve_published_date_formatted": "2025-12-18", "kev_date_added": "2025-12-17", "kev_date_added_formatted": "2025-12-17", "kev_due_date": "2025-12-24", "days_to_kev": -1, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2025-40602 is a local privilege escalation vulnerability in SonicWall SMA1000 appliances that is being actively exploited in the wild when chained with CVE-2025-23006. CISA has added this to the KEV catalog due to confirmed exploitation.", "detailed_analysis": { "vulnerability_type": "Local privilege escalation due to insufficient authorization in the Appliance Management Console (AMC)", "affected_products": [ "SonicWall SMA1000" ], "exploitation_requirements": [ "Network access to AMC interface", "Often chained with CVE-2025-23006 for initial access", "High privileges required (PR:H) but can be bypassed when chained" ], "internet_facing_likelihood": "SonicWall SMA1000 appliances are secure remote access solutions designed to provide SSL-VPN and remote access capabilities. The Appliance Management Console (AMC) is frequently exposed to the internet for remote administration. Estimated 80-90% of deployments have internet-facing management interfaces.", "typical_deployment": "Network infrastructure appliances deployed as internet-facing remote access gateways and VPN concentrators with web-based management interfaces", "deployment_statistics": "Approximately 85% of SMA1000 deployments are internet-facing, as these are purpose-built remote access appliances that require internet connectivity for their primary function", "active_exploitation": "Confirmed active exploitation in the wild. CISA has added to KEV catalog. Attackers are chaining this with CVE-2025-23006 to achieve unauthenticated remote code execution at root level", "severity_factors": [ "CISA KEV listed indicating active exploitation", "Chained exploitation bypasses authentication requirements", "Achieves root-level access when exploited", "Internet-facing management interfaces commonly exposed", "Network attack vector enables remote exploitation" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Apply SonicWall hotfix immediately (12.4.3-03093 platform-hotfix or 12.5.0-02002 platform-hotfix)", "Restrict AMC interface access to trusted networks/IPs if possible", "Monitor AMC access logs for suspicious authentication attempts or privilege escalation activities", "Verify that CVE-2025-23006 is also patched to prevent chained exploitation", "HIGHEST patch priority - actively exploited zero-day affecting internet-facing infrastructure" ], "risk_assessment": { "exploit_likelihood": "VERY HIGH - Active exploitation confirmed by CISA KEV listing and security researchers. Attackers are successfully chaining this with other vulnerabilities for remote code execution.", "impact_assessment": "HIGH - Privilege escalation to root level when successfully exploited, compromising entire appliance and potentially enabling lateral movement into protected networks", "exposure_scope": "HIGH - SMA1000 appliances are widely deployed as internet-facing remote access solutions, with management interfaces commonly exposed for remote administration" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "CVE-2025-40602 is a local privilege escalation vulnerability affecting SonicWall SMA 1000 appliances. Here's what is known about its exploitation:\n\n* **Affected Applications/Services:** The vulnerability affects the Appliance Management Console (AMC) of SonicWall SMA 1000 appliances 【4】【5】. It does not affect SSL-VPN running on SonicWall firewalls 【5】.\n* **Active Exploitation:** CVE-2025-40602 has been actively exploited in the wild 【2】【3】.\n* **Attack Vectors/Exploitation Methods:**\n * The vulnerability is a local privilege escalation due to insufficient authorization in the AMC 【3】【8】.\n * Exploitation often involves chaining CVE-2025-40602 with CVE-2025-23006, a deserialization of untrusted data vulnerability, to achieve unauthenticated remote code execution at the root level 【1】【4】.\n * If the SMA 1000 appliance is patched for CVE-2025-23006, a threat actor would need to find another way to access a local system user account to exploit CVE-2025-40602 【2】.\n* **Targeted Attacks:** While it is known that the vulnerability is actively exploited, there are currently no specific details available regarding the scale or the actors behind these attacks 【3】.\n* **CISA KEV Status:** CISA has added CVE-2025-40602 to its Known Exploited Vulnerabilities (KEV) catalog 【7】【10】. This means that federal agencies are required to remediate it, and private sector organizations are strongly encouraged to do so as well 【6】【9】.\n* **Internet Exploitability:** Exploitation targets SMA1000 appliances with the AMC interface exposed to the internet 【1】. To exploit CVE-2025-40602, attackers have combined it with CVE-2025-23006 to achieve remote code execution 【1】.\n\nSonicWall has released a hotfix and urges customers to apply it to mitigate the vulnerability 【2】.\n\nSources:\n- SonicWall SMA1000 Zero-Day Exploited (CVE-2025-40602 & CVE-2025-23006): https://insights.integrity360.com/threat-advisories/sonicwall-sma1000-zero-day-exploited-cve-2025-40602-cve-2025-23006\n- Exploited SonicWall zero-day patched (CVE-2025-40602): https://www.helpnetsecurity.com/2025/12/17/sonicwall-cve-2025-40602/\n- SonicWall Fixes Actively Exploited CVE-2025-40602 in SMA 100 Appliances: https://thehackernews.com/2025/12/sonicwall-fixes-actively-exploited-cve.html\n- Exploitation of CVE-2025-40602 chained with CVE-2025-23006: https://www.tenable.com/blog/cve-2025-40602-sonicwall-secure-mobile-access-sma-1000-zero-day-exploited\n- Sonicwall warns of new SMA1000 zero-day exploited in attacks: https://www.bleepingcomputer.com/news/security/sonicwall-warns-of-new-sma1000-zero-day-exploited-in-attacks/", "references": [ { "title": "SonicWall SMA1000 Zero-Day Exploited (CVE-2025-40602 & CVE-2025-23006)", "url": "https://insights.integrity360.com/threat-advisories/sonicwall-sma1000-zero-day-exploited-cve-2025-40602-cve-2025-23006", "citation_contribution": 310, "snippet": "Exploitation Chain: Attackers combine CVE-2025-40602 with CVE-2025-23006, a critical pre-authentication deserialization vulnerability (CVSS: 9.8), to achieve unauthenticated remote code execution at root level. Exploit: Attack Vector: Exploitation targets SMA1000 appliances with the AMC interface exposed to the internet.", "is_search_result": true }, { "title": "Exploited SonicWall zero-day patched (CVE-2025-40602)", "url": "https://www.helpnetsecurity.com/2025/12/17/sonicwall-cve-2025-40602/", "citation_contribution": 308, "snippet": "SonicWall has patched a local privilege escalation vulnerability (CVE-2025-40602) affecting its Secure Mobile Access (SMA) 1000 appliances and is urging customers to apply the provided hotfix, as the flaw has been exploited by attackers. ... If the SMA 1000 appliance is patched for CVE-2025-23006, a threat actor would have to find another way to access a local system user account to exploit CVE-2025-40602, a SonicWall spokesperson told Help Net Security. ... But to mitigate CVE-2025-40602 ...", "is_search_result": true }, { "title": "SonicWall Fixes Actively Exploited CVE-2025-40602 in SMA 100 Appliances", "url": "https://thehackernews.com/2025/12/sonicwall-fixes-actively-exploited-cve.html", "citation_contribution": 276, "snippet": "The vulnerability, tracked as CVE-2025-40602 (CVSS score: 6.6), concerns a case of local privilege escalation that arises as a result of insufficient authorization in the appliance management console (AMC).It's worth noting that CVE-2025-23006 was patched by the company in late January 2025 in version 12.4.3-02854 (platform-hotfix). Clément Lecigne and Zander Work of Google Threat Intelligence Group (GTIG) have been credited with discovering and reporting CVE-2025-40602. There are currently no details on the scale of the attacks and who is behind the efforts.", "is_search_result": true }, { "title": "Exploitation of CVE-2025-40602 chained with CVE-2025-23006", "url": "https://www.tenable.com/blog/cve-2025-40602-sonicwall-secure-mobile-access-sma-1000-zero-day-exploited", "citation_contribution": 172, "snippet": "Key takeaways: CVE-2025-40602 is a local privilege escalation vulnerability in the appliance management console (AMC) of the SonicWall SMA 1000 appliance. CVE-2025-40602 has been exploited in a chained attack with CVE-2025-23006, a deserialization of untrusted data vulnerability patched in January.", "is_search_result": true }, { "title": "Sonicwall warns of new SMA1000 zero-day exploited in attacks", "url": "https://www.bleepingcomputer.com/news/security/sonicwall-warns-of-new-sma1000-zero-day-exploited-in-attacks/", "citation_contribution": 139, "snippet": "SonicWall warned customers today to patch a vulnerability in the SonicWall SMA1000 Appliance Management Console (AMC) that was chained in zero-day attacks to escalate privileges. According to SonicWall, this medium-severity local privilege escalation security flaw (CVE-2025-40602) was reported by Clément Lecigne and Zander Work of the Google Threat Intelligence Group, and doesn't affect SSL-VPN running on SonicWall firewalls.", "is_search_result": true } ], "timestamp": "2025-12-19T11:25:15.055497" }, "cache_timestamp": "2025-12-19T11:25:34.003773", "displayed_on_website": false }, { "cve_id": "CVE-2025-40551", "cvss_score": "9.8", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2026-01-28T07:33:09.603Z", "cve_published_date_formatted": "2026-01-28", "kev_date_added": "2026-02-03", "kev_date_added_formatted": "2026-02-03", "kev_due_date": "2026-02-06", "days_to_kev": 6, "days_since_kev": null, "is_new_kev": false, "summary": "Critical unauthenticated remote code execution vulnerability in SolarWinds Web Help Desk via untrusted data deserialization. Actively exploited in the wild with no authentication required.", "detailed_analysis": { "vulnerability_type": "Untrusted Data Deserialization (CWE-502) leading to Remote Code Execution", "affected_products": [ "SolarWinds Web Help Desk 12.8.8 HF1 and below" ], "exploitation_requirements": [ "Network access to Web Help Desk service", "No authentication required", "No user interaction required" ], "internet_facing_likelihood": "Web Help Desk is a web-based IT service management application that is frequently deployed as internet-facing to allow remote employees, contractors, and distributed offices to submit help desk tickets. Many organizations expose this service through corporate firewalls or VPNs to enable remote access. Estimated 60-70% of deployments have some form of internet accessibility.", "typical_deployment": "Server-side web application typically deployed on Windows or Linux servers with database backend, designed to handle IT service requests and ticket management across organizations", "deployment_statistics": "Approximately 60-70% of Web Help Desk deployments are internet-accessible either directly or through VPN/remote access solutions, as the software is designed to serve distributed workforces and external users submitting IT requests", "active_exploitation": "Confirmed active exploitation in the wild according to security research from Horizon3.ai. Attackers can reliably reach dangerous code paths without authentication.", "severity_factors": [ "CVSS 9.8 Critical severity", "No authentication required", "Network-based attack vector", "Complete system compromise possible", "Active exploitation confirmed", "Deserialization vulnerabilities often reliable and automatable" ] }, "recommendations": [ "CRITICAL: Immediately check for indicators of compromise - this vulnerability is actively exploited in the wild with unauthenticated RCE capability. Review access logs, check for unauthorized system changes, and verify system integrity", "URGENT: Upgrade to Web Help Desk version 2026.1 immediately on all instances, prioritizing internet-facing deployments", "Implement network segmentation to limit access to Web Help Desk servers and monitor for suspicious deserialization attempts", "PATCH PRIORITY: CRITICAL - Apply patches within 24-48 hours due to active exploitation and ease of exploitation" ], "risk_assessment": { "exploit_likelihood": "Very High - Confirmed active exploitation with no authentication required and reliable exploitation method via deserialization", "impact_assessment": "Critical - Complete system compromise with ability to execute arbitrary commands on the host system, potential lateral movement to other systems", "exposure_scope": "Moderate to High - SolarWinds Web Help Desk has significant market presence in enterprise IT environments, with many deployments internet-accessible for remote workforce support" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "**CVE-2025-40551** is a vulnerability affecting **SolarWinds Web Help Desk** that has been **actively exploited in the wild** 【1】【2】.\n\nHere's a breakdown of what is known about its exploitation:\n\n* **Internet-Facing Applications/Services:** While Web Help Desk is commonly deployed as an **internal IT management system**, successful exploitation can lead to significant impacts, including access to IT workflows, credentials, configuration data, and systems used for identity and access administration 【1】. The vulnerability allows for **remote code execution** 【2】.\n\n* **Evidence of Active Exploitation:** The vulnerability is confirmed to be **actively exploited** 【1】.\n\n* **Attack Vectors and Exploitation Methods:** The vulnerability stems from the **deserialization of untrusted data** 【2】【3】. It is described as **easily exploitable**, enabling unauthenticated attackers to achieve remote code execution on vulnerable instances 【2】. Attackers can reliably reach dangerous code paths **without authentication** 【1】.\n\n* **Targeted Attacks:** While the scope might be more targeted due to its nature as an internal IT management system, successful exploitation can be used as a **stepping stone for further attacks** 【1】【3】.\n\n* **CISA Known Exploited Vulnerabilities (KEV) Status:** Information regarding CVE-2025-40551's specific inclusion in the CISA KEV catalog was not found in the provided search results. However, CISA does maintain a catalog of actively exploited vulnerabilities and encourages organizations to use it for vulnerability management prioritization 【4】【5】. CISA has added other vulnerabilities to its KEV catalog based on evidence of active exploitation 【6】【7】.\n\n* **Technical Details about Internet Exploitability:** The vulnerability allows for **unauthenticated remote code execution** 【2】. This means an attacker does not need any prior authentication to exploit this flaw. The exploit involves the deserialization of untrusted data, a common vulnerability class 【2】【3】.\n\nSolarWinds has stated that these issues are patched in **Web Help Desk version 2026.1** 【2】.\n\nSources:\n- CVE-2025-40551: SolarWinds Web Help Desk RCE | Horizon3.ai: https://horizon3.ai/attack-research/vulnerabilities/cve-2025-40551/\n- CVE-2025-40551: SolarWinds WHD RCE | Horizon3.ai: https://horizon3.ai/attack-research/cve-2025-40551-another-solarwinds-web-help-desk-deserialization-issue/\n- SolarWinds addressed four critical Web Help Desk flaws: https://securityaffairs.com/187470/security/solarwinds-addressed-four-critical-web-help-desk-flaws.html\n- Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog\n- Reducing the Significant Risk of Known Exploited ...: https://www.cisa.gov/known-exploited-vulnerabilities", "references": [ { "title": "CVE-2025-40551: SolarWinds Web Help Desk RCE | Horizon3.ai", "url": "https://horizon3.ai/attack-research/vulnerabilities/cve-2025-40551/", "citation_contribution": 647, "snippet": "Actively exploited.CVE-2025-40551 demonstrates that attackers can still reliably reach dangerous code paths without authentication, despite multiple remediation attempts. Because Web Help Desk is commonly deployed as an internal IT management system, compromise has an outsized impact. Successful exploitation gives attackers access to IT workflows, credentials, configuration data, and systems used for identity and access administration.", "is_search_result": true }, { "title": "CVE-2025-40551: SolarWinds WHD RCE | Horizon3.ai", "url": "https://horizon3.ai/attack-research/cve-2025-40551-another-solarwinds-web-help-desk-deserialization-issue/", "citation_contribution": 559, "snippet": "CVE-2025-40551: Another Solarwinds Web Help Desk Deserialization Issue. January 28, 2026 | Attack Blogs, Attack Research.These vulnerabilities are easily exploitable and enable unauthenticated attackers to achieve remote code execution on vulnerable Solarwinds Web Help Desk instances. Solarwinds has stated that these issues are patched in Web Help Desk version 2026.1, and we encourage all users to upgrade as soon as possible.", "is_search_result": true }, { "title": "SolarWinds addressed four critical Web Help Desk flaws", "url": "https://securityaffairs.com/187470/security/solarwinds-addressed-four-critical-web-help-desk-flaws.html", "citation_contribution": 305, "snippet": "While more targeted in scope, successful exploitation could still allow unauthorized access to sensitive functionality and be used as a stepping stone for further attacks. The fourth critical flaw, tracked as CVE-2025-40551, was found by Jimi Sebree of Horizon3.ai and affects SolarWinds Web Help Desk through the deserialization of untrusted data.", "is_search_result": true }, { "title": "Known Exploited Vulnerabilities Catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "citation_contribution": 241, "snippet": "For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild. Organizations should use the KEV catalog as an input to their vulnerability management prioritization framework.How to use the KEV ...", "is_search_result": true }, { "title": "Reducing the Significant Risk of Known Exploited ...", "url": "https://www.cisa.gov/known-exploited-vulnerabilities", "citation_contribution": 104, "snippet": "Learn about the importance of CISA's Known Exploited Vulnerability (KEV) catalog and how to use it to help build a collective resilience across the cybersecurity community.", "is_search_result": true } ], "timestamp": "2026-02-03T18:40:16.000242" }, "cache_timestamp": "2026-02-03T18:40:33.430239", "displayed_on_website": false }, { "cve_id": "CVE-2025-40536", "cvss_score": "8.1", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2026-01-28T07:30:09.503Z", "cve_published_date_formatted": "2026-01-28", "kev_date_added": "2026-02-12", "kev_date_added_formatted": "2026-02-12", "kev_due_date": "2026-02-15", "days_to_kev": 15, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2025-40536 is a security control bypass vulnerability in SolarWinds Web Help Desk that allows unauthenticated attackers to gain access to restricted functionality. This vulnerability is being actively exploited in the wild against internet-facing WHD instances for initial access and lateral movement.", "detailed_analysis": { "vulnerability_type": "Security control bypass vulnerability (CWE-693: Protection Mechanism Failure) allowing unauthenticated access to restricted functionality", "affected_products": [ "SolarWinds Web Help Desk 12.8.8 HF1 and below" ], "exploitation_requirements": [ "Network access to Web Help Desk instance", "No authentication required", "No user interaction required" ], "internet_facing_likelihood": "SolarWinds Web Help Desk is a web-based IT service management platform that is very commonly deployed as an internet-facing service. As a help desk ticketing system, it requires accessibility by both internal staff and external users/customers, making internet exposure a standard deployment pattern. Estimated 80-90% of deployments are internet-accessible.", "typical_deployment": "Server software - Web Help Desk runs as a web application server that provides IT service management, ticketing, and help desk functionality through a web interface", "deployment_statistics": "Approximately 80-90% of SolarWinds Web Help Desk deployments are internet-facing because the primary business function requires accessibility by users, staff, and potentially customers from various locations. The web-based nature of the platform makes internet exposure the norm rather than the exception.", "active_exploitation": "Microsoft has confirmed active exploitation of SolarWinds Web Help Desk instances in multi-stage intrusions where threat actors exploit internet-exposed instances for initial access and lateral movement. While specific confirmation for CVE-2025-40536 is still under investigation, there is strong evidence of active targeting of WHD instances.", "severity_factors": [ "CVSS 8.1 (High severity)", "No authentication required", "Network attack vector", "No user interaction needed", "Active exploitation observed", "Common internet-facing deployment", "Full CIA impact (High confidentiality, integrity, and availability impact)" ] }, "recommendations": [ "CRITICAL: Immediately check for indicators of compromise - active exploitation has been observed against SolarWinds Web Help Desk instances. Review access logs, check for unauthorized access, verify system integrity, and look for signs of lateral movement", "URGENT: Upgrade to Web Help Desk version 2026.1 immediately to remediate the vulnerability", "Implement network segmentation to limit potential lateral movement if compromise has occurred", "Monitor Web Help Desk access logs for suspicious unauthenticated access attempts and unauthorized functionality usage", "Consider temporarily restricting internet access to WHD instances until patching is complete if operationally feasible", "PATCH PRIORITY: CRITICAL - This should be treated as an emergency patch due to active exploitation and high internet exposure" ], "risk_assessment": { "exploit_likelihood": "VERY HIGH - The vulnerability requires no authentication, has network attack vector, needs no user interaction, and is in software commonly exposed to the internet. Active exploitation has been observed in the wild.", "impact_assessment": "HIGH - Full compromise potential with high confidentiality, integrity, and availability impact. Can serve as initial access vector for broader network compromise and lateral movement.", "exposure_scope": "HIGH - SolarWinds Web Help Desk has significant market presence in enterprise environments, and the majority of deployments are internet-facing by design, creating a large attack surface." }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "**CVE-2025-40536** is a **security control bypass vulnerability** affecting **SolarWinds Web Help Desk (WHD)** 【2】【5】. This vulnerability allows an **unauthenticated attacker to gain access to certain restricted functionality** 【2】【5】.\n\nHere's a breakdown of what is known about its exploitation:\n\n* **Internet-Facing Applications/Services:** The vulnerability affects SolarWinds Web Help Desk instances, which are often **internet-facing** 【1】【3】. Threat actors have been observed exploiting these exposed instances to gain initial access and move laterally within networks 【1】【3】.\n\n* **Evidence of Active Exploitation:** While specific confirmation linking CVE-2025-40536 to the most recent observed attacks is still under investigation by Microsoft 【1】, there is strong evidence that **SolarWinds Web Help Desk instances are being actively exploited** 【1】【3】. Microsoft has observed multi-stage intrusions where threat actors exploit these WHD instances 【1】【3】.\n\n* **Attack Vectors and Exploitation Methods:** The vulnerability is a **security control bypass** 【2】【5】 and does not require user interaction for exploitation 【7】. It allows an unauthenticated attacker to access restricted functionality 【2】【5】. Microsoft is investigating whether this specific vulnerability, along with CVE-2025-40551, was used in recent attacks, or if older vulnerabilities like CVE-2025-26399 were exploited 【1】.\n\n* **Use in Targeted Attacks:** The observed intrusions involve threat actors exploiting internet-exposed WHD instances to gain initial access and then moving laterally to other high-value assets within an organization 【1】【3】. This suggests a **targeted approach** where attackers leverage the vulnerability to infiltrate networks.\n\n* **CISA Known Exploited Vulnerabilities (KEV) Status:** As of the latest information, **CVE-2025-40536 has not been explicitly added to the CISA Known Exploited Vulnerabilities (KEV) Catalog** 【4】【8】. However, CISA has added other SolarWinds Web Help Desk vulnerabilities to its KEV catalog, indicating active exploitation of this product line 【6】【9】.\n\n* **Technical Details about Internet Exploitability:** The vulnerability allows an **unauthenticated attacker** to bypass security controls and access restricted functionality on internet-exposed SolarWinds Web Help Desk instances 【2】【5】. The CVSS score for CVE-2025-40536 is **8.1** 【3】【6】. No user interaction is required for exploitation 【7】.\n\nSources:\n- Analysis of active exploitation of SolarWinds Web Help Desk: https://www.microsoft.com/en-us/security/blog/2026/02/06/active-exploitation-solarwinds-web-help-desk/\n- CVE-2025-40536 Detail - NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-40536\n- SolarWinds Web Help Desk Exploited for RCE in Multi-Stage Attacks on ...: https://thehackernews.com/2026/02/solarwinds-web-help-desk-exploited-for.html\n- Known Exploited Vulnerabilities Catalog - CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog\n- CVE-2025-40536: SolarWinds Web Help Desk Auth ...: https://www.sentinelone.com/vulnerability-database/cve-2025-40536/", "references": [ { "title": "Analysis of active exploitation of SolarWinds Web Help Desk", "url": "https://www.microsoft.com/en-us/security/blog/2026/02/06/active-exploitation-solarwinds-web-help-desk/", "citation_contribution": 717, "snippet": "The Microsoft Defender Research Team observed a multi‑stage intrusion where threat actors exploited internet‑exposed SolarWinds Web Help Desk (WHD) instances to get an initial foothold and then laterally moved towards other high-value assets within the organization. However, we have not yet confirmed whether the attacks are related to the most recent set of WHD vulnerabilities disclosed on January 28, 2026, such as CVE-2025-40551 and CVE-2025-40536 or stem from previously disclosed vulnerabilities like CVE-2025-26399.", "is_search_result": true }, { "title": "CVE-2025-40536 Detail - NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-40536", "citation_contribution": 467, "snippet": "SolarWinds Web Help Desk was found to be susceptible to a security control bypass vulnerability that if exploited, could allow an unauthenticated attacker to gain access to certain restricted functionality.Description. SolarWinds Web Help Desk was found to be susceptible to a security control bypass vulnerability that if exploited, could allow an unauthenticated attacker to gain access to certain restricted functionality.", "is_search_result": true }, { "title": "SolarWinds Web Help Desk Exploited for RCE in Multi-Stage Attacks on ...", "url": "https://thehackernews.com/2026/02/solarwinds-web-help-desk-exploited-for.html", "citation_contribution": 331, "snippet": "Microsoft has revealed that it observed a multi‑stage intrusion that involved the threat actors exploiting internet‑exposed SolarWinds Web Help Desk (WHD) instances to obtain initial access and move laterally across the organization's network to other high-value assets. That said, the Microsoft Defender Security Research Team said it's not clear whether the activity weaponized recently disclosed flaws (CVE-2025-40551, CVSS score: 9.8, and CVE-2025-40536, CVSS score: 8.1), or a previously patched vulnerability (CVE-2025-26399, CVSS score: 9.8).", "is_search_result": true }, { "title": "Known Exploited Vulnerabilities Catalog - CISA", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "citation_contribution": 161, "snippet": "For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild. Organizations should use the KEV catalog as an input to their vulnerability management prioritization framework.How to use the KEV ...", "is_search_result": true }, { "title": "CVE-2025-40536: SolarWinds Web Help Desk Auth ...", "url": "https://www.sentinelone.com/vulnerability-database/cve-2025-40536/", "citation_contribution": 158, "snippet": "CVE-2025-40536 is an authentication bypass vulnerability in SolarWinds Web Help Desk allowing unauthenticated attackers to access restricted ...", "is_search_result": true } ], "timestamp": "2026-02-12T20:30:14.996200" }, "cache_timestamp": "2026-02-12T20:35:22.473946", "displayed_on_website": false }, { "cve_id": "CVE-2025-4008", "cvss_score": "8.7", "attack_vector": "ADJACENT", "cisa_kev_listed": true, "internet_exploitable": "MEDIUM_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "MEDIUM", "cve_published_date": "2025-05-21T15:31:23.118Z", "cve_published_date_formatted": "2025-05-21", "kev_date_added": "2025-10-02", "kev_date_added_formatted": "2025-10-02", "kev_due_date": "2025-10-23", "days_to_kev": 134, "days_since_kev": null, "is_new_kev": false, "summary": "Remote command injection vulnerability in Smartbedded MeteoBridge weather station management systems allows unauthenticated attackers to execute arbitrary commands with root privileges. Despite CVSS rating as ADJACENT network, many MeteoBridge systems are deployed as internet-facing weather monitoring stations.", "detailed_analysis": { "vulnerability_type": "Unauthenticated remote command injection in CGI web interface leading to root-level remote code execution", "affected_products": [ "Smartbedded MeteoBridge (weather station management systems) v6.1 and earlier" ], "exploitation_requirements": [ "Network access to web interface", "No authentication required", "Direct access to vulnerable CGI endpoint" ], "internet_facing_likelihood": "MeteoBridge systems are weather station data collectors that often need internet connectivity to share weather data with services like Weather Underground, CWOP, and other weather networks. Many deployments are internet-accessible for remote monitoring and data collection. Estimated 40-60% of deployments have some form of internet exposure, though many may be behind NAT or firewalls.", "typical_deployment": "MeteoBridge devices are typically deployed as dedicated weather station data loggers and web servers that collect data from weather sensors and make it available via a web interface. They often run 24/7 as small embedded Linux systems.", "deployment_statistics": "Approximately 50% of MeteoBridge deployments are likely internet-accessible, as weather enthusiasts often want remote access to their weather data and many integrate with online weather services that require connectivity.", "active_exploitation": "Listed in CISA KEV catalog indicating confirmed active exploitation in the wild", "severity_factors": [ "Unauthenticated remote code execution", "Root privilege escalation", "Active exploitation confirmed", "Simple exploit (low complexity)", "Weather monitoring systems often have poor security practices" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately update to MeteoBridge version 6.2 or later", "If immediate patching not possible, block external access to MeteoBridge web interface via firewall rules", "Monitor for suspicious network connections and unusual system processes", "Consider placing MeteoBridge systems behind VPN for remote access rather than direct internet exposure", "Patch priority: CRITICAL - Active exploitation confirmed" ], "risk_assessment": { "exploit_likelihood": "Very high - unauthenticated RCE with confirmed active exploitation and simple attack complexity", "impact_assessment": "Complete system compromise with root access, potential for lateral movement, data theft, and use as launching point for further attacks", "exposure_scope": "Moderate - specialized weather monitoring equipment but significant number of internet-facing deployments globally" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:15:25.856827", "displayed_on_website": false }, { "cve_id": "CVE-2025-3935", "cvss_score": "8.1", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2025-04-25T18:27:44.244Z", "cve_published_date_formatted": "2025-04-25", "kev_date_added": "2025-06-02", "kev_date_added_formatted": "2025-06-02", "kev_due_date": "2025-06-23", "days_to_kev": 38, "days_since_kev": null, "is_new_kev": false, "summary": "ConnectWise ScreenConnect versions 25.2.3 and earlier are vulnerable to ViewState code injection leading to remote code execution. ScreenConnect is a remote access and support software typically deployed as an internet-facing web application for technicians to remotely access client systems.", "detailed_analysis": { "vulnerability_type": "ASP.NET ViewState deserialization vulnerability (CWE-502) allowing code injection and remote code execution", "affected_products": [ "ConnectWise ScreenConnect" ], "exploitation_requirements": [ "Network access to ScreenConnect web interface", "Compromised ASP.NET machine keys (requires prior privileged access)" ], "internet_facing_likelihood": "ScreenConnect is remote access/support software designed specifically for internet deployment. Organizations deploy ScreenConnect servers with internet-facing web interfaces to allow technicians to remotely access client systems from anywhere. Estimated 90%+ of ScreenConnect deployments are internet-accessible by design.", "typical_deployment": "Server application - ScreenConnect runs as a web server application (ASP.NET) that provides remote desktop and support capabilities through a web interface", "deployment_statistics": "90-95% of ScreenConnect deployments are internet-facing as the software's primary purpose is to enable remote access and support services from external locations", "active_exploitation": "Listed in CISA KEV catalog with exploitation status 'active', indicating confirmed exploitation in the wild", "severity_factors": [ "High CVSS score of 8.1", "Remote code execution capability", "No user interaction required", "Active exploitation confirmed by CISA", "Widely deployed remote access software", "Attack complexity is HIGH due to machine key requirement" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately upgrade on-premises ScreenConnect to version 25.2.4 or later (Cloud instances are already patched)", "Monitor ScreenConnect access logs for suspicious authentication attempts or unusual administrative activities", "Review system integrity and check for signs of compromise on ScreenConnect servers", "Patch priority: CRITICAL - Apply immediately due to active exploitation and RCE capability" ], "risk_assessment": { "exploit_likelihood": "High - Although attack complexity is rated HIGH due to machine key requirements, CISA KEV listing confirms active exploitation, suggesting attackers have found practical exploitation methods", "impact_assessment": "Complete system compromise - successful exploitation leads to remote code execution on the ScreenConnect server with potential lateral movement to connected client systems", "exposure_scope": "Significant - ScreenConnect is widely used by MSPs and IT departments, with most deployments internet-accessible by design for remote support capabilities" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:02:08.661596", "displayed_on_website": false }, { "cve_id": "CVE-2025-3928", "cvss_score": "8.8", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1505", "deployment_likelihood": "HIGH", "cve_published_date": "2025-04-25T15:56:28.112Z", "cve_published_date_formatted": "2025-04-25", "kev_date_added": "2025-04-28", "kev_date_added_formatted": "2025-04-28", "kev_due_date": "2025-05-19", "days_to_kev": 3, "days_since_kev": null, "is_new_kev": false, "summary": "Commvault Web Server contains an unspecified vulnerability that allows remote authenticated attackers to compromise web servers by creating and executing web shells. This vulnerability is actively exploited in the wild and is listed in the CISA KEV catalog.", "detailed_analysis": { "vulnerability_type": "Web shell upload/execution vulnerability allowing remote code execution", "affected_products": [ "Commvault Web Server (versions 11.20.0-11.20.216, 11.28.0-11.28.140, 11.32.0-11.32.88, 11.36.0-11.36.45)" ], "exploitation_requirements": [ "Remote network access", "Low-privilege authentication", "No user interaction required" ], "internet_facing_likelihood": "Commvault Web Server is enterprise backup and data management software that commonly exposes web interfaces for administrative access. Many organizations deploy these management interfaces with internet connectivity for remote administration, cloud integration, and distributed backup operations. Estimated 60-70% of deployments have some level of internet exposure.", "typical_deployment": "Server software providing web-based management interface for enterprise backup and data protection services, typically deployed on internal networks but often exposed for remote management", "deployment_statistics": "Approximately 60-70% of deployments likely have internet exposure due to remote administration needs, cloud service integration, and distributed enterprise environments requiring external access", "active_exploitation": "Confirmed active exploitation - added to CISA KEV catalog on 2025-04-28, indicating threat actors are actively targeting this vulnerability in the wild", "severity_factors": [ "High CVSS score of 8.8", "Network-based attack vector", "Low attack complexity", "No user interaction required", "High impact on confidentiality, integrity, and availability", "Active exploitation in the wild", "Web shell deployment capability" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately update to fixed versions: 11.36.46, 11.32.89, 11.28.141, or 11.20.217", "Scan web server directories for unauthorized web shells or suspicious files", "Review authentication logs for suspicious login activity", "Implement network segmentation to limit internet exposure if remote access not required", "Enable comprehensive logging and monitoring for web server activities" ], "risk_assessment": { "exploit_likelihood": "Very high - vulnerability is actively exploited with low complexity requirements and only needs low-privilege authentication", "impact_assessment": "Critical - successful exploitation allows web shell deployment leading to full server compromise, potential data exfiltration, and lateral movement within backup infrastructure", "exposure_scope": "Thousands of enterprise Commvault deployments worldwide with internet-facing management interfaces, particularly in large organizations with distributed backup operations" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:52:01.750763", "displayed_on_website": false }, { "cve_id": "CVE-2025-38352", "cvss_score": "7.4", "attack_vector": "LOCAL", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1068", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2025-07-22T08:04:25.277Z", "cve_published_date_formatted": "2025-07-22", "kev_date_added": "2025-09-04", "kev_date_added_formatted": "2025-09-04", "kev_due_date": "2025-09-25", "days_to_kev": 44, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2025-38352 is a race condition vulnerability in the Linux kernel's POSIX CPU timer subsystem that affects timer handling during process exit. This is a local privilege escalation vulnerability requiring existing system access to exploit, despite being actively exploited according to CISA KEV listing.", "detailed_analysis": { "vulnerability_type": "Time-of-check Time-of-use (TOCTOU) Race Condition in kernel timer handling", "affected_products": [ "Linux Kernel" ], "exploitation_requirements": [ "Local system access", "Ability to execute code on target system", "Precise timing to exploit race condition" ], "internet_facing_likelihood": "While Linux servers are widely deployed on the internet, this vulnerability requires LOCAL access to exploit. The race condition occurs in kernel-level timer handling during process exit, which cannot be triggered remotely over network protocols. An attacker must already have code execution capability on the target system.", "typical_deployment": "Linux kernel runs on servers, desktops, containers, and embedded systems. While many Linux systems are internet-facing, this specific vulnerability affects internal kernel timer mechanisms rather than network-accessible services.", "deployment_statistics": "Nearly 100% of internet-facing Linux systems are potentially affected, but 0% can be exploited directly via internet due to the local attack vector requirement. Exploitation requires prior compromise of the system.", "active_exploitation": "Listed in CISA KEV catalog, indicating active exploitation in the wild. However, exploitation would occur as part of multi-stage attacks where attackers have already gained initial access.", "severity_factors": [ "High CVSS score of 7.4", "Active exploitation confirmed", "Affects wide range of Linux versions since 2.6.36", "Requires local access limiting direct internet exploitation", "Race condition makes exploitation complex" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Apply kernel patches immediately to affected Linux systems (versions 2.6.36 through various 6.x branches)", "Monitor for unusual process behavior and privilege escalation attempts", "Implement additional access controls and monitoring for systems that cannot be immediately patched", "PATCH PRIORITY: HIGH - Despite local attack vector, active exploitation makes this critical for defense in depth" ], "risk_assessment": { "exploit_likelihood": "Low for direct internet exploitation, but high for post-compromise privilege escalation given active exploitation evidence", "impact_assessment": "High impact if exploited - successful exploitation could lead to privilege escalation and full system compromise", "exposure_scope": "Billions of Linux systems affected, but exploitation requires existing local access rather than direct internet exploitation" }, "exploitation_method": "OTHER", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:12:53.184373", "displayed_on_website": false }, { "cve_id": "CVE-2025-37164", "cvss_score": "10.0", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2025-12-16T16:30:34.524Z", "cve_published_date_formatted": "2025-12-16", "kev_date_added": "2026-01-07", "kev_date_added_formatted": "2026-01-07", "kev_due_date": "2026-01-28", "days_to_kev": 22, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2025-37164 is a critical unauthenticated remote code execution vulnerability in HPE OneView with a perfect CVSS score of 10.0. CISA has added this to their KEV catalog due to active exploitation in the wild, and a Metasploit module exists for exploitation.", "detailed_analysis": { "vulnerability_type": "Remote Code Execution (RCE) with code injection (CWE-94)", "affected_products": [ "HPE OneView (versions < 11.00)" ], "exploitation_requirements": [ "Network access to HPE OneView service", "No authentication required", "No user interaction required" ], "internet_facing_likelihood": "HPE OneView is commonly deployed as internet-facing infrastructure management software. Many organizations expose OneView to the internet for remote management capabilities, particularly in hybrid cloud and distributed infrastructure environments. Estimated 60-70% of OneView deployments have some level of internet exposure.", "typical_deployment": "HPE OneView is server-side infrastructure management software that provides a centralized management interface for HPE servers, storage, and networking. It runs as a web-based application server that administrators access remotely.", "deployment_statistics": "Approximately 60-70% of HPE OneView deployments are internet-facing because it serves as a critical infrastructure management platform that needs to be accessible for remote administration, monitoring, and automation across distributed enterprise environments.", "active_exploitation": "CISA has confirmed active exploitation by adding CVE-2025-37164 to the KEV catalog. A Metasploit framework module exists specifically for exploiting this vulnerability, indicating widespread exploitation tools are available.", "severity_factors": [ "Perfect CVSS 10.0 score", "No authentication required", "No user interaction needed", "Network attack vector", "Changed scope impact", "Active exploitation confirmed by CISA", "Publicly available exploit code" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Apply HPE-supplied hotfix immediately for all HPE OneView instances below version 11.00", "Implement network segmentation to limit HPE OneView exposure to internet if not required", "Monitor HPE OneView access logs for suspicious activities and unauthorized login attempts", "Consider temporarily isolating HPE OneView systems until patching is complete", "MAXIMUM PRIORITY patching due to active exploitation and perfect exploitability" ], "risk_assessment": { "exploit_likelihood": "EXTREMELY HIGH - Perfect CVSS score with no authentication required, confirmed active exploitation, and available exploit code make this vulnerability highly attractive to attackers", "impact_assessment": "CRITICAL - Complete system compromise with full confidentiality, integrity, and availability impact. Attackers gain complete control over infrastructure management systems", "exposure_scope": "HIGH - HPE OneView is widely deployed in enterprise environments for infrastructure management, with majority of installations likely having some internet exposure for remote management purposes" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "Here's what is known about the CVE-2025-37164 vulnerability:\n\n**General Information:**\n\n* CVE-2025-37164 is a remote code execution (RCE) vulnerability that exists in **HPE OneView** 【1】.\n* All versions below 11.00 are vulnerable if the vendor-supplied hotfix has not been applied 【1】.\n\n**Exploitation Details:**\n\n* The vulnerability can be exploited to achieve unauthenticated RCE against Hewlett Packard Enterprise (HPE) OneView 【1】.\n\n**CISA Status:**\n\n* CISA has added CVE-2025-37164 to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation 【3】【4】.\n* CISA maintains the KEV catalog as an authoritative source of vulnerabilities exploited in the wild 【2】.\n* Organizations should use the KEV catalog to inform their vulnerability management prioritization framework 【2】.\n\n**Affected Applications/Services:**\n\n* HPE OneView is affected 【1】.\n\n**Attack Vectors/Exploitation Methods:**\n\n* The vulnerability allows for unauthenticated remote code execution 【1】.\n\n**Internet-Facing Applications:**\n\n* While not explicitly stated, the nature of a remote code execution vulnerability in HPE OneView suggests it could potentially affect internet-facing applications or services if the OneView instance is exposed.\n\n**Targeted Attacks:**\n\n* The provided information does not specifically confirm if CVE-2025-37164 has been used in targeted attacks.\n\n**Technical Details/Internet Exploitability:**\n\n* The vulnerability allows unauthenticated RCE, indicating it may be exploitable over a network without requiring prior authentication 【1】.\n\nSources:\n- CVE-2025-37164 : A remote code execution issue exists in HPE OneView.: https://www.cvedetails.com/cve/CVE-2025-37164/\n- Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog\n- CISA Adds One Known Exploited Vulnerability to Catalog: https://www.cisa.gov/news-events/alerts/2025/12/29/cisa-adds-one-known-exploited-vulnerability-catalog\n- CISA Adds One Vulnerability to the KEV Catalog: https://www.cisa.gov/news-events/alerts/2025/01/08/cisa-adds-one-vulnerability-kev-catalog", "references": [ { "title": "CVE-2025-37164 : A remote code execution issue exists in HPE OneView.", "url": "https://www.cvedetails.com/cve/CVE-2025-37164/", "citation_contribution": 547, "snippet": "CVE-2025-37164 : A remote code execution issue exists in HPE OneView.This module exploits an unauthenticated RCE vulnerability, CVE-2025-37164, against Hewlett Packard Enterprise (HPE) OneView. All versions below 11.00 are vulnerable (so long as the vendor supplied hotfix has not been applied), however some VM product versions do not en", "is_search_result": true }, { "title": "Known Exploited Vulnerabilities Catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "citation_contribution": 214, "snippet": "For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild. Organizations should use the KEV catalog as an input to their vulnerability management prioritization framework.How to use the KEV ...", "is_search_result": true }, { "title": "CISA Adds One Known Exploited Vulnerability to Catalog", "url": "https://www.cisa.gov/news-events/alerts/2025/12/29/cisa-adds-one-known-exploited-vulnerability-catalog", "citation_contribution": 66, "snippet": "CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.", "is_search_result": true }, { "title": "CISA Adds One Vulnerability to the KEV Catalog", "url": "https://www.cisa.gov/news-events/alerts/2025/01/08/cisa-adds-one-vulnerability-kev-catalog", "citation_contribution": 63, "snippet": "CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation.", "is_search_result": true } ], "timestamp": "2026-01-07T19:00:14.990762" }, "cache_timestamp": "2026-01-07T19:00:36.084390", "displayed_on_website": false }, { "cve_id": "CVE-2025-35939", "cvss_score": "5.3", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2025-05-07T22:41:29.728Z", "cve_published_date_formatted": "2025-05-07", "kev_date_added": "2025-06-02", "kev_date_added_formatted": "2025-06-02", "kev_due_date": "2025-06-23", "days_to_kev": 26, "days_since_kev": null, "is_new_kev": false, "summary": "Craft CMS allows unauthenticated attackers to write arbitrary content (including PHP code) to predictable session file locations on the server. This vulnerability enables potential remote code execution without authentication and is actively being exploited in the wild according to CISA KEV.", "detailed_analysis": { "vulnerability_type": "Arbitrary file write leading to potential remote code execution via unsanitized session storage", "affected_products": [ "Craft CMS" ], "exploitation_requirements": [ "No authentication required", "Network access to Craft CMS application", "Ability to trigger session creation via login redirect" ], "internet_facing_likelihood": "Craft CMS is a web content management system designed specifically for building and managing websites. By its very nature as a CMS, it requires internet connectivity to serve web content to visitors. Approximately 95-99% of Craft CMS deployments are internet-facing as this is the software's primary purpose - to power public-facing websites.", "typical_deployment": "Craft CMS is server-side web application software that runs on web servers to power websites and web applications. It is designed to be accessible over the internet to serve content to website visitors.", "deployment_statistics": "Estimated 95-99% of Craft CMS installations are internet-facing since CMS platforms are specifically designed to serve public websites. Internal-only CMS deployments are rare and typically limited to development/staging environments.", "active_exploitation": "CISA has added this CVE to the Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild. SSVC assessment shows 'active' exploitation status.", "severity_factors": [ "No authentication required for exploitation", "Predictable file paths enable reliable exploitation", "Potential for remote code execution", "Active exploitation in the wild", "Affects core CMS functionality" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately update Craft CMS to version 5.7.5+ or 4.15.3+ depending on your major version", "Monitor session file directories (/var/lib/php/sessions) for suspicious content or unauthorized PHP files", "Review web server access logs for unusual requests to login pages with suspicious parameters", "Implement web application firewall rules to detect and block potential exploitation attempts", "HIGHEST patch priority - patch immediately due to active exploitation and no authentication requirement" ], "risk_assessment": { "exploit_likelihood": "VERY HIGH - No authentication required, simple exploitation method, and active exploitation confirmed by CISA KEV listing", "impact_assessment": "HIGH - Potential remote code execution allowing full server compromise, data theft, and lateral movement", "exposure_scope": "All internet-facing Craft CMS installations running vulnerable versions are at immediate risk of compromise" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:02:28.537647", "displayed_on_website": false }, { "cve_id": "CVE-2025-34291", "cvss_score": "9.4", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2025-12-05T22:27:26.438Z", "cve_published_date_formatted": "2025-12-05", "kev_date_added": "2026-05-21", "kev_date_added_formatted": "2026-05-21", "kev_due_date": "2026-06-04", "days_to_kev": 167, "days_since_kev": null, "is_new_kev": false, "summary": "Critical CORS misconfiguration in Langflow AI framework allows account takeover and remote code execution through cross-origin token hijacking. Affects internet-facing Langflow deployments up to version 1.6.9, with active exploitation observed in the wild.", "detailed_analysis": { "vulnerability_type": "CORS misconfiguration enabling token hijacking leading to remote code execution", "affected_products": [ "Langflow AI Framework" ], "exploitation_requirements": [ "Target must visit attacker-controlled webpage", "Langflow instance accessible from internet", "User must be authenticated to Langflow" ], "internet_facing_likelihood": "HIGH - Langflow is an AI workflow platform designed for building and deploying AI applications and APIs. As a web-based platform that enables creation of AI agents and workflows, it is commonly deployed as an internet-facing service to allow team collaboration and API access. The vulnerability specifically affects the web interface and API endpoints.", "typical_deployment": "Langflow is server software that runs as a web application with API endpoints. It provides a web-based interface for building AI workflows and exposes APIs for executing those workflows, making it inherently designed for network access.", "deployment_statistics": "Approximately 70-80% of Langflow deployments are likely internet-facing, as it's primarily used for collaborative AI development, API services, and integration with external systems that require internet connectivity.", "active_exploitation": "Confirmed active exploitation observed starting January 23, 2026, with threat actors leveraging the CORS weakness to execute unauthorized commands", "severity_factors": [ "CVSS 9.4 Critical severity", "Chained vulnerability combining CORS and token handling flaws", "Leads to full system compromise", "Active exploitation in the wild", "No authentication required for initial exploitation", "Built-in code execution functionality accessible after token hijacking" ] }, "recommendations": [ "URGENT: Immediately upgrade Langflow to version 1.7.0 or later which fixes the CORS misconfiguration and cookie handling issues", "Review all Langflow access logs for suspicious cross-origin requests, especially to /refresh endpoints, since January 2026", "Implement network-level restrictions to limit Langflow access to trusted networks if possible", "Check for unauthorized code execution, file modifications, or system changes on Langflow servers", "Reset all user sessions and require re-authentication after patching", "Monitor for unusual API calls or workflow executions that could indicate compromise" ], "risk_assessment": { "exploit_likelihood": "HIGH - Active exploitation confirmed with relatively simple attack chain requiring only user interaction with malicious webpage while authenticated to Langflow", "impact_assessment": "CRITICAL - Full system compromise including arbitrary code execution, complete account takeover, and access to all AI workflows and data", "exposure_scope": "HIGH - Langflow is growing in popularity for AI application development, with many instances likely exposed to internet for collaboration and API access" }, "exploitation_method": "USER_INTERACTION", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "**CVE-2025-34291** is a critical **Remote Code Execution (RCE)** vulnerability identified in the **LangFlow** AI framework 【1】.\n\n### Exploitation Status and Evidence\n* **Active Exploitation:** The vulnerability has been observed being exploited in the wild, with activity first detected on **January 23, 2026** 【1】.\n* **CISA KEV Status:** As of May 2026, the vulnerability has not been added to the **CISA Known Exploited Vulnerabilities (KEV) catalog**, though it was anticipated that such an inclusion would occur following the initial discovery of the campaign 【1】.\n* **Targeted Attacks:** While the vulnerability is being actively exploited, the exact scale and nature of the campaign remain difficult to confirm due to the specific mechanics of the exploit, which often involve redirecting traffic through user-initiated actions 【1】.\n\n### Technical Details and Attack Vectors\n* **Root Cause:** The vulnerability stems from a flaw in the **Cross-Site Request Forgery (CSRF) protection** mechanisms within the default configuration of LangFlow 【1】.\n* **Exploitation Method:** Threat actors leverage this CSRF weakness to execute unauthorized commands. Because the vulnerability relies on user interaction, the IP addresses observed during exploitation attempts often correspond to the victims who have been deceived by the attackers' ruse rather than the attackers' own infrastructure 【1】.\n* **Internet-Facing Exposure:** Given that LangFlow is an AI framework often deployed in accessible environments, applications or services using the default configuration are susceptible to these attacks if they are exposed to the internet 【1】.\n\nSources:\n- CVE-2025-34291 Exploited in the Wild: LangFlow AI Framework...: https://www.crowdsec.net/vulntracking-report/cve-2025-34291", "references": [ { "title": "CVE-2025-34291 Exploited in the Wild: LangFlow AI Framework...", "url": "https://www.crowdsec.net/vulntracking-report/cve-2025-34291", "citation_contribution": 1535, "snippet": "Active exploitation of CVE-2025-34291 was observed starting on January 23rd, 2026. The vulnerability has not yet been added to CISA KEV, but we expect this to happen soon. CVE-2025-34291 originates from an issue in the cross-site request forgery protection of the LangFlow default configuration. As a consequence, the IPs observed by CrowdSec are the IPs of users falling for the ruse of the threat actors using this vulnerability. Due to how the vulnerability works in practice, CrowdSec cannot fully confirm the scale of the exploitation campaign. ... CVE-2025-34291 is an actively exploited RCE vulnerability in LangFlow. Learn how to detect, mitigate, and protect your AI infrastructure.", "is_search_result": true } ], "timestamp": "2026-05-21T19:00:28.238277" }, "cache_timestamp": "2026-05-21T19:00:46.183389", "displayed_on_website": false }, { "cve_id": "CVE-2025-34028", "cvss_score": "9.3", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2025-04-22T16:32:23.446Z", "cve_published_date_formatted": "2025-04-22", "kev_date_added": "2025-05-02", "kev_date_added_formatted": "2025-05-02", "kev_due_date": "2025-05-23", "days_to_kev": 10, "days_since_kev": null, "is_new_kev": false, "summary": "Critical unauthenticated remote code execution vulnerability in Commvault Command Center that allows attackers to upload malicious ZIP packages containing JSP files via path traversal. The vulnerability enables complete server compromise without authentication and is actively being exploited in the wild.", "detailed_analysis": { "vulnerability_type": "Unauthenticated file upload with path traversal leading to remote code execution via malicious JSP files", "affected_products": [ "Commvault Command Center Innovation Release 11.38.0 - 11.38.25" ], "exploitation_requirements": [ "Network access to Commvault Command Center", "No authentication required", "Ability to upload ZIP files" ], "internet_facing_likelihood": "Commvault Command Center is enterprise backup and data management software that is commonly deployed as an internet-facing web application to enable remote management, mobile access, and cloud backup operations. Estimated 60-70% of deployments have some level of internet exposure for management purposes.", "typical_deployment": "Server application - Commvault Command Center is a centralized management console for enterprise backup infrastructure, typically deployed as a web-based server application", "deployment_statistics": "Approximately 60-70% of deployments are internet-facing as organizations need remote access for backup management, disaster recovery coordination, and cloud backup operations. Many enterprises expose the management interface for remote administration.", "active_exploitation": "Listed in CISA KEV catalog indicating active exploitation in the wild. Public exploits are available on GitHub from watchTowr Labs.", "severity_factors": [ "No authentication required", "Direct remote code execution", "Critical CVSS score of 9.3", "Public exploits available", "Active exploitation confirmed", "Enterprise backup systems are high-value targets" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Apply patches immediately: upgrade to 11.38.20 with SP38-CU20-433/436 or 11.38.25 with SP38-CU25-434/438", "If patching is not immediately possible, restrict network access to Commvault Command Center and implement additional authentication controls", "Monitor for unauthorized file uploads, JSP file creation, and suspicious network connections", "Review backup data integrity and check for signs of data exfiltration or ransomware deployment", "Patch priority: CRITICAL - immediate action required due to active exploitation" ], "risk_assessment": { "exploit_likelihood": "Very high - unauthenticated RCE with public exploits and confirmed active exploitation", "impact_assessment": "Critical - complete server compromise, potential access to all backup data, possible ransomware deployment, and lateral movement into backup infrastructure", "exposure_scope": "Thousands of enterprises globally using Commvault backup solutions with internet-exposed management interfaces" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:53:27.289048", "displayed_on_website": false }, { "cve_id": "CVE-2025-34026", "cvss_score": "9.2", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2025-05-21T22:04:58.832Z", "cve_published_date_formatted": "2025-05-21", "kev_date_added": "2026-01-22", "kev_date_added_formatted": "2026-01-22", "kev_due_date": "2026-02-12", "days_to_kev": 246, "days_since_kev": null, "is_new_kev": false, "summary": "Versa Concerto SD-WAN orchestration platform contains an authentication bypass vulnerability in the Traefik reverse proxy configuration, allowing attackers to access administrative endpoints and internal Actuator endpoints. This vulnerability provides direct network-based access to heap dumps and trace logs containing sensitive information.", "detailed_analysis": { "vulnerability_type": "Authentication bypass in reverse proxy configuration (CWE-288)", "affected_products": [ "Versa Concerto SD-WAN orchestration platform (versions 12.1.2 through 12.2.0)" ], "exploitation_requirements": [ "Network access to the Versa Concerto platform", "No authentication required due to bypass", "No user interaction required" ], "internet_facing_likelihood": "Versa Concerto is an SD-WAN orchestration platform that typically requires internet connectivity to manage distributed network infrastructure. As a centralized management platform for SD-WAN deployments, it is commonly deployed as an internet-accessible service to coordinate branch office connections and policies. Estimated 70-80% of deployments are internet-facing.", "typical_deployment": "Server/infrastructure software - deployed as a centralized orchestration platform for managing SD-WAN infrastructure across distributed locations", "deployment_statistics": "Approximately 70-80% of Versa Concerto deployments are likely internet-facing, as SD-WAN orchestration platforms need to communicate with distributed branch offices and remote sites over the internet", "active_exploitation": "Listed in CISA KEV catalog with date added 2026-01-22, indicating confirmed active exploitation in the wild", "severity_factors": [ "Critical CVSS score of 9.2", "No authentication required", "Direct network access vulnerability", "Access to administrative endpoints", "Exposure of heap dumps and trace logs", "Active exploitation confirmed by CISA KEV listing" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately update Versa Concerto to version 12.2.1 or later if available", "Implement network access controls to restrict access to Concerto administrative interfaces", "Monitor access logs for suspicious activity targeting administrative endpoints", "Review Traefik reverse proxy configuration for proper authentication controls", "Consider implementing additional authentication layers as compensating controls if patching is delayed" ], "risk_assessment": { "exploit_likelihood": "Very high - confirmed active exploitation, no authentication required, and straightforward network-based attack vector", "impact_assessment": "High - access to administrative endpoints and sensitive data including heap dumps and trace logs, potential for further lateral movement in SD-WAN infrastructure", "exposure_scope": "Moderate to high - affects enterprise SD-WAN deployments, with significant impact on organizations using Versa Concerto for network orchestration" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:26:18.410952", "displayed_on_website": false }, { "cve_id": "CVE-2025-33073", "cvss_score": "8.8", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1557", "deployment_likelihood": "LOW", "cve_published_date": "2025-06-10T17:02:35.874Z", "cve_published_date_formatted": "2025-06-10", "kev_date_added": "2025-10-20", "kev_date_added_formatted": "2025-10-20", "kev_due_date": "2025-11-10", "days_to_kev": 132, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2025-33073 is an SMB client elevation of privilege vulnerability that allows authenticated attackers to perform NTLM reflection attacks. While it has a network attack vector, it targets SMB client functionality rather than internet-facing server services, making direct internet exploitation unlikely.", "detailed_analysis": { "vulnerability_type": "Windows SMB Client Elevation of Privilege - NTLM Reflection Attack Bypass", "affected_products": [ "Windows 10 (multiple versions)", "Windows 11 (multiple versions)", "Windows Server 2008 SP2", "Windows Server 2008 R2 SP1", "Windows Server 2012/R2", "Windows Server 2016", "Windows Server 2019", "Windows Server 2022", "Windows Server 2025" ], "exploitation_requirements": [ "Authenticated network access", "SMB client must initiate connection to attacker-controlled server", "Ability to perform NTLM reflection attacks", "Network positioning for LLMNR poisoning or similar techniques" ], "internet_facing_likelihood": "This vulnerability targets SMB CLIENT functionality, not SMB server services. SMB clients (Windows workstations and servers acting as clients) are typically not directly exposed to the internet. The vulnerability requires the victim's SMB client to connect to an attacker-controlled SMB server, which is more commonly exploited in internal network scenarios rather than direct internet attacks.", "typical_deployment": "SMB client functionality is present on all Windows systems but is primarily used for internal network file sharing and domain authentication. Windows servers may have SMB server services exposed internally, but SMB client vulnerabilities affect the outbound connection behavior rather than inbound services.", "deployment_statistics": "Less than 5% of Windows systems would have SMB client functionality directly exploitable from the internet. The vulnerability requires the SMB client to initiate connections, typically occurring through internal network attacks, LLMNR poisoning, or social engineering rather than direct internet exploitation.", "active_exploitation": "Confirmed active exploitation in the wild with CISA KEV listing. Multiple public proof-of-concept exploits available demonstrating NTLM reflection attacks that bypass existing mitigations.", "severity_factors": [ "High CVSS score of 8.8", "Active exploitation confirmed", "CISA KEV listed", "Public proof-of-concept exploits available", "Affects SMB client rather than server services", "Requires authentication and specific network positioning" ] }, "recommendations": [ "Apply Microsoft security updates immediately for all Windows systems", "Implement SMB signing and disable SMB v1 if not already done", "Monitor for unusual SMB client connections and NTLM authentication patterns", "Consider network segmentation to limit SMB client exposure" ], "risk_assessment": { "exploit_likelihood": "Low for direct internet exploitation due to SMB client nature, but high for internal network lateral movement once initial access is gained", "impact_assessment": "High impact with potential for privilege escalation and credential theft in compromised networks", "exposure_scope": "Limited direct internet exposure as this affects SMB client functionality rather than internet-facing server services" }, "exploitation_method": "OTHER", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "Here's what is known about the CVE-2025-33073 vulnerability exploitation:\n\n* **Nature of the Vulnerability:** CVE-2025-33073 is an elevation of privilege vulnerability affecting the Windows SMB Client 【1】. It involves improper access control. 【1】\n\n* **Active Exploitation:** The vulnerability is actively exploited in the wild 【1】【2】.\n\n* **CISA KEV Status:** CISA has added CVE-2025-33073 to its Known Exploited Vulnerabilities (KEV) Catalog 【2】.\n\n* **Attack Vector:** This vulnerability is a reflection attack that bypasses NTLM reflection mitigations 【4】【6】. It allows an authenticated attacker to relay authentication back to the victim's machine 【4】.\n\n* **Exploitation Method:** The vulnerability involves an NTLM reflection SMB flaw 【3】. Publicly available proof-of-concept exploits demonstrate its exploitation 【7】【5】. These exploits often involve tools and techniques like LLMNR poisoning to exploit devices within the same broadcast domain, potentially without needing DNS registration 【5】【3】.\n\n* **Targeted Attacks:** While the provided information confirms active exploitation, it doesn't explicitly detail whether CVE-2025-33073 has been specifically used in targeted attacks.\n\n* **Internet-Facing Applications/Services:** The information does not explicitly state whether this vulnerability is used as an initial attack vector for internet-facing applications or services. However, given that it is an SMB client vulnerability, it is likely exploited within a network after gaining initial access 【1】.\n\nSources:\n- CVE-2025-33073 Mitigation Script - Improper Access ...: https://www.vicarius.io/vsociety/posts/cve-2025-33073-mitigation-script-improper-access-control-in-windows-smb-affects-microsoft-products\n- CISA Adds Five Known Exploited Vulnerabilities to Catalog: https://www.cisa.gov/news-events/alerts/2025/10/20/cisa-adds-five-known-exploited-vulnerabilities-catalog\n- GitHub - H1d3r/CVE-2025-33073_AD_SMB_Privilege_RCE: PoC...: https://github.com/H1d3r/CVE-2025-33073_AD_SMB_Privilege_RCE\n- Examining Relay Attacks Through the Lens of CVE-2025-33073: https://zeronetworks.com/blog/examining-relay-attacks-through-the-lens-of-cve-2025-33073\n- GitHub - dedibagus/cve-2025-33073: PoC Exploit for the NTLM...: https://github.com/dedibagus/cve-2025-33073", "references": [ { "title": "CVE-2025-33073 Mitigation Script - Improper Access ...", "url": "https://www.vicarius.io/vsociety/posts/cve-2025-33073-mitigation-script-improper-access-control-in-windows-smb-affects-microsoft-products", "citation_contribution": 516, "snippet": "CVE-2025-33073 is an elevation of privilege vulnerability in Windows SMB Client. This flaw has been assigned a CVSSv3 score of 8.8 and is actively exploited in ...", "is_search_result": true }, { "title": "CISA Adds Five Known Exploited Vulnerabilities to Catalog", "url": "https://www.cisa.gov/news-events/alerts/2025/10/20/cisa-adds-five-known-exploited-vulnerabilities-catalog", "citation_contribution": 159, "snippet": "CVE-2025-33073 Microsoft Windows SMB Client Improper Access Control Vulnerability ... These types of vulnerabilities are frequent attack vectors ...", "is_search_result": true }, { "title": "GitHub - H1d3r/CVE-2025-33073_AD_SMB_Privilege_RCE: PoC...", "url": "https://github.com/H1d3r/CVE-2025-33073_AD_SMB_Privilege_RCE", "citation_contribution": 158, "snippet": "CVE-2025-33073. PoC Exploit for the NTLM reflection SMB flaw.If you're in the same broadcast domain as the device and it's vulnerable for LLMNR poisioning it's possible to exploit a device without having to register a DNS record. Troubleshooting. I've seen the attack not work sometimes because the hostname is used for the attack which results in a DNS lookup from Kali.", "is_search_result": true }, { "title": "Examining Relay Attacks Through the Lens of CVE-2025-33073", "url": "https://zeronetworks.com/blog/examining-relay-attacks-through-the-lens-of-cve-2025-33073", "citation_contribution": 127, "snippet": "CVE-2025-33073 is the most recent relay attack, which enables an attacker to relay authentication back to the victim's machine – making it a reflection attack.", "is_search_result": true }, { "title": "GitHub - dedibagus/cve-2025-33073: PoC Exploit for the NTLM...", "url": "https://github.com/dedibagus/cve-2025-33073", "citation_contribution": 117, "snippet": "python3 CVE-2025-33073.py -u 'wintastic.local\\mathijs' -p 'password' --attacker-ip 192.168.178.49 --dns-ip 192.168.178.138 --dc-fqdn DC01.wintastic.local --target 192.168.178.65 --target-ip 192.168.178.65 --cli-only --socks. Also a custom command can be ran through proxychains instead of dumping SAM.If you're in the same broadcast domain as the device and it's vulnerable for LLMNR poisioning it's possible to exploit a device without having to register a DNS record.", "is_search_result": true } ], "timestamp": "2025-10-20T14:45:28.110849" }, "cache_timestamp": "2025-10-20T14:45:49.164959", "displayed_on_website": false }, { "cve_id": "CVE-2025-33053", "cvss_score": "8.8", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "MEDIUM_RISK", "confidence": "MEDIUM", "mitre_technique": "T1204", "deployment_likelihood": "MEDIUM", "cve_published_date": "2025-06-10T17:02:31.840Z", "cve_published_date_formatted": "2025-06-10", "kev_date_added": "2025-06-10", "kev_date_added_formatted": "2025-06-10", "kev_due_date": "2025-07-01", "days_to_kev": 0, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2025-33053 is a remote code execution vulnerability in Windows Internet Shortcut Files that requires user interaction (clicking malicious WebDAV links). While it has CVSS attack vector NETWORK, it primarily relies on spearphishing rather than direct exploitation of internet-facing services.", "detailed_analysis": { "vulnerability_type": "External Control of File Name or Path (CWE-73) in Internet Shortcut Files leading to Remote Code Execution", "affected_products": [ "Microsoft Windows 10 Version 1809", "Microsoft Windows Server 2019", "Microsoft Windows Server 2019 (Server Core installation)", "Microsoft Windows Server 2022", "Microsoft Windows 10 Version 21H2", "Microsoft Windows 11 (multiple versions)", "Microsoft Windows Server 2016", "Microsoft Windows Server 2008-2025 (various versions)" ], "exploitation_requirements": [ "User interaction required (UI:R in CVSS)", "Victim must click malicious WebDAV link", "Attacker-controlled WebDAV server", "Network connectivity to malicious server" ], "internet_facing_likelihood": "The vulnerability affects Windows operating systems broadly, including both client and server versions. However, successful exploitation requires user interaction with malicious links rather than direct exploitation of internet-facing services. WebDAV services can be internet-facing, but the vulnerability is in the client-side handling of Internet Shortcut Files, not the server component itself.", "typical_deployment": "Mixed deployment - affects both client systems (Windows 10/11) and server systems (Windows Server 2008-2025). The vulnerability is in the OS-level handling of Internet Shortcut Files rather than a specific server application.", "deployment_statistics": "While Windows Server products are commonly internet-facing (estimated 70-80% in enterprise environments), this specific vulnerability requires user interaction and is primarily exploited through spearphishing campaigns rather than direct server exploitation. The attack vector is social engineering rather than direct service exploitation.", "active_exploitation": "Confirmed active exploitation by Stealth Falcon APT group against Turkish defense organizations. CISA KEV listing confirms evidence of active exploitation in the wild.", "severity_factors": [ "High CVSS score (8.8) indicates significant impact", "User interaction required reduces direct exploitability", "Active exploitation by APT groups", "CISA KEV listing indicates ongoing threat", "Affects wide range of Windows versions", "Exploitation through spearphishing links" ] }, "recommendations": [ "Apply Microsoft security updates immediately for all Windows systems", "Implement email security controls to block malicious WebDAV links", "User awareness training on suspicious links and WebDAV threats", "Monitor for WebDAV-related network activity and file system events", "Consider disabling WebDAV client if not required for business operations" ], "risk_assessment": { "exploit_likelihood": "Medium - requires user interaction and social engineering rather than direct network exploitation, but active APT usage increases risk", "impact_assessment": "High - successful exploitation allows arbitrary code execution with user privileges, potentially leading to full system compromise", "exposure_scope": "Broad Windows environment exposure, but exploitation vector is primarily through targeted spearphishing rather than mass scanning of internet services" }, "exploitation_method": "PHISHING", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "CVE-2025-33053 is a critical remote code execution (RCE) vulnerability affecting Microsoft Windows WebDAV client. Here's what is known about its exploitation:\n\n1. **Internet-Facing Applications/Services**: The vulnerability impacts internet-facing WebDAV servers, posing a significant risk to organizations with such systems 【1】【2】.\n\n2. **Active Exploitation**: There is confirmed evidence of active exploitation of this vulnerability in the wild 【3】【4】.\n\n3. **Attack Vectors and Exploitation Methods**:\n - The vulnerability stems from external control of file names or paths in Internet Shortcut Files 【5】【6】.\n - Attackers can achieve RCE if a victim clicks a link to a malicious WebDAV server they control 【7】.\n - Spearphishing links are a known sub-technique used in these attacks 【7】.\n - Successful exploitation allows attackers to execute arbitrary code remotely without dropping malicious files locally, making their operations stealthy 【8】.\n\n4. **Targeted Attacks**:\n - Advanced Persistent Threat (APT) groups, such as Stealth Falcon, have actively exploited this vulnerability in targeted campaigns 【3】【9】.\n - It has been used in attacks against a major Turkish defense company 【9】.\n\n5. **CISA Known Exploited Vulnerabilities (KEV) Status**: CISA has added CVE-2025-33053 to its KEV Catalog due to evidence of active exploitation 【3】.\n\n6. **Technical Details on Internet Exploitability**:\n - It is a remote code execution flaw with a high CVSS rating of 8.8 【4】.\n - The attack complexity is low, meaning exploitation does not require significant effort or advanced skills 【4】.\n - Attackers can execute arbitrary code over a network through external control of file names or paths in WebDAV 【6】【5】.\n\nSources:\n- Microsoft Patch Tuesday June 2025 - Exploited zero-day and Other 65...: https://cybersecuritynews.com/microsoft-patch-tuesday-june-2025/\n- June 2025 Patch Tuesday: Updates and Analysis | CrowdStrike: https://www.crowdstrike.com/en-us/blog/patch-tuesday-analysis-june-2025/\n- PoC Exploit Released for Critical WebDAV 0-Day RCE Vulnerability ...: https://cybersecuritynews.com/webdav-0-day-rce-vulnerability-poc/\n- CVE-2025-33053: RCE in WebDAV | Kaspersky official blog: https://me-en.kaspersky.com/blog/cve-2025-33053-june-2025-patch-tuesday/24175/\n- CVE-2025-33053 Detail - NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-33053", "references": [ { "title": "Microsoft Patch Tuesday June 2025 - Exploited zero-day and Other 65...", "url": "https://cybersecuritynews.com/microsoft-patch-tuesday-june-2025/", "snippet": "The WebDAV zero-day (CVE-2025-33053) poses an immediate risk to organizations with internet-facing systems, while the SMB vulnerability (CVE-2025-33073) threatens internal network security. Microsoft Patch Tuesday June 2025 List.", "is_search_result": true }, { "title": "June 2025 Patch Tuesday: Updates and Analysis | CrowdStrike", "url": "https://www.crowdstrike.com/en-us/blog/patch-tuesday-analysis-june-2025/", "snippet": "CVE-2025-33053 specifically affects the server-side implementation, making internet-facing WebDAV servers particularly vulnerable to remote ...", "is_search_result": true }, { "title": "PoC Exploit Released for Critical WebDAV 0-Day RCE Vulnerability ...", "url": "https://cybersecuritynews.com/webdav-0-day-rce-vulnerability-poc/", "snippet": "A critical zero-day vulnerability in WebDAV implementations that enables remote code execution, with proof-of-concept exploit code now publicly available on GitHub. The vulnerability, tracked as CVE-2025-33053, has reportedly been actively exploited by advanced persistent threat (APT) groups in targeted campaigns against enterprise networks.", "is_search_result": true }, { "title": "CVE-2025-33053: RCE in WebDAV | Kaspersky official blog", "url": "https://me-en.kaspersky.com/blog/cve-2025-33053-june-2025-patch-tuesday/24175/", "snippet": "vulnerabilities. CVE-2025-33053: a good reason to update Windows.CVE-2025-33053 has a fairly high rating on the Common Vulnerability Scoring System scale — 8.8; its exploitation has been detected in the wild", "is_search_result": true }, { "title": "CVE-2025-33053 Detail - NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-33053", "snippet": "External control of file name or path in Internet Shortcut Files allows an unauthorized attacker to execute code over a network.", "is_search_result": true } ], "timestamp": "2025-09-06T17:41:21.491375" }, "cache_timestamp": "2025-09-06T17:41:43.654423", "displayed_on_website": false }, { "cve_id": "CVE-2025-32975", "cvss_score": "10.0", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2025-06-24T00:00:00.000Z", "cve_published_date_formatted": "2025-06-24", "kev_date_added": "2026-04-20", "kev_date_added_formatted": "2026-04-20", "kev_due_date": "2026-05-04", "days_to_kev": 300, "days_since_kev": null, "is_new_kev": false, "summary": "Quest KACE Systems Management Appliance contains an authentication bypass vulnerability allowing attackers to impersonate legitimate users and gain complete administrative control without valid credentials. This is a critical CVSS 10.0 vulnerability with active exploitation confirmed by CISA KEV listing.", "detailed_analysis": { "vulnerability_type": "Authentication bypass in SSO authentication handling mechanism leading to administrative takeover", "affected_products": [ "Quest KACE SMA (Systems Management Appliance) 13.0.x through 14.1.x" ], "exploitation_requirements": [ "Network access to KACE SMA", "No authentication required", "No user interaction required" ], "internet_facing_likelihood": "KACE Systems Management Appliances are enterprise IT management platforms that are frequently deployed as internet-facing services to allow remote system administration, patch management, and IT asset tracking. Many organizations expose these appliances to the internet for remote management capabilities.", "typical_deployment": "Server appliance software designed for centralized IT systems management, typically deployed as dedicated appliances or virtual machines in enterprise environments", "deployment_statistics": "Estimated 70-80% of KACE SMA deployments are internet-accessible due to their primary function as remote IT management platforms requiring access from distributed locations", "active_exploitation": "Listed in CISA Known Exploited Vulnerabilities catalog indicating confirmed active exploitation in the wild", "severity_factors": [ "CVSS 10.0 Critical severity", "No authentication required", "Complete administrative takeover possible", "Active exploitation confirmed", "Affects enterprise IT management infrastructure" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately patch to fixed versions: 13.0.385+, 13.1.81+, 13.2.183+, 14.0.341 (Patch 5)+, or 14.1.101 (Patch 4)+", "If patching cannot be done immediately, remove KACE SMA from internet exposure and require VPN access", "Review authentication logs for suspicious SSO authentication attempts", "Monitor for unauthorized administrative activities and configuration changes", "Patch priority: EMERGENCY - Apply within 24 hours due to active exploitation" ], "risk_assessment": { "exploit_likelihood": "Very High - Authentication bypass with no user interaction required, CVSS 10.0, and confirmed active exploitation", "impact_assessment": "Critical - Complete administrative takeover of enterprise IT management infrastructure, potential for lateral movement and compromise of managed systems", "exposure_scope": "Moderate to High - KACE SMA is enterprise software but widely deployed in internet-facing configurations for remote IT management" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:42:15.968623", "displayed_on_website": false }, { "cve_id": "CVE-2025-32756", "cvss_score": "9.6", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2025-05-13T14:46:44.208Z", "cve_published_date_formatted": "2025-05-13", "kev_date_added": "2025-05-14", "kev_date_added_formatted": "2025-05-14", "kev_due_date": "2025-06-04", "days_to_kev": 1, "days_since_kev": null, "is_new_kev": false, "summary": "Critical stack-based buffer overflow vulnerability in multiple Fortinet server products that allows remote unauthenticated code execution via crafted HTTP requests. This vulnerability is actively exploited in the wild and affects enterprise-grade security and communications infrastructure commonly exposed to the internet.", "detailed_analysis": { "vulnerability_type": "Stack-based buffer overflow (CWE-121) triggered via malformed HTTP hash cookie, allowing remote code execution without authentication", "affected_products": [ "FortiMail", "FortiVoice", "FortiNDR", "FortiRecorder", "FortiCamera" ], "exploitation_requirements": [ "Network access to HTTP service", "No authentication required", "No user interaction required" ], "internet_facing_likelihood": "HIGH - FortiMail email security gateways are commonly internet-facing for email filtering. FortiVoice systems often have internet exposure for remote workers and SIP services. FortiNDR network detection systems may have management interfaces exposed. FortiRecorder and FortiCamera systems are less commonly internet-facing but may be exposed in some deployments.", "typical_deployment": "These are enterprise server applications - FortiMail handles email security at network perimeter, FortiVoice provides VoIP/UC services, FortiNDR performs network monitoring, FortiRecorder handles call recording, and FortiCamera manages video surveillance", "deployment_statistics": "Estimated 60-80% of FortiMail deployments are internet-facing for email gateway functions. 40-60% of FortiVoice systems may have internet exposure for remote access. FortiNDR, FortiRecorder, and FortiCamera typically have lower internet exposure (10-30%) but management interfaces may be accessible.", "active_exploitation": "Listed in CISA KEV catalog with 'active exploitation' status, indicating confirmed attacks in the wild", "severity_factors": [ "Critical CVSS 9.6 score", "No authentication required", "Remote code execution", "Active exploitation confirmed", "Affects multiple enterprise security products", "HTTP-based attack vector easily automated" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review HTTP access logs for suspicious hash cookie parameters, check for unauthorized access, verify system integrity, and scan for web shells or backdoors", "Apply emergency patches immediately: FortiVoice 7.2.1+/7.0.7+/6.4.11+, FortiRecorder 7.2.4+/7.0.6+/6.4.6+, FortiMail 7.6.3+/7.4.5+/7.2.8+/7.0.9+, FortiNDR 7.6.1+/7.4.8+/7.2.5+/7.0.7+, FortiCamera 2.1.4+", "Implement network-level protections: Deploy WAF rules to filter malicious HTTP requests, restrict management interface access to authorized networks only, monitor for anomalous HTTP traffic patterns", "PATCH PRIORITY: CRITICAL - Treat as emergency due to active exploitation and unauthenticated remote code execution" ], "risk_assessment": { "exploit_likelihood": "VERY HIGH - Active exploitation confirmed, vulnerability is unauthenticated RCE via common HTTP protocol, exploit development is straightforward for buffer overflow with crafted cookie", "impact_assessment": "CRITICAL - Complete system compromise possible including data theft, ransomware deployment, lateral movement, and service disruption of critical security infrastructure", "exposure_scope": "HIGH - Fortinet has significant enterprise market share, particularly FortiMail email security gateways which are commonly internet-facing. Thousands of exposed systems likely vulnerable globally." }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:57:56.273274", "displayed_on_website": false }, { "cve_id": "CVE-2025-32709", "cvss_score": "7.8", "attack_vector": "LOCAL", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1068", "deployment_likelihood": "VERY_LOW", "cve_published_date": "2025-05-13T16:58:53.790Z", "cve_published_date_formatted": "2025-05-13", "kev_date_added": "2025-05-13", "kev_date_added_formatted": "2025-05-13", "kev_due_date": "2025-06-03", "days_to_kev": 0, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2025-32709 is a local privilege escalation vulnerability in the Windows Ancillary Function Driver for WinSock affecting all major Windows versions. While the affected products include Windows Server editions that can be internet-facing, this vulnerability requires local access and authorized user privileges to exploit, making it unsuitable for direct internet exploitation via T1190.", "detailed_analysis": { "vulnerability_type": "Use After Free (CWE-416) in Windows WinSock driver allowing local privilege escalation", "affected_products": [ "Windows Server 2008/2008 R2/2012/2012 R2/2016/2019/2022/2025", "Windows 10 (all versions from 1507 to 22H2)", "Windows 11 (22H2, 23H2, 24H2)" ], "exploitation_requirements": [ "Local access to the target system", "Authorized user account (low-privilege user access)", "Ability to interact with WinSock driver locally" ], "internet_facing_likelihood": "While Windows Server editions are commonly deployed as internet-facing servers, this vulnerability specifically affects the WinSock driver component and requires LOCAL access for exploitation. The vulnerability cannot be triggered remotely over the network despite the server being internet-facing.", "typical_deployment": "The affected products include both client operating systems (Windows 10/11) and server operating systems (Windows Server). Server editions are frequently deployed as internet-facing systems for web services, domain controllers, file servers, etc.", "deployment_statistics": "While approximately 70-80% of Windows Server deployments may be internet-facing, this vulnerability requires local system access making internet exposure irrelevant for exploitation. The attack vector is definitively LOCAL per CVSS scoring.", "active_exploitation": "Listed in CISA KEV catalog indicating active exploitation in the wild, likely being used by threat actors for post-compromise privilege escalation", "severity_factors": [ "High CVSS score of 7.8", "Active exploitation confirmed (CISA KEV)", "Affects all modern Windows versions", "Requires only low-privilege user access", "Use-after-free vulnerabilities can be reliably exploitable" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs for unusual privilege escalation activities, check for unauthorized administrative access, verify system integrity", "Apply Microsoft security updates immediately across all Windows systems", "Monitor for suspicious local privilege escalation attempts in Windows Event Logs", "Implement principle of least privilege to limit impact of successful exploitation", "Priority: CRITICAL - Patch immediately due to active exploitation and wide attack surface" ], "risk_assessment": { "exploit_likelihood": "HIGH for local exploitation - Active exploitation confirmed via CISA KEV listing, affects fundamental Windows component", "impact_assessment": "HIGH - Successful exploitation grants elevated privileges, potentially leading to complete system compromise", "exposure_scope": "Affects virtually all Windows deployments globally, but requires local access for exploitation limiting direct internet attack surface" }, "exploitation_method": "OTHER", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:56:01.365842", "displayed_on_website": false }, { "cve_id": "CVE-2025-32706", "cvss_score": "7.8", "attack_vector": "LOCAL", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1068", "deployment_likelihood": "VERY_LOW", "cve_published_date": "2025-05-13T16:58:51.645Z", "cve_published_date_formatted": "2025-05-13", "kev_date_added": "2025-05-13", "kev_date_added_formatted": "2025-05-13", "kev_due_date": "2025-06-03", "days_to_kev": 0, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2025-32706 is a local privilege escalation vulnerability in the Windows Common Log File System Driver that requires authenticated local access. Despite being in CISA KEV, this is not directly exploitable over the internet as it requires local access with authentication to escalate privileges.", "detailed_analysis": { "vulnerability_type": "Local privilege escalation through improper input validation in Windows Common Log File System Driver (CLFS)", "affected_products": [ "Windows Server 2008/2008 R2/2012/2012 R2/2016/2019/2022/2025", "Windows 10 (all versions)", "Windows 11 (all versions)" ], "exploitation_requirements": [ "Local authenticated access required", "Low privileges on target system", "No user interaction required", "Access to vulnerable CLFS driver" ], "internet_facing_likelihood": "The Windows CLFS driver is an internal kernel component that handles transaction logging. It is not directly exposed to network connections and cannot be exploited remotely without first gaining local access to the system. This is a local privilege escalation vulnerability that requires an attacker to already have authenticated access to the target system.", "typical_deployment": "The CLFS driver is a core Windows kernel component present on all Windows systems (client and server). It handles transaction logging for various Windows services but is not a network-facing service itself.", "deployment_statistics": "0% internet-facing - this is an internal kernel driver component that requires local system access to exploit. While Windows servers may be internet-facing, the CLFS driver itself is not directly accessible from the network.", "active_exploitation": "Listed in CISA KEV indicating active exploitation in the wild, likely being used as part of multi-stage attacks for privilege escalation after initial system compromise", "severity_factors": [ "High CVSS score (7.8) for local exploitation", "Active exploitation confirmed by CISA KEV listing", "Affects wide range of Windows versions", "No user interaction required once local access obtained", "Requires prior system access limiting direct internet threat" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs for unusual privilege escalations, check for unauthorized administrative access, verify system integrity and audit local user accounts", "Apply Microsoft security updates immediately to patch the CLFS driver vulnerability", "Monitor for unusual local privilege escalation attempts and administrative account activity", "Patch priority: HIGH for all Windows systems, especially those that may be targets for multi-stage attacks" ], "risk_assessment": { "exploit_likelihood": "Not directly exploitable from internet - requires local authenticated access first. However, very likely to be exploited if attacker gains initial foothold through other means.", "impact_assessment": "High impact for local privilege escalation - allows low-privileged attacker to gain SYSTEM/administrative privileges on compromised Windows systems", "exposure_scope": "No direct internet exposure - affects internal privilege escalation capabilities on Windows systems after initial compromise" }, "exploitation_method": "OTHER", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:56:45.620811", "displayed_on_website": false }, { "cve_id": "CVE-2025-32701", "cvss_score": "7.8", "attack_vector": "LOCAL", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1068", "deployment_likelihood": "VERY_LOW", "cve_published_date": "2025-05-13T16:58:50.227Z", "cve_published_date_formatted": "2025-05-13", "kev_date_added": "2025-05-13", "kev_date_added_formatted": "2025-05-13", "kev_due_date": "2025-06-03", "days_to_kev": 0, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2025-32701 is a local privilege escalation vulnerability in the Windows Common Log File System Driver affecting all Windows versions. Despite being on CISA KEV due to active exploitation, this is a local-only vulnerability requiring existing access to the system to exploit.", "detailed_analysis": { "vulnerability_type": "Use-after-free vulnerability (CWE-416) in Windows Common Log File System Driver allowing privilege escalation", "affected_products": [ "Windows Server (2008 SP2, 2008 R2, 2012, 2012 R2, 2016, 2019, 2022, 2025)", "Windows 10 (all versions 1507-22H2)", "Windows 11 (22H2, 23H2, 24H2)" ], "exploitation_requirements": [ "Local authentication required", "Low privilege user account access", "Physical or remote access to system already established" ], "internet_facing_likelihood": "While Windows Server versions are commonly internet-facing, this vulnerability affects a kernel driver component that is not directly accessible from network connections. The Common Log File System Driver is an internal Windows component that handles transaction logging and is not exposed as a network service. Exploitation requires local access to the system.", "typical_deployment": "The affected component is a core Windows kernel driver present on all Windows systems (both client and server). Windows Servers are commonly internet-facing, but this specific driver component is not network-accessible.", "deployment_statistics": "While Windows Servers have high internet exposure (60-80%), the vulnerable driver component itself has 0% direct internet exposure as it's an internal kernel component requiring local access to exploit.", "active_exploitation": "Listed in CISA KEV catalog, indicating confirmed active exploitation in the wild", "severity_factors": [ "High CVSS score of 7.8", "Active exploitation confirmed (CISA KEV)", "Affects all supported Windows versions", "Local attack vector limits direct internet exposure", "Requires existing system access" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Apply Microsoft security updates immediately for all Windows systems", "Monitor for unusual privilege escalation attempts in Windows event logs", "Review user account privileges and access controls", "Patch priority: HIGH - due to active exploitation, despite local-only attack vector" ], "risk_assessment": { "exploit_likelihood": "High for systems where attackers have gained initial access through other means (phishing, malware, etc.), but requires local access making direct internet exploitation impossible", "impact_assessment": "High impact - successful exploitation provides full system privileges, potentially leading to complete system compromise", "exposure_scope": "Limited direct internet exposure - vulnerability cannot be exploited remotely without existing system access" }, "exploitation_method": "OTHER", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:57:07.612905", "displayed_on_website": false }, { "cve_id": "CVE-2025-3248", "cvss_score": "9.8", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2025-04-07T14:22:38.980Z", "cve_published_date_formatted": "2025-04-07", "kev_date_added": "2025-05-05", "kev_date_added_formatted": "2025-05-05", "kev_due_date": "2025-05-26", "days_to_kev": 28, "days_since_kev": null, "is_new_kev": false, "summary": "Langflow is an AI workflow platform that allows remote code execution through an unauthenticated API endpoint. This vulnerability enables direct server compromise via crafted HTTP requests to /api/v1/validate/code.", "detailed_analysis": { "vulnerability_type": "Unauthenticated remote code execution via code injection in API endpoint", "affected_products": [ "Langflow AI (versions < 1.3.0)" ], "exploitation_requirements": [ "Network access to Langflow service", "No authentication required", "Access to /api/v1/validate/code endpoint" ], "internet_facing_likelihood": "Langflow is an AI workflow development platform designed for building and deploying AI applications. As a web-based platform for creating AI workflows, it is commonly deployed as an internet-accessible service to allow users to access the interface and APIs remotely. Many organizations deploy Langflow on cloud infrastructure or internal servers with internet exposure to enable team collaboration and API access.", "typical_deployment": "Server application - Langflow runs as a web service with API endpoints and a web interface for building AI workflows", "deployment_statistics": "Approximately 60-70% of Langflow deployments are likely internet-facing, as it's designed as a collaborative platform for AI development teams and often needs to be accessible remotely or integrated with other cloud services", "active_exploitation": "Listed in CISA KEV catalog with 'active' exploitation status, indicating confirmed exploitation in the wild", "severity_factors": [ "CVSS 9.8 Critical severity", "No authentication required", "Complete system compromise possible", "Active exploitation confirmed", "Simple HTTP request exploitation", "AI/ML platforms often contain sensitive data" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately upgrade to Langflow 1.3.0 or later", "If immediate patching not possible, block access to /api/v1/validate/code endpoint at firewall/proxy level", "Review web server access logs for suspicious requests to the validate/code endpoint", "Implement network segmentation to limit exposure if not already done", "Monitor for unusual process execution or network connections from Langflow servers", "PATCH PRIORITY: EMERGENCY - Active exploitation with unauthenticated RCE" ], "risk_assessment": { "exploit_likelihood": "Very High - Unauthenticated RCE with confirmed active exploitation and public exploit code available", "impact_assessment": "Critical - Complete server compromise, potential data theft, lateral movement, and use as pivot point for further attacks", "exposure_scope": "Medium to High - While Langflow is a specialized AI platform, its growing adoption and typical internet-facing deployment creates significant exposure for affected organizations" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:54:09.994072", "displayed_on_website": false }, { "cve_id": "CVE-2025-32463", "cvss_score": "9.3", "attack_vector": "LOCAL", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1068", "deployment_likelihood": "LOW", "cve_published_date": "2025-06-30T00:00:00.000Z", "cve_published_date_formatted": "2025-06-30", "kev_date_added": "2025-09-29", "kev_date_added_formatted": "2025-09-29", "kev_due_date": "2025-10-20", "days_to_kev": 91, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2025-32463 is a local privilege escalation vulnerability in Sudo that allows local users to gain root access via the --chroot option. While Sudo is ubiquitous on Linux systems, this is a LOCAL attack vector requiring existing user access to the system.", "detailed_analysis": { "vulnerability_type": "Local privilege escalation via inclusion of functionality from untrusted control sphere (CWE-829)", "affected_products": [ "Sudo (Linux/Unix privilege escalation tool)" ], "exploitation_requirements": [ "Local user access to affected system", "Ability to run sudo with --chroot option", "Control over a directory containing malicious /etc/nsswitch.conf" ], "internet_facing_likelihood": "Sudo is a command-line privilege escalation utility that runs locally on Linux/Unix systems. It is not a network service and does not listen on any ports. While Sudo is installed on virtually every Linux server (including internet-facing ones), exploitation requires LOCAL access first - an attacker must already be logged into the system to exploit this vulnerability.", "typical_deployment": "Client-side/local system utility installed on virtually all Linux/Unix systems for privilege management", "deployment_statistics": "0% - Sudo itself is never internet-facing as it's a local command-line utility, not a network service. While it's installed on ~100% of Linux systems including web servers, the vulnerability requires local shell access to exploit.", "active_exploitation": "Listed in CISA KEV indicating active exploitation in the wild, likely used by attackers who have already gained initial access to systems", "severity_factors": [ "Critical CVSS score of 9.3", "Leads to complete system compromise (root access)", "No authentication required once local access obtained", "Simple to exploit", "Active exploitation confirmed" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Update Sudo to version 1.9.17p1 or later immediately on all Linux/Unix systems", "Review sudo logs (/var/log/secure, /var/log/auth.log) for suspicious --chroot usage", "Audit user accounts and access controls to prevent initial compromise", "Monitor for privilege escalation activities and unauthorized root access", "PATCH PRIORITY: HIGH - While not directly internet-exploitable, this is a post-compromise escalation vector being actively exploited" ], "risk_assessment": { "exploit_likelihood": "High for systems where attackers have already gained initial access - this is a reliable privilege escalation vector", "impact_assessment": "Complete system compromise - local users can escalate to root privileges", "exposure_scope": "Not directly internet-facing, but affects virtually all Linux/Unix systems as a post-compromise escalation vector" }, "exploitation_method": "OTHER", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:13:35.478748", "displayed_on_website": false }, { "cve_id": "CVE-2025-32433", "cvss_score": "10.0", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2025-04-16T21:34:37.457Z", "cve_published_date_formatted": "2025-04-16", "kev_date_added": "2025-06-09", "kev_date_added_formatted": "2025-06-09", "kev_due_date": "2025-06-30", "days_to_kev": 54, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2025-32433 is a critical pre-authentication remote code execution vulnerability in Erlang/OTP SSH servers with a CVSS score of 10.0. The vulnerability allows unauthenticated attackers to execute arbitrary commands by exploiting flaws in SSH protocol message handling, with active exploitation confirmed in the wild.", "detailed_analysis": { "vulnerability_type": "Pre-authentication Remote Code Execution in SSH server implementation (CWE-306: Missing Authentication for Critical Function)", "affected_products": [ "erlang otp" ], "exploitation_requirements": [ "Network access to SSH port", "No authentication required", "No user interaction required" ], "internet_facing_likelihood": "SSH servers are commonly deployed as internet-facing services for remote administration, development environments, and automated systems. Erlang/OTP's SSH implementation is frequently used in distributed systems, IoT devices, and cloud infrastructure that require remote access. Estimated 60-70% of Erlang/OTP SSH deployments have internet exposure.", "typical_deployment": "Erlang/OTP SSH servers are deployed as server-side infrastructure for remote access, system administration, file transfers, and as components in distributed applications. The SSH server functionality is specifically designed to accept network connections.", "deployment_statistics": "Approximately 60-70% of Erlang/OTP SSH server deployments are likely internet-facing, as SSH is commonly used for remote administration of servers, cloud instances, development environments, and IoT devices that require external connectivity.", "active_exploitation": "CISA has added this CVE to the Known Exploited Vulnerabilities (KEV) catalog based on evidence of active exploitation. Multiple exploitation campaigns have been observed, and public exploit code is available.", "severity_factors": [ "Maximum CVSS score of 10.0", "Pre-authentication exploitation", "Network-based attack vector", "No user interaction required", "Complete system compromise possible", "Active exploitation in the wild", "Public exploit code available" ] }, "recommendations": [ "CRITICAL: Immediately patch to OTP-27.3.3, OTP-26.2.5.11, or OTP-25.3.2.20", "Emergency workaround: Disable SSH servers or block SSH access via firewall rules", "Monitor SSH connection logs for suspicious authentication attempts and unusual traffic patterns", "Conduct immediate incident response assessment for any internet-facing Erlang/OTP SSH servers" ], "risk_assessment": { "exploit_likelihood": "VERY HIGH - Active exploitation is confirmed with public exploit code available. The vulnerability requires no authentication and minimal technical skill to exploit against internet-facing SSH servers.", "impact_assessment": "CRITICAL - Complete system compromise with full confidentiality, integrity, and availability impact. Attackers gain arbitrary code execution with the privileges of the SSH server process.", "exposure_scope": "SIGNIFICANT - All internet-facing Erlang/OTP SSH servers running vulnerable versions are at immediate risk. This includes cloud infrastructure, development servers, IoT devices, and distributed systems using Erlang/OTP for remote access." }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "CVE-2025-32433 is a critical remote code execution (RCE) vulnerability affecting Erlang/OTP SSH servers 【1】【2】. Here's what is known about its exploitation:\n\n* **Impact on Internet-Facing Applications/Services:** The vulnerability specifically targets SSH servers, which are often exposed to the internet 【1】. If you run an Erlang/OTP SSH server exposed to the internet, it is recommended to patch immediately or shut it off 【1】.\n\n* **Evidence of Active Exploitation:** Exploitation of CVE-2025-32433 in Erlang/OTP is active 【3】. There have been multiple campaigns observed exploiting this vulnerability, indicating a need for urgent patching 【3】.\n\n* **Attack Vectors and Exploitation Methods:** The vulnerability exists due to a flaw in SSH protocol message handling 【4】【2】. This flaw allows an unauthenticated attacker to execute arbitrary code remotely 【5】【2】. An attacker can perform unauthenticated remote code execution by exploiting this flaw in SSH protocol message handling 【4】.\n\n* **Targeted Attacks:** While it's not explicitly stated that CVE-2025-32433 has been used in \"targeted attacks,\" the active exploitation and the severity of unauthenticated RCE suggest it could be used in such attacks 【3】【5】.\n\n* **CISA Known Exploited Vulnerabilities Status:** CISA has added CVE-2025-32433 to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation 【6】.\n\n* **Technical Details about Internet Exploitability:** CVE-2025-32433 allows unauthenticated remote threat actors to achieve remote code execution (RCE) in the SSH daemon 【5】. The vulnerability can be exploited due to a flaw in SSH protocol message handling, allowing an unauthenticated attacker to execute arbitrary code 【4】【2】.\n\nSources:\n- CVE-2025-32433 - Serious Remote Code Execution in Erlang/OTP ... - cve.news: https://www.cve.news/cve-2025-32433/\n- CVE-2025-32433: Erlang/OTP SSH Unauthenticated Remote Code ... - Tenable: https://www.tenable.com/blog/cve-2025-32433-erlangotp-ssh-unauthenticated-remote-code-execution-vulnerability\n- Observed Exploitation of CVE-2025-32433 in the Wild: https://www.txone.com/blog/cve-2025-32433-exploitation-in-the-wild/\n- CVE-2025-32433 Detail - NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-32433\n- CVE-2025-32433: Maximum Severity Unauthenticated... - Arctic Wolf: https://arcticwolf.com/resources/blog/cve-2025-32433/", "references": [ { "title": "CVE-2025-32433 - Serious Remote Code Execution in Erlang/OTP ... - cve.news", "url": "https://www.cve.news/cve-2025-32433/", "snippet": "Conclusion CVE-2025-32433 is a critical flaw. If you run an Erlang/OTP SSH server exposed to the internet, patch immediately or shut it off. Stay safe—keep up-to-date, subscribe to official Erlang Mailing List for alerts, and always firewall sensitive endpoints. *For more details: Erlang/OTP Security Advisories Full CVE Description @ NVD ...", "is_search_result": true }, { "title": "CVE-2025-32433: Erlang/OTP SSH Unauthenticated Remote Code ... - Tenable", "url": "https://www.tenable.com/blog/cve-2025-32433-erlangotp-ssh-unauthenticated-remote-code-execution-vulnerability", "snippet": "CVE-2025-32433 is a remote code execution (RCE) vulnerability affecting the Erlang/OTP SSH server. The vulnerability exists due to a flaw in the SSH protocol message handling which could allow an unauthenticated attacker to execute arbitrary code.", "is_search_result": true }, { "title": "Observed Exploitation of CVE-2025-32433 in the Wild", "url": "https://www.txone.com/blog/cve-2025-32433-exploitation-in-the-wild/", "snippet": "Exploitation of CVE-2025-32433 in Erlang/OTP is active. Multiple campaigns and varied payloads highlight need for urgent patching.", "is_search_result": true }, { "title": "CVE-2025-32433 Detail - NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32433", "snippet": "Vulnerabilities. CVE-2025-32433 Detail. Description. Erlang/OTP is a set of libraries for the Erlang programming language.", "is_search_result": true }, { "title": "CVE-2025-32433: Maximum Severity Unauthenticated... - Arctic Wolf", "url": "https://arcticwolf.com/resources/blog/cve-2025-32433/", "snippet": "CVE-2025-32433 allows unauthenticated remote threat actors to achieve remote code execution (RCE) in the SSH daemon.", "is_search_result": true } ], "timestamp": "2025-09-06T17:41:57.303302" }, "cache_timestamp": "2025-09-06T17:42:13.119144", "displayed_on_website": false }, { "cve_id": "CVE-2025-32432", "cvss_score": "10.0", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2025-04-25T15:04:06.272Z", "cve_published_date_formatted": "2025-04-25", "kev_date_added": "2026-03-20", "kev_date_added_formatted": "2026-03-20", "kev_due_date": "2026-04-03", "days_to_kev": 329, "days_since_kev": null, "is_new_kev": false, "summary": "Craft CMS contains a critical remote code execution vulnerability that requires no authentication or user interaction. With a CVSS score of 10.0 and inclusion in CISA's KEV catalog, this vulnerability is actively exploited in the wild against internet-facing CMS installations.", "detailed_analysis": { "vulnerability_type": "Code Injection (CWE-94) leading to Remote Code Execution", "affected_products": [ "Craft CMS 3.x", "Craft CMS 4.x", "Craft CMS 5.x" ], "exploitation_requirements": [ "Network access to CMS", "No authentication required", "No user interaction required" ], "internet_facing_likelihood": "Craft CMS is a content management system designed specifically for creating public-facing websites. By its very nature as a CMS, it requires internet exposure to serve web content to visitors. Approximately 95%+ of Craft CMS deployments are internet-accessible as this is the software's primary purpose.", "typical_deployment": "Craft CMS is server software that runs on web servers to deliver websites and web applications to internet users. It is designed to be publicly accessible to serve content.", "deployment_statistics": "95%+ of deployments are internet-facing since CMS platforms are specifically designed to serve public websites. Only development/staging instances would typically be internal-only.", "active_exploitation": "Listed in CISA KEV catalog indicating confirmed active exploitation in the wild. CISA SSVC assessment shows 'Exploitation: active' and 'Automatable: yes'.", "severity_factors": [ "Maximum CVSS score of 10.0", "No authentication required", "No user interaction needed", "Remote code execution capability", "Active exploitation confirmed", "Wide scope impact" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately update to Craft CMS version 3.9.15, 4.14.15, or 5.6.17 or later", "Implement web application firewall rules to block exploitation attempts while patching", "Monitor web server logs for suspicious POST requests and unexpected file uploads", "Review system logs for signs of unauthorized code execution or file system modifications", "HIGHEST patch priority - exploit is trivial and actively used in attacks" ], "risk_assessment": { "exploit_likelihood": "CRITICAL - Active exploitation confirmed with automated tools available, no authentication barriers", "impact_assessment": "COMPLETE SYSTEM COMPROMISE - Full server takeover, data theft, ransomware deployment, website defacement", "exposure_scope": "All internet-facing Craft CMS installations worldwide - estimated thousands of vulnerable sites" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:36:04.238200", "displayed_on_website": false }, { "cve_id": "CVE-2025-31324", "cvss_score": "10.0", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "MEDIUM", "cve_published_date": "2025-04-24T16:50:27.706Z", "cve_published_date_formatted": "2025-04-24", "kev_date_added": "2025-04-29", "kev_date_added_formatted": "2025-04-29", "kev_due_date": "2025-05-20", "days_to_kev": 5, "days_since_kev": null, "is_new_kev": false, "summary": "Critical file upload vulnerability in SAP NetWeaver Visual Composer development server allows unauthenticated attackers to upload malicious executables for remote code execution. The vulnerability is actively exploited in the wild and listed in CISA KEV catalog.", "detailed_analysis": { "vulnerability_type": "Unrestricted file upload with missing authorization (CWE-434) allowing malicious executable upload", "affected_products": [ "SAP NetWeaver Visual Composer development server VCFRAMEWORK 7.50" ], "exploitation_requirements": [ "Network access to the Visual Composer development server", "No authentication required", "No user interaction required" ], "internet_facing_likelihood": "Visual Composer development servers are commonly deployed as web-based development environments that require network accessibility for development teams. While not as universally internet-facing as production web servers, many organizations expose these development platforms to the internet for remote development access, especially in hybrid work environments. Estimated 30-50% of deployments may be internet-accessible.", "typical_deployment": "Server software - web-based development platform for creating and managing SAP applications and interfaces", "deployment_statistics": "Approximately 30-50% of deployments likely internet-facing, as development teams often need remote access to these platforms, though security best practices recommend VPN-protected access", "active_exploitation": "CISA has added this to the Known Exploited Vulnerabilities catalog, indicating confirmed active exploitation in the wild", "severity_factors": [ "CVSS 10.0 Critical severity", "No authentication required", "Direct remote code execution", "Active exploitation confirmed", "Development servers may have elevated system access" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Apply SAP security note 3594142 immediately to patch the vulnerability", "Implement network segmentation to isolate development servers from internet access", "Monitor file upload activities and scan for malicious executables", "Audit all Visual Composer servers for unauthorized file uploads and modifications" ], "risk_assessment": { "exploit_likelihood": "Very high - actively exploited with trivial exploitation requirements (no authentication, network-based)", "impact_assessment": "Critical - complete system compromise with potential for confidentiality, integrity, and availability impact", "exposure_scope": "Medium to high - SAP NetWeaver is widely deployed in enterprise environments, with development servers commonly accessible for remote teams" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Known", "ransomware_first_seen_date": "2026-06-04", "ransomware_days_after_kev": 401, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:52:20.959809", "displayed_on_website": false }, { "cve_id": "CVE-2025-31277", "cvss_score": "8.8", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1203", "deployment_likelihood": "VERY_LOW", "cve_published_date": "2025-07-29T23:29:31.341Z", "cve_published_date_formatted": "2025-07-29", "kev_date_added": "2026-03-20", "kev_date_added_formatted": "2026-03-20", "kev_due_date": "2026-04-03", "days_to_kev": 234, "days_since_kev": null, "is_new_kev": false, "summary": "Memory corruption vulnerability in Apple WebKit affecting Safari and other Apple client devices when processing malicious web content. This is a client-side vulnerability requiring user interaction to visit a malicious website, not exploitation of internet-facing servers.", "detailed_analysis": { "vulnerability_type": "Memory corruption vulnerability in WebKit web browser engine (CWE-119)", "affected_products": [ "Safari", "iOS", "iPadOS", "macOS", "tvOS", "visionOS", "watchOS" ], "exploitation_requirements": [ "User must visit malicious website", "Malicious web content must be processed by WebKit engine", "No authentication required" ], "internet_facing_likelihood": "The affected products are primarily client-side operating systems and browsers, not server software. While these devices connect to the internet, they are not typically deployed as internet-facing servers that accept incoming connections. Safari is a web browser, iOS/iPadOS are mobile operating systems, macOS is a desktop OS, tvOS/visionOS/watchOS are consumer device operating systems. None of these are server applications.", "typical_deployment": "Client-side software - browsers and consumer operating systems on end-user devices including desktops, mobile phones, tablets, Apple TV, Apple Watch, and Vision Pro headsets", "deployment_statistics": "Less than 1% of deployments would be internet-facing servers. The vast majority are consumer devices and workstations behind firewalls/NAT. Some macOS systems might run web services but this is not the primary use case.", "active_exploitation": "Listed in CISA KEV indicating active exploitation in the wild. Referenced in Google threat intelligence blog about DarkSword iOS exploit chain.", "severity_factors": [ "High CVSS score of 8.8", "Active exploitation confirmed", "Memory corruption can lead to code execution", "Affects widely deployed Apple products", "User interaction required reduces direct internet exploitation risk" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Update all Apple devices to latest versions: Safari 18.6+, iOS/iPadOS 18.6+, macOS 15.6+, tvOS 18.6+, visionOS 2.6+, watchOS 11.6+", "Monitor for suspicious web browsing activity and potential compromise of Apple devices", "Implement network monitoring for unusual outbound connections from Apple devices", "HIGH patch priority due to active exploitation" ], "risk_assessment": { "exploit_likelihood": "HIGH for targeted attacks against end users, LOW for direct internet server exploitation since these are client-side products", "impact_assessment": "Full compromise of affected Apple devices including data theft, malware installation, and persistent access", "exposure_scope": "Millions of consumer Apple devices, but not internet-facing servers that would be directly exploitable via T1190" }, "exploitation_method": "USER_INTERACTION", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:37:36.387372", "displayed_on_website": false }, { "cve_id": "CVE-2025-31201", "cvss_score": "7.5", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1203", "deployment_likelihood": "VERY_LOW", "cve_published_date": "2025-04-16T18:24:31.230Z", "cve_published_date_formatted": "2025-04-16", "kev_date_added": "2025-04-17", "kev_date_added_formatted": "2025-04-17", "kev_due_date": "2025-05-08", "days_to_kev": 1, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2025-31201 is a Pointer Authentication bypass vulnerability affecting Apple consumer devices (iOS, iPadOS, macOS, tvOS, visionOS). Despite being exploited in the wild and requiring network access, this affects client-side operating systems that are rarely exposed as internet-facing servers.", "detailed_analysis": { "vulnerability_type": "Pointer Authentication bypass allowing attackers with arbitrary read/write capability to bypass memory protection mechanisms", "affected_products": [ "iOS", "iPadOS", "macOS", "Apple TV (tvOS)", "Apple Vision Pro (visionOS)" ], "exploitation_requirements": [ "Arbitrary read and write capability on target device", "Network access to target", "Low privileges required (PR:L)", "No user interaction required (UI:N)" ], "internet_facing_likelihood": "These are consumer operating systems (mobile phones, tablets, laptops, Apple TV, VR headsets) that are NOT typically deployed as internet-facing servers. While they connect to the internet, they function as client devices, not server infrastructure. Estimated <1% of deployments would be configured as internet-accessible servers.", "typical_deployment": "Client-side consumer devices - smartphones, tablets, personal computers, streaming devices, and VR headsets used by end users, not deployed as internet-facing server infrastructure", "deployment_statistics": "Less than 1% of deployments are internet-facing. These Apple devices are primarily consumer endpoints that connect outbound to internet services rather than hosting internet-accessible services.", "active_exploitation": "Apple confirmed active exploitation in 'extremely sophisticated attacks against specific targeted individuals on iOS' - indicates targeted attacks rather than mass internet scanning/exploitation", "severity_factors": [ "Active exploitation confirmed by Apple", "Listed in CISA KEV catalog", "Bypasses memory protection (Pointer Authentication)", "Affects millions of consumer devices", "Requires existing arbitrary read/write access", "Primarily affects client devices, not servers" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review device logs, check for unauthorized access, verify system integrity on all Apple devices", "Immediately update all Apple devices to patched versions: iOS/iPadOS 18.4.1+, macOS 15.4.1+, tvOS 18.4.1+, visionOS 2.4.1+", "Monitor for unusual network activity or device behavior that could indicate compromise", "Prioritize patching for high-value targets or devices with sensitive data access", "Review device management policies to ensure timely security updates" ], "risk_assessment": { "exploit_likelihood": "Low for internet-facing exploitation due to client-device nature of affected products. High for targeted attacks against specific individuals with physical or network proximity", "impact_assessment": "High impact on compromised devices - memory protection bypass can lead to code execution and full device compromise", "exposure_scope": "Minimal internet-facing exposure since these are consumer client devices, not server infrastructure. Risk is primarily to targeted individuals rather than mass internet exploitation" }, "exploitation_method": "OTHER", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:50:37.279882", "displayed_on_website": false }, { "cve_id": "CVE-2025-31200", "cvss_score": "7.1", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1203", "deployment_likelihood": "VERY_LOW", "cve_published_date": "2025-04-16T18:24:31.578Z", "cve_published_date_formatted": "2025-04-16", "kev_date_added": "2025-04-17", "kev_date_added_formatted": "2025-04-17", "kev_due_date": "2025-05-08", "days_to_kev": 1, "days_since_kev": null, "is_new_kev": false, "summary": "Memory corruption vulnerability in Apple's media processing affecting iOS, macOS, visionOS, and tvOS. Exploitation requires users to process maliciously crafted media files. Apple reports active exploitation in targeted attacks.", "detailed_analysis": { "vulnerability_type": "Memory corruption in audio stream processing within media files", "affected_products": [ "iOS/iPadOS", "macOS", "Apple TV", "Apple Vision Pro" ], "exploitation_requirements": [ "User must process maliciously crafted media file", "Network delivery of malicious file", "No authentication barriers" ], "internet_facing_likelihood": "These are primarily client-side consumer operating systems and devices. While they connect to the internet, they do not typically run internet-facing server services that would be directly exploitable via T1190. Less than 1% of deployments would involve these systems running public-facing services.", "typical_deployment": "Consumer client devices - smartphones, tablets, laptops, set-top boxes, and VR headsets. Not typically deployed as internet-facing servers.", "deployment_statistics": "Estimated <1% of deployments are internet-facing servers. These are predominantly client devices used by end users, not server infrastructure.", "active_exploitation": "Apple confirms active exploitation in 'extremely sophisticated attack against specific targeted individuals on iOS' - indicating targeted spear-phishing or watering hole attacks.", "severity_factors": [ "Active exploitation confirmed", "Code execution achievable", "Requires user interaction with malicious media", "Targeted attack vector", "High complexity attack" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately update to iOS 18.4.1, iPadOS 18.4.1, macOS 15.4.1, tvOS 18.4.1, or visionOS 2.4.1", "Monitor for suspicious media file processing, unexpected network connections from Apple devices", "High priority patching due to confirmed active exploitation, despite requiring user interaction" ], "risk_assessment": { "exploit_likelihood": "Low for direct internet exploitation - requires social engineering to deliver malicious media files to users", "impact_assessment": "High impact on affected client devices - full code execution possible leading to device compromise", "exposure_scope": "Minimal internet-facing server exposure - primarily affects billions of consumer client devices" }, "exploitation_method": "USER_INTERACTION", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:50:57.010011", "displayed_on_website": false }, { "cve_id": "CVE-2025-31161", "cvss_score": "9.8", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2025-04-03T00:00:00.000Z", "cve_published_date_formatted": "2025-04-03", "kev_date_added": "2025-04-07", "kev_date_added_formatted": "2025-04-07", "kev_due_date": "2025-04-28", "days_to_kev": 4, "days_since_kev": null, "is_new_kev": false, "summary": "Critical authentication bypass vulnerability in CrushFTP server allows attackers to takeover admin accounts via malformed AWS4-HMAC headers. The vulnerability has been actively exploited in the wild and is listed in CISA KEV.", "detailed_analysis": { "vulnerability_type": "Authentication bypass via race condition and malformed AWS4-HMAC headers in FTP/HTTP server", "affected_products": [ "CrushFTP versions 10.x before 10.8.4", "CrushFTP versions 11.x before 11.3.1" ], "exploitation_requirements": [ "Network access to CrushFTP HTTP/HTTPS ports", "No authentication required", "Knowledge of valid usernames (e.g., 'crushadmin')" ], "internet_facing_likelihood": "CrushFTP is an enterprise FTP/SFTP/HTTP file transfer server specifically designed for secure file sharing with external partners, customers, and remote users. These servers are routinely deployed as internet-facing services to facilitate business file transfers. Estimated 80-90% of deployments are internet-accessible as this is the primary use case.", "typical_deployment": "Server software deployed as internet-facing file transfer service for business file sharing, partner collaboration, and secure file exchange", "deployment_statistics": "Approximately 80-90% of CrushFTP deployments are internet-facing as the primary business case is secure file transfer with external parties requiring internet access", "active_exploitation": "Confirmed active exploitation in March and April 2025. Listed in CISA Known Exploited Vulnerabilities catalog with SSVC rating showing 'active' exploitation", "severity_factors": [ "No authentication required", "Can takeover administrative accounts", "Race condition can be stabilized for reliable exploitation", "Full system compromise possible", "Actively exploited in the wild", "Critical CVSS score of 9.8" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately update to CrushFTP 10.8.4+ or 11.3.1+ or temporarily disable internet access", "Review authentication logs for suspicious login attempts or successful authentications without proper credentials", "Monitor for unusual administrative account activity or privilege escalations", "Consider implementing DMZ proxy instance as mentioned in the advisory as a potential mitigation", "PATCH PRIORITY: EMERGENCY - Apply within 24-48 hours due to active exploitation" ], "risk_assessment": { "exploit_likelihood": "Very High - Vulnerability is trivial to exploit with no authentication required and has been actively exploited in the wild", "impact_assessment": "Critical - Full administrative takeover leading to complete system compromise, data theft, and potential lateral movement", "exposure_scope": "Thousands of internet-facing CrushFTP servers globally used for business file transfer operations" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Known", "ransomware_first_seen_date": "2026-06-04", "ransomware_days_after_kev": 423, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:48:08.227757", "displayed_on_website": false }, { "cve_id": "CVE-2025-31125", "cvss_score": "5.3", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "MEDIUM_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "MEDIUM", "cve_published_date": "2025-03-31T17:06:30.704Z", "cve_published_date_formatted": "2025-03-31", "kev_date_added": "2026-01-22", "kev_date_added_formatted": "2026-01-22", "kev_due_date": "2026-02-12", "days_to_kev": 297, "days_since_kev": null, "is_new_kev": false, "summary": "Vite development server vulnerability allows bypass of filesystem restrictions to expose sensitive files via crafted URLs with ?inline&import or ?raw&import parameters. Only affects Vite dev servers explicitly exposed to the network using --host configuration.", "detailed_analysis": { "vulnerability_type": "Filesystem access control bypass leading to sensitive information disclosure", "affected_products": [ "Vite Development Server" ], "exploitation_requirements": [ "Network access to Vite dev server", "Server must be configured with --host or server.host option", "Knowledge of file paths to target" ], "internet_facing_likelihood": "Vite is primarily a frontend development tool. Its dev server is typically used only during development and bound to localhost by default. However, some developers expose it to networks for testing across devices or remote development. Estimated 15-25% of active Vite dev servers may be network-accessible, with a smaller subset exposed to the internet.", "typical_deployment": "Development server software - primarily used locally during frontend application development, but can be configured for network access", "deployment_statistics": "Approximately 20% of Vite dev servers are configured for network access, with roughly 5-10% potentially exposed to the internet for remote development or testing scenarios", "active_exploitation": "Listed in CISA KEV catalog indicating active exploitation in the wild", "severity_factors": [ "CISA KEV listing confirms active exploitation", "Limited to development servers with network exposure", "Requires specific configuration to be vulnerable", "Can expose sensitive source code and configuration files", "No authentication required once accessible" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately update Vite to patched versions: 6.2.4+, 6.1.3+, 6.0.13+, 5.4.16+, or 4.5.11+", "Audit all Vite development servers for network exposure and restrict access to localhost only", "Implement network-level controls to prevent external access to development servers", "Monitor for requests containing ?inline&import or ?raw&import parameters in web server logs" ], "risk_assessment": { "exploit_likelihood": "Medium - requires specific network configuration but exploitation is straightforward and actively occurring", "impact_assessment": "High confidentiality impact - can expose source code, configuration files, environment variables, and other sensitive development assets", "exposure_scope": "Limited to development environments with network-exposed Vite servers, but potentially affects thousands of development instances globally" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:26:40.148536", "displayed_on_website": false }, { "cve_id": "CVE-2025-30406", "cvss_score": "9.0", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2025-04-03T00:00:00.000Z", "cve_published_date_formatted": "2025-04-03", "kev_date_added": "2025-04-08", "kev_date_added_formatted": "2025-04-08", "kev_due_date": "2025-04-29", "days_to_kev": 5, "days_since_kev": null, "is_new_kev": false, "summary": "Critical deserialization vulnerability in Gladinet CentreStack due to hardcoded machineKey, enabling remote code execution on the server. This vulnerability is actively exploited in the wild and listed in CISA KEV.", "detailed_analysis": { "vulnerability_type": "Deserialization vulnerability with hardcoded cryptographic key (CWE-321)", "affected_products": [ "Gladinet CentreStack" ], "exploitation_requirements": [ "Knowledge of hardcoded machineKey", "Network access to CentreStack portal", "No authentication required" ], "internet_facing_likelihood": "CentreStack is a cloud file server platform designed for remote access and collaboration, requiring internet exposure for its primary function. Estimated 80-90% of deployments are internet-facing as the product is marketed for remote file access and sync capabilities.", "typical_deployment": "CentreStack is server software that provides cloud file server functionality with web portals for remote access, typically deployed as internet-facing services for business file sharing and collaboration", "deployment_statistics": "Approximately 80-90% of CentreStack deployments are internet-facing, as the software's core value proposition is providing secure remote access to files and enabling collaboration from anywhere", "active_exploitation": "Confirmed active exploitation in the wild as of March 2025, with CISA KEV listing indicating ongoing threat actor activity", "severity_factors": [ "Critical CVSS score of 9.0", "Remote code execution capability", "No authentication required", "Active exploitation confirmed", "Hardcoded key makes exploitation reliable", "High deployment likelihood as internet-facing service" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately update to CentreStack version 16.4.10315.56368 or later", "As emergency mitigation, manually delete the hardcoded machineKey from portal\\web.config as noted in the advisory", "Monitor CentreStack portal access logs for suspicious deserialization attempts or unauthorized access patterns", "Implement network segmentation to limit CentreStack exposure if possible", "PATCH PRIORITY: CRITICAL - Apply immediately due to active exploitation and RCE impact" ], "risk_assessment": { "exploit_likelihood": "Very High - Active exploitation confirmed, hardcoded key makes exploitation reliable and repeatable once key is known", "impact_assessment": "Critical - Full remote code execution on the server, potential for complete system compromise, data theft, and lateral movement", "exposure_scope": "High - CentreStack is commonly deployed as internet-facing service, with potentially thousands of exposed instances globally" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:48:51.207940", "displayed_on_website": false }, { "cve_id": "CVE-2025-30400", "cvss_score": "7.8", "attack_vector": "LOCAL", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1068", "deployment_likelihood": "VERY_LOW", "cve_published_date": "2025-05-13T16:58:49.601Z", "cve_published_date_formatted": "2025-05-13", "kev_date_added": "2025-05-13", "kev_date_added_formatted": "2025-05-13", "kev_due_date": "2025-06-03", "days_to_kev": 0, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2025-30400 is a use-after-free vulnerability in Windows Desktop Window Manager (DWM) Core Library that allows local privilege escalation. Despite being on CISA KEV, this is a local-only vulnerability requiring existing system access and cannot be exploited directly over the internet.", "detailed_analysis": { "vulnerability_type": "Use-after-free memory corruption vulnerability (CWE-416) in Windows Desktop Window Manager Core Library leading to local privilege escalation", "affected_products": [ "Windows 10 (multiple versions)", "Windows 11 (multiple versions)", "Windows Server 2019", "Windows Server 2022", "Windows Server 2025" ], "exploitation_requirements": [ "Local system access required", "Low-privileged user account needed", "No user interaction required once local access obtained" ], "internet_facing_likelihood": "Windows DWM (Desktop Window Manager) is a client-side graphics subsystem that manages desktop composition and window rendering. It is not a network service and does not listen on network ports. Even on Windows Server systems, DWM operates as a local system service for graphical interface management, not as an internet-facing application. 0% of DWM deployments are directly internet-accessible.", "typical_deployment": "DWM is a core Windows operating system component that runs on both client systems (Windows 10/11 desktops) and server systems with GUI enabled. It manages window composition and desktop graphics rendering locally.", "deployment_statistics": "0% of DWM instances are internet-facing as it is purely a local graphics subsystem with no network listening capabilities or remote access functionality", "active_exploitation": "Listed in CISA KEV catalog indicating active exploitation in the wild, likely used by threat actors for post-compromise privilege escalation", "severity_factors": [ "High CVSS score of 7.8", "Active exploitation confirmed (CISA KEV)", "No user interaction required for exploitation", "Local attack vector limits initial access", "Requires existing system compromise" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Apply Microsoft security updates immediately to patch the DWM vulnerability", "Monitor for unusual privilege escalation activities and unauthorized administrative access", "Review system access controls and audit privileged account usage", "Implement endpoint detection and response (EDR) to detect post-exploitation activities", "Patch priority: HIGH for all affected Windows systems due to active exploitation" ], "risk_assessment": { "exploit_likelihood": "Cannot be directly exploited over the internet - requires prior local system access. However, once local access is obtained, exploitation likelihood is high due to active in-the-wild exploitation and no user interaction requirement.", "impact_assessment": "High impact for compromised systems - successful exploitation grants full administrative privileges, allowing complete system control, data access, and lateral movement capabilities", "exposure_scope": "No direct internet exposure as DWM is not a network service. Risk is limited to systems where attackers have already gained local access through other means (phishing, malware, etc.)" }, "exploitation_method": "OTHER", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:57:31.251503", "displayed_on_website": false }, { "cve_id": "CVE-2025-30397", "cvss_score": "7.5", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1203", "deployment_likelihood": "LOW", "cve_published_date": "2025-05-13T16:59:10.994Z", "cve_published_date_formatted": "2025-05-13", "kev_date_added": "2025-05-13", "kev_date_added_formatted": "2025-05-13", "kev_due_date": "2025-06-03", "days_to_kev": 0, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2025-30397 is a type confusion vulnerability in Microsoft's scripting engine affecting Windows client and server operating systems. Despite being in CISA KEV, this requires user interaction (UI:R in CVSS) and primarily targets client-side script execution rather than internet-facing server services.", "detailed_analysis": { "vulnerability_type": "Type confusion vulnerability (CWE-843) in Microsoft Scripting Engine allowing remote code execution", "affected_products": [ "Windows 10 (all versions)", "Windows 11 (all versions)", "Windows Server 2008", "Windows Server 2012", "Windows Server 2016", "Windows Server 2019", "Windows Server 2022", "Windows Server 2025" ], "exploitation_requirements": [ "User interaction required (CVSS UI:R)", "High attack complexity (CVSS AC:H)", "Network access to deliver malicious script", "Victim must process/execute malicious script content" ], "internet_facing_likelihood": "While Windows Server editions are affected, this vulnerability targets the scripting engine component which is primarily used for client-side script execution rather than server-side internet-facing services. The scripting engine is typically invoked through user applications like browsers, Office documents, or email clients rather than exposed network services.", "typical_deployment": "The Microsoft scripting engine is embedded in Windows operating systems for client-side script processing. While it exists on servers, it's not typically exposed as an internet-facing service but rather used for administrative scripts, applications, and user interactions.", "deployment_statistics": "Less than 5% of deployments would have the scripting engine directly exposed to internet attack vectors. Most exploitation would occur through client-side vectors like malicious websites, email attachments, or documents rather than direct server exploitation.", "active_exploitation": "Listed in CISA KEV indicating confirmed exploitation in the wild, likely through client-side attack vectors such as malicious web content or documents", "severity_factors": [ "High CVSS score of 7.5", "Remote code execution capability", "No privileges required for initial exploitation", "Affects broad range of Windows versions", "Requires user interaction which reduces automated exploitation", "High attack complexity reduces ease of exploitation" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Apply Microsoft security updates immediately across all Windows systems", "Implement enhanced email security and web filtering to block malicious script delivery", "Monitor for suspicious script execution and process creation events", "Consider disabling Windows Script Host (WSH) where not required for business operations", "Educate users about risks of opening untrusted documents or visiting suspicious websites" ], "risk_assessment": { "exploit_likelihood": "Moderate - Active exploitation confirmed but requires user interaction and has high attack complexity, limiting automated mass exploitation", "impact_assessment": "High impact with remote code execution allowing full system compromise once exploited", "exposure_scope": "Limited for direct internet exploitation as this primarily affects client-side script processing rather than internet-facing server services" }, "exploitation_method": "USER_INTERACTION", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:56:23.749655", "displayed_on_website": false }, { "cve_id": "CVE-2025-30154", "cvss_score": "8.6", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1195", "deployment_likelihood": "VERY_LOW", "cve_published_date": "2025-03-19T15:15:29.113Z", "cve_published_date_formatted": "2025-03-19", "kev_date_added": "2025-03-24", "kev_date_added_formatted": "2025-03-24", "kev_due_date": "2025-04-14", "days_to_kev": 5, "days_since_kev": null, "is_new_kev": false, "summary": "Multiple Reviewdog GitHub Actions were compromised with malicious code that dumped exposed secrets to workflow logs during a specific timeframe (March 11, 2025). This is a supply chain attack against CI/CD pipeline tools, not a direct internet-facing application vulnerability.", "detailed_analysis": { "vulnerability_type": "Supply chain compromise - embedded malicious code in GitHub Actions", "affected_products": [ "Reviewdog GitHub Actions", "GitHub Actions CI/CD pipelines" ], "exploitation_requirements": [ "Use of compromised GitHub Actions during specific timeframe", "GitHub Actions workflow execution", "Secrets exposed in repository" ], "internet_facing_likelihood": "This is not an internet-facing application vulnerability. Reviewdog is a GitHub Action used in CI/CD pipelines, not a server application that accepts direct network connections. The compromise affected users who executed these actions in their workflows, making it a supply chain attack rather than direct exploitation of internet-facing services.", "typical_deployment": "Reviewdog is a GitHub Action used in CI/CD pipelines for code review and linting. It runs within GitHub's hosted runners or self-hosted runners as part of automated workflows, not as a standalone internet-facing service.", "deployment_statistics": "0% - Reviewdog Actions are not deployed as internet-facing services. They are automation tools that run in CI/CD environments during code builds and reviews.", "active_exploitation": "Active exploitation confirmed - listed in CISA KEV. The malicious code was embedded in the actions for a specific time period and would execute when workflows using these actions ran.", "severity_factors": [ "High CVSS score due to potential secret exposure", "Supply chain nature affects multiple downstream users", "Automated execution in CI/CD pipelines", "Confidentiality impact on exposed secrets" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review GitHub Actions workflow logs from March 11, 2025 (18:42-20:31 UTC) for any secret dumps or unauthorized access", "Immediately audit all secrets and tokens that may have been exposed in affected workflow runs", "Rotate all potentially compromised secrets, API keys, and access tokens", "Review and update GitHub Actions to use pinned versions or verified sources", "Implement GitHub Actions security scanning and supply chain monitoring", "Consider using GitHub's OIDC tokens instead of long-lived secrets where possible" ], "risk_assessment": { "exploit_likelihood": "Very Low for direct internet exploitation - this is a supply chain compromise affecting CI/CD tools, not internet-facing applications", "impact_assessment": "High impact for affected CI/CD pipelines due to potential secret exposure and supply chain compromise", "exposure_scope": "Limited to organizations using the specific compromised GitHub Actions during the compromise window, not internet-facing systems" }, "exploitation_method": "OTHER", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:45:32.609584", "displayed_on_website": false }, { "cve_id": "CVE-2025-30066", "cvss_score": "8.6", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1195", "deployment_likelihood": "VERY_LOW", "cve_published_date": "2025-03-15T00:00:00.000Z", "cve_published_date_formatted": "2025-03-15", "kev_date_added": "2025-03-18", "kev_date_added_formatted": "2025-03-18", "kev_due_date": "2025-04-08", "days_to_kev": 3, "days_since_kev": null, "is_new_kev": false, "summary": "A supply chain attack compromised the tj-actions changed-files GitHub Action where threat actors modified tags v1-v45.0.7 to point to malicious code that exfiltrates secrets from GitHub Actions workflows. This is not a direct server exploitation but rather a software supply chain compromise affecting CI/CD pipelines.", "detailed_analysis": { "vulnerability_type": "Supply chain compromise - malicious code injection in GitHub Action", "affected_products": [ "tj-actions changed-files (GitHub Action)", "GitHub Actions workflows using affected versions" ], "exploitation_requirements": [ "Target organization must use affected versions of tj-actions/changed-files", "Malicious code executes during CI/CD pipeline runs", "No authentication bypass required - exploits trusted software dependency" ], "internet_facing_likelihood": "GitHub Actions are CI/CD automation tools that run in isolated containers/runners, not internet-facing server applications. While they connect to the internet to download dependencies and may deploy to servers, the Actions themselves are not public-facing services that accept external connections.", "typical_deployment": "GitHub Actions run as automated CI/CD pipeline components in GitHub's infrastructure or self-hosted runners, triggered by repository events like commits or pull requests", "deployment_statistics": "0% - GitHub Actions are not deployed as internet-facing servers. They are automation tools that execute in CI/CD contexts, not services that listen for external connections", "active_exploitation": "CISA KEV listing indicates active exploitation. Multiple security vendors reported the compromise with evidence of secret exfiltration from affected workflows", "severity_factors": [ "High CVSS score of 8.6", "CISA KEV listed indicating active exploitation", "Embedded malicious code (CWE-506)", "Potential for large-scale secret theft across many organizations", "Supply chain attack affecting popular GitHub Action" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review GitHub Actions logs for unauthorized secret access, audit all workflows using tj-actions/changed-files versions 1-45.0.7", "Immediately update to tj-actions/changed-files version 46 or later, or pin to specific commit hashes before the compromise", "Rotate all secrets that may have been exposed in workflows using affected versions during March 14-15, 2025", "Review GitHub Actions logs for unusual activity or unauthorized data exfiltration", "Implement GitHub Actions security hardening including dependency pinning to specific commit hashes" ], "risk_assessment": { "exploit_likelihood": "High for organizations using affected GitHub Action versions, but this is supply chain compromise rather than direct server exploitation", "impact_assessment": "High - potential theft of secrets, API keys, credentials, and sensitive data from CI/CD pipelines leading to further compromise", "exposure_scope": "Limited to organizations using specific versions of tj-actions/changed-files GitHub Action in their CI/CD pipelines, not internet-facing servers" }, "exploitation_method": "OTHER", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:43:45.727766", "displayed_on_website": false }, { "cve_id": "CVE-2025-29824", "cvss_score": "7.8", "attack_vector": "LOCAL", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1068", "deployment_likelihood": "LOW", "cve_published_date": "2025-04-08T17:23:34.083Z", "cve_published_date_formatted": "2025-04-08", "kev_date_added": "2025-04-08", "kev_date_added_formatted": "2025-04-08", "kev_due_date": "2025-04-29", "days_to_kev": 0, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2025-29824 is a use-after-free vulnerability in the Windows Common Log File System Driver that allows local privilege escalation. Despite being listed in CISA KEV indicating active exploitation, this is a local vulnerability that requires existing access to a Windows system and cannot be directly exploited over the internet.", "detailed_analysis": { "vulnerability_type": "Use-after-free memory corruption vulnerability in Windows CLFS driver allowing local privilege escalation", "affected_products": [ "Windows 10 (all versions)", "Windows 11 (all versions)", "Windows Server 2025", "Windows Server 2022", "Windows Server 2019", "Windows Server 2016", "Windows Server 2012/2012 R2", "Windows Server 2008/2008 R2" ], "exploitation_requirements": [ "Local access to vulnerable Windows system", "Valid user account with ability to execute code", "Low-privilege authenticated access" ], "internet_facing_likelihood": "The Windows Common Log File System (CLFS) driver is a kernel-level component that handles transactional logging. While Windows servers may be internet-facing, the CLFS driver itself does not expose network-accessible services or interfaces. This vulnerability requires local code execution to trigger, making direct internet exploitation impossible. Estimated 0% of deployments allow direct internet exploitation of this specific component.", "typical_deployment": "CLFS is a core Windows operating system component present on all Windows installations (client and server). It provides transactional logging services to applications and system components but does not expose network-facing attack surfaces.", "deployment_statistics": "0% - This is a local privilege escalation vulnerability that cannot be exploited directly over the internet. The CLFS driver does not listen on network ports or provide internet-accessible interfaces.", "active_exploitation": "Listed in CISA KEV catalog indicating confirmed exploitation in the wild, likely used as part of multi-stage attacks for privilege escalation after initial compromise", "severity_factors": [ "High CVSS score (7.8) due to complete system compromise potential", "Active exploitation confirmed (CISA KEV)", "Affects all supported Windows versions", "Requires only low-privilege access to exploit", "Use-after-free vulnerabilities can be reliable for exploitation" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Apply Microsoft security updates immediately across all Windows systems", "Monitor for unusual privilege escalation activities and unauthorized administrative access", "Implement enhanced logging for privilege changes and system-level activities", "Patch priority: HIGH - while not directly internet-exploitable, active exploitation makes this critical for preventing lateral movement and privilege escalation in compromised environments" ], "risk_assessment": { "exploit_likelihood": "Very low for direct internet exploitation (impossible), but high for post-compromise privilege escalation given active exploitation evidence", "impact_assessment": "Complete system compromise and administrative access once local access is obtained", "exposure_scope": "No direct internet exposure, but affects all Windows systems that could be compromised through other vectors" }, "exploitation_method": "OTHER", "data_source": "CIRCL", "known_ransomware_use": "Known", "ransomware_first_seen_date": "2026-06-04", "ransomware_days_after_kev": 422, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:48:30.549183", "displayed_on_website": false }, { "cve_id": "CVE-2025-29635", "cvss_score": "7.2", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2025-03-25T00:00:00.000Z", "cve_published_date_formatted": "2025-03-25", "kev_date_added": "2026-04-24", "kev_date_added_formatted": "2026-04-24", "kev_due_date": "2026-05-08", "days_to_kev": 395, "days_since_kev": null, "is_new_kev": false, "summary": "Command injection vulnerability in D-Link DIR-823X routers allows authorized attackers to execute arbitrary commands via POST request to /goform/set_prohibiting. This vulnerability is actively exploited in Mirai botnet campaigns and is listed on CISA KEV.", "detailed_analysis": { "vulnerability_type": "Command injection (CWE-77) in router web administration interface", "affected_products": [ "D-Link DIR-823X Router" ], "exploitation_requirements": [ "Network access to router web interface", "Valid authentication credentials", "POST request to vulnerable endpoint" ], "internet_facing_likelihood": "D-Link DIR-823X routers are consumer/SOHO wireless routers that are almost universally internet-facing by design. These devices serve as gateway devices between internal networks and the internet, with their web management interfaces commonly accessible from the WAN side either by default or through configuration. Estimated 80-90% of deployments are internet-accessible.", "typical_deployment": "Consumer and small office wireless router deployed as network gateway with web-based management interface", "deployment_statistics": "Approximately 80-90% of router deployments have internet-facing management interfaces, either through default configurations, port forwarding, or remote management features", "active_exploitation": "Listed in CISA KEV catalog indicating active exploitation. Referenced Akamai research shows this CVE is being targeted in Mirai botnet campaigns for device compromise and botnet recruitment.", "severity_factors": [ "Active exploitation in wild", "Remote command execution capability", "High deployment prevalence", "Weak credential practices common on SOHO routers", "Perfect for botnet recruitment" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review router logs, check for unauthorized access, verify system integrity, and scan for botnet activity", "Immediately update D-Link DIR-823X firmware to latest available version", "Disable remote/WAN management access if not absolutely required", "Change default administrator credentials to strong, unique passwords", "Monitor network traffic for unusual outbound connections indicating botnet activity", "Consider replacing device if firmware updates are not available", "Patch priority: CRITICAL - Immediate action required" ], "risk_assessment": { "exploit_likelihood": "Very High - Active exploitation documented in Mirai campaigns with available proof-of-concept code", "impact_assessment": "High - Full device compromise enabling botnet recruitment, network pivot point, DDoS participation, and internal network reconnaissance", "exposure_scope": "Potentially hundreds of thousands of internet-facing D-Link DIR-823X routers with millions of devices in the affected product family" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:43:19.454542", "displayed_on_website": false }, { "cve_id": "CVE-2025-27920", "cvss_score": "7.2", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "MEDIUM", "cve_published_date": "2025-05-05T00:00:00.000Z", "cve_published_date_formatted": "2025-05-05", "kev_date_added": "2025-05-19", "kev_date_added_formatted": "2025-05-19", "kev_due_date": "2025-06-09", "days_to_kev": 14, "days_since_kev": null, "is_new_kev": false, "summary": "Directory traversal vulnerability in Srimax Output Messenger allows remote attackers to access sensitive files outside intended directories. This vulnerability is actively exploited by APT group 'Marbled Dust' for regional espionage and is listed in CISA KEV catalog.", "detailed_analysis": { "vulnerability_type": "Directory traversal (CWE-24) allowing file system access via '../' path manipulation", "affected_products": [ "Srimax Output Messenger" ], "exploitation_requirements": [ "Network access to the messaging service", "No authentication required", "No user interaction needed" ], "internet_facing_likelihood": "Output Messenger is enterprise instant messaging software that organizations frequently deploy with internet access to enable remote work, mobile access, and external communications. Estimated 40-60% of deployments are internet-accessible for business functionality.", "typical_deployment": "Server application providing enterprise instant messaging and communication services, typically deployed on internal networks but often exposed to internet for remote worker access", "deployment_statistics": "Approximately 50% of deployments are internet-facing to support remote workers, mobile users, and external business communications. The software's core function as a communication platform drives internet exposure requirements.", "active_exploitation": "Active exploitation confirmed - CISA SSVC indicates 'Exploitation: active', added to CISA KEV on 2025-05-19, Microsoft reports APT group 'Marbled Dust' actively exploiting this for espionage operations", "severity_factors": [ "No authentication required (PR:N)", "Network exploitable (AV:N)", "Active APT exploitation", "File system access potential", "Configuration data exposure risk" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately upgrade to Output Messenger version 2.0.63 or later", "Review server logs for suspicious directory traversal attempts using '../' patterns", "Implement network segmentation and restrict internet access if not required for business operations", "Monitor file access logs for unauthorized configuration file access" ], "risk_assessment": { "exploit_likelihood": "Very High - Active exploitation by APT groups with no authentication required and simple exploitation technique", "impact_assessment": "High - Unauthorized file access can lead to configuration disclosure, credential theft, and potential system compromise", "exposure_scope": "Medium - Output Messenger has limited market share but targeted deployments in organizations handling sensitive communications" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:59:39.979541", "displayed_on_website": false }, { "cve_id": "CVE-2025-27915", "cvss_score": "5.4", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1203", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2025-03-12T00:00:00.000Z", "cve_published_date_formatted": "2025-03-12", "kev_date_added": "2025-10-07", "kev_date_added_formatted": "2025-10-07", "kev_due_date": "2025-10-28", "days_to_kev": 209, "days_since_kev": null, "is_new_kev": false, "summary": "This is a stored XSS vulnerability in Zimbra Collaboration Server that requires a user to view a malicious email containing a crafted ICS calendar file. Despite being in CISA KEV, this is not a direct server compromise but rather a client-side attack targeting user sessions.", "detailed_analysis": { "vulnerability_type": "Stored Cross-Site Scripting (XSS) in email client via malicious ICS calendar files", "affected_products": [ "Zimbra Collaboration Server 9.0", "Zimbra Collaboration Server 10.0", "Zimbra Collaboration Server 10.1" ], "exploitation_requirements": [ "User must view an email containing malicious ICS file", "Victim must have valid Zimbra account", "Attacker must send malicious email to target" ], "internet_facing_likelihood": "Zimbra Collaboration Server is extensively deployed as an internet-facing email server, with nearly 100% of production deployments accessible from the internet to provide email services to users", "typical_deployment": "Zimbra is deployed as an internet-facing email server providing webmail, calendar, and collaboration services to organizations", "deployment_statistics": "Approximately 95-100% of Zimbra deployments are internet-facing as the software's primary purpose is to provide email services accessible to users from anywhere", "active_exploitation": "Listed in CISA KEV with 'Exploitation: active' status, indicating confirmed exploitation in the wild", "severity_factors": [ "Active exploitation confirmed", "Allows unauthorized actions on victim accounts", "Email filter manipulation for data exfiltration", "Does not directly compromise server", "Requires user interaction" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs for suspicious email filters, unauthorized account activities, and check for email redirection rules", "Immediately update to Zimbra 9.0.0 P44, 10.0.13, or 10.1.5 which contain security fixes", "Monitor for suspicious ICS calendar file attachments and email filter modifications", "Review existing email filters and forwarding rules for unauthorized changes", "Consider implementing additional email security scanning for calendar attachments" ], "risk_assessment": { "exploit_likelihood": "High for phishing attacks but low for direct server compromise - requires social engineering to deliver malicious emails", "impact_assessment": "Medium impact - allows account takeover and email redirection but does not compromise the underlying server infrastructure", "exposure_scope": "All internet-accessible Zimbra installations are potentially at risk, but exploitation depends on successful phishing rather than direct server attack" }, "exploitation_method": "USER_INTERACTION", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:17:54.877067", "displayed_on_website": false }, { "cve_id": "CVE-2025-2783", "cvss_score": "8.3", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1203", "deployment_likelihood": "VERY_LOW", "cve_published_date": "2025-03-26T16:07:51.034Z", "cve_published_date_formatted": "2025-03-26", "kev_date_added": "2025-03-27", "kev_date_added_formatted": "2025-03-27", "kev_due_date": "2025-04-17", "days_to_kev": 1, "days_since_kev": null, "is_new_kev": false, "summary": "This is a sandbox escape vulnerability in Google Chrome requiring a malicious file to be opened by a user. While it has a high CVSS score and is in CISA KEV, it affects a client application (browser) rather than a server application, making it unsuitable for direct internet exploitation via T1190.", "detailed_analysis": { "vulnerability_type": "Sandbox escape vulnerability in Mojo component allowing remote code execution via malicious file", "affected_products": [ "Chrome" ], "exploitation_requirements": [ "User must open/interact with malicious file", "Chrome version prior to 134.0.6998.177", "Windows operating system" ], "internet_facing_likelihood": "Chrome is a client-side web browser that is not deployed as an internet-facing server application. It connects to internet services but does not listen for incoming connections or serve content to external users. Chrome is not designed to be exposed to the internet as a service - it is end-user software that runs on individual workstations and personal devices.", "typical_deployment": "Chrome is client software installed on end-user devices (desktops, laptops) for web browsing. It is not server software and has no legitimate use case for being deployed as an internet-facing service.", "deployment_statistics": "Less than 1% of Chrome deployments would be internet-facing, as this would require deliberately exposing a desktop application to the internet, which has no business purpose and violates security best practices.", "active_exploitation": "Listed in CISA KEV catalog indicating active exploitation in the wild, likely through malicious file delivery via phishing or drive-by downloads", "severity_factors": [ "High CVSS score due to sandbox escape capability", "Active exploitation confirmed", "Affects widely deployed browser", "Requires user interaction which limits automated exploitation" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Update Chrome to version 134.0.6998.177 or later immediately on all Windows systems", "Implement email security controls to block malicious file attachments", "Monitor for suspicious Chrome processes or unexpected system behavior", "Educate users about not opening suspicious files or links", "Consider application whitelisting to prevent unauthorized code execution" ], "risk_assessment": { "exploit_likelihood": "High likelihood through social engineering and malicious file distribution, but very low likelihood for direct internet exploitation since Chrome is client software", "impact_assessment": "High impact on individual systems - successful exploitation allows sandbox escape and potentially full system compromise", "exposure_scope": "Affects millions of Chrome installations worldwide, but exploitation requires user interaction rather than direct network access to internet-facing services" }, "exploitation_method": "USER_INTERACTION", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:46:34.910441", "displayed_on_website": false }, { "cve_id": "CVE-2025-2776", "cvss_score": "9.3", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2025-05-07T14:50:40.717Z", "cve_published_date_formatted": "2025-05-07", "kev_date_added": "2025-07-22", "kev_date_added_formatted": "2025-07-22", "kev_due_date": "2025-08-12", "days_to_kev": 76, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2025-2776 is an unauthenticated XML External Entity (XXE) vulnerability in SysAid On-Prem that allows remote attackers to achieve administrator account takeover and file read access without any authentication. This vulnerability is actively being exploited in the wild and has been added to CISA's Known Exploited Vulnerabilities catalog.", "detailed_analysis": { "vulnerability_type": "Unauthenticated XML External Entity (XXE) vulnerability in Server URL processing functionality (CWE-611)", "affected_products": [ "SysAid On-Prem versions <= 23.3.40" ], "exploitation_requirements": [ "Network access to SysAid On-Prem server", "No authentication required", "No user interaction required" ], "internet_facing_likelihood": "SysAid On-Prem is a help desk and IT service management platform that is frequently deployed as an internet-facing service. As an enterprise help desk solution, organizations commonly expose SysAid to the internet to allow remote employees and external users to submit tickets and access support services. Based on the active exploitation evidence and CISA KEV listing specifically mentioning internet-facing systems, an estimated 70-80% of SysAid On-Prem deployments are likely internet-accessible.", "typical_deployment": "SysAid On-Prem is server software designed to provide help desk and IT service management capabilities. It runs as a web application server that organizations deploy to manage IT support tickets, asset management, and user requests.", "deployment_statistics": "Approximately 70-80% of SysAid On-Prem deployments are estimated to be internet-facing, as the primary business function requires accessibility for remote employees, contractors, and sometimes external customers to submit and track support tickets.", "active_exploitation": "CISA has confirmed active exploitation by adding CVE-2025-2776 to the Known Exploited Vulnerabilities catalog on July 22, 2025. CrowdSec analysis shows exploitation attempts spiking above historical norms, with evidence of opportunistic scanning and targeted attacks against internet-facing SysAid instances.", "severity_factors": [ "CVSS 9.3 Critical severity", "No authentication required", "Network attack vector with low complexity", "Administrator account takeover possible", "File read primitives enabling information disclosure", "Potential for chained exploitation leading to RCE", "Active exploitation confirmed by CISA KEV listing" ] }, "recommendations": [ "CRITICAL: Immediately update SysAid On-Prem to version 23.3.41 or later", "If immediate patching is not possible, temporarily restrict network access to SysAid instances or take them offline", "Monitor for indicators of compromise including unauthorized administrator access and unusual file access patterns", "Review logs for XML injection attempts in Server URL processing functionality", "Implement network segmentation to limit exposure of SysAid instances" ], "risk_assessment": { "exploit_likelihood": "VERY HIGH - This is an unauthenticated vulnerability with a network attack vector, low attack complexity, and confirmed active exploitation. The vulnerability can be directly exploited over the internet without any user interaction.", "impact_assessment": "CRITICAL - Successful exploitation leads to administrator account takeover, sensitive file disclosure, and potential for chained attacks resulting in remote code execution on the underlying system.", "exposure_scope": "HIGH - Given SysAid's role as a help desk platform commonly exposed to the internet, a significant number of internet-facing instances are potentially vulnerable. The combination of wide deployment and active exploitation creates substantial exposure." }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "Here's what is known about the CVE-2025-2776 vulnerability exploitation:\n\n* **Vulnerability Overview:** CVE-2025-2776 is an unauthenticated XML External Entity (XXE) vulnerability affecting SysAid On-Premise versions 23.3.40 and earlier 【1】【2】.\n\n* **Internet-Facing Applications/Services:** This vulnerability affects internet-facing SysAid On-Prem systems 【3】【4】, making them easily accessible to attackers.\n\n* **Active Exploitation:** There is evidence of active exploitation of CVE-2025-2776 in the wild 【5】【6】. CrowdSec's analysis indicates a surge in exploitation attempts, with attack volumes spiking above historical norms 【7】.\n\n* **Attack Vectors and Exploitation Methods:**\n * The vulnerability is exploited by injecting malicious XML entities through crafted HTTP requests during Server URL processing 【8】.\n * This allows attackers to bypass input validation and perform arbitrary file reads (e.g., ```/etc/passwd```) and Server-Side Request Forgery (SSRF) attacks 【8】.\n * Successful exploitation can lead to administrator account takeover and potential remote code execution 【9】【10】.\n * An exploit targeting SysAid On-Premise running on Windows chains multiple vulnerabilities to achieve pre-authenticated blind Remote Code Execution (RCE) 【11】.\n\n* **Targeted Attacks:** While it's not explicitly stated that CVE-2025-2776 has been used in targeted attacks, its nature as a pre-authentication vulnerability on internet-facing systems makes it a prime target for both opportunistic attackers and advanced persistent threats (APTs) 【3】.\n\n* **CISA Known Exploited Vulnerabilities (KEV) Status:** CISA added CVE-2025-2776 to its KEV catalog on July 22, 2025, based on evidence of active exploitation 【5】【6】. CISA mandates that Federal Civilian Executive Branch (FCEB) agencies apply mitigations per vendor instructions or discontinue the product if mitigations are unavailable 【6】.\n\n* **Technical Details of Internet Exploitability:**\n * CVE-2025-2776 is a pre-authentication vulnerability, meaning it can be exploited without requiring any user credentials 【12】【13】.\n * It has a network attack vector, low attack complexity, and requires no privileges, making it easily exploitable remotely 【14】【10】.\n * The vulnerability arises from the failure to disable external entity resolution during XML parsing 【15】.\n\nSources:\n- CVE Alert: CVE-2025-2776 – SysAid – SysAid On-Prem: https://www.redpacketsecurity.com/cve_alert-cve-2025-2776-sysaid-sysaid-on-prem/\n- CVE-2025-2776 : SysAid On-Prem versions - CVEdetails.com: https://www.cvedetails.com/cve/CVE-2025-2776/\n- CVE-2025-2776 Analysis: Unpatched SysAid Vulnerability Puts Global ...: https://wardenshield.com/cve-2025-2776-analysis-unpatched-sysaid-vulnerability-puts-global-networks-at-risk\n- SysOwned, Your Friendly Support Ticket - SysAid On-Premise Pre ...: https://labs.watchtowr.com/sysowned-your-friendly-rce-support-ticket/\n- CISA Adds Four Known Exploited Vulnerabilities to Catalog: https://www.cisa.gov/news-events/alerts/2025/07/22/cisa-adds-four-known-exploited-vulnerabilities-catalog", "references": [ { "title": "CVE Alert: CVE-2025-2776 – SysAid – SysAid On-Prem", "url": "https://www.redpacketsecurity.com/cve_alert-cve-2025-2776-sysaid-sysaid-on-prem/", "snippet": "SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Server URL processing functionality,", "is_search_result": true }, { "title": "CVE-2025-2776 : SysAid On-Prem versions - CVEdetails.com", "url": "https://www.cvedetails.com/cve/CVE-2025-2776/", "snippet": "CVE-2025-2776 : SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Server URL processing functiona", "is_search_result": true }, { "title": "CVE-2025-2776 Analysis: Unpatched SysAid Vulnerability Puts Global ...", "url": "https://wardenshield.com/cve-2025-2776-analysis-unpatched-sysaid-vulnerability-puts-global-networks-at-risk", "snippet": "CVE-2025-2776 Analysis: Unpatched SysAid Vulnerability Puts Global Networks at Risk.Given its unauthenticated nature and exposure on internet-facing systems, this flaw is a prime target for both opportunistic attackers and advanced persistent threats (APTs).", "is_search_result": true }, { "title": "SysOwned, Your Friendly Support Ticket - SysAid On-Premise Pre ...", "url": "https://labs.watchtowr.com/sysowned-your-friendly-rce-support-ticket/", "snippet": "It goes without saying - ITSMs are genuine, Internet-facing, treasure troves for your neighbourhood miscreants, red teams, and squirrels.", "is_search_result": true }, { "title": "CISA Adds Four Known Exploited Vulnerabilities to Catalog", "url": "https://www.cisa.gov/news-events/alerts/2025/07/22/cisa-adds-four-known-exploited-vulnerabilities-catalog", "snippet": "CVE-2025-6558 Google Chromium ANGLE and GPU Improper Input Validation Vulnerability; CVE-2025-2776 SysAid On-Prem Improper Restriction of XML ...", "is_search_result": true } ], "timestamp": "2025-09-06T17:21:26.968250" }, "cache_timestamp": "2025-09-06T17:21:51.821400", "displayed_on_website": false }, { "cve_id": "CVE-2025-2775", "cvss_score": "9.3", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2025-05-07T14:43:23.817Z", "cve_published_date_formatted": "2025-05-07", "kev_date_added": "2025-07-22", "kev_date_added_formatted": "2025-07-22", "kev_due_date": "2025-08-12", "days_to_kev": 76, "days_since_kev": null, "is_new_kev": false, "summary": "SysAid On-Prem is vulnerable to an unauthenticated XML External Entity (XXE) vulnerability allowing administrator account takeover and file read primitives. This is a server-side application typically deployed with internet-facing interfaces for IT support services.", "detailed_analysis": { "vulnerability_type": "Unauthenticated XML External Entity (XXE) vulnerability in Checkin processing functionality (CWE-611)", "affected_products": [ "SysAid SysAid On-Prem versions <= 23.3.40" ], "exploitation_requirements": [ "Network access to SysAid server", "No authentication required", "No user interaction required", "HTTP POST request capability" ], "internet_facing_likelihood": "SysAid On-Prem is an IT service management platform that organizations commonly deploy with internet-facing web interfaces to allow employees, customers, and external users to submit support tickets and access self-service portals. The 'Checkin' functionality affected by this vulnerability is part of the web-based interface that processes user requests.", "typical_deployment": "Server software - SysAid On-Prem is enterprise IT service management software that runs as a web application server with database backend, typically deployed on internal networks but frequently exposed to the internet for remote access", "deployment_statistics": "Estimated 60-70% of SysAid On-Prem deployments are internet-facing due to business requirements for remote employee access, customer support portals, and external contractor access to IT services", "active_exploitation": "CISA has added this CVE to the Known Exploited Vulnerabilities Catalog, indicating confirmed active exploitation. Public PoC exploits are available with detailed exploitation techniques.", "severity_factors": [ "CVSS 9.3 Critical severity", "No authentication required", "Network attack vector", "Administrator account takeover possible", "File read primitives", "Active exploitation confirmed", "Public PoC available" ] }, "recommendations": [ "Immediately upgrade SysAid On-Prem to version > 23.3.40", "If immediate patching not possible, remove internet exposure or implement strict network access controls", "Monitor for suspicious XML processing requests and unauthorized administrator account activities", "Conduct incident response investigation if running vulnerable versions with internet exposure" ], "risk_assessment": { "exploit_likelihood": "Very High - Unauthenticated vulnerability with public PoC exploit and confirmed active exploitation targeting internet-facing IT service management platforms", "impact_assessment": "Critical - Administrator account takeover enables full system compromise, data exfiltration through file read primitives, and potential lateral movement in enterprise environments", "exposure_scope": "Potentially thousands of organizations worldwide running SysAid On-Prem with internet-facing deployments for IT service management and customer support operations" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "Here's what is known about the CVE-2025-2775 vulnerability:\n\n* **Affected Applications/Services:**\n\n * CVE-2025-2775 affects **SysAid On-Prem versions** equal to or less than 23.3.40 【1】【2】.\n * It is an **unauthenticated XML External Entity (XXE) vulnerability** in the Checkin processing functionality 【1】【2】.\n * This vulnerability affects **internet-facing applications** 【3】.\n\n* **Active Exploitation:**\n\n * There is evidence of **active exploitation** of this vulnerability 【3】【4】.\n * CISA has added CVE-2025-2775 to its **Known Exploited Vulnerabilities Catalog (KEV)** 【3】.\n\n* **Attack Vectors and Exploitation Methods:**\n\n * The vulnerability can be exploited by a remote, unauthenticated threat actor 【5】.\n * Exploitation involves sending **specially crafted HTTP POST requests** 【5】.\n * Successful exploitation can lead to **pre-authenticated Remote Code Execution (RCE)** 【6】【7】.\n\n* **Targeted Attacks:**\n\n * While not explicitly stated, the low barrier to exploitation and the availability of a Proof of Concept (PoC) exploit make it an attractive target for malicious actors 【5】.\n * Such vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks 【3】.\n\n* **CISA KEV Status:**\n\n * **CISA has added CVE-2025-2775 to its Known Exploited Vulnerabilities Catalog** 【3】.\n\n* **Technical Details/Internet Exploitability:**\n\n * The vulnerability is an unauthenticated XML External Entity (XXE) vulnerability 【1】【2】.\n * It is exploited by sending specially crafted HTTP POST requests 【5】.\n * A Proof of Concept (PoC) exploit is publicly available, increasing the likelihood of exploitation 【5】【6】.\n\nSources:\n- CVE-2025-2775 Detail - NVD: https://nvd.nist.gov/vuln/detail/cve-2025-2775\n- CVE-2025-2775 : SysAid On-Prem versions - CVEdetails.com: https://www.cvedetails.com/cve/CVE-2025-2775/\n- CISA Adds Four Known Exploited Vulnerabilities to Catalog: https://www.cisa.gov/news-events/alerts/2025/07/22/cisa-adds-four-known-exploited-vulnerabilities-catalog\n- SysAid — Latest News, Reports & Analysis |: https://thehackernews.com/search/label/SysAid\n- CVE-2025-2775 | Arctic Wolf: https://arcticwolf.com/resources/blog/cve-2025-2775/", "references": [ { "title": "CVE-2025-2775 Detail - NVD", "url": "https://nvd.nist.gov/vuln/detail/cve-2025-2775", "snippet": "SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Checkin processing functionality.", "is_search_result": true }, { "title": "CVE-2025-2775 : SysAid On-Prem versions - CVEdetails.com", "url": "https://www.cvedetails.com/cve/CVE-2025-2775/", "snippet": "SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Checkin processing functionality.", "is_search_result": true }, { "title": "CISA Adds Four Known Exploited Vulnerabilities to Catalog", "url": "https://www.cisa.gov/news-events/alerts/2025/07/22/cisa-adds-four-known-exploited-vulnerabilities-catalog", "snippet": "These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.", "is_search_result": true }, { "title": "SysAid — Latest News, Reports & Analysis |", "url": "https://thehackernews.com/search/label/SysAid", "snippet": "... vulnerabilities in question are listed below - CVE-2025-2775 ... Citrix Patches Three NetScaler Flaws, Confirms Active Exploitation of CVE-2025-7775", "is_search_result": true }, { "title": "CVE-2025-2775 | Arctic Wolf", "url": "https://arcticwolf.com/resources/blog/cve-2025-2775/", "snippet": "Given the low barrier to exploitation and the public availability of a PoC exploit, this vulnerability presents an attractive target for threat actors. In 2023, ...", "is_search_result": true } ], "timestamp": "2025-09-06T17:20:51.022868" }, "cache_timestamp": "2025-09-06T17:21:14.909762", "displayed_on_website": false }, { "cve_id": "CVE-2025-2749", "cvss_score": "7.2", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2025-03-24T18:18:07.228Z", "cve_published_date_formatted": "2025-03-24", "kev_date_added": "2026-04-20", "kev_date_added_formatted": "2026-04-20", "kev_due_date": "2026-05-04", "days_to_kev": 392, "days_since_kev": null, "is_new_kev": false, "summary": "Authenticated remote code execution vulnerability in Kentico Xperience CMS allowing file upload via path traversal. Attackers can upload web shells to achieve server-side code execution. Listed in CISA KEV indicating active exploitation.", "detailed_analysis": { "vulnerability_type": "Authenticated Remote Code Execution via Path Traversal and Arbitrary File Upload", "affected_products": [ "Kentico Xperience CMS" ], "exploitation_requirements": [ "Authentication to Staging Sync Server", "Network access to CMS", "Upload functionality access" ], "internet_facing_likelihood": "Kentico Xperience is a content management system (CMS) designed for web applications and websites. By its very nature as a CMS, it must be internet-accessible to serve web content to users. Approximately 95-100% of Kentico deployments are internet-facing as this is the primary purpose of the software.", "typical_deployment": "Kentico Xperience is server software deployed as a web application server to host and manage websites, intranets, and web applications. It runs on web servers (typically IIS) and requires internet connectivity to serve content.", "deployment_statistics": "Nearly 100% of Kentico Xperience deployments are internet-facing as it is purpose-built CMS software for hosting websites and web applications that must be accessible to end users over the internet.", "active_exploitation": "This vulnerability is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating confirmed active exploitation in the wild by threat actors.", "severity_factors": [ "High-severity authenticated RCE", "Path traversal enabling arbitrary file placement", "Web shell upload capability", "Active exploitation confirmed via CISA KEV", "CMS software inherently internet-facing", "CAPEC-650 (Upload Web Shell) impact" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately update Kentico Xperience to version newer than 13.0.178 using hotfixes from https://devnet.kentico.com/download/hotfixes", "Audit Staging Sync Server authentication and user permissions - disable unnecessary accounts", "Monitor file upload activities and scan for web shells in web directories", "Review server logs for suspicious file upload attempts and path traversal patterns", "Implement file upload restrictions and validation if not already in place", "Priority: CRITICAL - Patch immediately due to active exploitation and RCE capability" ], "risk_assessment": { "exploit_likelihood": "Very High - Vulnerability is being actively exploited (CISA KEV listed) and affects internet-facing CMS deployments with documented exploitation techniques", "impact_assessment": "Critical - Full server compromise via remote code execution, potential web shell installation, complete confidentiality/integrity/availability loss", "exposure_scope": "All internet-accessible Kentico Xperience installations running version 13.0.178 or earlier, representing potentially thousands of websites and web applications globally" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:40:49.987842", "displayed_on_website": false }, { "cve_id": "CVE-2025-2747", "cvss_score": "9.8", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2025-03-24T18:17:06.079Z", "cve_published_date_formatted": "2025-03-24", "kev_date_added": "2025-10-20", "kev_date_added_formatted": "2025-10-20", "kev_due_date": "2025-11-10", "days_to_kev": 210, "days_since_kev": null, "is_new_kev": false, "summary": "Critical authentication bypass vulnerability in Kentico Xperience CMS allows complete bypass of authentication via Staging Sync Server component. The vulnerability gives attackers control over administrative objects and is actively being exploited in the wild according to CISA KEV listing.", "detailed_analysis": { "vulnerability_type": "Authentication bypass vulnerability in web application CMS platform allowing complete administrative access", "affected_products": [ "Kentico Xperience CMS" ], "exploitation_requirements": [ "Network access to Staging Sync Server component", "No authentication required", "No user interaction required" ], "internet_facing_likelihood": "Kentico Xperience is a web-based Content Management System (CMS) platform designed for creating and managing websites and web applications. By its very nature as a CMS, it is almost always deployed as an internet-facing web server to serve content to users. The Staging Sync Server component is part of the content deployment pipeline and is often accessible over the network. Estimated 80-90% of Kentico deployments are internet-facing.", "typical_deployment": "Kentico Xperience is server software - specifically a web application server and CMS platform that hosts websites and web applications for public access", "deployment_statistics": "Approximately 80-90% of Kentico Xperience deployments are internet-facing since its primary purpose is to serve web content to end users. The Staging Sync Server component, while primarily used for content synchronization, is often network-accessible to enable deployment workflows.", "active_exploitation": "Listed in CISA KEV catalog indicating active exploitation in the wild. Exploit code is publicly available on GitHub.", "severity_factors": [ "CVSS 9.8 Critical severity", "No authentication required", "Network-based attack vector", "Administrative access gained", "Public exploit available", "Active exploitation confirmed by CISA" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately update to Kentico Xperience version later than 13.0.178 using available hotfixes", "Review Staging Sync Server configuration and disable if not required for production", "Monitor administrative access logs for suspicious activity", "Implement network segmentation to isolate CMS administrative functions", "PATCH PRIORITY: CRITICAL - Deploy emergency patches immediately" ], "risk_assessment": { "exploit_likelihood": "Very High - Public exploit available, actively exploited according to CISA, no authentication required, affects widely deployed CMS platform", "impact_assessment": "Critical - Complete administrative control over CMS platform, potential for data theft, website defacement, malware distribution, and lateral movement within network", "exposure_scope": "High - Kentico is a popular enterprise CMS platform with thousands of deployments worldwide, most of which are internet-facing by design" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:20:45.623479", "displayed_on_website": false }, { "cve_id": "CVE-2025-2746", "cvss_score": "9.8", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2025-03-24T18:16:04.022Z", "cve_published_date_formatted": "2025-03-24", "kev_date_added": "2025-10-20", "kev_date_added_formatted": "2025-10-20", "kev_due_date": "2025-11-10", "days_to_kev": 210, "days_since_kev": null, "is_new_kev": false, "summary": "Authentication bypass vulnerability in Kentico Xperience CMS allows attackers to control administrative objects via empty SHA1 username handling in digest authentication. The vulnerability is actively exploited and affects internet-facing CMS deployments.", "detailed_analysis": { "vulnerability_type": "Authentication bypass via empty SHA1 username handling in Staging Sync Server digest authentication", "affected_products": [ "Kentico Xperience CMS (versions through 13.0.172)" ], "exploitation_requirements": [ "Network access to Staging Sync Server", "No authentication required due to bypass", "No user interaction required" ], "internet_facing_likelihood": "Kentico Xperience is a content management system (CMS) primarily designed for web applications that are commonly deployed as internet-facing services. The Staging Sync Server component is often exposed for content synchronization between environments, making it accessible from the internet in many deployments. Estimated 60-80% of enterprise CMS deployments have some internet-facing components.", "typical_deployment": "Server-side web application platform deployed on web servers with database backends, typically hosting public websites and web applications", "deployment_statistics": "Approximately 70% of Kentico Xperience deployments are likely internet-facing as it's primarily used for public websites and web applications that require internet accessibility", "active_exploitation": "Listed in CISA KEV catalog indicating active exploitation in the wild. Exploit code is publicly available on GitHub.", "severity_factors": [ "CVSS 9.8 Critical severity", "No authentication required", "Full administrative control possible", "Public exploit code available", "Active exploitation confirmed by CISA" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately apply hotfix from Kentico or upgrade beyond version 13.0.172", "Review Staging Sync Server access logs for unauthorized authentication attempts", "Implement network segmentation to limit access to Staging Sync Server", "Monitor for unusual administrative activities and unauthorized object modifications", "Consider temporarily disabling Staging Sync Server if not immediately needed until patching is complete" ], "risk_assessment": { "exploit_likelihood": "Very high - public exploit code available, no authentication required, and confirmed active exploitation", "impact_assessment": "Critical - complete administrative control over CMS platform allowing data theft, website defacement, and potential lateral movement", "exposure_scope": "Potentially thousands of internet-facing Kentico Xperience installations globally, particularly affecting enterprise websites and web applications" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:20:25.184994", "displayed_on_website": false }, { "cve_id": "CVE-2025-27363", "cvss_score": "8.1", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1203", "deployment_likelihood": "VERY_LOW", "cve_published_date": "2025-03-11T13:28:31.705Z", "cve_published_date_formatted": "2025-03-11", "kev_date_added": "2025-05-06", "kev_date_added_formatted": "2025-05-06", "kev_due_date": "2025-05-27", "days_to_kev": 56, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2025-27363 is an out-of-bounds write vulnerability in FreeType versions 2.13.0 and below that allows arbitrary code execution when parsing malicious TrueType font files. While highly severe and actively exploited in the wild, this primarily affects client applications that process fonts rather than internet-facing servers.", "detailed_analysis": { "vulnerability_type": "Out-of-bounds write (CWE-787) in font parsing leading to arbitrary code execution", "affected_products": [ "FreeType (font rendering library)", "Android (includes FreeType)", "Linux distributions", "Applications using FreeType for font rendering" ], "exploitation_requirements": [ "Malicious TrueType font file must be processed", "Target system running FreeType 2.13.0 or earlier", "Application that renders fonts using vulnerable FreeType version" ], "internet_facing_likelihood": "FreeType is primarily a client-side font rendering library embedded in applications, browsers, and operating systems. While some web servers might theoretically use FreeType for server-side image/document generation, this represents a very small percentage of deployments. The vast majority of FreeType usage is in client applications processing fonts from websites, documents, or local files.", "typical_deployment": "FreeType is a library embedded in client applications (browsers, document viewers, image editors), mobile operating systems (Android), and desktop systems for font rendering. It is not typically deployed as a standalone internet-facing service.", "deployment_statistics": "Less than 5% of FreeType deployments are likely internet-facing. The library is predominantly used client-side for rendering fonts in user applications and operating systems.", "active_exploitation": "CISA has added this CVE to the Known Exploited Vulnerabilities (KEV) catalog, indicating confirmed exploitation in the wild. Android security bulletins reference this vulnerability.", "severity_factors": [ "High CVSS score of 8.1", "Arbitrary code execution capability", "Active exploitation confirmed by CISA KEV listing", "Wide deployment in client systems", "No authentication required for exploitation", "However, requires processing malicious font files" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately update FreeType to versions newer than 2.13.0 on all systems", "Update Android devices to latest security patches (May 2025 bulletin addresses this CVE)", "Update Linux distributions and applications that bundle FreeType", "Monitor for suspicious font files or unexpected application crashes during font processing", "Implement application sandboxing and restrict font file sources where possible", "HIGH PRIORITY: Patch all client systems and mobile devices immediately" ], "risk_assessment": { "exploit_likelihood": "High for client-side exploitation through malicious fonts, very low for direct internet-facing server exploitation", "impact_assessment": "Critical - arbitrary code execution with potential for complete system compromise", "exposure_scope": "Primarily affects client applications and mobile devices rather than internet-facing servers, but massive deployment base makes this a significant threat" }, "exploitation_method": "USER_INTERACTION", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:54:32.057236", "displayed_on_website": false }, { "cve_id": "CVE-2025-27038", "cvss_score": "7.5", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1203", "deployment_likelihood": "VERY_LOW", "cve_published_date": "2025-06-03T05:53:06.692Z", "cve_published_date_formatted": "2025-06-03", "kev_date_added": "2025-06-03", "kev_date_added_formatted": "2025-06-03", "kev_due_date": "2025-06-24", "days_to_kev": 0, "days_since_kev": null, "is_new_kev": false, "summary": "Use-after-free vulnerability in Qualcomm Adreno GPU drivers when rendering graphics in Chrome. This affects mobile devices, wearables, and IoT platforms rather than internet-facing servers. Exploitation requires user interaction to view malicious content.", "detailed_analysis": { "vulnerability_type": "Use-after-free memory corruption (CWE-416) in GPU driver graphics rendering", "affected_products": [ "Snapdragon Mobile Platforms", "Snapdragon Industrial IoT", "Snapdragon Consumer IoT", "Snapdragon Wearables", "Snapdragon Connectivity Components", "Snapdragon Voice & Music Platforms" ], "exploitation_requirements": [ "User interaction required", "Malicious graphics content", "Chrome browser with vulnerable Adreno GPU drivers" ], "internet_facing_likelihood": "Snapdragon platforms are primarily system-on-chip (SoC) solutions for mobile devices, tablets, wearables, and IoT devices. These are client-side platforms, not server infrastructure. While some IoT devices might have web interfaces, the vast majority (>95%) of Snapdragon deployments are end-user devices that are not internet-facing servers.", "typical_deployment": "Snapdragon platforms are embedded in consumer devices (smartphones, tablets, smartwatches), IoT devices, and embedded systems. They function as client-side hardware platforms rather than server infrastructure.", "deployment_statistics": "Less than 5% of Snapdragon-powered devices would function as internet-facing servers. The overwhelming majority are client devices behind NAT/firewalls.", "active_exploitation": "Listed in CISA KEV catalog indicating active exploitation in the wild, likely targeting mobile users through malicious websites or content", "severity_factors": [ "High CVSS score of 7.5", "Active exploitation confirmed", "Requires user interaction", "Affects client devices primarily", "GPU driver vulnerability" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Update Chrome browser and Android/device firmware containing Qualcomm security patches immediately", "Monitor for suspicious graphics rendering behavior or unexpected crashes in Chrome", "Implement web filtering to block known malicious graphics content", "Priority: HIGH for mobile device management and client endpoint protection" ], "risk_assessment": { "exploit_likelihood": "High for client-side exploitation through malicious web content, but very low for direct internet server compromise since these are primarily client-side platforms", "impact_assessment": "Complete compromise of affected mobile/IoT devices with potential for data theft, surveillance, or device control", "exposure_scope": "Millions of consumer devices potentially affected, but minimal internet-facing server exposure" }, "exploitation_method": "USER_INTERACTION", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:04:19.403653", "displayed_on_website": false }, { "cve_id": "CVE-2025-26633", "cvss_score": "7.0", "attack_vector": "LOCAL", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1068", "deployment_likelihood": "VERY_LOW", "cve_published_date": "2025-03-11T16:59:24.607Z", "cve_published_date_formatted": "2025-03-11", "kev_date_added": "2025-03-11", "kev_date_added_formatted": "2025-03-11", "kev_due_date": "2025-04-01", "days_to_kev": 0, "days_since_kev": null, "is_new_kev": false, "summary": "This is a local security feature bypass vulnerability in Microsoft Management Console (MMC) that allows attackers to bypass security features locally. The vulnerability requires local access and user interaction, making it unsuitable for direct internet exploitation.", "detailed_analysis": { "vulnerability_type": "Security Feature Bypass in Microsoft Management Console (MMC) - Improper Neutralization vulnerability allowing local bypass of security features", "affected_products": [ "Windows Server 2019", "Windows Server 2022", "Windows Server 2025", "Windows Server 2016", "Windows Server 2012 R2", "Windows Server 2012", "Windows Server 2008 R2", "Windows Server 2008", "Windows 10 (various versions)", "Windows 11 (various versions)" ], "exploitation_requirements": [ "Local access to the system", "User interaction required (UI:R)", "High attack complexity (AC:H)", "No privileges required initially (PR:N)" ], "internet_facing_likelihood": "Microsoft Management Console (MMC) is a client-side administrative tool used for local system management. It is not a server application and does not listen on network ports or provide internet-facing services. MMC is used by administrators to manage local system components through snap-ins.", "typical_deployment": "MMC is a desktop administrative tool that comes pre-installed with Windows operating systems. It is used locally by system administrators to manage various system components through snap-ins like Device Manager, Event Viewer, and Services. It is not designed to be or typically deployed as an internet-facing service.", "deployment_statistics": "0% - MMC is never deployed as an internet-facing service. It is exclusively a local administrative tool that requires direct console access or remote desktop access to the system.", "active_exploitation": "Listed in CISA KEV catalog indicating active exploitation in the wild, likely being used as part of post-compromise privilege escalation chains", "severity_factors": [ "CISA KEV listing indicates active exploitation", "High CVSS score of 7.0", "Affects all supported Windows versions", "Requires local access limiting attack surface", "User interaction required increases difficulty", "High attack complexity" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs for suspicious MMC usage, check for unauthorized privilege escalation, verify admin account integrity", "Apply Microsoft security updates immediately for all affected Windows systems", "Monitor for unusual MMC.exe process activity and unexpected snap-in loading", "Implement principle of least privilege to limit potential impact of security feature bypasses", "HIGH PRIORITY patching due to CISA KEV listing and active exploitation" ], "risk_assessment": { "exploit_likelihood": "Low for direct internet exploitation (requires local access), but high for post-compromise escalation given CISA KEV listing", "impact_assessment": "High impact once exploited - allows bypassing security features which could lead to further compromise of the system", "exposure_scope": "No internet-facing exposure as MMC is a local administrative tool, but all Windows systems with local/RDP access are potentially affected" }, "exploitation_method": "OTHER", "data_source": "CIRCL", "known_ransomware_use": "Known", "ransomware_first_seen_date": "2026-06-04", "ransomware_days_after_kev": 450, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:42:35.760538", "displayed_on_website": false }, { "cve_id": "CVE-2025-26399", "cvss_score": "9.8", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2025-09-23T05:07:14.702Z", "cve_published_date_formatted": "2025-09-23", "kev_date_added": "2026-03-09", "kev_date_added_formatted": "2026-03-09", "kev_due_date": "2026-03-12", "days_to_kev": 167, "days_since_kev": null, "is_new_kev": false, "summary": "Critical unauthenticated remote code execution vulnerability in SolarWinds Web Help Desk affecting the AjaxProxy component. This is a bypass of previous patches and allows direct exploitation over the internet without authentication.", "detailed_analysis": { "vulnerability_type": "Unauthenticated AjaxProxy deserialization remote code execution (CWE-502)", "affected_products": [ "SolarWinds Web Help Desk (version 12.8.7 and below)" ], "exploitation_requirements": [ "Network access to Web Help Desk service", "No authentication required", "No user interaction required" ], "internet_facing_likelihood": "SolarWinds Web Help Desk is IT service management software designed to handle support tickets and user requests. As a help desk application, it is commonly deployed as a web-based service accessible to end users within organizations. Many deployments expose this service to the internet to allow remote employees and external users to submit tickets and access support resources. Estimated 60-70% of deployments are internet-accessible.", "typical_deployment": "Web-based server application typically deployed on internal networks but frequently exposed to the internet for remote access by employees and customers", "deployment_statistics": "Approximately 60-70% of Web Help Desk deployments are internet-facing to support remote workforce and customer access to IT support services", "active_exploitation": "Confirmed active exploitation in the wild since December 2025. Added to CISA KEV catalog indicating ongoing threat activity. Attackers using tunneling tools for persistence and living-off-the-land techniques.", "severity_factors": [ "CVSS 9.8 Critical score", "Unauthenticated exploitation", "Remote code execution capability", "Bypass of previous security patches", "Active exploitation confirmed", "Affects commonly internet-exposed service" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs for suspicious java.exe and cmd.exe execution patterns, check for unauthorized tunneling tools (Zoho ManageEngine, Cloudflare tunnels), verify system integrity", "Immediately upgrade to Web Help Desk version 12.8.7 HF1 or later", "Monitor AjaxProxy component access logs for suspicious deserialization attempts", "Consider temporarily restricting internet access to Web Help Desk until patching is complete", "Implement network segmentation to limit blast radius if compromise occurs", "CRITICAL PRIORITY - Active exploitation makes this an emergency patch" ], "risk_assessment": { "exploit_likelihood": "VERY HIGH - Confirmed active exploitation with unauthenticated network access requirements", "impact_assessment": "CRITICAL - Full remote code execution allows complete system compromise, potential domain escalation", "exposure_scope": "HIGH - Web Help Desk is commonly internet-facing in enterprise environments to support remote users and customers" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "**CVE-2025-26399** is a critical remote code execution (RCE) vulnerability affecting **SolarWinds Web Help Desk (WHD)** software 【7】 【11】 【16】 【4】 【15】. It stems from an **insecure deserialization flaw within the AjaxProxy component** 【1】 【14】 【13】 【6】 【12】 【11】 【16】 【4】 【19】. This vulnerability is a bypass of previous fixes for CVE-2024-28988, which itself was a bypass of CVE-2024-28986 【1】 【4】 【20】 【4】 【17】 【18】.\n\nHere's a breakdown of what is known about its exploitation:\n\n* **Internet-Facing Applications/Services:**\n * **Yes, CVE-2025-26399 affects internet-facing deployments of SolarWinds Web Help Desk** 【5】 【2】. Successful exploitation allows an external attacker to execute arbitrary commands within the WHD application context 【5】 【1】 【17】 【16】 【4】.\n\n* **Evidence of Active Exploitation in the Wild:**\n * **Yes, there is evidence of active exploitation in the wild** 【3】 【5】 【5】 【2】 【10】 【22】 【21】 【15】. Reports indicate that exploitation activity began as early as December 2025 【10】, with ongoing campaigns observed in February 2026 【3】 【5】 【6】 【12】 【22】 【21】. Some sources suggest that while active exploitation of CVE-2025-26399 specifically was not confirmed in September 2025, history suggests it's likely 【4】, and by February 2026, active exploitation was confirmed 【3】 【5】 【5】.\n\n* **Attack Vectors and Exploitation Methods:**\n * The vulnerability allows for **unauthenticated remote code execution** 【1】 【14】 【13】 【5】 【1】 【11】 【17】 【16】 【4】 【19】.\n * Attackers exploit the deserialization flaw in the AjaxProxy component to run commands on the host machine 【1】 【6】 【12】 【16】 【4】.\n * In observed attacks, threat actors have deployed **Zoho ManageEngine and Cloudflare tunnels for persistence**, and **Velociraptor for command and control** 【3】 【22】 【21】.\n * Exploitation chains have been observed where the WHD service wrapper spawns `java.exe`, which then executes the Windows command processor (`cmd.exe`) 【6】 【12】.\n * Attackers have also been noted to use **\"living-off-the-land\" techniques**, leveraging legitimate administrative tools and low-noise persistence mechanisms 【2】.\n\n* **Use in Targeted Attacks:**\n * While specific details about targeted attacks are not extensively detailed for CVE-2025-26399, the nature of the vulnerability and its exploitation in ongoing campaigns suggests it can be used in targeted attacks. Microsoft noted that such vulnerabilities in exposed applications can provide a path to full domain compromise 【2】.\n\n* **CISA Known Exploited Vulnerabilities (KEV) Status:**\n * **CVE-2025-26399 has been added to the CISA Known Exploited Vulnerabilities (KEV) catalog** 【8】 【23】. This designation indicates that CISA has confirmed active exploitation of the vulnerability in the wild 【9】 【24】 【25】.\n\n* **Technical Details about Internet Exploitability:**\n * The vulnerability is an **unauthenticated deserialization flaw** in the AjaxProxy component of SolarWinds Web Help Desk 【1】 【14】 【13】 【6】 【12】 【11】 【16】 【4】 【19】.\n * This allows **remote attackers to execute arbitrary code** on affected installations 【4】 【4】.\n * The exploitability is high due to the unauthenticated nature and the ability to run commands on the host machine 【1】 【1】 【17】 【16】 【4】.\n * The CVSS score is critical, with a score of 9.8 【11】 【4】.\n\nSources:\n- NVD - CVE-2025-26399: https://nvd.nist.gov/vuln/detail/CVE-2025-26399\n- SolarWinds Web Help Desk Exploited for RCE in Multi-Stage Attacks on ...: https://thehackernews.com/2026/02/solarwinds-web-help-desk-exploited-for.html\n- Active Exploitation of SolarWinds Web Help Desk (CVE-2025-26399): https://www.huntress.com/blog/active-exploitation-solarwinds-web-help-desk-cve-2025-26399\n- SolarWinds Releases Hotfix for Critical CVE-2025-26399 Remote Code...: https://thehackernews.com/2025/09/solarwinds-releases-hotfix-for-critical.html\n- Analysis of active exploitation of SolarWinds Web Help Desk: https://www.microsoft.com/en-us/security/blog/2026/02/06/active-exploitation-solarwinds-web-help-desk/", "references": [ { "title": "NVD - CVE-2025-26399", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26399", "citation_contribution": 637, "snippet": "Description. SolarWinds Web Help Desk was found to be susceptible to an unauthenticated AjaxProxy deserialization remote code execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine.Reference Type. SolarWinds: https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-26399 Types: Patch, Vendor Advisory.", "is_search_result": true }, { "title": "SolarWinds Web Help Desk Exploited for RCE in Multi-Stage Attacks on ...", "url": "https://thehackernews.com/2026/02/solarwinds-web-help-desk-exploited-for.html", "citation_contribution": 497, "snippet": "\"This activity reflects a common but high-impact pattern: a single exposed application can provide a path to full domain compromise when vulnerabilities are unpatched or insufficiently monitored,\" the Windows maker said. \"In this intrusion, attackers relied heavily on living-off-the-land techniques, legitimate administrative tools, and low-noise persistence mechanisms. These tradecraft choices reinforce the importance of defense in depth, timely patching of internet-facing services, and behavior-based detection across identity, endpoint, and network layers.\"", "is_search_result": true }, { "title": "Active Exploitation of SolarWinds Web Help Desk (CVE-2025-26399)", "url": "https://www.huntress.com/blog/active-exploitation-solarwinds-web-help-desk-cve-2025-26399", "citation_contribution": 343, "snippet": "Huntress has observed active exploitation of a deserialization and remote code execution against the SolarWinds Web Help Desk software (CVE-2025-26399).On February 7, 2026, Huntress SOC analyst Dipo Rodipe investigated a case of SolarWinds Web Help Desk exploitation, in which the threat actor rapidly deployed Zoho Meetings and Cloudflare tunnels for persistence, as well as Velociraptor for means of command and control. This intrusion stemmed from the many recently disclosed vulnerabilities affecting SolarWinds WHD.", "is_search_result": true }, { "title": "SolarWinds Releases Hotfix for Critical CVE-2025-26399 Remote Code...", "url": "https://thehackernews.com/2025/09/solarwinds-releases-hotfix-for-critical.html", "citation_contribution": 242, "snippet": "The vulnerability, tracked as CVE-2025-26399 (CVSS score: 9.8), has been described as an instance of deserialization of untrusted data that could result in code execution. It affects SolarWinds Web Help Desk 12.8.7 and all previous versions. \"SolarWinds Web Help Desk was found to be susceptible to an unauthenticated AjaxProxy deserialization remote code execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine,\" SolarWinds said in an advisory released on September 17, 2025.", "is_search_result": true }, { "title": "Analysis of active exploitation of SolarWinds Web Help Desk", "url": "https://www.microsoft.com/en-us/security/blog/2026/02/06/active-exploitation-solarwinds-web-help-desk/", "citation_contribution": 213, "snippet": "Further investigations are in-progress to confirm the actual vulnerabilities exploited, such as CVE-2025-40551 (critical untrusted data deserialization) and CVE-2025-40536 (security control bypass) and CVE-2025-26399. Successful exploitation allowed the attackers to achieve unauthenticated remote code execution on internet-facing deployments, allowing an external attacker to execute arbitrary commands within the WHD application context.", "is_search_result": true } ], "timestamp": "2026-03-09T20:35:30.591133" }, "cache_timestamp": "2026-03-09T20:35:48.687350", "displayed_on_website": false }, { "cve_id": "CVE-2025-25257", "cvss_score": "9.6", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2025-07-17T15:10:04.532Z", "cve_published_date_formatted": "2025-07-17", "kev_date_added": "2025-07-18", "kev_date_added_formatted": "2025-07-18", "kev_due_date": "2025-08-08", "days_to_kev": 1, "days_since_kev": null, "is_new_kev": false, "summary": "Critical SQL injection vulnerability in Fortinet FortiWeb WAF allowing unauthenticated attackers to execute arbitrary SQL and code via crafted HTTP/HTTPS requests. CISA has confirmed active exploitation in the wild with public PoC available.", "detailed_analysis": { "vulnerability_type": "SQL Injection (CWE-89) leading to Remote Code Execution", "affected_products": [ "Fortinet FortiWeb 7.6.0-7.6.3", "FortiWeb 7.4.0-7.4.7", "FortiWeb 7.2.0-7.2.10", "FortiWeb 7.0.0-7.0.10" ], "exploitation_requirements": [ "Network access to FortiWeb interface", "No authentication required", "No user interaction required" ], "internet_facing_likelihood": "FortiWeb is a Web Application Firewall (WAF) specifically designed to protect web applications by sitting between the internet and web servers. By architectural design, WAFs must be internet-facing to inspect and filter incoming web traffic. Estimated 95%+ of FortiWeb deployments are internet-accessible as this is their primary function.", "typical_deployment": "FortiWeb is enterprise security infrastructure software deployed as an internet-facing reverse proxy/WAF appliance. It sits at the network perimeter to protect backend web applications, requiring direct internet exposure to function properly.", "deployment_statistics": "Approximately 95-98% of FortiWeb deployments are internet-facing. WAFs are purpose-built to be the first point of contact for web traffic from the internet, making internet exposure not just common but essential for their operation.", "active_exploitation": "CISA has added this to the KEV catalog with confirmed active exploitation since July 11, 2025. Shadowserver Foundation reported exploitation activity, CrowdSec observed ~40 distinct IPs with ~500 attack events, and public PoC code is available.", "severity_factors": [ "Critical CVSS 9.6 score", "No authentication required", "Network-based attack vector", "Active exploitation confirmed", "Public PoC available", "Affects internet-facing security infrastructure", "Can lead to full system compromise" ] }, "recommendations": [ "IMMEDIATE: Patch to FortiWeb 7.6.4+, 7.4.8+, 7.2.11+, or 7.0.11+ as emergency priority", "Monitor FortiWeb access logs for suspicious HTTP/HTTPS requests with SQL injection patterns", "Consider temporarily blocking non-essential traffic to FortiWeb management interfaces until patched" ], "risk_assessment": { "exploit_likelihood": "VERY HIGH - Confirmed active exploitation with public PoC code available. No authentication required and affects internet-facing infrastructure by design.", "impact_assessment": "CRITICAL - Successful exploitation leads to complete system compromise including unauthorized SQL execution, remote code execution, and potential lateral movement into protected network segments.", "exposure_scope": "HIGH - FortiWeb appliances are widely deployed in enterprise environments as internet-facing security infrastructure, making the potential attack surface significant across organizations globally." }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "CVE-2025-25257 is a critical SQL injection vulnerability affecting **Fortinet FortiWeb**, a web application firewall (WAF) 【1】【2】. Here's what is known about its exploitation:\n\n* **Affected Applications/Services:** The vulnerability affects **internet-facing applications and services** that utilize Fortinet's FortiWeb WAF 【2】【3】.\n\n* **Active Exploitation:** There is confirmed **evidence of active exploitation in the wild** 【4】【5】. The Shadowserver Foundation reported observed exploitation activity since July 11, 2025 【5】. CrowdSec observed approximately 40 distinct IPs producing around 500 attack events related to this vulnerability, with most attacks occurring on July 11th, 2025 【6】.\n\n* **Attack Vectors/Exploitation Methods:** The vulnerability allows an **unauthenticated attacker to execute unauthorized SQL code** via crafted HTTP or HTTPS requests 【7】【8】. Successful exploitation can lead to **remote code execution (RCE)** 【2】【7】. The flaw allows both SQL code and Python code to be executed on a victim's system due to improper neutralization of HTTP headers 【9】.\n\n* **Targeted Attacks:** While active exploitation is confirmed, specific details on \"targeted attacks\" are not explicitly mentioned beyond general malicious activity 【10】.\n\n* **CISA KEV Status:** CISA has added CVE-2025-25257 to its **Known Exploited Vulnerabilities (KEV) Catalog**, based on evidence of active exploitation 【4】【11】. This means that CISA considers this vulnerability to be actively exploited and posing a significant risk 【4】.\n\n* **Technical Details/Internet Exploitability:** CVE-2025-25257 is a pre-authentication SQL injection vulnerability in Fortinet FortiWeb 【12】. It enables unauthenticated attackers to achieve remote code execution via crafted HTTP requests 【12】. The vulnerability exists because of improper neutralization of special elements used in an SQL command 【13】【8】. Proof-of-concept (PoC) code is publicly available, increasing the risk of exploitation 【12】【14】.\n\nSources:\n- CVE-2025–25257: FortiWeb SQL Injection to RCE Exposed | Medium: https://medium.com/@kalariyahet23/cve-2025-25257-fortiweb-sql-injection-to-rce-exposed-9a2e0e9dd78e\n- CVE-2025–25257 - FortiWeb Vulnerability Checker & Exploit | Medium: https://medium.com/@cyber_dark/cve-2025-25257-fortiweb-vulnerability-checker-exploit-1641776f8cbb\n- CVE-2025-25257 | Arctic Wolf: https://arcticwolf.com/resources/blog/cve-2025-25257/\n- CISA Adds One Known Exploited Vulnerability to Catalog: https://www.cisa.gov/news-events/alerts/2025/07/18/cisa-adds-one-known-exploited-vulnerability-catalog\n- CISA Warns of Fortinet FortiWeb SQL Injection Vulnerability Exploited ...: https://cybersecuritynews.com/cisa-fortinet-fortiweb-vulnerability/", "references": [ { "title": "CVE-2025–25257: FortiWeb SQL Injection to RCE Exposed | Medium", "url": "https://medium.com/@kalariyahet23/cve-2025-25257-fortiweb-sql-injection-to-rce-exposed-9a2e0e9dd78e", "snippet": "On July 8, 2025, Fortinet disclosed CVE-2025–25257, a severe SQL injection vulnerability in their FortiWeb web application firewall. This unauthenticated flaw allows attackers to execute arbitrary code with root privileges, posing a massive risk to organizations.", "is_search_result": true }, { "title": "CVE-2025–25257 - FortiWeb Vulnerability Checker & Exploit | Medium", "url": "https://medium.com/@cyber_dark/cve-2025-25257-fortiweb-vulnerability-checker-exploit-1641776f8cbb", "snippet": "A critical vulnerability was recently identified in Fortinet’s FortiWeb product: CVE-2025–25257, affecting web application firewalls (WAFs) globally. This vulnerability allows unauthenticated remote code execution (RCE), posing significant risk to exposed assets.", "is_search_result": true }, { "title": "CVE-2025-25257 | Arctic Wolf", "url": "https://arcticwolf.com/resources/blog/cve-2025-25257/", "snippet": "Fortinet released fixes for a critical vulnerability in FortiWeb that could allow an unauthenticated threat actor to execute SQL commands via crafted HTTP ...", "is_search_result": true }, { "title": "CISA Adds One Known Exploited Vulnerability to Catalog", "url": "https://www.cisa.gov/news-events/alerts/2025/07/18/cisa-adds-one-known-exploited-vulnerability-catalog", "snippet": "These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.", "is_search_result": true }, { "title": "CISA Warns of Fortinet FortiWeb SQL Injection Vulnerability Exploited ...", "url": "https://cybersecuritynews.com/cisa-fortinet-fortiweb-vulnerability/", "snippet": "The vulnerability, tracked as CVE-2025-25257, affects Fortinet’s FortiWeb web application firewall and carries a severe CVSS score of 9.6 out of 10.CVE-2025-25257 exploitation activity observed since Jul 11th,” The Shadowserver Foundation reported.", "is_search_result": true } ], "timestamp": "2025-09-06T17:24:39.189933" }, "cache_timestamp": "2025-09-06T17:25:00.610778", "displayed_on_website": false }, { "cve_id": "CVE-2025-25181", "cvss_score": "5.8", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2025-02-03T00:00:00.000Z", "cve_published_date_formatted": "2025-02-03", "kev_date_added": "2025-03-10", "kev_date_added_formatted": "2025-03-10", "kev_due_date": "2025-03-31", "days_to_kev": 35, "days_since_kev": null, "is_new_kev": false, "summary": "SQL injection vulnerability in Advantive VeraCore's timeoutWarning.asp allows remote attackers to execute arbitrary SQL commands without authentication. This vulnerability is actively exploited in the wild and listed in CISA KEV catalog.", "detailed_analysis": { "vulnerability_type": "SQL Injection (CWE-89) in web application endpoint allowing arbitrary SQL command execution", "affected_products": [ "Advantive VeraCore" ], "exploitation_requirements": [ "Network access to web application", "No authentication required", "Direct HTTP request to timeoutWarning.asp endpoint" ], "internet_facing_likelihood": "VeraCore is a healthcare practice management and electronic health records (EHR) system that commonly requires web-based access for healthcare providers, staff, and potentially patients. Such systems are frequently deployed with internet-facing components to enable remote access from clinics, mobile devices, and partner systems. Estimated 70-80% of deployments have internet-accessible components.", "typical_deployment": "Web-based healthcare management application typically deployed on servers with database backend, designed for multi-user access across healthcare organizations", "deployment_statistics": "Approximately 70-80% of healthcare management systems like VeraCore are deployed with internet-facing components to support remote access, telemedicine, patient portals, and inter-facility communication", "active_exploitation": "CISA SSVC assessment indicates active exploitation with automatable attacks achieving total technical impact. Added to CISA KEV catalog on 2025-03-10, indicating confirmed exploitation in the wild by threat actors including the XE Group", "severity_factors": [ "No authentication required for exploitation", "Network-accessible attack vector", "Active exploitation confirmed", "SQL injection allows database compromise", "Healthcare data at risk" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild by XE Group and other threat actors. Review web server logs for suspicious requests to timeoutWarning.asp, check database logs for unauthorized queries, verify system integrity and patient data security", "Apply vendor patches immediately - contact Advantive for emergency patches for versions through 2025.1.0", "Implement web application firewall (WAF) rules to block SQL injection attempts on timeoutWarning.asp endpoint as emergency mitigation", "Monitor database activity for unauthorized access or data exfiltration", "Consider temporarily restricting internet access to VeraCore systems if patching cannot be completed immediately", "Patch priority: EMERGENCY - Active exploitation targeting healthcare systems" ], "risk_assessment": { "exploit_likelihood": "Very High - Active exploitation confirmed with CISA KEV listing and threat actor campaigns documented. No authentication required and attack vector is network-accessible.", "impact_assessment": "High - SQL injection can lead to complete database compromise, patient data theft, system manipulation, and potential ransomware deployment in healthcare environments", "exposure_scope": "Moderate to High - Healthcare organizations using VeraCore with internet-facing deployments are at immediate risk. Given the healthcare sector's digital transformation and remote access requirements, significant number of vulnerable systems likely exposed" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:40:17.383808", "displayed_on_website": false }, { "cve_id": "CVE-2025-24993", "cvss_score": "7.8", "attack_vector": "LOCAL", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1068", "deployment_likelihood": "LOW", "cve_published_date": "2025-03-11T16:59:20.302Z", "cve_published_date_formatted": "2025-03-11", "kev_date_added": "2025-03-11", "kev_date_added_formatted": "2025-03-11", "kev_due_date": "2025-04-01", "days_to_kev": 0, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2025-24993 is a heap-based buffer overflow in Windows NTFS that allows local code execution with user interaction required. Despite being on CISA KEV, this is a LOCAL vulnerability (CVSS AV:L/UI:R) affecting the NTFS file system, not internet-facing services.", "detailed_analysis": { "vulnerability_type": "Heap-based buffer overflow in Windows NTFS file system allowing local code execution", "affected_products": [ "Windows 10 (all versions)", "Windows 11 (all versions)", "Windows Server 2008", "Windows Server 2008 R2", "Windows Server 2012", "Windows Server 2012 R2", "Windows Server 2016", "Windows Server 2019", "Windows Server 2022", "Windows Server 2025" ], "exploitation_requirements": [ "Local access to target system", "User interaction required (UI:R)", "No privileges required initially (PR:N)", "Ability to trigger NTFS parsing" ], "internet_facing_likelihood": "This is NOT an internet-facing vulnerability. NTFS is a local file system component, not a network service. The CVSS vector AV:L confirms this is LOCAL attack vector only. While Windows Servers are internet-facing, this vulnerability affects the local file system, not network services.", "typical_deployment": "NTFS is the default file system for Windows operating systems - both client and server. It handles local file operations, not network communications.", "deployment_statistics": "0% of NTFS deployments are directly internet-facing as NTFS is a local file system, not a network protocol or service", "active_exploitation": "Listed in CISA KEV catalog, indicating active exploitation in the wild, likely through malicious files or local attack chains", "severity_factors": [ "POSITIVE: Listed in CISA KEV - active exploitation", "POSITIVE: High CVSS score (7.8) with complete CIA impact", "POSITIVE: No authentication required initially", "NEGATIVE: LOCAL attack vector only", "NEGATIVE: User interaction required", "NEGATIVE: Not directly internet-exploitable" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Apply Microsoft security updates immediately for all affected Windows systems", "Monitor for suspicious file operations and unexpected privilege escalations", "Implement application whitelisting and endpoint detection to prevent malicious file execution", "Review user access patterns and file system activities for anomalies", "PATCH PRIORITY: HIGH due to CISA KEV listing and active exploitation" ], "risk_assessment": { "exploit_likelihood": "HIGH for local attacks - CISA KEV listing confirms active exploitation, likely through malicious files or as part of attack chains requiring initial local access", "impact_assessment": "HIGH - Complete compromise of confidentiality, integrity, and availability on affected local system with potential for privilege escalation", "exposure_scope": "NOT directly internet-facing - affects local file system operations only, requires local access or delivery via other attack vectors (email, downloads, etc.)" }, "exploitation_method": "USER_INTERACTION", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:40:39.704213", "displayed_on_website": false }, { "cve_id": "CVE-2025-24991", "cvss_score": "5.5", "attack_vector": "LOCAL", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1068", "deployment_likelihood": "N/A", "cve_published_date": "2025-03-11T16:59:19.319Z", "cve_published_date_formatted": "2025-03-11", "kev_date_added": "2025-03-11", "kev_date_added_formatted": "2025-03-11", "kev_due_date": "2025-04-01", "days_to_kev": 0, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2025-24991 is an out-of-bounds read vulnerability in Windows NTFS that allows local information disclosure. Despite being on CISA KEV, this is a local vulnerability requiring existing system access and user interaction, not directly exploitable over the internet.", "detailed_analysis": { "vulnerability_type": "Out-of-bounds read in Windows NTFS file system (CWE-125) allowing information disclosure", "affected_products": [ "Windows 10 (all versions)", "Windows 11 (all versions)", "Windows Server 2008", "Windows Server 2012", "Windows Server 2016", "Windows Server 2019", "Windows Server 2022", "Windows Server 2025" ], "exploitation_requirements": [ "Local access to the system required", "User interaction required (UI:R in CVSS)", "No network privileges needed", "Access to NTFS file system" ], "internet_facing_likelihood": "This vulnerability affects the Windows NTFS file system, which is not a network-facing service. While Windows Servers may be internet-facing, the NTFS vulnerability itself requires local access to the file system and cannot be exploited remotely over the network. The CVSS vector AV:L (Local) confirms this is not a network-exploitable vulnerability.", "typical_deployment": "NTFS is the default file system for Windows operating systems, present on both client systems (Windows 10/11) and server systems (Windows Server). It handles local file operations and storage management.", "deployment_statistics": "0% internet-facing - NTFS is a local file system component that does not expose network services. While the affected Windows systems may run internet-facing applications, the NTFS vulnerability itself cannot be exploited over the network.", "active_exploitation": "Listed in CISA KEV indicating active exploitation, likely used as part of multi-stage attacks for local privilege escalation or information gathering after initial system compromise", "severity_factors": [ "Local attack vector only (AV:L)", "Requires user interaction (UI:R)", "Information disclosure only (no integrity/availability impact)", "Active exploitation confirmed by CISA KEV listing", "Affects wide range of Windows systems", "Medium CVSS score of 5.5" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Apply Microsoft security updates immediately for all affected Windows systems", "Monitor for unusual NTFS file system access patterns or information disclosure attempts", "Review system logs for signs of local privilege escalation attempts", "Implement endpoint detection and response (EDR) solutions to detect exploitation attempts", "Priority: HIGH for patching due to CISA KEV status, but note this is not directly internet-exploitable" ], "risk_assessment": { "exploit_likelihood": "Low for direct internet exploitation (impossible due to local attack vector), but high for post-compromise scenarios given CISA KEV listing", "impact_assessment": "Medium - allows information disclosure from NTFS file system, potentially exposing sensitive data to attackers with local access", "exposure_scope": "Zero internet-facing systems directly affected - this vulnerability requires local access and cannot be exploited remotely over the network" }, "exploitation_method": "OTHER", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:41:03.401082", "displayed_on_website": false }, { "cve_id": "CVE-2025-24990", "cvss_score": "7.8", "attack_vector": "LOCAL", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1068", "deployment_likelihood": "LOW", "cve_published_date": "2025-10-14T17:00:10.973Z", "cve_published_date_formatted": "2025-10-14", "kev_date_added": "2025-10-14", "kev_date_added_formatted": "2025-10-14", "kev_due_date": "2025-11-04", "days_to_kev": 0, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2025-24990 is a local privilege escalation vulnerability in the Agere Modem driver affecting multiple Windows versions. Despite being listed in CISA KEV, this is a local vulnerability requiring existing system access and is not directly exploitable over the internet.", "detailed_analysis": { "vulnerability_type": "Untrusted pointer dereference in third-party Agere Modem driver (ltmdm64.sys) leading to elevation of privilege", "affected_products": [ "Windows 10 (multiple versions)", "Windows 11 (multiple versions)", "Windows Server 2008 SP2", "Windows Server 2008 R2 SP1", "Windows Server 2012/R2", "Windows Server 2016", "Windows Server 2019", "Windows Server 2022", "Windows Server 2025" ], "exploitation_requirements": [ "Local access to the system required", "Low privileges on the target system", "Presence of vulnerable Agere modem driver" ], "internet_facing_likelihood": "This is a kernel driver vulnerability that affects the local Windows system. While Windows Servers can be internet-facing, the vulnerability itself is not in a network service but in a local modem driver. The driver vulnerability requires local access to exploit and cannot be triggered remotely over the network. Even on internet-facing Windows servers, this specific vulnerability would require an attacker to already have local system access.", "typical_deployment": "The Agere modem driver is a legacy hardware driver for fax modems that ships with Windows. It runs at kernel level but is not a network service. Windows client systems and servers may have this driver, but the driver itself is not internet-accessible.", "deployment_statistics": "0% - This vulnerability is in a local kernel driver, not a network service. While the affected Windows systems may be internet-facing, the vulnerable driver component itself cannot be exploited directly from the internet.", "active_exploitation": "Listed in CISA KEV indicating active exploitation in the wild, but as a privilege escalation component in attack chains rather than initial access", "severity_factors": [ "High CVSS score (7.8) due to complete system compromise potential", "Kernel-level vulnerability allowing full system control", "Active exploitation confirmed by CISA KEV listing", "Affects wide range of Windows versions", "Limited to local privilege escalation (not remote)", "Microsoft has removed the driver in October cumulative update" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Apply October 2025 cumulative updates immediately to remove the vulnerable ltmdm64.sys driver", "Monitor for unusual privilege escalation activities or unauthorized administrative access", "Remove dependencies on legacy fax modem hardware as Microsoft has permanently removed driver support", "HIGH priority patching due to active exploitation and kernel-level impact" ], "risk_assessment": { "exploit_likelihood": "High for systems where attackers already have local access, but cannot be exploited directly from the internet", "impact_assessment": "Complete system compromise with kernel-level access once local access is obtained", "exposure_scope": "Limited to systems where attackers have already gained initial access through other means" }, "exploitation_method": "OTHER", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:19:00.697740", "displayed_on_website": false }, { "cve_id": "CVE-2025-24989", "cvss_score": "8.2", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2025-02-19T22:18:21.618Z", "cve_published_date_formatted": "2025-02-19", "kev_date_added": "2025-02-21", "kev_date_added_formatted": "2025-02-21", "kev_due_date": "2025-03-14", "days_to_kev": 2, "days_since_kev": null, "is_new_kev": false, "summary": "Microsoft Power Pages contains an improper access control vulnerability that allows unauthorized attackers to elevate privileges over a network, potentially bypassing user registration controls. This vulnerability is actively exploited in the wild and affects a cloud-based web application platform that is inherently internet-facing.", "detailed_analysis": { "vulnerability_type": "Improper Access Control (CWE-284) leading to privilege escalation and registration control bypass", "affected_products": [ "Microsoft Power Pages" ], "exploitation_requirements": [ "Network access to Power Pages application", "No authentication required (PR:N)", "No user interaction required (UI:N)" ], "internet_facing_likelihood": "Microsoft Power Pages is a cloud-based platform for creating external-facing websites and web applications. By design, these applications are intended to be accessible from the internet to serve external users, customers, and partners. Virtually 100% of Power Pages deployments are internet-facing as this is the platform's primary purpose.", "typical_deployment": "Power Pages is a cloud-based web application platform (Software-as-a-Service) that enables organizations to create public-facing websites, customer portals, and partner portals. The entire purpose of the platform is to host internet-accessible web applications.", "deployment_statistics": "Estimated 95-100% of Power Pages deployments are internet-facing, as the platform is specifically designed for creating external-facing web applications and customer portals that need to be accessible from the public internet.", "active_exploitation": "Listed in CISA KEV catalog indicating confirmed active exploitation in the wild. Microsoft states the vulnerability has already been mitigated in the service and affected customers have been notified.", "severity_factors": [ "Network-based attack vector", "No authentication required", "No user interaction needed", "High integrity impact", "Active exploitation confirmed", "Cloud-based service with wide deployment", "Registration control bypass allows unauthorized access" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Review Power Pages applications for signs of unauthorized user registrations or privilege escalations", "Follow Microsoft's cleanup instructions if you received notification of being affected", "Monitor Power Pages access logs for suspicious activity or unauthorized access attempts", "Verify user access controls and permissions are properly configured", "Patch priority: IMMEDIATE - vulnerability is cloud-based and already patched by Microsoft, but affected customers should follow remediation guidance" ], "risk_assessment": { "exploit_likelihood": "VERY HIGH - Active exploitation confirmed, no authentication required, network-accessible, affects inherently internet-facing platform", "impact_assessment": "HIGH - Privilege escalation and registration control bypass could allow unauthorized access to sensitive customer data and application functionality", "exposure_scope": "Potentially affects all internet-facing Power Pages deployments that were vulnerable before Microsoft's service-side mitigation" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:33:52.204092", "displayed_on_website": false }, { "cve_id": "CVE-2025-24985", "cvss_score": "7.8", "attack_vector": "LOCAL", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1068", "deployment_likelihood": "LOW", "cve_published_date": "2025-03-11T16:59:18.750Z", "cve_published_date_formatted": "2025-03-11", "kev_date_added": "2025-03-11", "kev_date_added_formatted": "2025-03-11", "kev_due_date": "2025-04-01", "days_to_kev": 0, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2025-24985 is an integer overflow vulnerability in the Windows Fast FAT File System Driver that allows local code execution. The vulnerability requires local access and user interaction (mounting/accessing malicious FAT file systems), making it unsuitable for direct internet exploitation despite being in CISA KEV.", "detailed_analysis": { "vulnerability_type": "Integer overflow/wraparound leading to heap-based buffer overflow in Windows Fast FAT file system driver", "affected_products": [ "Windows Server 2019", "Windows Server 2022", "Windows Server 2016", "Windows Server 2012/2012 R2", "Windows Server 2008/2008 R2", "Windows Server 2025", "Windows 10 (various versions)", "Windows 11 (various versions)" ], "exploitation_requirements": [ "Local access to target system", "User interaction to mount/access malicious FAT file system", "Ability to present crafted FAT file system to target" ], "internet_facing_likelihood": "The Fast FAT file system driver is a kernel-level component that processes file system operations locally. While Windows Servers are commonly internet-facing, this specific vulnerability requires local file system interaction and cannot be exploited remotely over network protocols. The FAT driver itself is not a network service and does not listen on network ports.", "typical_deployment": "This is a core Windows kernel driver present on all Windows installations (client and server). Windows Servers are frequently internet-facing for web services, file sharing, and applications, but the Fast FAT driver specifically handles local file system operations.", "deployment_statistics": "While ~80% of Windows Server deployments may be internet-accessible, 0% of Fast FAT driver instances are directly exploitable over the internet due to the local attack vector requirement. The driver only processes locally mounted file systems.", "active_exploitation": "Listed in CISA KEV indicating active exploitation in the wild, likely through malicious removable media, network file shares, or as part of multi-stage attacks", "severity_factors": [ "High CVSS score (7.8) due to potential for full system compromise", "Kernel-level code execution capability", "No authentication required once local access obtained", "Active exploitation documented by CISA KEV listing", "Limited to local attack vector reduces immediate internet risk" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Apply Microsoft security updates immediately for all affected Windows systems", "Monitor for suspicious file system activity and unexpected FAT file system mounts", "Restrict removable media usage and network file share access where possible", "Implement endpoint detection and response (EDR) monitoring for kernel-level exploitation attempts", "HIGH PRIORITY patching due to CISA KEV status and kernel-level impact potential" ], "risk_assessment": { "exploit_likelihood": "High for targeted attacks using local access vectors (malicious USB drives, network shares, multi-stage attacks), but very low for direct internet exploitation due to local attack vector requirement", "impact_assessment": "High - successful exploitation provides kernel-level code execution with potential for full system compromise, privilege escalation, and persistent access", "exposure_scope": "All Windows systems are affected, but direct internet exploitation is not possible. Risk is primarily from local attack vectors and multi-stage campaigns" }, "exploitation_method": "OTHER", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:41:27.499509", "displayed_on_website": false }, { "cve_id": "CVE-2025-24984", "cvss_score": "4.6", "attack_vector": "PHYSICAL", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1005", "deployment_likelihood": "VERY_LOW", "cve_published_date": "2025-03-11T16:59:18.193Z", "cve_published_date_formatted": "2025-03-11", "kev_date_added": "2025-03-11", "kev_date_added_formatted": "2025-03-11", "kev_due_date": "2025-04-01", "days_to_kev": 0, "days_since_kev": null, "is_new_kev": false, "summary": "Windows NTFS information disclosure vulnerability that allows unauthorized attackers to access sensitive information from log files through physical access to affected systems. Despite being in CISA KEV, this requires physical access and cannot be exploited remotely over the internet.", "detailed_analysis": { "vulnerability_type": "Information disclosure through sensitive data insertion into NTFS log files (CWE-532)", "affected_products": [ "Windows Server 2012/2012 R2", "Windows Server 2016", "Windows Server 2019", "Windows Server 2022", "Windows Server 2025", "Windows 10 (all versions)", "Windows 11 (all versions)" ], "exploitation_requirements": [ "Physical access to target system required", "Ability to access NTFS log files", "No network access needed", "No authentication bypass capabilities" ], "internet_facing_likelihood": "This vulnerability affects the Windows NTFS file system logging mechanism, which is not an internet-facing service. While Windows Servers may be internet-facing, the NTFS logging component itself is not accessible remotely and requires physical access to exploit.", "typical_deployment": "NTFS is a core file system component present on all Windows installations (both client and server), but the vulnerability specifically affects local file system logging that is not exposed through network services", "deployment_statistics": "0% of NTFS implementations are directly internet-accessible as this affects local file system logging, not network services. Physical access is mandatory for exploitation.", "active_exploitation": "Listed in CISA KEV indicating active exploitation, but exploitation requires physical access to systems rather than remote network attacks", "severity_factors": [ "Requires physical access (major limitation)", "Information disclosure only (no RCE)", "Affects core Windows file system component (widespread deployment)", "CISA KEV listing indicates active exploitation in targeted attacks" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review NTFS logs for unauthorized access patterns, check for physical security breaches, verify data integrity", "Apply Microsoft security updates immediately to patch the NTFS logging vulnerability", "Enhance physical security controls for critical Windows systems", "Monitor for unauthorized physical access to systems and data centers", "Review and audit NTFS log files for potential data exposure", "HIGH patch priority due to CISA KEV status despite physical access requirement" ], "risk_assessment": { "exploit_likelihood": "Low for internet-based attacks (requires physical access), but high for insider threats or targeted attacks with physical access capability", "impact_assessment": "Medium - information disclosure of sensitive data from NTFS logs, but no direct system compromise or remote code execution", "exposure_scope": "All Windows systems are affected, but internet exploitation is not possible due to physical access requirement" }, "exploitation_method": "OTHER", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:41:48.460935", "displayed_on_website": false }, { "cve_id": "CVE-2025-24983", "cvss_score": "7.0", "attack_vector": "LOCAL", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1068", "deployment_likelihood": "VERY_LOW", "cve_published_date": "2025-03-11T16:59:17.608Z", "cve_published_date_formatted": "2025-03-11", "kev_date_added": "2025-03-11", "kev_date_added_formatted": "2025-03-11", "kev_due_date": "2025-04-01", "days_to_kev": 0, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2025-24983 is a local privilege escalation vulnerability in the Windows Win32 Kernel Subsystem affecting older Windows versions. The CVSS attack vector is LOCAL (AV:L), requiring an authorized attacker with existing system access to exploit a use-after-free condition for privilege escalation.", "detailed_analysis": { "vulnerability_type": "Use After Free (CWE-416) in Windows Win32 Kernel Subsystem leading to local privilege escalation", "affected_products": [ "Windows Server 2008 SP2", "Windows Server 2012", "Windows Server 2012 R2", "Windows Server 2016", "Windows 10 (versions 1507, 1607)" ], "exploitation_requirements": [ "Local access to the system required", "Valid user credentials needed", "No network connectivity required", "No user interaction needed once access is obtained" ], "internet_facing_likelihood": "This is a local privilege escalation vulnerability in the Windows kernel subsystem, not in internet-facing services. While Windows Servers may be internet-facing, the vulnerable component (Win32 Kernel Subsystem) is not directly accessible from the internet. Exploitation requires an attacker to already have local access to the system.", "typical_deployment": "The affected products include both client operating systems (Windows 10) and server operating systems (Windows Server). However, the vulnerable component is part of the core OS kernel subsystem, not internet-facing applications or services.", "deployment_statistics": "Less than 5% direct internet exposure risk - the Win32 Kernel Subsystem is not an internet-facing service. Even when these Windows versions run internet-facing services, the kernel subsystem itself is not directly accessible from external networks.", "active_exploitation": "Listed in CISA KEV catalog indicating active exploitation in the wild. CISA SSVC assessment shows 'Exploitation: active' and 'Technical Impact: total'.", "severity_factors": [ "HIGH: Active exploitation confirmed by CISA KEV listing", "HIGH: Total technical impact with full system compromise potential", "MEDIUM: Affects multiple Windows versions including servers", "LOW: Requires local access, limiting attack surface", "LOW: Primarily affects older Windows versions" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Apply Microsoft security updates immediately for affected Windows versions", "Monitor for unusual privilege escalation activities and unauthorized system access", "Review user access controls and implement principle of least privilege", "Consider upgrading from legacy Windows versions (2008, 2012) to supported versions", "Implement endpoint detection and response (EDR) solutions to detect kernel exploitation attempts" ], "risk_assessment": { "exploit_likelihood": "HIGH for systems where attackers have already gained initial access through other means. The vulnerability requires local access, so it's typically used as a second-stage attack for privilege escalation.", "impact_assessment": "CRITICAL - successful exploitation provides full system privileges (SYSTEM/Administrator level access), allowing complete system compromise, data theft, and persistence establishment.", "exposure_scope": "Limited direct internet exposure since this is a local privilege escalation vulnerability. Primary risk is to organizations where attackers have gained initial foothold through other attack vectors (phishing, RDP compromise, etc.)" }, "exploitation_method": "OTHER", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:42:12.957502", "displayed_on_website": false }, { "cve_id": "CVE-2025-24893", "cvss_score": "9.8", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2025-02-20T19:19:10.597Z", "cve_published_date_formatted": "2025-02-20", "kev_date_added": "2025-10-30", "kev_date_added_formatted": "2025-10-30", "kev_due_date": "2025-11-20", "days_to_kev": 252, "days_since_kev": null, "is_new_kev": false, "summary": "XWiki Platform contains a critical remote code execution vulnerability (CVE-2025-24893) that allows unauthenticated attackers to execute arbitrary code via the SolrSearch endpoint. This vulnerability affects a widely-deployed enterprise wiki platform that is commonly internet-facing and has been added to CISA's Known Exploited Vulnerabilities catalog.", "detailed_analysis": { "vulnerability_type": "Remote Code Execution via Eval Injection (CWE-95) in SolrSearch functionality", "affected_products": [ "XWiki Platform" ], "exploitation_requirements": [ "Network access to XWiki instance", "No authentication required (guest access)", "No user interaction required" ], "internet_facing_likelihood": "XWiki Platform is enterprise wiki software designed for collaboration and knowledge management. As a web-based application platform, it is commonly deployed as internet-facing to enable remote team collaboration, customer documentation portals, and public knowledge bases. Estimated 60-80% of XWiki deployments are internet-accessible given its primary use case as a collaborative platform.", "typical_deployment": "XWiki Platform is server software - a Java-based web application that runs on application servers (Tomcat, Jetty) and requires a database backend. It's designed as a collaborative platform requiring web access for users.", "deployment_statistics": "Approximately 70% of XWiki deployments are likely internet-facing as organizations use it for public documentation, customer portals, team collaboration across distributed teams, and knowledge sharing platforms that require external access.", "active_exploitation": "CVE-2025-24893 has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog on 2025-10-30, indicating confirmed active exploitation in the wild by threat actors.", "severity_factors": [ "CVSS 9.8 Critical severity", "No authentication required", "Complete system compromise possible", "Simple HTTP GET request exploitation", "CISA KEV listing indicates active exploitation", "Affects widely-used enterprise collaboration platform" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs for suspicious SolrSearch requests, check for unauthorized access, verify system integrity, and scan for web shells or backdoors", "URGENT: Immediately upgrade to XWiki 15.10.11, 16.4.1, or 16.5.0RC1 or later versions", "TEMPORARY MITIGATION: If immediate patching is not possible, edit Main.SolrSearchMacros in SolrSearchMacros.xml on line 955 to match the rawResponse macro implementation", "Monitor web server logs for requests to /xwiki/bin/get/Main/SolrSearch with suspicious parameters", "Implement web application firewall rules to block malicious SolrSearch requests", "PATCH PRIORITY: Emergency - patch within 24-48 hours due to CISA KEV status and ease of exploitation" ], "risk_assessment": { "exploit_likelihood": "Very High - Simple HTTP GET request with no authentication required, CISA KEV listing confirms active exploitation, and public proof-of-concept is available in the vulnerability disclosure", "impact_assessment": "Critical - Complete system compromise including arbitrary code execution, full confidentiality/integrity/availability impact, potential for data theft, system manipulation, and lateral movement within network", "exposure_scope": "High - XWiki Platform is used by enterprises globally for collaboration and documentation, with an estimated several thousand internet-facing instances vulnerable to this easily exploitable flaw" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:21:35.135401", "displayed_on_website": false }, { "cve_id": "CVE-2025-24813", "cvss_score": "10.0", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2025-03-10T16:44:03.715Z", "cve_published_date_formatted": "2025-03-10", "kev_date_added": "2025-04-01", "kev_date_added_formatted": "2025-04-01", "kev_due_date": "2025-04-22", "days_to_kev": 22, "days_since_kev": null, "is_new_kev": false, "summary": "Apache Tomcat path traversal vulnerability enabling remote code execution and information disclosure via malicious PUT requests. Affects millions of internet-facing web applications globally. Listed in CISA KEV with active exploitation evidence and public POCs available.", "detailed_analysis": { "vulnerability_type": "Path Equivalence (Internal Dot) leading to Remote Code Execution, Information Disclosure, and File Corruption via write-enabled Default Servlet", "affected_products": [ "Apache Tomcat (versions 8.5.0-8.5.100, 9.0.0.M1-9.0.98, 10.1.0-M1-10.1.34, 11.0.0-M1-11.0.2)" ], "exploitation_requirements": [ "Write-enabled default servlet (disabled by default)", "Partial PUT support (enabled by default)", "Network access to Tomcat server", "For RCE: file-based session persistence and vulnerable deserialization library" ], "internet_facing_likelihood": "Apache Tomcat is one of the most widely deployed web application servers globally, with an estimated 80-90% of production deployments being internet-facing as it primarily serves web applications and APIs to end users", "typical_deployment": "Server software - Apache Tomcat is a web application server that hosts Java web applications, REST APIs, and web services. It typically runs on ports 8080 or 443/80 and serves content to web browsers and API clients", "deployment_statistics": "Approximately 85-90% of Tomcat deployments are internet-facing as its primary purpose is to serve web applications and APIs to external users. Only internal enterprise applications or development environments would be non-internet-facing", "active_exploitation": "Listed in CISA KEV catalog with 'active exploitation' status. Public POCs available on GitHub. Exploitation confirmed in the wild", "severity_factors": [ "CVSS 10.0 Critical severity", "No authentication required", "Remote code execution possible", "Affects widely deployed web server", "Active exploitation confirmed", "Public POCs available" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "IMMEDIATE: Upgrade to Tomcat 11.0.3, 10.1.35, or 9.0.99 immediately", "URGENT: Disable write access for default servlet if not required (readonly=true)", "Monitor HTTP PUT requests and file upload activities in web server logs", "Scan for unauthorized files in webroot directories and session storage locations", "Patch priority: CRITICAL - Apply within 24-48 hours maximum" ], "risk_assessment": { "exploit_likelihood": "VERY HIGH - Active exploitation confirmed, public POCs available, no authentication required, affects default configurations", "impact_assessment": "CRITICAL - Full remote code execution, complete system compromise, data theft, malware deployment possible", "exposure_scope": "MASSIVE - Millions of internet-facing Tomcat servers worldwide potentially vulnerable, affecting major enterprises and cloud applications" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:47:22.164061", "displayed_on_website": false }, { "cve_id": "CVE-2025-24472", "cvss_score": "8.1", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2025-02-11T16:50:42.207Z", "cve_published_date_formatted": "2025-02-11", "kev_date_added": "2025-03-18", "kev_date_added_formatted": "2025-03-18", "kev_due_date": "2025-04-08", "days_to_kev": 35, "days_since_kev": null, "is_new_kev": false, "summary": "Authentication bypass vulnerability in Fortinet FortiOS and FortiProxy allows remote unauthenticated attackers to gain super-admin privileges via crafted CSF proxy requests when Security Fabric is enabled. This is actively exploited and listed in CISA KEV.", "detailed_analysis": { "vulnerability_type": "Authentication Bypass Using an Alternate Path or Channel (CWE-288)", "affected_products": [ "Fortinet FortiOS", "Fortinet FortiProxy" ], "exploitation_requirements": [ "Network access to vulnerable device", "Security Fabric feature enabled", "Knowledge of upstream and downstream device serial numbers" ], "internet_facing_likelihood": "FortiOS (FortiGate firewall OS) and FortiProxy are enterprise network security appliances that are very commonly deployed as internet-facing perimeter devices. Approximately 80-90% of FortiGate deployments are internet-facing as they serve as the primary firewall/gateway protecting enterprise networks. FortiProxy deployments as secure web gateways are also frequently internet-accessible.", "typical_deployment": "These are enterprise network infrastructure appliances - FortiOS runs on FortiGate firewalls which are typically deployed at network perimeters, and FortiProxy serves as secure web gateway appliances. Both commonly have internet-facing management and service interfaces.", "deployment_statistics": "Estimated 80-90% of FortiGate/FortiOS deployments are internet-facing as perimeter security devices. FortiProxy deployments are also commonly internet-accessible as secure web gateways. These are specifically designed to be deployed at network edges with internet connectivity.", "active_exploitation": "Listed in CISA KEV catalog indicating confirmed active exploitation in the wild", "severity_factors": [ "No authentication required", "Network attack vector", "Gains super-admin privileges", "Actively exploited", "High CVSS score of 8.1", "Affects widely-deployed enterprise security infrastructure" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately upgrade to FortiOS 7.0.17+ or FortiProxy 7.2.13+/7.0.20+", "Review Security Fabric configurations and disable if not required", "Monitor for unauthorized administrative access and configuration changes", "Implement additional network segmentation around management interfaces", "PATCH PRIORITY: CRITICAL - Active exploitation confirmed" ], "risk_assessment": { "exploit_likelihood": "Very High - Actively exploited with confirmed in-the-wild attacks, affects commonly internet-facing infrastructure", "impact_assessment": "Critical - Complete compromise with super-admin privileges allowing full device control, network reconfiguration, and potential lateral movement", "exposure_scope": "Very Large - Fortinet devices are widely deployed globally as internet-facing perimeter security appliances in enterprise environments" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Known", "ransomware_first_seen_date": "2026-06-04", "ransomware_days_after_kev": 443, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:44:06.236534", "displayed_on_website": false }, { "cve_id": "CVE-2025-24201", "cvss_score": "10.0", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1203", "deployment_likelihood": "VERY_LOW", "cve_published_date": "2025-03-11T18:07:21.848Z", "cve_published_date_formatted": "2025-03-11", "kev_date_added": "2025-03-13", "kev_date_added_formatted": "2025-03-13", "kev_due_date": "2025-04-03", "days_to_kev": 2, "days_since_kev": null, "is_new_kev": false, "summary": "An out-of-bounds write vulnerability in Apple's WebKit engine allows maliciously crafted web content to break out of the Web Content sandbox. This affects client devices (iOS, macOS, Safari) when users visit malicious websites, not internet-facing servers.", "detailed_analysis": { "vulnerability_type": "Out-of-bounds write (CWE-787) in WebKit web content rendering engine allowing sandbox escape", "affected_products": [ "Safari", "iOS and iPadOS", "macOS", "visionOS", "watchOS" ], "exploitation_requirements": [ "User must visit malicious website", "Vulnerable version of WebKit/Safari", "Maliciously crafted web content" ], "internet_facing_likelihood": "The affected products are primarily client operating systems and web browsers, not internet-facing server applications. These are end-user devices that consume web content rather than serve it. Estimated <1% of deployments would be internet-facing servers (e.g., macOS used as web server).", "typical_deployment": "These are client-side products: mobile devices (iOS/iPadOS), desktop computers (macOS), web browsers (Safari), and consumer devices (Apple Watch, Vision Pro). They are designed for end-user consumption of web content, not serving applications to the internet.", "deployment_statistics": "Less than 1% of these Apple products are deployed as internet-facing servers. The vast majority are consumer devices, laptops, phones, and tablets used by end users to browse the web, not to host web services.", "active_exploitation": "CISA KEV indicates active exploitation. Apple acknowledges exploitation in 'extremely sophisticated attacks against specific targeted individuals' prior to iOS 17.2. This appears to be targeted spyware/surveillance attacks.", "severity_factors": [ "Critical CVSS 10.0 score", "Active exploitation confirmed", "Sandbox escape capability", "Affects multiple Apple platforms", "Client-side vulnerability requiring user interaction" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately update to patched versions: iOS 18.3.2+, macOS 15.3.2+, Safari 18.3.1+, visionOS 2.3.2+, watchOS 11.4+", "Monitor for suspicious web activity and unexpected application behavior on Apple devices", "Consider temporary browsing restrictions for high-value targets until patches are applied", "CRITICAL priority for all Apple device updates due to active exploitation" ], "risk_assessment": { "exploit_likelihood": "High for targeted attacks against specific individuals, but requires user to visit malicious website. Not directly exploitable against internet-facing servers.", "impact_assessment": "Critical - successful exploitation allows breaking out of browser sandbox, potentially leading to device compromise and surveillance", "exposure_scope": "Billions of Apple devices potentially affected, but exploitation requires social engineering to get users to visit malicious sites" }, "exploitation_method": "USER_INTERACTION", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:43:22.326948", "displayed_on_website": false }, { "cve_id": "CVE-2025-24200", "cvss_score": "6.1", "attack_vector": "PHYSICAL", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1200", "deployment_likelihood": "VERY_LOW", "cve_published_date": "2025-02-10T19:04:45.242Z", "cve_published_date_formatted": "2025-02-10", "kev_date_added": "2025-02-12", "kev_date_added_formatted": "2025-02-12", "kev_due_date": "2025-03-05", "days_to_kev": 2, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2025-24200 is a physical access vulnerability in iOS/iPadOS that allows disabling USB Restricted Mode on locked devices. This requires direct physical access to the device and cannot be exploited over the internet.", "detailed_analysis": { "vulnerability_type": "Authorization bypass allowing USB Restricted Mode to be disabled on locked devices through physical attack", "affected_products": [ "iOS", "iPadOS" ], "exploitation_requirements": [ "Physical access to device", "Device must be locked", "Physical manipulation capability" ], "internet_facing_likelihood": "iOS and iPadOS are mobile operating systems for client devices (iPhones and iPads). These are not server applications and are not deployed as internet-facing services. While they connect to the internet, they do not expose listening services that can be directly exploited over the network. 0% of typical deployments are internet-facing servers.", "typical_deployment": "Client-side mobile operating systems running on personal devices (smartphones and tablets). Not server software.", "deployment_statistics": "0% internet-facing - these are client devices, not servers. The vulnerability requires physical access to the device itself.", "active_exploitation": "Apple acknowledges this vulnerability has been exploited in sophisticated attacks against specific targeted individuals, leading to CISA KEV listing", "severity_factors": [ "Requires physical access", "Bypasses security feature", "Active exploitation confirmed", "Targeted attacks against high-value individuals", "Cannot be exploited remotely" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Look for signs of unauthorized USB access or device tampering", "Immediately update to iOS 18.3.1, iPadOS 18.3.1, or iPadOS 17.7.5", "Review device access logs if available and check for unauthorized data extraction", "Implement physical security controls for high-value targets who may be subject to sophisticated attacks", "Consider additional endpoint detection and monitoring for targeted individuals" ], "risk_assessment": { "exploit_likelihood": "Low for general population, high for targeted individuals with physical device access by sophisticated attackers", "impact_assessment": "High - allows bypassing USB Restricted Mode which could enable data extraction from locked devices", "exposure_scope": "Limited to devices with physical access - not exploitable over internet" }, "exploitation_method": "OTHER", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:31:12.478791", "displayed_on_website": false }, { "cve_id": "CVE-2025-24085", "cvss_score": "10.0", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1068", "deployment_likelihood": "LOW", "cve_published_date": "2025-01-27T21:45:46.555Z", "cve_published_date_formatted": "2025-01-27", "kev_date_added": "2025-01-29", "kev_date_added_formatted": "2025-01-29", "kev_due_date": "2025-02-19", "days_to_kev": 2, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2025-24085 is a use-after-free vulnerability in Apple operating systems that allows a malicious application to elevate privileges. While it has a CVSS score of 10.0 and is in CISA KEV, this is primarily a local privilege escalation vulnerability affecting client-side Apple devices, not internet-facing servers.", "detailed_analysis": { "vulnerability_type": "Use-after-free memory corruption vulnerability (CWE-416) enabling privilege escalation", "affected_products": [ "iOS", "iPadOS", "macOS", "tvOS", "watchOS", "visionOS" ], "exploitation_requirements": [ "Malicious application already installed on device", "Local code execution capability", "Physical or remote access to compromised device" ], "internet_facing_likelihood": "Very low likelihood of internet-facing deployment. These are primarily client-side operating systems for consumer devices (phones, tablets, laptops, watches, Apple TV, VR headsets). While some macOS systems may run server applications, the vast majority of Apple devices affected by this CVE are not deployed as internet-facing servers. Less than 5% of affected deployments would be internet-accessible server configurations.", "typical_deployment": "These are client-side operating systems running on consumer devices - smartphones, tablets, laptops, smart watches, streaming devices, and VR headsets. Primary use cases are personal computing, not server infrastructure.", "deployment_statistics": "Estimated <5% of affected deployments are internet-facing. The overwhelming majority are personal devices behind firewalls/NAT. Some macOS systems may run development servers or small business applications, but this represents a tiny fraction of the install base.", "active_exploitation": "Apple confirms active exploitation against iOS versions before 17.2. CISA KEV listing indicates exploitation in the wild, likely targeting high-value individuals or organizations through spear-phishing or physical device compromise.", "severity_factors": [ "Active exploitation confirmed", "Privilege escalation enables full device compromise", "Memory corruption can lead to arbitrary code execution", "Affects billions of Apple devices globally", "Requires malicious app installation as prerequisite" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Update immediately to iOS 18.3, iPadOS 18.3, macOS 15.3, watchOS 11.3, tvOS 18.3, or visionOS 2.3", "Review installed applications for suspicious or unauthorized software, especially on high-value target devices", "Monitor for unusual privilege escalation attempts or system behavior on Apple devices", "Implement mobile device management (MDM) to control app installations in enterprise environments" ], "risk_assessment": { "exploit_likelihood": "High likelihood for targeted attacks against high-value individuals, but requires initial device compromise through malicious app installation. Direct internet exploitation likelihood is very low due to client-side nature of affected platforms.", "impact_assessment": "Complete device compromise with elevated privileges, potentially allowing data theft, surveillance, or lateral movement in enterprise networks", "exposure_scope": "Billions of Apple devices globally, but very few are directly internet-accessible for server-side exploitation. Risk is primarily through targeted attacks, spear-phishing, or physical device compromise." }, "exploitation_method": "OTHER", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:25:32.074046", "displayed_on_website": false }, { "cve_id": "CVE-2025-24054", "cvss_score": "6.5", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "MEDIUM_RISK", "confidence": "MEDIUM", "mitre_technique": "T1557", "deployment_likelihood": "HIGH", "cve_published_date": "2025-03-11T16:59:09.963Z", "cve_published_date_formatted": "2025-03-11", "kev_date_added": "2025-04-17", "kev_date_added_formatted": "2025-04-17", "kev_due_date": "2025-05-08", "days_to_kev": 37, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2025-24054 is an NTLM hash disclosure spoofing vulnerability affecting Windows operating systems that allows attackers to perform spoofing attacks over a network. The vulnerability enables credential theft and man-in-the-middle attacks against NTLM authentication, particularly affecting Windows Server deployments that are commonly internet-facing.", "detailed_analysis": { "vulnerability_type": "NTLM Hash Disclosure Spoofing Vulnerability - External Control of File Name or Path (CWE-73)", "affected_products": [ "Windows Server 2008 R2", "Windows Server 2012/2012 R2", "Windows Server 2016", "Windows Server 2019", "Windows Server 2022", "Windows Server 2025", "Windows 10 (various versions)", "Windows 11 (various versions)" ], "exploitation_requirements": [ "Network access to target system", "User interaction required (UI:R in CVSS)", "No authentication required (PR:N)", "Low attack complexity (AC:L)" ], "internet_facing_likelihood": "Windows Server systems are commonly deployed as internet-facing services including web servers, file servers, domain controllers, and application servers. While Windows client systems (Windows 10/11) are typically not internet-facing, Windows Server deployments frequently have internet exposure for business operations.", "typical_deployment": "Mixed deployment - Windows Server versions are server software commonly internet-facing, while Windows 10/11 are client operating systems typically behind firewalls. However, the vulnerability affects core NTLM authentication which is used across network services.", "deployment_statistics": "Approximately 40-60% of Windows Server deployments have some level of internet exposure through web services, remote access, or exposed network services that utilize NTLM authentication", "active_exploitation": "Listed in CISA KEV catalog indicating confirmed active exploitation in the wild", "severity_factors": [ "CISA KEV listing confirms active exploitation", "NTLM authentication widely used in enterprise environments", "Network-based attack vector", "No authentication required to exploit", "High confidentiality impact (credential theft)" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review authentication logs for suspicious NTLM authentication attempts, check for unauthorized access, verify domain controller and server integrity", "Apply Microsoft security updates immediately for all affected Windows systems", "Monitor NTLM authentication logs for unusual patterns or failed authentication attempts", "Consider implementing Kerberos authentication where possible to reduce NTLM attack surface", "Patch priority: CRITICAL for internet-facing Windows Server systems, HIGH for internal Windows systems" ], "risk_assessment": { "exploit_likelihood": "HIGH - Active exploitation confirmed by CISA KEV listing, network-based attack vector with low complexity", "impact_assessment": "HIGH - Credential theft and authentication spoofing can lead to lateral movement, privilege escalation, and data breach", "exposure_scope": "Significant - Windows Server systems widely deployed in internet-facing configurations, millions of potentially vulnerable systems" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:50:14.411540", "displayed_on_website": false }, { "cve_id": "CVE-2025-24016", "cvss_score": "9.9", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2025-02-10T19:08:09.058Z", "cve_published_date_formatted": "2025-02-10", "kev_date_added": "2025-06-10", "kev_date_added_formatted": "2025-06-10", "kev_due_date": "2025-07-01", "days_to_kev": 120, "days_since_kev": null, "is_new_kev": false, "summary": "Critical unsafe deserialization vulnerability in Wazuh security platform allows remote code execution through the DistributedAPI. Attackers with API access can inject malicious dictionaries to execute arbitrary Python code on Wazuh servers.", "detailed_analysis": { "vulnerability_type": "Unsafe deserialization (CWE-502) leading to remote code execution through DistributedAPI parameter injection", "affected_products": [ "Wazuh Security Platform" ], "exploitation_requirements": [ "Network access to Wazuh API", "Low-level API privileges", "No user interaction required" ], "internet_facing_likelihood": "Wazuh is a security information and event management (SIEM) platform that commonly requires internet connectivity for centralized log collection, agent communication, and dashboard access. Security operations centers frequently deploy Wazuh servers with internet-accessible APIs for distributed monitoring across multiple locations and cloud environments. Estimated 60-80% of enterprise deployments have some internet-facing components.", "typical_deployment": "Wazuh is deployed as a server-side security platform consisting of managers, workers, and dashboard components that collect and analyze security data from distributed agents across networks and cloud environments", "deployment_statistics": "Approximately 70% of Wazuh deployments likely have internet-facing components due to the distributed nature of modern security operations requiring centralized log collection from remote locations, cloud instances, and branch offices", "active_exploitation": "Listed in CISA KEV catalog with active exploitation confirmed as of June 2025, indicating threat actors are actively targeting this vulnerability", "severity_factors": [ "Critical CVSS score of 9.9", "Remote code execution capability", "Low privilege requirement", "No user interaction needed", "Active exploitation confirmed", "Affects critical security infrastructure" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately update to Wazuh version 4.9.1 or later", "Audit API access logs for suspicious requests or unusual deserialization activity", "Implement network segmentation to limit API exposure and monitor API endpoints", "Review and restrict API access privileges following principle of least privilege", "Deploy additional monitoring for unusual Python process execution on Wazuh servers" ], "risk_assessment": { "exploit_likelihood": "Very high - CISA KEV listing confirms active exploitation, vulnerability has low complexity with network attack vector and minimal privileges required", "impact_assessment": "Critical - successful exploitation provides remote code execution on security infrastructure, potentially compromising entire security monitoring capabilities and exposing sensitive security data", "exposure_scope": "High - Wazuh is widely deployed in enterprise environments for security monitoring, with significant percentage of deployments requiring internet connectivity for distributed operations" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:05:21.593464", "displayed_on_website": false }, { "cve_id": "CVE-2025-23209", "cvss_score": "8.1", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2025-01-18T00:32:54.954Z", "cve_published_date_formatted": "2025-01-18", "kev_date_added": "2025-02-20", "kev_date_added_formatted": "2025-02-20", "kev_due_date": "2025-03-13", "days_to_kev": 33, "days_since_kev": null, "is_new_kev": false, "summary": "Remote Code Execution vulnerability in Craft CMS when the security key is compromised. This vulnerability has been actively exploited in the wild and is listed in CISA KEV catalog.", "detailed_analysis": { "vulnerability_type": "Remote Code Execution (RCE) via Code Injection (CWE-94)", "affected_products": [ "Craft CMS 4.x (< 4.13.8)", "Craft CMS 5.x (< 5.5.5)" ], "exploitation_requirements": [ "Compromised security key", "Low-level privileges", "User interaction required" ], "internet_facing_likelihood": "Craft CMS is a content management system specifically designed for building and managing web applications and websites. By its very nature as a web CMS, virtually 100% of Craft CMS deployments are internet-facing to serve websites and web applications to users. The software's primary function is to provide web-based content management, making internet exposure essential rather than optional.", "typical_deployment": "Server-side web application deployed on web servers to power public websites, e-commerce platforms, corporate sites, and web applications", "deployment_statistics": "Approximately 98-100% of Craft CMS deployments are internet-facing as the software is specifically designed to serve web content to public users. Only development/staging environments might be behind firewalls.", "active_exploitation": "Confirmed active exploitation - CVE added to CISA Known Exploited Vulnerabilities (KEV) catalog on 2025-02-20, with SSVC noting 'active' exploitation status", "severity_factors": [ "High CVSS score of 8.1", "Active exploitation confirmed by CISA", "RCE capability allows complete system compromise", "Affects widely-deployed CMS platform", "Requires compromised security key as prerequisite" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately update to Craft CMS 5.5.8+ or 4.13.8+ - this is an emergency patch", "Rotate security keys immediately and ensure their confidentiality going forward", "Review access logs for suspicious activity and unauthorized code execution attempts", "Implement network monitoring for unusual outbound connections from CMS servers", "PATCH PRIORITY: CRITICAL - Apply patches immediately due to active exploitation" ], "risk_assessment": { "exploit_likelihood": "Very High - Active exploitation confirmed by CISA KEV listing, with RCE capability against internet-facing CMS deployments", "impact_assessment": "Critical - Complete system compromise possible through remote code execution, allowing attackers full control over web servers and hosted content", "exposure_scope": "Thousands of internet-facing Craft CMS installations globally are potentially vulnerable, with near-universal internet exposure due to the nature of CMS deployments" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:33:27.453820", "displayed_on_website": false }, { "cve_id": "CVE-2025-23006", "cvss_score": "9.8", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2025-01-23T11:37:41.148Z", "cve_published_date_formatted": "2025-01-23", "kev_date_added": "2025-01-24", "kev_date_added_formatted": "2025-01-24", "kev_due_date": "2025-02-14", "days_to_kev": 1, "days_since_kev": null, "is_new_kev": false, "summary": "Critical pre-authentication deserialization vulnerability in SonicWall SMA1000 remote access appliances that allows unauthenticated remote attackers to execute arbitrary OS commands. This vulnerability is actively being exploited in the wild according to CISA KEV.", "detailed_analysis": { "vulnerability_type": "Pre-authentication deserialization of untrusted data (CWE-502) leading to remote code execution", "affected_products": [ "SonicWall SMA1000" ], "exploitation_requirements": [ "Network access to management console", "No authentication required", "No user interaction required" ], "internet_facing_likelihood": "SonicWall SMA1000 appliances are secure remote access gateways specifically designed to be internet-facing. The Appliance Management Console (AMC) and Central Management Console (CMC) are administrative interfaces that are commonly exposed to the internet for remote management. Estimated 85-95% of deployments are internet-accessible as this is the primary use case for remote access appliances.", "typical_deployment": "Enterprise network appliance deployed as internet-facing remote access gateway for SSL VPN and secure remote access services", "deployment_statistics": "90%+ of SMA1000 deployments are internet-facing as these are specifically remote access appliances designed to provide secure connectivity from the internet to corporate networks", "active_exploitation": "Listed in CISA KEV catalog on 2025-01-24, indicating active exploitation in the wild. CISA SSVC assessment shows 'active' exploitation status.", "severity_factors": [ "CVSS 9.8 Critical severity", "Pre-authentication attack", "Remote code execution", "No user interaction required", "Active exploitation confirmed", "Internet-facing by design" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Apply security patches immediately to version 12.4.3-02804 (platform-hotfix) or later", "Implement network segmentation to limit access to management interfaces if possible", "Monitor for unusual administrative activity and unauthorized command execution", "Review access logs for suspicious pre-authentication requests", "HIGHEST patch priority - patch within 24-48 hours due to active exploitation" ], "risk_assessment": { "exploit_likelihood": "VERY HIGH - Pre-authentication RCE with active exploitation confirmed and public disclosure", "impact_assessment": "CRITICAL - Full system compromise with arbitrary OS command execution on network security appliance", "exposure_scope": "Large - SonicWall SMA appliances are widely deployed in enterprise environments and are internet-facing by design" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Known", "ransomware_first_seen_date": "2026-06-04", "ransomware_days_after_kev": 496, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:25:08.254842", "displayed_on_website": false }, { "cve_id": "CVE-2025-22457", "cvss_score": "9.0", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1133", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2025-04-03T15:20:23.628Z", "cve_published_date_formatted": "2025-04-03", "kev_date_added": "2025-04-04", "kev_date_added_formatted": "2025-04-04", "kev_due_date": "2025-04-11", "days_to_kev": 1, "days_since_kev": null, "is_new_kev": false, "summary": "Critical stack-based buffer overflow in Ivanti remote access gateways allows unauthenticated remote code execution. These products are specifically designed to be internet-facing to provide secure remote access to corporate networks.", "detailed_analysis": { "vulnerability_type": "Stack-based buffer overflow (CWE-121) allowing remote unauthenticated code execution", "affected_products": [ "Ivanti Connect Secure (SSL VPN gateway)", "Ivanti Policy Secure (access control gateway)", "Ivanti Neurons for ZTA (Zero Trust Access gateway)" ], "exploitation_requirements": [ "Network connectivity to the gateway", "No authentication required", "No user interaction required" ], "internet_facing_likelihood": "These are purpose-built remote access gateways that must be internet-facing to function. Estimated 95%+ of deployments are directly accessible from the internet as this is their core business function - providing secure remote access to corporate networks for employees and partners.", "typical_deployment": "Enterprise network security appliances deployed at network perimeters to provide secure remote access. These are server-class appliances specifically designed to accept connections from the internet.", "deployment_statistics": "95%+ of deployments are internet-facing by design. These products have no business value unless they are accessible from the internet to provide remote access functionality to users outside the corporate network.", "active_exploitation": "Listed in CISA KEV catalog with 'Exploitation: active' status, indicating confirmed exploitation in the wild", "severity_factors": [ "CVSS 9.0 Critical severity", "Unauthenticated remote code execution", "Internet-facing by design", "Active exploitation confirmed by CISA", "Affects enterprise perimeter security devices" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Apply security updates immediately: Ivanti Connect Secure 22.7R2.6+, Policy Secure 22.7R1.4+, ZTA Gateways 22.8R2.2+", "Monitor network traffic and authentication logs for suspicious activity", "Consider temporarily blocking internet access to unpatched systems if possible", "Implement additional network monitoring around these perimeter devices", "HIGHEST patch priority - exploit is trivial and systems are internet-exposed" ], "risk_assessment": { "exploit_likelihood": "Very High - unauthenticated RCE vulnerability in internet-facing systems with active exploitation confirmed", "impact_assessment": "Critical - complete system compromise of perimeter security devices could allow lateral movement into internal networks", "exposure_scope": "All internet-facing Ivanti remote access gateways are potentially compromised, affecting thousands of enterprise networks globally" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Known", "ransomware_first_seen_date": "2026-06-04", "ransomware_days_after_kev": 426, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:47:43.049931", "displayed_on_website": false }, { "cve_id": "CVE-2025-22226", "cvss_score": "7.1", "attack_vector": "LOCAL", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1068", "deployment_likelihood": "LOW", "cve_published_date": "2025-03-04T11:56:57.541Z", "cve_published_date_formatted": "2025-03-04", "kev_date_added": "2025-03-04", "kev_date_added_formatted": "2025-03-04", "kev_due_date": "2025-03-25", "days_to_kev": 0, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2025-22226 is an information disclosure vulnerability in VMware virtualization products affecting HGFS (Host-Guest File System). Despite being in CISA KEV, this is a local vulnerability requiring administrative access to a virtual machine to leak memory from the vmx process, not directly exploitable over the internet.", "detailed_analysis": { "vulnerability_type": "Out-of-bounds read in HGFS causing information disclosure", "affected_products": [ "VMware ESXi", "VMware Workstation", "VMware Fusion", "VMware Cloud Foundation", "VMware Telco Cloud Platform" ], "exploitation_requirements": [ "Administrative privileges to a virtual machine", "Local access to VM", "HGFS functionality enabled" ], "internet_facing_likelihood": "While ESXi management interfaces may be internet-facing, this vulnerability specifically targets the HGFS component which facilitates file sharing between host and guest VMs. The vulnerability requires administrative access within a VM to exploit, making direct internet exploitation highly unlikely. ESXi servers themselves are typically deployed in data centers with restricted network access.", "typical_deployment": "ESXi is server virtualization software typically deployed in enterprise data centers. Workstation and Fusion are desktop virtualization products for individual use. Cloud Foundation and Telco Cloud Platform are enterprise infrastructure management solutions.", "deployment_statistics": "Less than 5% of ESXi deployments would have management interfaces directly exposed to the internet, and this specific vulnerability requires VM-level access rather than management interface access, making internet exploitation extremely rare.", "active_exploitation": "Listed in CISA KEV indicating active exploitation in the wild, likely in targeted attacks against virtualized infrastructure", "severity_factors": [ "Requires local VM administrative access", "Information disclosure only (no RCE)", "CVSS Attack Vector is LOCAL", "Active exploitation confirmed by CISA KEV listing", "Affects critical virtualization infrastructure" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Apply vendor patches immediately for all affected VMware products", "Review VM administrative access controls and audit VM permissions", "Monitor HGFS usage and disable if not required", "Implement network segmentation for virtualization infrastructure", "HIGH patch priority due to CISA KEV listing and infrastructure criticality" ], "risk_assessment": { "exploit_likelihood": "Low for direct internet exploitation due to LOCAL attack vector requirement, but HIGH for targeted attacks against compromised VMs", "impact_assessment": "Information disclosure could lead to memory leakage containing sensitive data from the hypervisor process", "exposure_scope": "Limited to environments where attackers have already gained VM administrative access" }, "exploitation_method": "OTHER", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:37:24.045839", "displayed_on_website": false }, { "cve_id": "CVE-2025-22225", "cvss_score": "8.2", "attack_vector": "LOCAL", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1068", "deployment_likelihood": "MEDIUM", "cve_published_date": "2025-03-04T11:56:27.537Z", "cve_published_date_formatted": "2025-03-04", "kev_date_added": "2025-03-04", "kev_date_added_formatted": "2025-03-04", "kev_due_date": "2025-03-25", "days_to_kev": 0, "days_since_kev": null, "is_new_kev": false, "summary": "VMware ESXi contains an arbitrary write vulnerability allowing sandbox escape from the VMX process to kernel level. This is a local privilege escalation vulnerability requiring existing privileged access within the VMX process, not directly exploitable over the internet.", "detailed_analysis": { "vulnerability_type": "Arbitrary write vulnerability leading to sandbox escape", "affected_products": [ "VMware ESXi", "VMware Cloud Foundation", "VMware Telco Cloud Platform", "VMware Telco Cloud Infrastructure" ], "exploitation_requirements": [ "Privileged access within VMX process", "Local access to ESXi hypervisor", "High privileges required (PR:H)" ], "internet_facing_likelihood": "While ESXi management interfaces can be internet-facing, this vulnerability specifically requires privileges within the VMX process (virtual machine execution context), which is not directly accessible from the internet. The attack vector is LOCAL, indicating this cannot be exploited remotely over the network.", "typical_deployment": "ESXi is hypervisor infrastructure software typically deployed in data centers. Management interfaces may be internet-accessible, but the VMX process sandbox is internal to the hypervisor", "deployment_statistics": "Estimated 20-30% of ESXi deployments may have management interfaces exposed to internet, but the vulnerable component (VMX process) is not directly internet-accessible", "active_exploitation": "Listed in CISA KEV catalog indicating active exploitation in the wild", "severity_factors": [ "High CVSS score of 8.2", "Kernel-level privilege escalation", "Hypervisor compromise potential", "Active exploitation confirmed", "Requires high privileges to exploit" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Apply ESXi patches immediately: ESXi80U3d-24585383, ESXi80U2d-24585300, ESXi70U3s-24585291", "Monitor VMX process activities and hypervisor logs for suspicious behavior", "Review VM access controls and audit privileged accounts", "Patch priority: HIGH - Active exploitation and hypervisor-level impact" ], "risk_assessment": { "exploit_likelihood": "Moderate - requires initial privileged access within VMX process, but active exploitation confirmed", "impact_assessment": "Critical - successful exploitation leads to hypervisor compromise and potential escape from VM sandbox", "exposure_scope": "Limited direct internet exposure as vulnerability requires local VMX process access, but widespread ESXi deployment increases overall risk" }, "exploitation_method": "OTHER", "data_source": "CIRCL", "known_ransomware_use": "Known", "ransomware_first_seen_date": "2026-06-04", "ransomware_days_after_kev": 457, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:37:43.308211", "displayed_on_website": false }, { "cve_id": "CVE-2025-22224", "cvss_score": "9.3", "attack_vector": "LOCAL", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1068", "deployment_likelihood": "LOW", "cve_published_date": "2025-03-04T11:56:12.317Z", "cve_published_date_formatted": "2025-03-04", "kev_date_added": "2025-03-04", "kev_date_added_formatted": "2025-03-04", "kev_due_date": "2025-03-25", "days_to_kev": 0, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2025-22224 is a critical TOCTOU vulnerability in VMware virtualization products that allows VM escape from guest to host. Despite being in CISA KEV, this requires local administrative privileges within a VM and primarily affects infrastructure software not typically exposed to the internet.", "detailed_analysis": { "vulnerability_type": "Time-of-Check Time-of-Use (TOCTOU) race condition leading to out-of-bounds write and VM escape", "affected_products": [ "VMware ESXi", "VMware Workstation", "VMware Cloud Foundation", "VMware Telco Cloud Platform", "VMware Telco Cloud Infrastructure" ], "exploitation_requirements": [ "Local administrative privileges within a virtual machine", "Access to guest VM operating system", "Ability to execute code within the VM" ], "internet_facing_likelihood": "ESXi management interfaces are occasionally exposed to the internet (estimated 5-15% of deployments), but this vulnerability requires compromising a VM first, not direct exploitation of the management interface. VMware Workstation is primarily desktop virtualization software. Cloud Foundation and Telco platforms are typically internal infrastructure.", "typical_deployment": "ESXi is hypervisor infrastructure software typically deployed in data centers. Workstation is client-side desktop virtualization. Cloud Foundation and Telco platforms are enterprise infrastructure solutions for private/hybrid clouds.", "deployment_statistics": "While ESXi management interfaces may be internet-accessible in 5-15% of deployments, this vulnerability cannot be directly exploited via those interfaces. It requires prior compromise of a guest VM, making internet exploitation extremely unlikely in practice.", "active_exploitation": "Listed in CISA KEV indicating active exploitation in the wild, likely in targeted attacks where attackers have already gained VM access", "severity_factors": [ "CRITICAL CVSS score of 9.3", "VM escape capability (guest-to-host privilege escalation)", "No user interaction required once VM access is obtained", "Active exploitation confirmed by CISA KEV listing", "Requires prior VM compromise significantly limiting direct internet exploitation" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Apply patches immediately: ESXi80U3d-24585383, ESXi80U2d-24585300, ESXi70U3s-24585291, VMware Workstation 17.6.3", "Monitor VM guest activities for suspicious administrative actions and potential escape attempts", "Implement VM isolation best practices and restrict administrative access within guest VMs", "Review ESXi management interface exposure and implement strong authentication/network segmentation" ], "risk_assessment": { "exploit_likelihood": "High likelihood for VM escape if attacker has VM admin access, but very low likelihood of direct internet exploitation due to architectural requirements", "impact_assessment": "Critical impact - successful exploitation allows escape from VM to hypervisor host, potentially compromising entire virtualization infrastructure", "exposure_scope": "Limited direct internet exposure - requires multi-stage attack chain starting with VM compromise rather than direct exploitation of internet-facing services" }, "exploitation_method": "OTHER", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:38:07.691657", "displayed_on_website": false }, { "cve_id": "CVE-2025-21590", "cvss_score": "4.4", "attack_vector": "LOCAL", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1068", "deployment_likelihood": "HIGH", "cve_published_date": "2025-03-12T13:59:43.038Z", "cve_published_date_formatted": "2025-03-12", "kev_date_added": "2025-03-13", "kev_date_added_formatted": "2025-03-13", "kev_due_date": "2025-04-03", "days_to_kev": 1, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2025-21590 is a local privilege escalation vulnerability in Juniper Junos OS that requires high privileges and shell access to exploit. Despite being in CISA KEV due to active exploitation, it cannot be directly exploited from the internet as it requires LOCAL attack vector and existing high-privilege access to the device shell.", "detailed_analysis": { "vulnerability_type": "Improper Isolation or Compartmentalization in kernel allowing arbitrary code injection", "affected_products": [ "Juniper Junos OS (network routers, switches, firewalls)" ], "exploitation_requirements": [ "High privileges required", "Local shell access required", "Cannot be exploited from Junos CLI", "Attack vector is LOCAL only" ], "internet_facing_likelihood": "While Juniper network devices are commonly internet-facing infrastructure, this specific vulnerability requires LOCAL access with high privileges and shell access. The CVSS attack vector is explicitly LOCAL (AV:L), making direct internet exploitation impossible. Approximately 0% of exploitations would be direct from internet.", "typical_deployment": "Juniper Junos OS runs on network infrastructure devices (routers, switches, firewalls) that are typically internet-facing but protected by authentication and access controls", "deployment_statistics": "Nearly 100% of Juniper devices are deployed in network infrastructure roles, but this vulnerability requires existing authenticated shell access with high privileges, preventing direct internet exploitation", "active_exploitation": "At least one instance of malicious exploitation reported to Juniper SIRT. Also referenced in Google Cloud blog about China-nexus espionage campaigns targeting Juniper routers", "severity_factors": [ "Local attack vector limits direct internet exploitation", "Requires high privileges", "Kernel-level vulnerability allows arbitrary code execution", "Active exploitation in the wild", "Affects critical network infrastructure" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity, examine shell access logs", "Immediately upgrade to fixed Junos OS versions: 21.2R3-S9, 21.4R3-S10, 22.2R3-S6, 22.4R3-S6, 23.2R2-S3, 23.4R2-S4, 24.2R1-S2, 24.2R2, or 24.4R1+", "Restrict shell access to trusted users only as recommended by Juniper", "Monitor for suspicious shell activity and privilege escalation attempts", "Review and audit administrative access to network devices", "Patch priority: URGENT due to CISA KEV listing and active exploitation" ], "risk_assessment": { "exploit_likelihood": "High likelihood for attackers who have already gained initial access to network devices, but cannot be directly exploited from internet due to LOCAL attack vector requirement", "impact_assessment": "High impact - allows arbitrary code execution and device compromise for attackers with existing high-privilege access", "exposure_scope": "Limited direct internet exposure - requires prior compromise or legitimate high-privilege access to exploit" }, "exploitation_method": "OTHER", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:42:59.993458", "displayed_on_website": false }, { "cve_id": "CVE-2025-21480", "cvss_score": "8.6", "attack_vector": "LOCAL", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1068", "deployment_likelihood": "VERY_LOW", "cve_published_date": "2025-06-03T05:53:00.920Z", "cve_published_date_formatted": "2025-06-03", "kev_date_added": "2025-06-03", "kev_date_added_formatted": "2025-06-03", "kev_due_date": "2025-06-24", "days_to_kev": 0, "days_since_kev": null, "is_new_kev": false, "summary": "Memory corruption vulnerability in Qualcomm Snapdragon GPU micronode allowing unauthorized command execution. Despite being in CISA KEV, this is a local privilege escalation requiring user interaction on mobile/IoT devices, not an internet-facing server vulnerability.", "detailed_analysis": { "vulnerability_type": "Memory corruption due to unauthorized command execution in GPU micronode (CWE-863: Incorrect Authorization)", "affected_products": [ "Snapdragon Mobile Platforms", "Snapdragon Compute Platforms", "Snapdragon Industrial IoT", "FastConnect WiFi Chips", "Snapdragon AR Platforms", "Snapdragon Audio Codecs", "Snapdragon Modem Components" ], "exploitation_requirements": [ "Local access to device", "User interaction required", "Ability to execute specific sequence of GPU commands", "No authentication mentioned" ], "internet_facing_likelihood": "Qualcomm Snapdragon products are primarily System-on-Chip (SoC) solutions for mobile devices, tablets, laptops, IoT devices, and AR/VR platforms. These are embedded chipsets that power end-user devices rather than server infrastructure. Less than 5% of deployments would be internet-facing, primarily limited to some IoT gateway devices.", "typical_deployment": "Embedded chipsets in consumer devices (smartphones, tablets, laptops), IoT endpoints, AR/VR headsets, and edge computing devices. Not typically deployed as internet-facing server infrastructure.", "deployment_statistics": "Estimated <5% internet-facing deployments. The vast majority are in consumer mobile devices, laptops, and IoT endpoints behind NAT/firewalls. Some industrial IoT gateways may be internet-accessible but represent a small fraction of total deployments.", "active_exploitation": "Listed in CISA KEV catalog indicating confirmed exploitation in the wild, likely targeting mobile devices or IoT endpoints for privilege escalation", "severity_factors": [ "High CVSS score (8.6)", "Memory corruption with full impact (C:H/I:H/A:H)", "Listed in CISA KEV", "Requires local access and user interaction", "Affects widely deployed mobile chipsets" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review device logs, check for unauthorized access, verify system integrity on affected mobile devices and IoT systems", "Apply firmware updates from device manufacturers (OEMs) that incorporate Qualcomm security patches", "For enterprise-managed mobile devices: deploy mobile device management (MDM) solutions to ensure timely patching", "Monitor for unusual GPU-related activity or privilege escalation on affected devices", "High priority patching for any internet-facing IoT devices using affected Snapdragon chipsets" ], "risk_assessment": { "exploit_likelihood": "High for local exploitation given CISA KEV listing, but very low for direct internet exploitation due to chipset deployment patterns", "impact_assessment": "High impact on individual devices - full system compromise with changed scope (S:C) allowing complete device takeover", "exposure_scope": "Billions of consumer devices affected, but minimal direct internet exposure. Primary risk is post-compromise privilege escalation rather than initial access vector" }, "exploitation_method": "USER_INTERACTION", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:03:58.506562", "displayed_on_website": false }, { "cve_id": "CVE-2025-21479", "cvss_score": "8.6", "attack_vector": "LOCAL", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1068", "deployment_likelihood": "VERY_LOW", "cve_published_date": "2025-06-03T06:42:42.042Z", "cve_published_date_formatted": "2025-06-03", "kev_date_added": "2025-06-03", "kev_date_added_formatted": "2025-06-03", "kev_due_date": "2025-06-24", "days_to_kev": 0, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2025-21479 is a memory corruption vulnerability in Snapdragon GPU components that requires local access and user interaction. Despite being in CISA KEV, it affects mobile/client chipsets rather than internet-facing servers.", "detailed_analysis": { "vulnerability_type": "Memory corruption due to unauthorized command execution in GPU micronode", "affected_products": [ "Snapdragon Mobile Platforms", "FastConnect WiFi Chips", "Snapdragon Compute Platforms", "Snapdragon Industrial IoT", "Audio Codecs (WCD series)", "WiFi Chips (WCN series)", "Smart Speaker Audio (WSA series)" ], "exploitation_requirements": [ "Local access to device", "User interaction required", "Ability to execute specific GPU command sequences", "No authentication required once local access obtained" ], "internet_facing_likelihood": "Snapdragon chipsets are primarily found in mobile devices, tablets, laptops, IoT devices, and embedded systems. These are predominantly client-side devices, not server infrastructure. While some IoT devices may be internet-connected, they rarely expose GPU interfaces directly to network access. Estimated <1% of affected deployments would be directly internet-accessible for GPU exploitation.", "typical_deployment": "Client-side hardware in smartphones, tablets, laptops, AR/VR devices, IoT devices, and embedded systems. GPU components handle graphics processing and are typically accessed through device drivers and applications rather than network services.", "deployment_statistics": "Less than 1% of Snapdragon deployments are internet-facing servers. The vast majority are consumer devices, mobile phones, tablets, and embedded systems where GPU access requires local device access.", "active_exploitation": "Listed in CISA KEV indicating active exploitation, likely targeting mobile devices, IoT devices, or embedded systems for privilege escalation", "severity_factors": [ "High CVSS score of 8.6", "Active exploitation confirmed by CISA KEV listing", "Wide range of affected Snapdragon platforms", "Can achieve full device compromise", "Limited to local attack vector", "Requires user interaction" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review device logs, check for unauthorized access, verify system integrity on affected Snapdragon devices", "Apply firmware/driver updates from device manufacturers immediately", "Monitor for unusual GPU-related activity or unauthorized command execution", "For IoT deployments: ensure devices are not unnecessarily exposed to internet", "HIGH priority patching for all affected Snapdragon-based devices" ], "risk_assessment": { "exploit_likelihood": "High for local attackers with device access; very low for remote internet-based attacks due to local attack vector requirement", "impact_assessment": "Complete device compromise with high confidentiality, integrity, and availability impact once exploited", "exposure_scope": "Billions of Snapdragon devices globally, but direct internet exploitation limited to specific IoT/embedded deployments with exposed GPU interfaces" }, "exploitation_method": "USER_INTERACTION", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:03:34.264357", "displayed_on_website": false }, { "cve_id": "CVE-2025-21418", "cvss_score": "7.8", "attack_vector": "LOCAL", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1068", "deployment_likelihood": "VERY_LOW", "cve_published_date": "2025-02-11T17:58:17.776Z", "cve_published_date_formatted": "2025-02-11", "kev_date_added": "2025-02-11", "kev_date_added_formatted": "2025-02-11", "kev_due_date": "2025-03-04", "days_to_kev": 0, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2025-21418 is a heap-based buffer overflow in the Windows Ancillary Function Driver for WinSock that allows local privilege escalation. Despite affecting both Windows client and server systems, this is fundamentally a local vulnerability requiring existing system access to exploit.", "detailed_analysis": { "vulnerability_type": "Heap-based buffer overflow in Windows WinSock driver leading to elevation of privilege", "affected_products": [ "Windows Server (2008-2025, all editions including Server Core)", "Windows 10 (all versions from 1507 to 22H2)", "Windows 11 (22H2, 23H2, 24H2)" ], "exploitation_requirements": [ "Local system access required", "Low privileges on Windows system", "No network access required", "No user interaction needed once on system" ], "internet_facing_likelihood": "While Windows Server systems can host internet-facing services, this vulnerability targets a low-level WinSock driver component that is not directly exposed to network traffic. The vulnerability requires local code execution to trigger the heap overflow in the driver. Even on internet-facing Windows servers, attackers would need initial access to the system before exploiting this vulnerability.", "typical_deployment": "This affects both client systems (Windows 10/11 desktops) and server infrastructure (Windows Server in data centers), but the vulnerable component is a local kernel driver, not a network service", "deployment_statistics": "0% - The WinSock Ancillary Function Driver is not a network-facing service but rather a local kernel component that handles socket operations. Even though it's present on internet-facing Windows servers, it cannot be directly exploited over the network", "active_exploitation": "Listed in CISA KEV indicating active exploitation in the wild, likely being used by threat actors for privilege escalation after gaining initial access through other means", "severity_factors": [ "High CVSS score of 7.8 due to complete system compromise potential", "Active exploitation confirmed by CISA KEV listing", "Affects wide range of Windows versions", "Local attack vector limits immediate internet risk", "Requires existing system access to exploit" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs for suspicious privilege escalation activities, check for unauthorized administrative access, verify system integrity", "Apply February 2025 Windows security updates immediately on all affected systems", "Monitor for unusual process elevation and administrative account creation", "Implement endpoint detection and response (EDR) to detect privilege escalation attempts", "HIGH PRIORITY patching - while not directly internet-exploitable, active exploitation makes this critical for defense in depth" ], "risk_assessment": { "exploit_likelihood": "Low for direct internet exploitation (requires local access first), but high likelihood of exploitation once attackers have initial system access given active exploitation in the wild", "impact_assessment": "Complete system compromise with SYSTEM/Administrator level privileges, allowing attackers to install malware, access sensitive data, and establish persistence", "exposure_scope": "Not directly internet-exploitable, but affects millions of Windows systems that could be targeted for privilege escalation in multi-stage attacks" }, "exploitation_method": "OTHER", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:30:33.512505", "displayed_on_website": false }, { "cve_id": "CVE-2025-21391", "cvss_score": "7.1", "attack_vector": "LOCAL", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1068", "deployment_likelihood": "LOW", "cve_published_date": "2025-02-11T17:58:17.297Z", "cve_published_date_formatted": "2025-02-11", "kev_date_added": "2025-02-11", "kev_date_added_formatted": "2025-02-11", "kev_due_date": "2025-03-04", "days_to_kev": 0, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2025-21391 is a Windows Storage elevation of privilege vulnerability affecting multiple Windows versions and Windows Server editions. Despite being in CISA KEV, this is a local privilege escalation vulnerability requiring prior system access, not a direct internet-exploitable flaw.", "detailed_analysis": { "vulnerability_type": "Elevation of Privilege via Improper Link Resolution (CWE-59)", "affected_products": [ "Windows Server 2025", "Windows Server 2022", "Windows Server 2019", "Windows Server 2016", "Windows 11", "Windows 10" ], "exploitation_requirements": [ "Local access to system", "Low privileges on target system", "No user interaction required" ], "internet_facing_likelihood": "While Windows Server editions can be internet-facing, this vulnerability affects the Windows Storage subsystem which is not a network service. The vulnerability requires local access to exploit and cannot be triggered remotely over the network.", "typical_deployment": "Windows operating systems are deployed as both client systems (desktops/laptops) and server systems. Windows Server editions run various services that may be internet-facing, but the Storage subsystem itself is not a network-accessible service.", "deployment_statistics": "0% - The Windows Storage subsystem is not a network service and cannot be exploited over the internet. This is a local privilege escalation vulnerability that requires an attacker to already have access to the system.", "active_exploitation": "Listed in CISA KEV indicating active exploitation in the wild, likely as part of post-exploitation activity for privilege escalation after initial access via other means.", "severity_factors": [ "High CVSS score (7.1)", "Active exploitation confirmed by CISA KEV listing", "Affects wide range of Windows versions", "Local access required limits remote exploitation", "Can be chained with other vulnerabilities for complete system compromise" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Apply Microsoft security updates immediately for all affected Windows systems", "Monitor for suspicious local privilege escalation attempts and unusual file system activity", "Implement principle of least privilege to limit impact of local privilege escalation", "HIGH priority patching - this is actively exploited and enables attackers to escalate privileges once they have initial access" ], "risk_assessment": { "exploit_likelihood": "High for systems where attackers have already gained initial access through other means (phishing, malware, other vulnerabilities)", "impact_assessment": "High - successful exploitation allows elevation to higher privileges, potentially leading to full system compromise when chained with initial access methods", "exposure_scope": "Not directly internet-exploitable, but affects millions of Windows systems worldwide. Risk depends on attackers gaining initial access through other attack vectors." }, "exploitation_method": "OTHER", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:30:54.017083", "displayed_on_website": false }, { "cve_id": "CVE-2025-21335", "cvss_score": "7.8", "attack_vector": "LOCAL", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1068", "deployment_likelihood": "VERY_LOW", "cve_published_date": "2025-01-14T18:04:17.808Z", "cve_published_date_formatted": "2025-01-14", "kev_date_added": "2025-01-14", "kev_date_added_formatted": "2025-01-14", "kev_due_date": "2025-02-04", "days_to_kev": 0, "days_since_kev": null, "is_new_kev": false, "summary": "This is a local privilege escalation vulnerability in Windows Hyper-V's NT Kernel Integration VSP component affecting multiple Windows versions. The vulnerability requires local access and low-level privileges to exploit, making it unsuitable for direct internet exploitation.", "detailed_analysis": { "vulnerability_type": "Use After Free (CWE-416) in Windows Hyper-V NT Kernel Integration VSP leading to elevation of privilege", "affected_products": [ "Windows 10 21H2", "Windows 10 22H2", "Windows 11 22H2", "Windows 11 23H2", "Windows 11 24H2", "Windows Server 2025", "Windows Server 2022 23H2" ], "exploitation_requirements": [ "Local access to the system", "Low-level user privileges", "Access to Hyper-V NT Kernel Integration VSP component", "No user interaction required" ], "internet_facing_likelihood": "This vulnerability is in the Windows Hyper-V NT Kernel Integration component, which is an internal kernel-level service that handles communication between the hypervisor and virtual machines. This component does not expose network services directly to the internet and requires local system access to exploit. Estimated 0-1% chance of being directly exploitable from internet.", "typical_deployment": "Hyper-V NT Kernel Integration VSP is an internal Windows kernel component that facilitates communication between Hyper-V hypervisor and guest VMs. It operates at kernel level and is not a network service or internet-facing application.", "deployment_statistics": "Less than 1% of deployments would be directly accessible from the internet, as this is a kernel-level component that requires local access to the system to exploit. The vulnerability affects the hypervisor integration layer, not network-facing services.", "active_exploitation": "Listed in CISA KEV catalog indicating active exploitation in the wild, likely being used as a privilege escalation component in multi-stage attacks after initial access has been gained through other means", "severity_factors": [ "High CVSS score of 7.8", "Active exploitation confirmed by CISA KEV listing", "Affects multiple current Windows versions", "Kernel-level vulnerability", "No user interaction required once local access obtained", "Limited to local attack vector only" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Apply Microsoft security updates immediately for all affected Windows systems", "Monitor for unusual privilege escalation activities and unauthorized administrative access", "Review Hyper-V host security and guest VM isolation", "Implement principle of least privilege to limit impact of successful privilege escalation", "HIGH patch priority due to active exploitation despite local attack vector" ], "risk_assessment": { "exploit_likelihood": "High for local exploitation after initial access, but very low for direct internet exploitation due to local attack vector requirement", "impact_assessment": "High impact - successful exploitation provides elevated privileges (High confidentiality, integrity, and availability impact according to CVSS)", "exposure_scope": "Limited internet exposure as this affects kernel-level Hyper-V components that are not directly internet-accessible, but widespread deployment across Windows infrastructure" }, "exploitation_method": "OTHER", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:22:55.621629", "displayed_on_website": false }, { "cve_id": "CVE-2025-21334", "cvss_score": "7.8", "attack_vector": "LOCAL", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1068", "deployment_likelihood": "VERY_LOW", "cve_published_date": "2025-01-14T18:04:51.608Z", "cve_published_date_formatted": "2025-01-14", "kev_date_added": "2025-01-14", "kev_date_added_formatted": "2025-01-14", "kev_due_date": "2025-02-04", "days_to_kev": 0, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2025-21334 is a local privilege escalation vulnerability in Windows Hyper-V NT Kernel Integration VSP component with a use-after-free flaw. Despite being in CISA KEV indicating active exploitation, it requires local access and authenticated user privileges to exploit.", "detailed_analysis": { "vulnerability_type": "Use-after-free vulnerability in Windows Hyper-V NT Kernel Integration VSP component leading to elevation of privilege", "affected_products": [ "Windows Server 2025", "Windows Server 2022 23H2", "Windows 11 (versions 22H2, 23H2, 24H2)", "Windows 10 (versions 21H2, 22H2)" ], "exploitation_requirements": [ "Local access to the system required", "Low-privileged user account needed", "Hyper-V integration services must be enabled", "Virtual machine context required" ], "internet_facing_likelihood": "The Hyper-V NT Kernel Integration VSP is an internal hypervisor component that facilitates communication between host and guest virtual machines. This component is not directly exposed to network interfaces and requires local system access to exploit. Even on servers with Hyper-V role, the vulnerable component itself is not internet-facing.", "typical_deployment": "This is a hypervisor infrastructure component that runs on Windows systems with Hyper-V enabled. It operates within the kernel space to manage virtual machine integration services and is not a network service.", "deployment_statistics": "Less than 5% chance of direct internet exploitation as this requires local access to a system with Hyper-V enabled and the ability to interact with the integration services from within a VM or host context.", "active_exploitation": "Listed in CISA KEV catalog as of January 14, 2025, indicating confirmed active exploitation in the wild by threat actors", "severity_factors": [ "CISA KEV listing indicates active threat actor exploitation", "High CVSS score of 7.8 with complete impact triad (C:H/I:H/A:H)", "Local attack vector limits remote exploitation potential", "Requires authenticated low-privileged access", "Use-after-free vulnerability type can lead to reliable exploitation", "Affects multiple Windows versions including latest releases" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Apply Microsoft security updates immediately for all affected Windows systems with Hyper-V enabled", "Review Hyper-V host and guest system logs for suspicious activity or unauthorized privilege escalations", "Implement additional monitoring for privilege escalation attempts on Hyper-V infrastructure", "Audit virtual machine access and integration services configurations", "Prioritize patching of Hyper-V hosts in production environments" ], "risk_assessment": { "exploit_likelihood": "High likelihood for attackers with local access to Hyper-V systems, but very low likelihood for direct internet-based attacks due to local attack vector requirement", "impact_assessment": "High impact with complete system compromise possible - attacker can gain full administrative privileges on affected Hyper-V hosts", "exposure_scope": "Limited to attackers who have already gained initial access to Windows systems with Hyper-V enabled, significantly reducing the attack surface compared to network-based vulnerabilities" }, "exploitation_method": "OTHER", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:23:19.287831", "displayed_on_website": false }, { "cve_id": "CVE-2025-21333", "cvss_score": "7.8", "attack_vector": "LOCAL", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1068", "deployment_likelihood": "VERY_LOW", "cve_published_date": "2025-01-14T18:04:50.962Z", "cve_published_date_formatted": "2025-01-14", "kev_date_added": "2025-01-14", "kev_date_added_formatted": "2025-01-14", "kev_due_date": "2025-02-04", "days_to_kev": 0, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2025-21333 is a local privilege escalation vulnerability in Windows Hyper-V NT Kernel Integration VSP affecting multiple Windows versions. Despite being in CISA KEV, it requires local access and is not directly exploitable from the internet against public-facing applications.", "detailed_analysis": { "vulnerability_type": "Heap-based buffer overflow in Windows Hyper-V NT Kernel Integration VSP leading to elevation of privilege", "affected_products": [ "Windows Server 2025", "Windows Server 2022 23H2", "Windows 11", "Windows 10" ], "exploitation_requirements": [ "Local access to the system", "Low privileges on the target system", "Access to Hyper-V virtualization service provider components", "No user interaction required" ], "internet_facing_likelihood": "This vulnerability affects the Windows Hyper-V NT Kernel Integration VSP component, which is not directly exposed to the internet. While Windows Server systems may be internet-facing, the specific vulnerable component (Hyper-V kernel integration service) operates at the hypervisor level and requires local system access to exploit. The attack vector is LOCAL per CVSS, confirming this cannot be exploited remotely over the network.", "typical_deployment": "The affected component is part of Windows Hyper-V virtualization infrastructure, primarily used in enterprise environments for virtual machine management. While Windows Server systems may host internet-facing services, the Hyper-V kernel integration component itself is not exposed to network connections.", "deployment_statistics": "Less than 1% of deployments would have this component directly accessible from the internet, as it operates at the hypervisor kernel level and is not a network service", "active_exploitation": "Listed in CISA KEV catalog on 2025-01-14, indicating active exploitation in the wild. CISA SSVC assessment shows active exploitation with total technical impact but not automatable.", "severity_factors": [ "High CVSS score of 7.8", "Active exploitation confirmed by CISA KEV listing", "Total technical impact according to CISA SSVC", "Affects critical infrastructure components (Hyper-V)", "Local attack vector limits remote exploitation" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Apply Microsoft security updates immediately for all affected Windows versions", "Review access controls to Hyper-V environments and virtualization infrastructure", "Monitor for unusual privilege escalation activities on Windows systems with Hyper-V enabled", "High patch priority for virtualization infrastructure and Hyper-V hosts" ], "risk_assessment": { "exploit_likelihood": "High for attackers with local access to Windows systems with Hyper-V enabled, but very low for direct internet exploitation", "impact_assessment": "Complete system compromise and privilege escalation to highest privileges on affected Hyper-V systems", "exposure_scope": "Limited to systems where attackers already have local access; not directly exploitable from internet" }, "exploitation_method": "OTHER", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:23:41.440432", "displayed_on_website": false }, { "cve_id": "CVE-2025-21043", "cvss_score": "8.8", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1203", "deployment_likelihood": "VERY_LOW", "cve_published_date": "2025-09-12T07:21:51.025Z", "cve_published_date_formatted": "2025-09-12", "kev_date_added": "2025-10-02", "kev_date_added_formatted": "2025-10-02", "kev_due_date": "2025-10-23", "days_to_kev": 20, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2025-21043 is an out-of-bounds write vulnerability in Samsung Android devices' image codec library that requires user interaction for exploitation. While actively exploited as a zero-day, it affects client devices rather than internet-facing servers.", "detailed_analysis": { "vulnerability_type": "Out-of-bounds write (CWE-787) in libimagecodec.quram.so library", "affected_products": [ "Samsung Android devices (versions 13, 14, 15, 16)" ], "exploitation_requirements": [ "User interaction required", "Network access to deliver malicious content", "Processing of crafted image data" ], "internet_facing_likelihood": "Samsung Android devices are consumer mobile devices that are NOT typically deployed as internet-facing server applications. While these devices connect to the internet, they function as clients consuming content rather than servers providing services. The vulnerability is in an image codec library that processes image data, which requires user interaction to trigger (viewing/processing images).", "typical_deployment": "Consumer mobile devices used as client endpoints. These are personal devices that connect to internet services but do not typically run server applications accessible from the internet.", "deployment_statistics": "Less than 1% of Samsung Android devices would be configured as internet-facing servers. The vast majority (>99%) are client devices used for personal communication, web browsing, and app usage.", "active_exploitation": "Evidence indicates active zero-day exploitation, potentially through targeted attacks against WhatsApp users, suggesting delivery through messaging applications or social engineering.", "severity_factors": [ "High CVSS score of 8.8", "Active zero-day exploitation", "Arbitrary code execution capability", "Mitigated by user interaction requirement", "Client-side rather than server-side vulnerability" ] }, "recommendations": [ "Apply Samsung SMR Sep-2025 security update immediately on affected devices", "Monitor for suspicious image files or links, especially through messaging applications", "Medium patch priority for enterprise mobile device management" ], "risk_assessment": { "exploit_likelihood": "Low for direct internet exploitation - requires user interaction and delivery of malicious image content through applications like messaging services", "impact_assessment": "High impact on individual devices if successfully exploited (arbitrary code execution), but limited scope for mass internet-based attacks", "exposure_scope": "Minimal internet-facing server exposure - affects consumer mobile devices that are not typically configured as public-facing services" }, "exploitation_method": "USER_INTERACTION", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "CVE-2025-21043 is a critical vulnerability affecting **Samsung Android devices** and allows for remote attackers to execute arbitrary code 【1】【2】. Here's a breakdown of what is known about its exploitation:\n\n* **Affected Applications/Services:** The vulnerability resides in the `libimagecodec.quram.so` library on Android versions 13, 14, 15, and 16 【8】【6】.\n\n* **Active Exploitation:** CVE-2025-21043 has been actively exploited as a zero-day vulnerability 【4】.\n\n* **Attack Vectors/Exploitation Methods:** The vulnerability is an out-of-bounds write issue 【1】【2】. It's suggested that it might have been exploited in attacks targeting **WhatsApp users** 【3】.\n\n* **Targeted Attacks:** There are indications that CVE-2025-21043 has been used in targeted attacks 【3】.\n\n* **CISA KEV Status:** As of now, CVE-2025-21043 is not explicitly listed in CISA's Known Exploited Vulnerabilities (KEV) catalog 【9】【5】.\n\n* **Technical Details/Internet Exploitability:** The vulnerability is an out-of-bounds write, allowing remote attackers to execute arbitrary code 【1】【2】. The attack vector is logically remote, and successful exploitation doesn't require privileges 【7】.\n\nSources:\n- CVE-2025-21043 Detail - NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21043\n- CVE-2025-21043 Security Vulnerability & Exploit Details: https://cve.akaoma.com/cve-2025-21043\n- Samsung Patches Zero-Day Exploited Against Android Users: https://www.securityweek.com/samsung-patches-zero-day-exploited-against-android-users/\n- Samsung Fixes Critical Zero-Day CVE-2025-21043 ...: https://thehackernews.com/2025/09/samsung-fixes-critical-zero-day-cve.html\n- CISA Sounds Alarm on Critical Sudo Flaw Actively Exploited in Linux and ...: https://thehackernews.com/2025/09/cisa-sounds-alarm-on-critical-sudo-flaw.html", "references": [ { "title": "CVE-2025-21043 Detail - NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-21043", "citation_contribution": 188, "snippet": "Out-of-bounds write in libimagecodec.quram.so prior to SMR Sep-2025 Release 1 allows remote attackers to execute arbitrary code. Metrics. CVSS ...", "is_search_result": true }, { "title": "CVE-2025-21043 Security Vulnerability & Exploit Details", "url": "https://cve.akaoma.com/cve-2025-21043", "citation_contribution": 193, "snippet": "CVE-2025-21043 - Out-of-bounds write in libimagecodec.quram.so prior to SMR Sep-2025 Release 1 allows remote attackers to execute arbitrary code.", "is_search_result": true }, { "title": "Samsung Patches Zero-Day Exploited Against Android Users", "url": "https://www.securityweek.com/samsung-patches-zero-day-exploited-against-android-users/", "citation_contribution": 191, "snippet": "The timing of the report and the fact that the Samsung zero-day was in a core image library suggests that CVE-2025-21043 might have been exploited in attacks targeting WhatsApp users, just as was CVE-2025-43300, an out-of-bounds write issue in the ImageIO framework component of iOS, iPadOS, and macOS.", "is_search_result": true }, { "title": "Samsung Fixes Critical Zero-Day CVE-2025-21043 ...", "url": "https://thehackernews.com/2025/09/samsung-fixes-critical-zero-day-cve.html", "citation_contribution": 100, "snippet": "Samsung patched CVE-2025-21043 on Sep 2025 after zero-day Android exploits enabled code execution.", "is_search_result": true }, { "title": "CISA Sounds Alarm on Critical Sudo Flaw Actively Exploited in Linux and ...", "url": "https://thehackernews.com/2025/09/cisa-sounds-alarm-on-critical-sudo-flaw.html", "citation_contribution": 105, "snippet": "The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a critical security flaw impacting the Sudo command-line utility for Linux and Unix-like operating systems to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation in the wild. The vulnerability in question is CVE-2025-32463 (CVSS score: 9.3), which affects Sudo versions prior ...", "is_search_result": true } ], "timestamp": "2025-10-02T15:10:24.254372" }, "cache_timestamp": "2025-10-02T15:10:48.921133", "displayed_on_website": false }, { "cve_id": "CVE-2025-21042", "cvss_score": "8.8", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1203", "deployment_likelihood": "VERY_LOW", "cve_published_date": "2025-09-12T07:21:49.997Z", "cve_published_date_formatted": "2025-09-12", "kev_date_added": "2025-11-10", "kev_date_added_formatted": "2025-11-10", "kev_due_date": "2025-12-01", "days_to_kev": 59, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2025-21042 is an out-of-bounds write vulnerability in Samsung mobile devices' image processing library that requires user interaction with malicious DNG image files. While actively exploited via messaging apps like WhatsApp, it targets client devices rather than internet-facing servers.", "detailed_analysis": { "vulnerability_type": "Out-of-bounds write (CWE-787) in image processing library libimagecodec.quram.so", "affected_products": [ "Samsung Galaxy Mobile Devices" ], "exploitation_requirements": [ "User interaction required (UI:R)", "Specially crafted DNG image file", "Message delivery via apps like WhatsApp", "Image processing by device" ], "internet_facing_likelihood": "Samsung mobile devices are client endpoints, not internet-facing servers. While they connect to the internet, they do not expose listening services that can be directly exploited via T1190. The vulnerability requires delivery of malicious content to the device.", "typical_deployment": "Consumer mobile devices - client-side applications that connect to services but do not expose internet-facing server applications", "deployment_statistics": "0% - Mobile devices are client endpoints, not server infrastructure. They do not run internet-facing services that can be directly exploited", "active_exploitation": "Confirmed active exploitation in the wild by LANDFALL spyware, particularly targeting users in the Middle East via malicious DNG images sent through messaging applications", "severity_factors": [ "High CVSS score of 8.8", "Active exploitation confirmed", "Zero-click potential in some scenarios", "Remote code execution capability", "Requires user interaction (UI:R)", "Limited to client devices", "Not a server-side vulnerability" ] }, "recommendations": [ "IMMEDIATE: Samsung device users should install the April 2025 security update (SMR Apr-2025) immediately", "Enable automatic security updates on all Samsung Galaxy devices", "Exercise caution when receiving image files via messaging applications, especially DNG files from unknown sources", "Monitor for indicators of compromise on affected devices, particularly unauthorized activities or performance anomalies", "Organizations should prioritize updating Samsung devices in their mobile device management programs" ], "risk_assessment": { "exploit_likelihood": "Low for direct internet exploitation - this is a client-side vulnerability requiring social engineering or message delivery, not direct network exploitation of server services", "impact_assessment": "High impact on individual devices if exploited - remote code execution allows complete device compromise", "exposure_scope": "Not applicable for internet-facing servers - affects client mobile devices that require targeted delivery of malicious content" }, "exploitation_method": "USER_INTERACTION", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "CVE-2025-21042 is a critical zero-day vulnerability in **Samsung's Android image processing library** (`libimagecodec.quram.so`) that has been actively exploited in the wild 【6】【1】. Here's a breakdown of what is known about its exploitation:\n\n* **Affected Applications/Services:** The vulnerability affects **Samsung Galaxy devices** and is exploited through specially crafted DNG image files 【3】【7】. These images are often delivered via messaging applications like **WhatsApp** 【11】【8】.\n\n* **Active Exploitation:** There is evidence of active exploitation in the wild. The vulnerability has been exploited by a commercial-grade spyware called **LANDFALL** 【6】【1】.\n\n* **Attack Vectors/Exploitation Methods:**\n * The primary attack vector involves sending a malformed DNG image file to the victim 【6】【8】.\n * The vulnerability is triggered when the device processes the image, leading to an out-of-bounds write error in the `libimagecodec.quram.so` component 【4】【2】.\n * Successful exploitation allows for **remote code execution (RCE)**, enabling attackers to execute arbitrary code on the affected device 【10】【2】.\n * The exploit can be **zero-click**, requiring no user interaction beyond auto-download or viewing the image 【9】【7】.\n\n* **Targeted Attacks:** The vulnerability has been used in **targeted attacks**, particularly against Samsung Galaxy users in the **Middle East** 【3】.\n\n* **CISA KEV Status:** As of November 10, 2025, there is **no information** indicating that CVE-2025-21042 has been added to the **CISA Known Exploited Vulnerabilities (KEV) Catalog**.\n\n* **Technical Details/Internet Exploitability:**\n * CVE-2025-21042 is considered an **easy target** for cybercriminals due to its **low attack complexity** and **no required privileges** 【5】.\n * The vulnerability has a high severity rating with a **CVSS score of 8.8** 【2】.\n * It involves an **out-of-bounds write flaw** in the `libimagecodec.quram.so` component 【4】【2】.\n * The vulnerability was patched by Samsung in **April 2025** 【12】【13】.\n\nSources:\n- Unit 42 - Latest Cybersecurity Research | Palo Alto Networks: https://unit42.paloaltonetworks.com/\n- ⚡ Weekly Recap: Hyper-V Malware, Malicious AI Bots, RDP Exploits ...: https://thehackernews.com/2025/11/weekly-recap-hyper-v-malware-malicious.html\n- LANDFALL Spyware Exploited Samsung Galaxy Zero-Day in Targeted Middle ...: https://dailysecurityreview.com/cyber-security/landfall-spyware-exploited-samsung-galaxy-zero-day-in-targeted-middle-east-attacks/\n- CVE-2025-21042 - Exploits & Severity - Feedly: https://feedly.com/cve/CVE-2025-21042\n- CVE-2025-21042 Security Vulnerability & Exploit Details: https://cve.akaoma.com/cve-2025-21042", "references": [ { "title": "Unit 42 - Latest Cybersecurity Research | Palo Alto Networks", "url": "https://unit42.paloaltonetworks.com/", "citation_contribution": 263, "snippet": "Commercial-grade LANDFALL spyware exploits CVE-2025-21042 in Samsung Android’s image processing library.The silhouette of a bull facing the reviewer and the Taurus constellation inside an orange abstract planet. Abstract, stylized cosmic setting with vibrant blue and purple shapes, representing space and distant planetary bodies. Malware September 30, 2025.", "is_search_result": true }, { "title": "⚡ Weekly Recap: Hyper-V Malware, Malicious AI Bots, RDP Exploits ...", "url": "https://thehackernews.com/2025/11/weekly-recap-hyper-v-malware-malicious.html", "citation_contribution": 255, "snippet": "The activity involved the exploitation of CVE-2025-21042 (CVSS score: 8.8), an out-of-bounds write flaw in the \"libimagecodec.quram.so\" component that could allow remote attackers to execute arbitrary code, according to Palo Alto Networks Unit 42.", "is_search_result": true }, { "title": "LANDFALL Spyware Exploited Samsung Galaxy Zero-Day in Targeted Middle ...", "url": "https://dailysecurityreview.com/cyber-security/landfall-spyware-exploited-samsung-galaxy-zero-day-in-targeted-middle-east-attacks/", "citation_contribution": 233, "snippet": "The exploitation of CVE-2025-21042 to distribute LANDFALL spyware illustrates the widening attack surface in mobile ecosystems. For Samsung Galaxy users in the Middle East, the campaign represents both a direct invasion of privacy and a notable evolution in cyber-espionage tactics. Vigilance, device hygiene, and timely patching remain non ...", "is_search_result": true }, { "title": "CVE-2025-21042 - Exploits & Severity - Feedly", "url": "https://feedly.com/cve/CVE-2025-21042", "citation_contribution": 165, "snippet": "CVE-2025-21042 is a high-severity vulnerability identified in Samsung Mobile Devices, specifically involving an out-of-bounds write flaw in the component libimagecodec.quram.so.", "is_search_result": true }, { "title": "CVE-2025-21042 Security Vulnerability & Exploit Details", "url": "https://cve.akaoma.com/cve-2025-21042", "citation_contribution": 143, "snippet": "The exploitability of CVE-2025-21042 depends on two key factors: attack complexity (the level of effort required to execute an exploit) and privileges required (the access level an attacker needs).", "is_search_result": true } ], "timestamp": "2025-11-10T18:45:18.562936" }, "cache_timestamp": "2025-11-10T18:45:36.532055", "displayed_on_website": false }, { "cve_id": "CVE-2025-20393", "cvss_score": "10.0", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2025-12-17T16:47:13.128Z", "cve_published_date_formatted": "2025-12-17", "kev_date_added": "2025-12-17", "kev_date_added_formatted": "2025-12-17", "kev_due_date": "2025-12-24", "days_to_kev": 0, "days_since_kev": null, "is_new_kev": false, "summary": "Critical remote command execution vulnerability in Cisco Secure Email Gateway and Manager appliances with CVSS 10.0 score requiring no authentication or user interaction. CISA has added this to their KEV catalog due to active exploitation in the wild targeting these internet-facing email security appliances.", "detailed_analysis": { "vulnerability_type": "Remote Command Execution vulnerability due to Improper Input Validation (CWE-20)", "affected_products": [ "Cisco Secure Email Gateway", "Cisco Secure Email and Web Manager" ], "exploitation_requirements": [ "Network access to the appliance", "No authentication required (PR:N)", "No user interaction required (UI:N)", "Low attack complexity (AC:L)" ], "internet_facing_likelihood": "These are dedicated email security appliances that are specifically designed to be deployed as internet-facing services. Email gateways must be internet-accessible to receive and process incoming email traffic from external sources. Approximately 95-99% of deployments would be internet-facing as this is their primary operational requirement.", "typical_deployment": "These are enterprise email security appliances deployed as server infrastructure to protect organizational email systems. They function as internet-facing gateways that process inbound and outbound email traffic.", "deployment_statistics": "Estimated 95-99% of deployments are internet-facing, as email security gateways must be accessible from the internet to perform their core function of filtering incoming email traffic before it reaches internal mail servers.", "active_exploitation": "CISA PSIRT became aware of potentially malicious activity targeting these appliances in December 2025. CISA has added this vulnerability to the Known Exploited Vulnerabilities catalog based on evidence of active exploitation.", "severity_factors": [ "Maximum CVSS score of 10.0", "No authentication required", "No user interaction needed", "Network-based attack vector", "Changed scope impact", "High impact on confidentiality, integrity, and availability", "Active exploitation confirmed by CISA", "Internet-facing deployment model" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Apply emergency patches immediately for all Cisco Secure Email Gateway and Manager appliances", "Monitor network traffic to/from email security appliances for suspicious activity", "Review authentication logs and system integrity on affected appliances", "Consider temporarily isolating affected systems if patches cannot be applied immediately", "Implement additional network monitoring and access controls around email security infrastructure" ], "risk_assessment": { "exploit_likelihood": "Very High - Maximum CVSS score with no authentication required, confirmed active exploitation, and internet-facing deployment model makes this extremely likely to be exploited", "impact_assessment": "Critical - Complete system compromise possible with high impact on confidentiality, integrity, and availability. Compromise of email security infrastructure could lead to business email compromise attacks and data exfiltration", "exposure_scope": "Very High - Email security appliances are widely deployed across enterprises globally and are typically internet-facing by design, creating a large attack surface" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "Based on the search results, here's what is known about the CVE-2025-20393 vulnerability exploitation:\n\n* **CISA KEV Status:** CISA has added a new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation 【2】【3】.\n* **Active Exploitation:** CISA added CVE-2025-20393 to the KEV catalog due to evidence of active exploitation 【2】.\n* **Internet-Facing Applications:** One source mentions that a vulnerability degrades security for public exposed endpoints and may offer arbitrary local file inclusion 【1】.\n* **Attack Vectors:** Frequent attack vectors for malicious cyber actors pose significant risks 【3】【4】.\n\nThe provided search results do not offer specific details regarding:\n\n* Whether CVE-2025-20393 specifically affects internet-facing applications or services.\n* Specific attack vectors and exploitation methods for CVE-2025-20393.\n* Whether CVE-2025-20393 has been used in targeted attacks.\n* Technical details about internet exploitability for CVE-2025-20393.\n\nSources:\n- Known Exploited Vulnerabilities Catalog - CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog\n- CISA Adds One Known Exploited Vulnerability to Catalog: https://www.cisa.gov/news-events/alerts/2025/12/16/cisa-adds-one-known-exploited-vulnerability-catalog\n- CISA Adds One Known Exploited Vulnerability to Catalog | CISA: https://www.cisa.gov/news-events/alerts/2025/07/02/cisa-adds-one-known-exploited-vulnerability-catalog\n- CISA Adds Two Known Exploited Vulnerabilities to Catalog | CISA: https://www.cisa.gov/news-events/alerts/2025/07/01/cisa-adds-two-known-exploited-vulnerabilities-catalog", "references": [ { "title": "Known Exploited Vulnerabilities Catalog - CISA", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "citation_contribution": 171, "snippet": "This vulnerability degrades security for public exposed endpoints that may make use of it and may offer arbitrary local file inclusion when provided a specially ...Read more", "is_search_result": true }, { "title": "CISA Adds One Known Exploited Vulnerability to Catalog", "url": "https://www.cisa.gov/news-events/alerts/2025/12/16/cisa-adds-one-known-exploited-vulnerability-catalog", "citation_contribution": 158, "snippet": "CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.Read more", "is_search_result": true }, { "title": "CISA Adds One Known Exploited Vulnerability to Catalog | CISA", "url": "https://www.cisa.gov/news-events/alerts/2025/07/02/cisa-adds-one-known-exploited-vulnerability-catalog", "citation_contribution": 139, "snippet": "CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2025-6554 Google Chromium V8 Type Confusion Vulnerability. These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.", "is_search_result": true }, { "title": "CISA Adds Two Known Exploited Vulnerabilities to Catalog | CISA", "url": "https://www.cisa.gov/news-events/alerts/2025/07/01/cisa-adds-two-known-exploited-vulnerabilities-catalog", "citation_contribution": 67, "snippet": "CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2025-48927 TeleMessage TM SGNL Initialization of a Resource with an Insecure Default Vulnerability.These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.", "is_search_result": true } ], "timestamp": "2025-12-17T20:50:44.712158" }, "cache_timestamp": "2025-12-17T20:51:06.372867", "displayed_on_website": false }, { "cve_id": "CVE-2025-20362", "cvss_score": "6.5", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2025-09-25T16:12:35.916Z", "cve_published_date_formatted": "2025-09-25", "kev_date_added": "2025-09-25", "kev_date_added_formatted": "2025-09-25", "kev_due_date": "2025-09-26", "days_to_kev": 0, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2025-20362 is a missing authorization vulnerability in Cisco ASA and FTD VPN web servers that allows unauthenticated remote attackers to access restricted URL endpoints. The vulnerability is being actively exploited in the wild and affects internet-facing firewall appliances.", "detailed_analysis": { "vulnerability_type": "Missing Authorization (CWE-862) in VPN web server allowing unauthorized access to restricted URL endpoints", "affected_products": [ "Cisco ASA Software (versions 9.8.x through 9.23.x)", "Cisco Firepower Threat Defense (FTD) Software (versions 6.2.x through 7.7.x)" ], "exploitation_requirements": [ "Network access to VPN web server", "No authentication required", "No user interaction needed", "Crafted HTTP requests to targeted web server" ], "internet_facing_likelihood": "Cisco ASA and FTD devices are network security appliances (firewalls) that are predominantly deployed at network perimeters with internet-facing interfaces. The VPN web server component is specifically designed to provide remote access services to users connecting from the internet.", "typical_deployment": "These are infrastructure appliances deployed as network security gateways at organizational perimeters, providing firewall, VPN, and threat defense services", "deployment_statistics": "Estimated 90-95% of Cisco ASA/FTD deployments with VPN functionality have internet-facing interfaces, as their primary purpose is to provide secure remote access and perimeter defense", "active_exploitation": "Cisco PSIRT confirms active exploitation attempts in the wild, and CISA KEV catalog listing indicates ongoing threat activity", "severity_factors": [ "No authentication required for exploitation", "Direct internet accessibility of VPN web servers", "Active exploitation confirmed by Cisco", "Wide deployment of affected products as internet-facing security appliances", "Medium CVSS score (6.5) with Low confidentiality and integrity impact" ] }, "recommendations": [ "Immediately upgrade to fixed software releases as recommended by Cisco", "Monitor VPN web server access logs for suspicious HTTP requests and unauthorized access attempts", "Critical patch priority - treat as emergency due to active exploitation and internet-facing exposure" ], "risk_assessment": { "exploit_likelihood": "Very High - vulnerability is being actively exploited, requires no authentication, and affects commonly internet-facing network appliances", "impact_assessment": "Medium to High - unauthorized access to restricted endpoints could lead to information disclosure, configuration changes, or serve as initial access for further compromise", "exposure_scope": "Large - thousands of organizations deploy Cisco ASA/FTD appliances with internet-facing VPN services globally" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "CVE-2025-20362 is a vulnerability in **Cisco Secure Firewall ASA and FTD Software** that allows unauthenticated, remote attackers to access restricted URL endpoints 【1】. Here's a breakdown of what is known about its exploitation:\n\n* **Internet-facing applications or services:** Yes, this vulnerability affects internet-facing applications and services.\n* **Active exploitation in the wild:** There is strong evidence of active exploitation in the wild.\n* **Attack vectors and exploitation methods:** The attack vector involves improper validation of user-supplied input to the VPN web server.\n* **Targeted attacks:** It has been used in targeted attacks.\n* **CISA Known Exploited Vulnerabilities (KEV) status:** The CISA KEV catalog indicates active exploitation of this vulnerability.\n* **Technical details about internet exploitability:** The vulnerability is exploited via the VPN web server due to improper validation of user-supplied input.【1】\n\nSources:\n- Cisco Security Advisory: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-YROOTUW?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Secure%20Firewall%20Adaptive%20Security%20Appliance%20Software%20and%20Secure%20Firewall%20Threat%20Defense%20Software%20VPN%20Web%20Server%20Unauthorized%20Access%20Vulnerability%26vs_k=1", "references": [ { "title": "Cisco Security Advisory", "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-YROOTUW?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Secure%20Firewall%20Adaptive%20Security%20Appliance%20Software%20and%20Secure%20Firewall%20Threat%20Defense%20Software%20VPN%20Web%20Server%20Unauthorized%20Access%20Vulnerability%26vs_k=1", "citation_contribution": 326, "snippet": "A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat ...", "is_search_result": true } ], "timestamp": "2025-09-25T16:35:08.497720" }, "cache_timestamp": "2025-09-25T16:35:28.316667", "displayed_on_website": false }, { "cve_id": "CVE-2025-20352", "cvss_score": "7.7", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2025-09-24T17:10:42.891Z", "cve_published_date_formatted": "2025-09-24", "kev_date_added": "2025-09-29", "kev_date_added_formatted": "2025-09-29", "kev_due_date": "2025-10-20", "days_to_kev": 5, "days_since_kev": null, "is_new_kev": false, "summary": "Critical SNMP stack overflow vulnerability in Cisco IOS/IOS XE that allows remote code execution with high privileges or denial of service with low privileges. Actively exploited in the wild against network infrastructure devices commonly exposed to the internet.", "detailed_analysis": { "vulnerability_type": "Stack-based buffer overflow in SNMP subsystem (CWE-121)", "affected_products": [ "Cisco IOS (versions 12.2.x through 15.9.x)", "Cisco IOS XE (versions 3.5.x through 17.18.x)", "Cisco IOS XE Catalyst SD-WAN (versions 16.9.x through 16.12.x)" ], "exploitation_requirements": [ "Network access to SNMP service (typically UDP port 161)", "SNMPv2c/earlier read-only community string OR valid SNMPv3 credentials for DoS", "Administrative/privilege 15 credentials for RCE (high-privilege attack)" ], "internet_facing_likelihood": "Cisco network devices (routers, switches, firewalls) are commonly deployed as internet-facing infrastructure. SNMP is frequently enabled for network monitoring and management, with many deployments inadvertently exposing SNMP services to the internet despite security best practices recommending against it.", "typical_deployment": "Infrastructure software - network devices that serve as routers, switches, and security appliances in enterprise and service provider networks", "deployment_statistics": "Estimated 70-80% of Cisco network devices are internet-facing as they form network perimeters. While SNMP should be restricted, studies show 15-25% of network devices have SNMP exposed to the internet due to misconfigurations.", "active_exploitation": "Cisco PSIRT confirmed successful exploitation in the wild after local Administrator credentials were compromised. Described as actively exploited zero-day RCE vulnerability.", "severity_factors": [ "Active exploitation confirmed by vendor", "Can achieve remote code execution as root user", "Affects critical network infrastructure", "Wide deployment base of affected products", "Network-based attack vector", "No user interaction required" ] }, "recommendations": [ "URGENT: Upgrade to fixed software releases immediately", "Restrict SNMP access to management networks only", "Monitor for unusual SNMP traffic patterns", "Implement network segmentation for infrastructure devices", "Review and rotate SNMP community strings and credentials" ], "risk_assessment": { "exploit_likelihood": "HIGH - Confirmed active exploitation with publicly documented attack vector via crafted SNMP packets", "impact_assessment": "CRITICAL - Full system compromise possible with administrative privileges, causing complete network infrastructure takeover", "exposure_scope": "HIGH - Millions of Cisco devices globally with significant portion internet-accessible, especially in enterprise perimeter and service provider networks" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "CVE-2025-20352 is a high-severity vulnerability affecting the **Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE Software** 【2】. Here's what is known about its exploitation:\n\n* **Internet-facing applications or services:** The vulnerability affects internet-facing applications and services running vulnerable Cisco software.\n* **Active exploitation:** There is evidence of active exploitation of this vulnerability in the wild 【2】. Cisco has confirmed it is being used as a zero-day RCE (Remote Code Execution) vulnerability 【2】.\n* **Attack vectors and exploitation methods:** An attacker could exploit this vulnerability by sending a crafted SNMP packet to an affected device over IPv4 or IPv6 networks 【1】. To cause a DoS, the attacker needs to have low-level privileges 【1】.\n* **Targeted attacks:** While not explicitly stated, the active exploitation suggests it may be used in targeted attacks.\n* **CISA Known Exploited Vulnerabilities (KEV) status:** While CVE-2025-20352 is not explicitly listed in the CISA KEV catalog, related vulnerabilities have been added 【3】.\n* **Technical details about internet exploitability:** The vulnerability can be exploited over IPv4 or IPv6 networks by sending crafted SNMP packets to a vulnerable device 【1】. The attacker needs to have authenticated, low-privileged, remote access 【1】.\n\nSources:\n- NVD - CVE-2025-20352: https://nvd.nist.gov/vuln/detail/CVE-2025-20352\n- Cisco uncovers new SNMP vulnerability used in attacks on ...: https://cyberscoop.com/cisco-ios-xe-snmp-vulnerability-september-2025/\n- CVE-2025-20333 - Exploits & Severity - Feedly: https://feedly.com/cve/CVE-2025-20333", "references": [ { "title": "NVD - CVE-2025-20352", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-20352", "citation_contribution": 486, "snippet": "An attacker could exploit this vulnerability by sending a crafted SNMP packet to an affected device over IPv4 or IPv6 networks. This ...", "is_search_result": true }, { "title": "Cisco uncovers new SNMP vulnerability used in attacks on ...", "url": "https://cyberscoop.com/cisco-ios-xe-snmp-vulnerability-september-2025/", "citation_contribution": 348, "snippet": "Designated CVE-2025-20352, the vulnerability resides in the Simple Network Management Protocol (SNMP) subsystem of Cisco's core network software ...", "is_search_result": true }, { "title": "CVE-2025-20333 - Exploits & Severity - Feedly", "url": "https://feedly.com/cve/CVE-2025-20333", "citation_contribution": 170, "snippet": "CVE-2025-20333 is a critical vulnerability that has been exploited in the wild, as indicated by evidence linking it to an ongoing attack campaign. Patches are available in the first fixed releases for Cisco ASA and FTD software, and users are advised to migrate to these fixed releases to mitigate the risk.Attacks in the wild have been reported by CISA Known Exploited Vulnerability. Sep 25, 2025 at 4:30 PM / CISA Known Exploited Vulnerability.", "is_search_result": true } ], "timestamp": "2025-09-29T17:21:20.908646" }, "cache_timestamp": "2025-09-29T17:21:41.033517", "displayed_on_website": false }, { "cve_id": "CVE-2025-20337", "cvss_score": "10.0", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2025-07-16T16:17:04.664Z", "cve_published_date_formatted": "2025-07-16", "kev_date_added": "2025-07-28", "kev_date_added_formatted": "2025-07-28", "kev_due_date": "2025-08-18", "days_to_kev": 12, "days_since_kev": null, "is_new_kev": false, "summary": "Critical unauthenticated remote code execution vulnerability in Cisco ISE API that allows attackers to execute arbitrary code as root. The vulnerability is actively exploited in the wild and requires no authentication or user interaction.", "detailed_analysis": { "vulnerability_type": "Unauthenticated Remote Code Execution via API Input Validation Bypass (CWE-74 Injection)", "affected_products": [ "Cisco Identity Services Engine Software", "Cisco ISE Passive Identity Connector" ], "exploitation_requirements": [ "Network access to ISE API endpoint", "No authentication required", "No user interaction required", "Ability to craft malicious API requests" ], "internet_facing_likelihood": "Cisco ISE is enterprise network access control infrastructure that frequently has internet-facing components. ISE commonly exposes guest portals, sponsor portals, BYOD onboarding, and administrative interfaces to the internet. Conservative estimates suggest 60-80% of ISE deployments have some internet-facing components, particularly for guest access and remote device onboarding functionalities.", "typical_deployment": "Cisco ISE is server-side network infrastructure software that provides network access control, policy enforcement, and identity services. It typically runs on dedicated appliances or virtual machines and operates network services including web portals, APIs, and authentication services.", "deployment_statistics": "Approximately 70% of ISE deployments likely have internet-facing components due to business requirements for guest access, BYOD programs, and remote authentication services. Many organizations intentionally expose ISE guest portals and device onboarding interfaces to provide network access to external users.", "active_exploitation": "Cisco PSIRT confirmed attempted exploitation in the wild as of July 2025. CISA added this to the Known Exploited Vulnerabilities Catalog, indicating active threat actor usage.", "severity_factors": [ "CVSS 10.0 Critical severity", "No authentication required", "Root-level code execution", "Active exploitation confirmed", "No available workarounds", "Scope changed indicating potential lateral movement" ] }, "recommendations": [ "EMERGENCY: Immediately upgrade to fixed ISE software releases", "Implement network segmentation to limit ISE internet exposure if possible", "Monitor ISE logs for suspicious API activity and unauthorized access attempts", "Deploy IPS/IDS rules to detect exploitation attempts", "Consider temporarily blocking non-essential internet access to ISE if patching is delayed" ], "risk_assessment": { "exploit_likelihood": "VERY HIGH - Unauthenticated RCE with confirmed exploitation in the wild and publicly available vulnerability details make exploitation highly likely", "impact_assessment": "CRITICAL - Root-level compromise of network access control infrastructure can lead to complete network compromise, credential theft, and lateral movement throughout the enterprise", "exposure_scope": "HIGH - Large number of enterprise ISE deployments with internet-facing components for guest access and device onboarding, representing significant attack surface" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "CVE-2025-20337 is a critical vulnerability affecting **Cisco Identity Services Engine (ISE)** and **ISE Passive Identity Connector (ISE-PIC)** 【1】【2】. Here's what is known about its exploitation:\n\n* **Affected Applications/Services:** Cisco ISE and ISE-PIC, specifically a particular API 【1】【3】.\n* **Internet-Facing:** This vulnerability affects network access control, policy enforcement, and guest access, often involving internet-facing applications 【1】【2】.\n* **Active Exploitation:** Cisco PSIRT confirmed attempted exploitation of CVE-2025-20337 in the wild in July 2025 【2】.\n* **Attack Vectors/Exploitation Methods:** The vulnerability stems from insufficient validation of user-supplied input in a specific API 【4】. An unauthenticated, remote attacker can exploit this by submitting a crafted API request to execute arbitrary code with root privileges on the underlying system 【3】【1】.\n* **Targeted Attacks:** While not explicitly stated, active exploitation in the wild suggests the potential for targeted attacks 【2】.\n* **CISA KEV Status:** Due to active exploitation, CISA added CVE-2025-20337 to its Known Exploited Vulnerabilities Catalog 【5】【6】.\n* **Technical Details:** The vulnerability allows unauthenticated remote code execution with root privileges due to insufficient input validation in a specific API, which can be triggered via crafted API requests 【4】【1】. There are no workarounds available to address this vulnerability 【2】.\n\nSources:\n- NVD - CVE-2025-20337: https://nvd.nist.gov/vuln/detail/CVE-2025-20337\n- Cisco Identity Services Engine Unauthenticated Remote Code ...: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-unauth-rce-ZAd2GnJ6\n- tenable.com/cve/CVE-2025-20337: https://www.tenable.com/cve/CVE-2025-20337\n- Cisco Warns of Identity Services Engine RCE Vulnerability Exploited in ...: https://cybersecuritynews.com/cisco-ise-rce-vulnerability-exploited-in-wild/\n- CISA Warns of Cisco Identity Services Engine Vulnerability Exploited...: https://cybersecuritynews.com/cisco-identity-services-engine-vulnerability/", "references": [ { "title": "NVD - CVE-2025-20337", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-20337", "snippet": "NVD - CVE-2025-20337Information Technology Laboratory National Vulnerability Database", "is_search_result": true }, { "title": "Cisco Identity Services Engine Unauthenticated Remote Code ...", "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-unauth-rce-ZAd2GnJ6", "snippet": "Exploitation and Public Announcements In July 2025, the Cisco PSIRT became aware of attempted exploitation of CVE-2025-20281 and CVE-2025-20337 ...", "is_search_result": true }, { "title": "tenable.com/cve/CVE-2025-20337", "url": "https://www.tenable.com/cve/CVE-2025-20337", "snippet": "A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying ...", "is_search_result": true }, { "title": "Cisco Warns of Identity Services Engine RCE Vulnerability Exploited in ...", "url": "https://cybersecuritynews.com/cisco-ise-rce-vulnerability-exploited-in-wild/", "snippet": "Cisco ISE RCE Vulnerability Exploited in Wild. The most severe vulnerabilities, CVE-2025-20281 and CVE-2025-20337, stem from insufficient validation of user-supplied input in specific APIs within ISE versions 3.3 and 3.4.", "is_search_result": true }, { "title": "CISA Warns of Cisco Identity Services Engine Vulnerability Exploited...", "url": "https://cybersecuritynews.com/cisco-identity-services-engine-vulnerability/", "snippet": "The vulnerabilities, tracked as CVE-2025-20281 and CVE-2025-20337, allow attackers to achieve remote code execution with root privileges on affected systems. Key Takeaways 1. CISA added two Cisco ISE vulnerabilities (CVE-2025-20281, CVE-2025-20337) to its Known Exploited...", "is_search_result": true } ], "timestamp": "2025-09-06T17:19:40.286906" }, "cache_timestamp": "2025-09-06T17:20:02.621822", "displayed_on_website": false }, { "cve_id": "CVE-2025-20333", "cvss_score": "9.9", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2025-09-25T16:12:14.308Z", "cve_published_date_formatted": "2025-09-25", "kev_date_added": "2025-09-25", "kev_date_added_formatted": "2025-09-25", "kev_due_date": "2025-09-26", "days_to_kev": 0, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2025-20333 is a critical buffer overflow vulnerability in the VPN web server component of Cisco ASA and Firepower Threat Defense Software that allows authenticated remote attackers to execute arbitrary code as root. This vulnerability is actively being exploited in the wild and affects internet-facing VPN appliances that are commonly deployed with public internet access.", "detailed_analysis": { "vulnerability_type": "Buffer overflow (CWE-120) in VPN web server due to improper validation of user-supplied input in HTTP(S) requests", "affected_products": [ "Cisco ASA Software (versions 9.8.1 through 9.22.1.2)", "Cisco Firepower Threat Defense Software (versions 6.2.3 through 7.6.0)" ], "exploitation_requirements": [ "Valid VPN user credentials required", "Network access to VPN web server", "Ability to send crafted HTTP requests" ], "internet_facing_likelihood": "Cisco ASA and Firepower Threat Defense are primarily security appliances designed to be deployed at network perimeters. Their VPN functionality specifically requires internet exposure to allow remote users to connect. An estimated 85-95% of these deployments have internet-facing VPN services, as this is their primary use case for remote access.", "typical_deployment": "These are network security appliances (firewalls/VPN concentrators) typically deployed at network perimeters as dedicated hardware or virtual appliances, functioning as internet-facing servers that provide VPN services to remote users", "deployment_statistics": "Approximately 90% of ASA and FTD deployments with VPN functionality are internet-facing, as the primary business purpose is to provide secure remote access to corporate networks from the internet", "active_exploitation": "Cisco PSIRT has confirmed attempted exploitation of this vulnerability in the wild, and CISA has added it to their Known Exploited Vulnerabilities catalog", "severity_factors": [ "Critical CVSS score of 9.9", "Remote code execution as root user", "Active exploitation confirmed", "Internet-facing deployment is standard", "Authentication bypass potential through code execution", "Affects widely deployed enterprise security infrastructure" ] }, "recommendations": [ "Immediately update to fixed software versions as specified in Cisco advisory cisco-sa-asaftd-webvpn-z5xP8EUB", "Monitor VPN web server logs for suspicious HTTP requests and authentication patterns", "Consider temporarily disabling VPN web server functionality if patching cannot be done immediately", "Implement additional network segmentation and monitoring around affected devices", "Highest patch priority - treat as emergency due to active exploitation" ], "risk_assessment": { "exploit_likelihood": "Very High - Active exploitation confirmed with relatively low technical barriers (only requires valid VPN credentials which are commonly available to remote workers)", "impact_assessment": "Critical - Complete system compromise with root-level access, potential for lateral movement into corporate networks, and compromise of network security infrastructure", "exposure_scope": "Very High - Cisco ASA and FTD are widely deployed enterprise security appliances with most VPN-enabled instances being internet-facing by design" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "CVE-2025-20333 is a critical vulnerability affecting **Cisco Secure Firewall Adaptive Security Appliance (ASA) Software** and **Cisco Secure Firewall Threat Defense Software** 【1】. Here's what is known about its exploitation:\n\n* **Internet-facing applications or services:** The vulnerability affects internet-facing applications and services, specifically the **VPN web server** 【1】.\n* **Active exploitation in the wild:** There is evidence of active exploitation of CVE-2025-20333 in the wild 【4】【5】.\n* **Attack vectors and exploitation methods:** Technical details suggest that **remote code execution** is a primary exploitation method 【2】.\n* **Targeted attacks:** CVE-2025-20333 has been used in targeted attacks 【6】【7】.\n* **CISA Known Exploited Vulnerabilities (KEV) status:** The CISA KEV catalog includes this CVE, indicating its severe risk and active exploitation 【3】【4】.\n\nSources:\n- Cisco Security Advisory: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-z5xP8EUB?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Secure%20Firewall%20Adaptive%20Security%20Appliance%20Software%20and%20Secure%20Firewall%20Threat%20Defense%20Software%20VPN%20Web%20Server%20Remote%20Code%20Execution%20Vulnerability%26vs_k=1\n- GitHub - omer-efe-curkus/CVE-2025-32433-Erlang-OTP...: https://github.com/omer-efe-curkus/CVE-2025-32433-Erlang-OTP-SSH-RCE-PoC\n- Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog\n- CISA Adds Four Known Exploited Vulnerabilities to Catalog: https://www.cisa.gov/news-events/alerts/2025/07/22/cisa-adds-four-known-exploited-vulnerabilities-catalog\n- CISA Adds Six Known Exploited Vulnerabilities to Catalog: https://www.cisa.gov/news-events/alerts/2025/03/11/cisa-adds-six-known-exploited-vulnerabilities-catalog", "references": [ { "title": "Cisco Security Advisory", "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-z5xP8EUB?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Secure%20Firewall%20Adaptive%20Security%20Appliance%20Software%20and%20Secure%20Firewall%20Threat%20Defense%20Software%20VPN%20Web%20Server%20Remote%20Code%20Execution%20Vulnerability%26vs_k=1", "citation_contribution": 331, "snippet": "A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat ...", "is_search_result": true }, { "title": "GitHub - omer-efe-curkus/CVE-2025-32433-Erlang-OTP...", "url": "https://github.com/omer-efe-curkus/CVE-2025-32433-Erlang-OTP-SSH-RCE-PoC", "citation_contribution": 139, "snippet": "CVE-2025-32433-Erlang-OTP-SSH-RCE-PoC. The vulnerability allows an attacker with network access to an Erlang/OTP SSH server to execute arbitrary code without prior authentication. Description.Vulnerability Check: Determine if a target is vulnerable to CVE-2025-32433. Exploit Execution: Execute arbitrary commands.", "is_search_result": true }, { "title": "Known Exploited Vulnerabilities Catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "citation_contribution": 105, "snippet": "CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild. Organizations should use the KEV catalog as an input to their ...", "is_search_result": true }, { "title": "CISA Adds Four Known Exploited Vulnerabilities to Catalog", "url": "https://www.cisa.gov/news-events/alerts/2025/07/22/cisa-adds-four-known-exploited-vulnerabilities-catalog", "citation_contribution": 82, "snippet": "CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.", "is_search_result": true }, { "title": "CISA Adds Six Known Exploited Vulnerabilities to Catalog", "url": "https://www.cisa.gov/news-events/alerts/2025/03/11/cisa-adds-six-known-exploited-vulnerabilities-catalog", "citation_contribution": 73, "snippet": "CISA has added six new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation.", "is_search_result": true } ], "timestamp": "2025-09-25T16:35:38.502474" }, "cache_timestamp": "2025-09-25T16:35:58.898181", "displayed_on_website": false }, { "cve_id": "CVE-2025-20281", "cvss_score": "10.0", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2025-06-25T16:11:42.285Z", "cve_published_date_formatted": "2025-06-25", "kev_date_added": "2025-07-28", "kev_date_added_formatted": "2025-07-28", "kev_due_date": "2025-08-18", "days_to_kev": 33, "days_since_kev": null, "is_new_kev": false, "summary": "Critical unauthenticated remote code execution vulnerability in Cisco ISE API that allows attackers to execute arbitrary code as root via crafted API requests. Actively exploited in the wild with CVSS 10.0 severity.", "detailed_analysis": { "vulnerability_type": "Unauthenticated Remote Code Execution via API injection (CWE-74)", "affected_products": [ "Cisco Identity Services Engine Software" ], "exploitation_requirements": [ "Network access to ISE API endpoint", "No authentication required", "No user interaction required" ], "internet_facing_likelihood": "Cisco ISE is commonly deployed as an internet-facing service for network access control, authentication, and policy management. Many organizations expose ISE to the internet to support remote access, guest access, and partner connectivity. Estimated 60-75% of ISE deployments have some level of internet exposure through web portals, APIs, or management interfaces.", "typical_deployment": "Cisco ISE is enterprise server software that provides network access control (NAC), authentication, authorization, and accounting (AAA) services. It typically runs as a centralized server infrastructure with web-based management interfaces and APIs.", "deployment_statistics": "Approximately 60-75% of ISE deployments are internet-facing due to business requirements for remote access management, guest portals, BYOD support, and partner network access. ISE's primary function as a network access control system necessitates connectivity to support distributed users and devices.", "active_exploitation": "Confirmed active exploitation in the wild as of July 2025. Added to CISA KEV catalog. Public exploit code available targeting the /deployment-rpc/enableStrongSwanTunnel endpoint.", "severity_factors": [ "CVSS 10.0 Critical severity", "No authentication required", "Root-level code execution", "Active exploitation confirmed", "Public exploit code available", "Network-based attack vector" ] }, "recommendations": [ "IMMEDIATE: Apply patches to all ISE systems - treat as emergency priority", "Block network access to ISE APIs from untrusted networks until patched", "Monitor for exploitation attempts targeting /deployment-rpc/enableStrongSwanTunnel endpoint", "Implement network segmentation to limit ISE exposure", "Conduct forensic analysis on potentially compromised ISE systems" ], "risk_assessment": { "exploit_likelihood": "VERY HIGH - Unauthenticated RCE with public exploits and confirmed active exploitation makes this extremely likely to be targeted", "impact_assessment": "CRITICAL - Root-level code execution allows complete system compromise, data theft, network pivoting, and infrastructure takeover", "exposure_scope": "HIGH - Large number of enterprise ISE deployments globally with significant percentage internet-accessible for business operations" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "Here's what is known about the CVE-2025-20281 vulnerability:\n\n**Affected Applications/Services:**\n\n* CVE-2025-20281 affects **Cisco Identity Services Engine (ISE)** and **ISE-PIC (ISE Passive Identity Connector)** 【1】【2】.\n\n**Active Exploitation:**\n\n* Cisco has confirmed that **CVE-2025-20281 is actively being exploited in the wild** 【3】【4】.\n\n**Attack Vectors and Exploitation Methods:**\n\n* The vulnerability is due to **insufficient validation of user-supplied input** 【5】【6】.\n* An attacker can exploit this vulnerability by **submitting a crafted API request** 【7】【5】.\n* Successful exploitation allows an attacker to **execute arbitrary code as the root user** 【7】【8】 and **gain root privileges on affected systems** 【7】【8】.\n* The attack vector is **network-based** with **low attack complexity** and **requires no user interaction** 【9】.\n* Specifically, the vulnerability allows attackers to send malicious serialized Java objects to the ```/deployment-rpc/enableStrongSwanTunnel``` endpoint 【10】.\n\n**Targeted Attacks:**\n\n* While not explicitly stated, the active exploitation of a critical vulnerability like CVE-2025-20281 suggests its potential use in targeted attacks.\n\n**CISA Known Exploited Vulnerabilities Catalog:**\n\n* **CVE-2025-20281 has been added to the CISA Known Exploited Vulnerabilities Catalog** 【11】【6】.\n\n**Technical Details and Internet Exploitability:**\n\n* CVE-2025-20281 is a **critical severity vulnerability (CVSS 9.8)** 【8】.\n* It is an **unauthenticated remote code execution (RCE) vulnerability** 【1】【8】.\n* The vulnerability exists in a specific API of Cisco ISE and ISE-PIC 【12】【13】.\n* It can be exploited without any valid credentials, making the attack vector easily accessible to remote adversaries 【12】【14】.\n* Exploitation enables unauthenticated root access 【15】【16】.\n\nSources:\n- Critical Vulnerability SAP ICM Could Lead to Full System Takeover: https://arcticwolf.com/resources/blog/critical-vulnerability-in-the-sap-internet-communication-manager-component-could-lead-to-full-system-takeover-patch-available/\n- CVE-2025-20281-CVE-2025-20282 | Arctic Wolf: https://arcticwolf.com/resources/blog/cve-2025-20281-cve-2025-20282/\n- Exploit available for critical Cisco ISE bug exploited in attacks: https://www.bleepingcomputer.com/news/security/exploit-available-for-critical-cisco-ise-bug-exploited-in-attacks/\n- Cisco Identity Services Engine Unauthenticated Remote Code ...: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-unauth-rce-ZAd2GnJ6\n- CVE-2025-20281 Detail - NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-20281", "references": [ { "title": "Critical Vulnerability SAP ICM Could Lead to Full System Takeover", "url": "https://arcticwolf.com/resources/blog/critical-vulnerability-in-the-sap-internet-communication-manager-component-could-lead-to-full-system-takeover-patch-available/", "snippet": "CVE-2025-20281 & CVE-2025-20282: Maximum Severity Unauthenticated RCE Vulnerabilities in Cisco ISE and ISE-PIC.Critical Vulnerability in the SAP Internet Communication Manager Component Could Lead to Full System Takeover, Patch Available.", "is_search_result": true }, { "title": "CVE-2025-20281-CVE-2025-20282 | Arctic Wolf", "url": "https://arcticwolf.com/resources/blog/cve-2025-20281-cve-2025-20282/", "snippet": "CVE-2025-20282: Caused by missing file validation checks, which allows a threat actor to upload files into privileged directories. A successful ...", "is_search_result": true }, { "title": "Exploit available for critical Cisco ISE bug exploited in attacks", "url": "https://www.bleepingcomputer.com/news/security/exploit-available-for-critical-cisco-ise-bug-exploited-in-attacks/", "snippet": "On July 22, 2025, Cisco marked both CVE-2025-20281 and CVE-2025-20337 as actively exploited in attacks, urging admins to apply the security updates as soon as possible.", "is_search_result": true }, { "title": "Cisco Identity Services Engine Unauthenticated Remote Code ...", "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-unauth-rce-ZAd2GnJ6", "snippet": "Multiple vulnerabilities in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an ...", "is_search_result": true }, { "title": "CVE-2025-20281 Detail - NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-20281", "snippet": "This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a crafted API request. A ...", "is_search_result": true } ], "timestamp": "2025-09-06T17:20:15.297255" }, "cache_timestamp": "2025-09-06T17:20:37.850770", "displayed_on_website": false }, { "cve_id": "CVE-2025-1976", "cvss_score": "8.6", "attack_vector": "ADJACENT", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1068", "deployment_likelihood": "LOW", "cve_published_date": "2025-04-24T02:55:40.225Z", "cve_published_date_formatted": "2025-04-24", "kev_date_added": "2025-04-28", "kev_date_added_formatted": "2025-04-28", "kev_due_date": "2025-05-19", "days_to_kev": 4, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2025-1976 is a privilege escalation vulnerability in Brocade Fabric OS that allows local admin users to execute arbitrary code with root privileges. Despite being on CISA KEV, this requires adjacent network access and existing admin credentials, making direct internet exploitation unlikely.", "detailed_analysis": { "vulnerability_type": "Code injection vulnerability allowing privilege escalation from admin to root level access", "affected_products": [ "Brocade Fabric OS (SAN switch infrastructure)" ], "exploitation_requirements": [ "Adjacent network access", "Existing admin-level authentication", "Local or network-adjacent access to the switch management interface" ], "internet_facing_likelihood": "Brocade Fabric OS runs on Storage Area Network (SAN) switches, which are critical infrastructure components typically deployed in secure data center environments. These devices are rarely exposed directly to the internet due to security best practices. The CVSS attack vector is ADJACENT, indicating network-adjacent access is required rather than direct internet connectivity. Estimated <5% of deployments would be directly internet-accessible.", "typical_deployment": "Infrastructure software running on specialized SAN switches in enterprise data centers, typically behind multiple layers of network security controls and firewalls", "deployment_statistics": "Less than 5% of deployments are estimated to be directly internet-facing, as these are critical storage infrastructure components that security best practices recommend keeping isolated from public networks", "active_exploitation": "Listed in CISA KEV catalog indicating active exploitation in the wild, suggesting attackers are leveraging this for lateral movement and privilege escalation in compromised networks", "severity_factors": [ "High CVSS score of 8.6", "Code injection leading to full root access", "CISA KEV listing indicates active exploitation", "Limited by adjacent network access requirement", "Requires existing admin credentials" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately update Brocade Fabric OS to versions newer than 9.1.1d6", "Review and audit all admin-level access to SAN infrastructure", "Implement network segmentation to ensure SAN management interfaces are not accessible from untrusted networks", "Monitor for unusual privilege escalation attempts and code execution on SAN switches", "PATCH PRIORITY: HIGH - Due to CISA KEV listing and critical infrastructure impact" ], "risk_assessment": { "exploit_likelihood": "LOW for direct internet exploitation due to adjacent network access requirement and typical deployment patterns, but HIGH for lateral movement in compromised enterprise networks", "impact_assessment": "VERY HIGH - Full root access to critical SAN infrastructure could lead to data center storage disruption, data theft, or ransomware deployment across storage systems", "exposure_scope": "Limited number of directly internet-facing systems due to infrastructure nature, but significant impact potential in enterprise environments where initial access has been obtained" }, "exploitation_method": "OTHER", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:51:19.547551", "displayed_on_website": false }, { "cve_id": "CVE-2025-15556", "cvss_score": "7.7", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1203", "deployment_likelihood": "VERY_LOW", "cve_published_date": "2026-02-03T00:50:29.516Z", "cve_published_date_formatted": "2026-02-03", "kev_date_added": "2026-02-12", "kev_date_added_formatted": "2026-02-12", "kev_due_date": "2026-03-05", "days_to_kev": 9, "days_since_kev": null, "is_new_kev": false, "summary": "Notepad++ WinGUp updater lacks cryptographic verification of updates, allowing man-in-the-middle attacks to deliver malicious installers. This is a client application vulnerability requiring user interaction (running the updater) and is not directly exploitable against internet-facing services.", "detailed_analysis": { "vulnerability_type": "Update integrity verification bypass (CWE-494) - lack of cryptographic verification for downloaded update metadata and installers", "affected_products": [ "Notepad++ (text editor client application)" ], "exploitation_requirements": [ "User must run the WinGUp updater", "Attacker must intercept or redirect update traffic", "Man-in-the-middle position or DNS hijacking capability", "No authentication required but requires user interaction" ], "internet_facing_likelihood": "Notepad++ is a desktop text editor client application, not server software. It is not designed to be internet-facing and has no business case for direct internet exposure. 0% of typical deployments would be accessible from the internet as it lacks server functionality.", "typical_deployment": "Desktop client application installed on individual workstations for text editing. The software does not listen on network ports or provide services to other systems.", "deployment_statistics": "0% internet-facing deployment - this is end-user desktop software with no server components or listening services", "active_exploitation": "CISA KEV listed with confirmed active exploitation in the wild as of February 2026", "severity_factors": [ "CISA KEV listing indicates active exploitation", "Arbitrary code execution with user privileges", "Requires man-in-the-middle attack capability", "Requires user to manually run updater", "Client-side vulnerability, not server-side" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately update Notepad++ to version 8.8.9 or later on all systems", "Monitor for signs of compromise on systems with older Notepad++ versions", "Consider disabling automatic updates temporarily until patching is complete", "HIGH priority patching due to CISA KEV status despite client-side nature" ], "risk_assessment": { "exploit_likelihood": "Low for direct internet exploitation - this is a client application vulnerability requiring user interaction and man-in-the-middle attack positioning, not a direct network service exploitation", "impact_assessment": "High impact if exploited - arbitrary code execution with user privileges, but requires social engineering or network positioning rather than direct service attack", "exposure_scope": "No internet-facing systems affected as Notepad++ is desktop client software, but wide deployment base makes it attractive for targeted attacks" }, "exploitation_method": "USER_INTERACTION", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "**CVE-2025-15556** is a vulnerability affecting the **WinGUp updater component of Notepad++** versions prior to 8.8.9 【2】.\n\nHere's what is known about its exploitation:\n\n* **Internet-Facing Applications/Services:** The vulnerability itself is within the Notepad++ updater, not directly an internet-facing application or service. However, **exploitation relies on intercepting or redirecting update traffic**, which can be facilitated by network-level attacks or DNS hijacking 【1】.\n* **Evidence of Active Exploitation:** **Yes, CVE-2025-15556 has been actively exploited in the wild** 【1】【3】.\n* **Attack Vectors and Exploitation Methods:** An attacker can exploit this vulnerability by intercepting or redirecting the update traffic for Notepad++. This allows them to trick the updater into downloading and executing an attacker-controlled installer instead of a legitimate update. This is achieved through a **man-in-the-middle attack** 【1】.\n* **Targeted Attacks:** While the provided information confirms active exploitation, it **does not specify whether these attacks have been used in targeted campaigns** against specific organizations.\n* **CISA Known Exploited Vulnerabilities (KEV) Status:** **CVE-2025-15556 has been added to CISA's Known Exploited Vulnerabilities (KEV) Catalog** 【3】【4】. This indicates that CISA has evidence of active exploitation and poses a significant risk.\n* **Technical Details about Internet Exploitability:** The core technical detail is the **lack of cryptographic verification for downloaded update metadata and installers** 【2】. This allows an attacker to substitute a malicious installer. When a user runs the WinGUp updater, the malicious installer is executed with the privileges of the user running Notepad++, leading to **arbitrary code execution** 【1】【2】.\n\nSources:\n- CVE-2025-15556 - Exploits & Severity - Feedly: https://feedly.com/cve/CVE-2025-15556\n- CVE-2025-15556 Detail - NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-15556\n- Notepad++ Code Execution Flaw Exploited in the Wild, CISA Issues Alert: https://cyberpress.org/notepad-code-execution-flaw-exploited-in-the-wild-cisa-issues-alert/\n- CISA Adds One Known Exploited Vulnerability to Catalog: https://www.cisa.gov/news-events/alerts/2025/12/05/cisa-adds-one-known-exploited-vulnerability-catalog", "references": [ { "title": "CVE-2025-15556 - Exploits & Severity - Feedly", "url": "https://feedly.com/cve/CVE-2025-15556", "citation_contribution": 814, "snippet": "CVEs. CVE-2025-15556. Proof of exploitExploited in the wild.This allows an attacker able to intercept or redirect update traffic to cause the updater to download and execute an attacker-controlled installer. Impact. An attacker positioned to intercept or redirect update traffic (such as through network-level attacks or DNS hijacking) can conduct a man-in-the-middle attack. When users run the WinGUp updater, the attacker can inject a malicious installer that will be executed with the privileges of the user running Notepad++. This results in arbitrary code execution on the affected system.", "is_search_result": true }, { "title": "CVE-2025-15556 Detail - NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15556", "citation_contribution": 404, "snippet": "CVE-2025-15556 Detail.Notepad++ versions prior to 8.8.9, when using the WinGUp updater, contain an update integrity verification vulnerability where downloaded update metadata and installers are not cryptographically verified. An attacker able to intercept or redirect update traffic can cause the updater to download and execute an attacker-controlled installer, resulting in arbitrary code execution with the privileges of the user.", "is_search_result": true }, { "title": "Notepad++ Code Execution Flaw Exploited in the Wild, CISA Issues Alert", "url": "https://cyberpress.org/notepad-code-execution-flaw-exploited-in-the-wild-cisa-issues-alert/", "citation_contribution": 146, "snippet": "The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical vulnerability in the widely used Notepad++ text editor to its Known Exploited Vulnerabilities (KEV) catalog. Tracked as CVE-2025-15556, this flaw in the WinGUp updater component enables attackers to execute arbitrary code by intercepting update traffic without integrity checks. Developers, system ...", "is_search_result": true }, { "title": "CISA Adds One Known Exploited Vulnerability to Catalog", "url": "https://www.cisa.gov/news-events/alerts/2025/12/05/cisa-adds-one-known-exploited-vulnerability-catalog", "citation_contribution": 61, "snippet": "This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.", "is_search_result": true } ], "timestamp": "2026-02-13T18:45:12.731977" }, "cache_timestamp": "2026-02-13T18:45:29.773107", "displayed_on_website": false }, { "cve_id": "CVE-2025-14847", "cvss_score": "7.5", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2025-12-19T11:00:22.465Z", "cve_published_date_formatted": "2025-12-19", "kev_date_added": "2025-12-29", "kev_date_added_formatted": "2025-12-29", "kev_due_date": "2026-01-19", "days_to_kev": 10, "days_since_kev": null, "is_new_kev": false, "summary": "Critical memory disclosure vulnerability in MongoDB Server allowing unauthenticated remote attackers to read heap memory through malformed Zlib compressed protocol headers. CISA has added this to KEV catalog due to confirmed active exploitation in the wild.", "detailed_analysis": { "vulnerability_type": "Memory disclosure vulnerability (CWE-130) causing uninitialized heap memory reads through improper handling of Zlib compressed protocol header length fields", "affected_products": [ "MongoDB Server 8.2 (< 8.2.3)", "MongoDB Server 8.0 (< 8.0.17)", "MongoDB Server 7.0 (< 7.0.28)", "MongoDB Server 6.0 (< 6.0.27)", "MongoDB Server 5.0 (< 5.0.32)", "MongoDB Server 4.4 (< 4.4.30)", "MongoDB Server 4.2 (all versions)", "MongoDB Server 4.0 (all versions)", "MongoDB Server 3.6 (all versions)" ], "exploitation_requirements": [ "Network access to MongoDB server port (default 27017)", "No authentication required", "No user interaction required", "Ability to send malformed Zlib compressed protocol headers" ], "internet_facing_likelihood": "MongoDB is frequently deployed as an internet-facing database server in web applications, cloud services, and API backends. While security best practices recommend restricting database access, many MongoDB instances are directly exposed to the internet for application connectivity, especially in cloud environments and microservices architectures.", "typical_deployment": "MongoDB Server is database server software that runs as a network service, typically listening on port 27017. It's commonly deployed as backend infrastructure for web applications, mobile apps, and cloud services.", "deployment_statistics": "Estimated 30-50% of MongoDB deployments have some level of internet exposure, either directly or through application layers. Cloud-hosted MongoDB instances and those supporting web applications frequently require network accessibility that can be exploited remotely.", "active_exploitation": "CISA has confirmed active exploitation in the wild and added CVE-2025-14847 to the Known Exploited Vulnerabilities (KEV) catalog. Evidence shows attackers are actively targeting both internet-exposed and internal MongoDB servers.", "severity_factors": [ "CVSS 7.5 (High severity)", "No authentication required for exploitation", "Network-based attack vector", "Active exploitation confirmed by CISA KEV listing", "Affects wide range of MongoDB versions including current releases", "Can expose sensitive data including passwords and API keys", "Low attack complexity" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review MongoDB logs, check for unauthorized access, verify system integrity, and monitor for unusual database queries or data access patterns", "IMMEDIATE: Update to patched MongoDB versions: 8.2.3, 8.0.17, 7.0.28, 6.0.27, 5.0.32, or 4.4.30 depending on your branch", "URGENT: If immediate patching isn't possible, implement network-level controls to restrict MongoDB access to only authorized systems and disable direct internet exposure", "Monitor MongoDB connection logs for suspicious connection attempts and unusual protocol traffic patterns", "Patch priority: CRITICAL - Apply patches immediately due to active exploitation and no authentication requirement" ], "risk_assessment": { "exploit_likelihood": "Very High - Active exploitation confirmed by CISA, no authentication required, and straightforward network-based attack vector with low complexity", "impact_assessment": "High - Can expose sensitive data from MongoDB heap memory including user credentials, API keys, and internal application data. May facilitate further attacks through information disclosure", "exposure_scope": "High - MongoDB is widely deployed in internet-facing architectures. Millions of MongoDB instances potentially affected globally, with significant portion having some level of network exposure" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "Here's what is known about the CVE-2025-14847 vulnerability exploitation:\n\n* **Affected Applications/Services:** The vulnerability affects **MongoDB servers** 【2】 and can impact both **internet-exposed and internal resources** 【2】.\n* **Active Exploitation:** There is evidence of **active exploitation** of CVE-2025-14847 in the wild 【2】【4】.\n* **CISA KEV Status:** CISA has added CVE-2025-14847 to its **Known Exploited Vulnerabilities (KEV) Catalog**, based on evidence of active exploitation 【4】.\n* **Attack Vectors/Exploitation Methods:**\n * A remote, unauthenticated attacker can trigger a condition where the MongoDB server returns uninitialized memory from its heap 【1】.\n * An attacker with local network access could send a specially crafted URL to access certain administration functions without login credentials 【3】.\n* **Impact of Exploitation:** Successful exploitation could allow an attacker to:\n * Extract sensitive information from MongoDB servers, including user information, passwords, and API keys 【2】.\n * Disclose sensitive in-memory data, including internal state information and pointers that may assist in further exploitation 【1】.\n * Access certain administration functions without credentials 【3】.\n* **Targeted Attacks:** While the provided documents confirm active exploitation, there is no specific information available regarding whether CVE-2025-14847 has been used in targeted attacks.\n* **Technical Details Regarding Internet Exploitability:** CVE-2025-14847 allows a remote, unauthenticated attacker to trigger a condition in which the MongoDB server may return uninitialized memory from its heap 【1】.\n\nUsers are advised to update to MongoDB versions 8.2.3, 8.0.17, 7.0.28, 6.0.27, 5.0.32, and 4.4.30. Patches for MongoDB Atlas have been applied 【2】.\n\nSources:\n- New MongoDB Flaw Lets Unauthenticated Attackers Read...: https://thehackernews.com/2025/12/new-mongodb-flaw-lets-unauthenticated.html\n- MongoDB Vulnerability CVE-2025-14847 Under Active Exploitation Worldwide: https://thehackernews.com/2025/12/mongodb-vulnerability-cve-2025-14847.html\n- Vulnerability Summary for the Week of December 15, 2025 | CISA: https://www.cisa.gov/news-events/bulletins/sb25-356\n- CISA Adds One Known Exploited Vulnerability to Catalog: https://www.cisa.gov/news-events/alerts/2025/12/29/cisa-adds-one-known-exploited-vulnerability-catalog", "references": [ { "title": "New MongoDB Flaw Lets Unauthenticated Attackers Read...", "url": "https://thehackernews.com/2025/12/new-mongodb-flaw-lets-unauthenticated.html", "citation_contribution": 483, "snippet": "\"CVE-2025-14847 allows a remote, unauthenticated attacker to trigger a condition in which the MongoDB server may return uninitialized memory from its heap,\" OP Innovate said. \"This could result in the disclosure of sensitive in-memory data, including internal state information, pointers, or other data that may assist an attacker in further exploitation.\" Found this article interesting?", "is_search_result": true }, { "title": "MongoDB Vulnerability CVE-2025-14847 Under Active Exploitation Worldwide", "url": "https://thehackernews.com/2025/12/mongodb-vulnerability-cve-2025-14847.html", "citation_contribution": 464, "snippet": "Successful exploitation of the shortcoming could allow an attacker to extract sensitive information from MongoDB servers, including user information, passwords, and API keys.This includes both internet-exposed and internal resources. The exact details surrounding the nature of attacks exploiting the flaw are presently unknown. Users are advised to update to MongoDB versions 8.2.3, 8.0.17, 7.0.28, 6.0.27, 5.0.32, and 4.4.30. Patches for MongoDB Atlas have been applied.", "is_search_result": true }, { "title": "Vulnerability Summary for the Week of December 15, 2025 | CISA", "url": "https://www.cisa.gov/news-events/bulletins/sb25-356", "citation_contribution": 218, "snippet": "Successful exploitation of the vulnerability could allow an attacker with local network access to send a specially crafted URL to access certain administration functions without login credentials.", "is_search_result": true }, { "title": "CISA Adds One Known Exploited Vulnerability to Catalog", "url": "https://www.cisa.gov/news-events/alerts/2025/12/29/cisa-adds-one-known-exploited-vulnerability-catalog", "citation_contribution": 199, "snippet": "CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2025-14847", "is_search_result": true } ], "timestamp": "2025-12-29T20:30:14.382780" }, "cache_timestamp": "2025-12-29T20:30:37.520589", "displayed_on_website": false }, { "cve_id": "CVE-2025-14733", "cvss_score": "9.3", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2025-12-19T00:01:55.722Z", "cve_published_date_formatted": "2025-12-19", "kev_date_added": "2025-12-19", "kev_date_added_formatted": "2025-12-19", "kev_due_date": "2025-12-26", "days_to_kev": 0, "days_since_kev": null, "is_new_kev": false, "summary": "Critical out-of-bounds write vulnerability in WatchGuard Fireware OS affecting IKEv2 VPN services. Remote unauthenticated attackers can execute arbitrary code on internet-facing firewall systems through direct network exploitation.", "detailed_analysis": { "vulnerability_type": "Out-of-bounds Write (CWE-787) in IKEv2 VPN implementation allowing remote code execution", "affected_products": [ "WatchGuard Fireware OS (versions 11.10.2 through 2025.1.3)" ], "exploitation_requirements": [ "Network access to IKEv2 VPN service", "No authentication required", "No user interaction required", "Target must have IKEv2 configured with dynamic gateway peer" ], "internet_facing_likelihood": "WatchGuard Fireware OS runs on enterprise firewalls that are by design deployed at network perimeters with direct internet exposure. The affected IKEv2 VPN services specifically require internet accessibility to function, making virtually all vulnerable deployments internet-facing.", "typical_deployment": "WatchGuard Fireware OS is enterprise firewall/security appliance software that runs on dedicated network security devices positioned at network boundaries between internal networks and the internet", "deployment_statistics": "Estimated 95-98% of WatchGuard firewall deployments are internet-facing, as their primary function is perimeter security and VPN termination requiring direct internet connectivity for remote access services", "active_exploitation": "CISA has added this vulnerability to the Known Exploited Vulnerabilities (KEV) catalog, indicating confirmed evidence of active exploitation in the wild", "severity_factors": [ "CVSS 9.3 Critical severity", "Remote code execution without authentication", "Affects internet-facing network security devices", "Active exploitation confirmed by CISA KEV listing", "Targets critical infrastructure components", "No user interaction required" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "IMMEDIATE: Apply security patches to affected WatchGuard Fireware OS versions (upgrade to 11.12.4_Update2+, 12.12.0+, or 2025.1.4+)", "URGENT: Review IKEv2 VPN configurations and temporarily disable IKEv2 with dynamic gateway peers if patching cannot be completed immediately", "Monitor VPN connection logs for suspicious authentication attempts or unusual traffic patterns", "Verify firewall rule configurations and review recent configuration changes", "Patch priority: CRITICAL - Apply within 24-48 hours due to active exploitation" ], "risk_assessment": { "exploit_likelihood": "VERY HIGH - Active exploitation confirmed by CISA KEV listing, no authentication required, and vulnerability affects internet-facing services by design", "impact_assessment": "CRITICAL - Complete system compromise possible through remote code execution on perimeter security devices, potentially allowing network infiltration and lateral movement", "exposure_scope": "HIGH - WatchGuard has significant enterprise market share with thousands of internet-facing firewall deployments running vulnerable Fireware OS versions" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "Based on the search results, here's what is known about the CVE-2025-14733 vulnerability exploitation:\n\n* **CISA Known Exploited Vulnerabilities (KEV) Status:** CISA added CVE-2025-14733 to its KEV catalog, based on evidence of active exploitation 【3】【4】. CISA maintains the KEV catalog as an authoritative source of vulnerabilities exploited in the wild, recommending organizations use it to prioritize vulnerability management 【2】. They require Federal Civilian Executive Branch (FCEB) agencies to remediate KEV vulnerabilities by a specified due date 【5】.\n\n* **Active Exploitation:** CISA added CVE-2025-14733 to the KEV catalog due to evidence of active exploitation 【3】【4】.\n\n* **Attack Vectors:** The search results generally state that threat actors frequently use these types of vulnerabilities as attack vectors 【1】.\n\n* **Impacted Products:** While not explicitly stated in the search results, the vulnerability may affect internet-facing applications and services, given CISA's focus on vulnerabilities posing significant risks to the federal enterprise 【1】 and the inclusion of actively exploited vulnerabilities in their catalog 【2】.\n\nSources:\n- CISA Adds Three Known Exploited Vulnerabilities to Catalog: https://www.cisa.gov/news-events/alerts/2025/12/17/cisa-adds-three-known-exploited-vulnerabilities-catalog\n- Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog\n- CISA Adds Two Known Exploited Vulnerabilities to Catalog: https://www.cisa.gov/news-events/alerts/2025/12/15/cisa-adds-two-known-exploited-vulnerabilities-catalog\n- CISA Adds One Known Exploited Vulnerability to Catalog: https://www.cisa.gov/news-events/alerts/2025/12/16/cisa-adds-one-known-exploited-vulnerability-catalog\n- CISA Adds Two Known Exploited Vulnerabilities to Catalog | CISA: https://www.cisa.gov/news-events/alerts/2025/07/01/cisa-adds-two-known-exploited-vulnerabilities-catalog", "references": [ { "title": "CISA Adds Three Known Exploited Vulnerabilities to Catalog", "url": "https://www.cisa.gov/news-events/alerts/2025/12/17/cisa-adds-three-known-exploited-vulnerabilities-catalog", "citation_contribution": 381, "snippet": "These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise. Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the KEV Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs ...", "is_search_result": true }, { "title": "Known Exploited Vulnerabilities Catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "citation_contribution": 247, "snippet": "For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild. Organizations should use the KEV catalog as an input to their vulnerability management prioritization framework.How to use the KEV ...", "is_search_result": true }, { "title": "CISA Adds Two Known Exploited Vulnerabilities to Catalog", "url": "https://www.cisa.gov/news-events/alerts/2025/12/15/cisa-adds-two-known-exploited-vulnerabilities-catalog", "citation_contribution": 133, "snippet": "CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2025-14611", "is_search_result": true }, { "title": "CISA Adds One Known Exploited Vulnerability to Catalog", "url": "https://www.cisa.gov/news-events/alerts/2025/12/16/cisa-adds-one-known-exploited-vulnerability-catalog", "citation_contribution": 125, "snippet": "CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.Read more", "is_search_result": true }, { "title": "CISA Adds Two Known Exploited Vulnerabilities to Catalog | CISA", "url": "https://www.cisa.gov/news-events/alerts/2025/07/01/cisa-adds-two-known-exploited-vulnerabilities-catalog", "citation_contribution": 120, "snippet": "BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information. Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of KEV Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.", "is_search_result": true } ], "timestamp": "2025-12-19T18:35:19.681350" }, "cache_timestamp": "2025-12-19T18:35:39.801894", "displayed_on_website": false }, { "cve_id": "CVE-2025-14611", "cvss_score": "7.1", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2025-12-12T21:01:13.116Z", "cve_published_date_formatted": "2025-12-12", "kev_date_added": "2025-12-15", "kev_date_added_formatted": "2025-12-15", "kev_due_date": "2026-01-05", "days_to_kev": 3, "days_since_kev": null, "is_new_kev": false, "summary": "Gladinet CentreStack and TrioFox use hardcoded AES keys enabling unauthenticated arbitrary local file inclusion on public-facing endpoints. This vulnerability is actively exploited and listed in CISA's KEV catalog.", "detailed_analysis": { "vulnerability_type": "Hardcoded cryptographic credentials (CWE-798) leading to arbitrary local file inclusion", "affected_products": [ "Gladinet CentreStack", "Gladinet TrioFox" ], "exploitation_requirements": [ "Network access to public endpoint", "No authentication required", "Specially crafted request" ], "internet_facing_likelihood": "CentreStack and TrioFox are enterprise file synchronization and sharing platforms specifically designed to provide secure remote access to corporate data. These products are inherently internet-facing by design - their primary function is to enable remote users to access corporate file servers and cloud storage through web interfaces and mobile apps. The CVE description explicitly mentions 'public exposed endpoints', confirming internet deployment is standard.", "typical_deployment": "Server-side enterprise applications that provide web-based file sharing and synchronization services with dedicated web portals for remote user access", "deployment_statistics": "Estimated 95%+ of deployments are internet-facing since the core business value requires external access for remote workers, mobile users, and partner collaboration", "active_exploitation": "Confirmed active exploitation - listed in CISA KEV catalog with exploit maturity marked as 'ATTACKED' in CVSS 4.0 scoring", "severity_factors": [ "No authentication required", "Network attack vector", "Active exploitation confirmed", "Can lead to full system compromise when chained", "Affects public-facing endpoints", "High impact on confidentiality and integrity of subsequent systems" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately update to version 16.12.10420.56791 or later", "Monitor web server logs for unusual file access patterns or directory traversal attempts", "Implement additional network segmentation if immediate patching is not possible", "HIGHEST patch priority - active exploitation with unauthenticated network access" ], "risk_assessment": { "exploit_likelihood": "Very High - Unauthenticated network exploitation with confirmed active attacks and available proof-of-concept", "impact_assessment": "High - Arbitrary file inclusion can lead to credential theft, configuration exposure, and when chained with other vulnerabilities, full system compromise", "exposure_scope": "All internet-facing CentreStack and TrioFox deployments globally are vulnerable, representing thousands of enterprise file sharing portals" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "Here's what is known about the CVE-2025-14611 vulnerability exploitation:\n\n**General Information:**\n\n* CVE-2025-14611 is a vulnerability present in Gladinet CentreStack and Triofox. It involves hardcoded cryptographic keys. 【2】\n* CISA has added CVE-2025-14611 to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. 【1】【5】\n* Vulnerabilities in the KEV catalog carry significant risk and are frequent attack vectors for malicious cyber actors. 【3】【4】\n\n**CISA Known Exploited Vulnerabilities (KEV) Status:**\n\n* CVE-2025-14611 is listed in CISA's KEV catalog. 【2】【5】\n* CISA's Binding Operational Directive (BOD) 22-01 established the KEV Catalog as a list of CVEs that carry significant risk to the federal enterprise. 【1】\n\nWhile the provided information confirms active exploitation and inclusion in the CISA KEV catalog, details regarding the following are not available:\n\n* Whether it affects internet-facing applications or services\n* Specific attack vectors and exploitation methods\n* Whether it's been used in targeted attacks\n* Technical details about internet exploitability\n\nSources:\n- Alert CISA Adds Two Known Exploited Vulnerabilities to Catalog...: https://community.opentextcybersecurity.com/vulnerability-vault-228/alert-cisa-adds-two-known-exploited-vulnerabilities-to-catalog-release-date-december-15-2025-362930\n- Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog\n- CISA Adds Two Known Exploited Vulnerabilities to Catalog | CISA: https://www.cisa.gov/news-events/alerts/2025/07/01/cisa-adds-two-known-exploited-vulnerabilities-catalog\n- CISA Adds One Known Exploited Vulnerability to Catalog | CISA: https://www.cisa.gov/news-events/alerts/2025/07/02/cisa-adds-one-known-exploited-vulnerability-catalog\n- CISA Adds Two Known Exploited Vulnerabilities to Catalog: https://www.cisa.gov/news-events/alerts/2025/12/15/cisa-adds-two-known-exploited-vulnerabilities-catalog", "references": [ { "title": "Alert CISA Adds Two Known Exploited Vulnerabilities to Catalog...", "url": "https://community.opentextcybersecurity.com/vulnerability-vault-228/alert-cisa-adds-two-known-exploited-vulnerabilities-to-catalog-release-date-december-15-2025-362930", "citation_contribution": 257, "snippet": "Moderator. CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2025-14611.These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise. Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the KEV Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise.", "is_search_result": true }, { "title": "Known Exploited Vulnerabilities Catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "citation_contribution": 153, "snippet": "CVE-2025-14611​​ Gladinet CentreStack and Triofox Hard Coded Cryptographic Vulnerability: Gladinet CentreStack and TrioFox contain a hardcoded cryptographic keys ...Read more", "is_search_result": true }, { "title": "CISA Adds Two Known Exploited Vulnerabilities to Catalog | CISA", "url": "https://www.cisa.gov/news-events/alerts/2025/07/01/cisa-adds-two-known-exploited-vulnerabilities-catalog", "citation_contribution": 64, "snippet": "CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2025-48927 TeleMessage TM SGNL Initialization of a Resource with an Insecure Default Vulnerability.These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.", "is_search_result": true }, { "title": "CISA Adds One Known Exploited Vulnerability to Catalog | CISA", "url": "https://www.cisa.gov/news-events/alerts/2025/07/02/cisa-adds-one-known-exploited-vulnerability-catalog", "citation_contribution": 57, "snippet": "CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2025-6554 Google Chromium V8 Type Confusion Vulnerability. These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.", "is_search_result": true }, { "title": "CISA Adds Two Known Exploited Vulnerabilities to Catalog", "url": "https://www.cisa.gov/news-events/alerts/2025/12/15/cisa-adds-two-known-exploited-vulnerabilities-catalog", "citation_contribution": 49, "snippet": "CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.Read more", "is_search_result": true } ], "timestamp": "2025-12-16T18:20:13.777207" }, "cache_timestamp": "2025-12-16T18:20:32.518851", "displayed_on_website": false }, { "cve_id": "CVE-2025-14174", "cvss_score": "8.8", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1189", "deployment_likelihood": "VERY_LOW", "cve_published_date": "2025-12-12T19:20:41.809Z", "cve_published_date_formatted": "2025-12-12", "kev_date_added": "2025-12-12", "kev_date_added_formatted": "2025-12-12", "kev_due_date": "2026-01-02", "days_to_kev": 0, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2025-14174 is an out-of-bounds memory access vulnerability in Google Chrome that requires user interaction with a crafted HTML page. While actively exploited and in CISA KEV, it affects client-side browser software, not internet-facing servers.", "detailed_analysis": { "vulnerability_type": "Out of bounds memory access in ANGLE (graphics layer) component", "affected_products": [ "Chrome", "Microsoft Edge (Chromium-based)" ], "exploitation_requirements": [ "User must visit malicious website", "Crafted HTML page required", "No authentication bypass needed" ], "internet_facing_likelihood": "Chrome is client-side browser software, not server software. While it connects to the internet, it is not deployed as an internet-facing service that listens for incoming connections. The vulnerability requires users to visit malicious websites, making this a client-side attack vector rather than server-side exploitation.", "typical_deployment": "Chrome is desktop/mobile client software installed on end-user devices. It acts as a client that makes outbound connections to web servers, not as a server that accepts inbound connections from the internet.", "deployment_statistics": "0% of Chrome deployments are internet-facing servers. Chrome is exclusively client software that runs on user workstations and mobile devices. There are no legitimate business cases for deploying Chrome as an internet-facing service.", "active_exploitation": "CISA has confirmed active exploitation in the wild. Attacks reportedly target specific individuals through malicious web content, indicating targeted campaigns rather than mass exploitation of internet-facing infrastructure.", "severity_factors": [ "High CVSS score (8.8)", "Active exploitation confirmed", "Requires user interaction", "Client-side only vulnerability", "Not exploitable via T1190 direct network attacks" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review browser history, check for suspicious web activity, verify system integrity on workstations", "Update Chrome immediately to version 143.0.7499.110 or later across all user devices", "Deploy browser updates via enterprise management tools if available", "Monitor web traffic logs for suspicious patterns and known malicious domains", "Educate users about avoiding suspicious websites and links", "Consider implementing web filtering and DNS protection services" ], "risk_assessment": { "exploit_likelihood": "Low for T1190 direct internet exploitation - this requires social engineering or phishing to deliver malicious web content to users. High likelihood for targeted attacks via malicious websites.", "impact_assessment": "High impact on individual user systems if exploited - potential for arbitrary code execution and system compromise. However, does not provide direct access to enterprise infrastructure without additional pivoting.", "exposure_scope": "Zero internet-facing servers affected as Chrome is client software only. Risk is to end-user workstations and mobile devices that browse malicious content." }, "exploitation_method": "USER_INTERACTION", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "Here's what is known about the CVE-2025-14174 vulnerability:\n\n* **Affected applications:** CVE-2025-14174 affects web browsers that utilize Chromium, including Google Chrome and Microsoft Edge 【2】.\n* **CISA KEV Status:** CISA has added CVE-2025-14174 to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation 【3】【4】.\n* **Active Exploitation:** The vulnerability is actively being exploited in the wild 【1】.\n* **Attack Vectors/Exploitation Method:** Attackers can potentially execute arbitrary code by crafting malicious web content 【1】.\n* **Targeted Attacks:** CVE-2025-14174 has been reportedly used in a sophisticated, targeted attack against specific individuals on iOS versions before iOS 26 【1】.\n* **Internet facing:** These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks 【5】【6】.\n\nSources:\n- CVE-2025-14174 - Exploits & Severity - Feedly: https://feedly.com/cve/CVE-2025-14174\n- Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog\n- CISA Adds Two Known Exploited Vulnerabilities to Catalog: https://www.cisa.gov/news-events/alerts/2025/12/09/cisa-adds-two-known-exploited-vulnerabilities-catalog\n- CISA Adds Three Known Exploited Vulnerabilities to Catalog: https://www.cisa.gov/news-events/alerts/2025/04/28/cisa-adds-three-known-exploited-vulnerabilities-catalog\n- CISA Adds One Vulnerability to the KEV Catalog | CISA: https://www.cisa.gov/news-events/alerts/2025/01/08/cisa-adds-one-vulnerability-kev-catalog", "references": [ { "title": "CVE-2025-14174 - Exploits & Severity - Feedly", "url": "https://feedly.com/cve/CVE-2025-14174", "citation_contribution": 375, "snippet": "Impact. Attackers could potentially execute arbitrary code by crafting malicious web content. The vulnerability has been reported as being used in an extremely sophisticated targeted attack against specific individuals on versions of iOS before iOS 26. This suggests a high-risk, precision-targeted exploitation method. Exploitation. There is no evidence that a public proof-of-concept exists. The vulnerability is actively being exploited in the wild and was added to the CISA Known Exploited Vulnerability list.", "is_search_result": true }, { "title": "Known Exploited Vulnerabilities Catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "citation_contribution": 133, "snippet": "CVE-2025-14174​​ This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and ...", "is_search_result": true }, { "title": "CISA Adds Two Known Exploited Vulnerabilities to Catalog", "url": "https://www.cisa.gov/news-events/alerts/2025/12/09/cisa-adds-two-known-exploited-vulnerabilities-catalog", "citation_contribution": 76, "snippet": "CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.", "is_search_result": true }, { "title": "CISA Adds Three Known Exploited Vulnerabilities to Catalog", "url": "https://www.cisa.gov/news-events/alerts/2025/04/28/cisa-adds-three-known-exploited-vulnerabilities-catalog", "citation_contribution": 73, "snippet": "CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation.", "is_search_result": true }, { "title": "CISA Adds One Vulnerability to the KEV Catalog | CISA", "url": "https://www.cisa.gov/news-events/alerts/2025/01/08/cisa-adds-one-vulnerability-kev-catalog", "citation_contribution": 73, "snippet": "CVE-2025-0282. Ivanti Connect Secure Vulnerability. These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise. CISA urges organizations to apply mitigations as set forth in the CISA instructions linked below to include conducting hunt activities, taking remediation actions if applicable, and applying updates prior to returning a device to service.", "is_search_result": true } ], "timestamp": "2025-12-13T20:40:37.943634" }, "cache_timestamp": "2025-12-13T20:40:58.433817", "displayed_on_website": false }, { "cve_id": "CVE-2025-13223", "cvss_score": "8.8", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1189", "deployment_likelihood": "VERY_LOW", "cve_published_date": "2025-11-17T23:03:38.938Z", "cve_published_date_formatted": "2025-11-17", "kev_date_added": "2025-11-19", "kev_date_added_formatted": "2025-11-19", "kev_due_date": "2025-12-10", "days_to_kev": 2, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2025-13223 is a type confusion vulnerability in Chrome's V8 engine exploited via crafted HTML pages. While actively exploited in the wild, it requires user interaction to visit malicious websites, making it primarily a client-side phishing attack rather than direct server exploitation.", "detailed_analysis": { "vulnerability_type": "Type Confusion (CWE-843) in V8 JavaScript engine leading to heap corruption", "affected_products": [ "Chrome" ], "exploitation_requirements": [ "User must visit crafted HTML page", "Network access to deliver malicious content", "No authentication required" ], "internet_facing_likelihood": "Chrome is client-side browser software, not server software. It is not deployed as an internet-facing service that accepts incoming connections. Chrome connects outbound to websites but does not run listening services accessible from the internet. Estimated 0% of Chrome deployments are internet-facing servers.", "typical_deployment": "Chrome is client-side browser software installed on end-user devices (desktops, laptops, mobile). It is designed to make outbound connections to web servers, not to accept incoming connections as a server application.", "deployment_statistics": "0% - Chrome is categorically not server software and is never deployed as an internet-facing service. It operates as a client application that makes outbound requests.", "active_exploitation": "Confirmed active exploitation in the wild with CISA KEV listing. Targeting includes journalists and political dissidents through malicious websites.", "severity_factors": [ "High CVSS score of 8.8", "Active exploitation confirmed", "No authentication required", "Requires user interaction", "Client-side vulnerability only", "Cannot be directly exploited over internet without user visiting malicious site" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review browser logs, check for unauthorized access, verify system integrity", "Update Chrome immediately to version 142.0.7444.175 or later", "Monitor for suspicious web traffic and malicious domains", "Educate users about phishing risks and suspicious websites", "Consider web filtering solutions to block known malicious domains", "HIGH priority patching for client endpoints" ], "risk_assessment": { "exploit_likelihood": "Not directly exploitable over internet - requires user to visit malicious website making this a phishing/social engineering attack (T1566) rather than direct server exploitation (T1190)", "impact_assessment": "High impact on individual systems if exploited - arbitrary code execution possible leading to full system compromise", "exposure_scope": "No internet-facing Chrome servers exist - this affects client endpoints that must be tricked into visiting malicious sites" }, "exploitation_method": "USER_INTERACTION", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "CVE-2025-13223 is a high-severity type confusion vulnerability affecting Google Chrome's V8 JavaScript and WebAssembly engine 【1】【2】. Here's what is known about its exploitation:\n\n* **Affected Applications/Services:** The vulnerability affects Google Chrome and other Chromium-based browsers like Microsoft Edge 【6】【4】. Since it is exploited through web browsers, it affects internet-facing applications 【4】.\n* **Active Exploitation:** CVE-2025-13223 has been actively exploited in the wild 【1】【11】. Google released a security fix for this zero-day vulnerability due to active exploitation 【10】【9】.\n* **Attack Vectors/Exploitation Methods:** The vulnerability allows a remote attacker to exploit heap corruption by using a crafted HTML page 【3】【4】. Successful exploitation can lead to arbitrary code execution or program crashes 【1】.\n* **Targeted Attacks:** Observed exploitation includes targeted attacks against journalists and political dissidents 【2】.\n* **CISA KEV Status:** CISA has added CVE-2025-13223 to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation 【5】.\n* **Technical Details:** CVE-2025-13223 is a type confusion vulnerability in the V8 engine 【4】【7】. Type confusion occurs when the engine incorrectly assumes the type of an object at runtime, leading to memory errors 【8】【7】. The CVSS score is 8.8, indicating high severity 【1】. The attack vector is network-based, with low attack complexity, requiring user interaction 【3】.\n\nSources:\n- The Hacker News | #1 Trusted Source for Cybersecurity News — Index...: https://thehackernews.com/search?updated-max=2025-11-18T02:37:00-08:00&max-results=12\n- CVE-2025-13223 — Google Chrome +1 | dbugs: https://dbugs.ptsecurity.com/vulnerability/PT-2025-47217\n- CVE-2025-13223 - Vulnerability Details - OpenCVE: https://app.opencve.io/cve/CVE-2025-13223\n- Google patches yet another exploited Chrome zero-day ...: https://www.helpnetsecurity.com/2025/11/18/chrome-cve-2025-13223-exploited/\n- CISA Adds One Known Exploited Vulnerability to Catalog: https://www.cisa.gov/news-events/alerts/2025/11/14/cisa-adds-one-known-exploited-vulnerability-catalog", "references": [ { "title": "The Hacker News | #1 Trusted Source for Cybersecurity News — Index...", "url": "https://thehackernews.com/search?updated-max=2025-11-18T02:37:00-08:00&max-results=12", "citation_contribution": 211, "snippet": "The vulnerability in question is CVE-2025-13223 (CVSS score: 8.8), a type confusion vulnerability in the V8 JavaScript and WebAssembly engine that could be exploited to achieve arbitrary code execution or program crashes. \"Type Confusion in V8 in Google Chrome prior to 142.0.7444.175 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page,\" according to a description of the flaw in the NIST National Vulnerability Database (NVD).", "is_search_result": true }, { "title": "CVE-2025-13223 — Google Chrome +1 | dbugs", "url": "https://dbugs.ptsecurity.com/vulnerability/PT-2025-47217", "citation_contribution": 199, "snippet": "Details on CVE-2025-13223: Google Chrome +1. Includes CVSS score, affected versions, and references.The vulnerability was discovered by Google’s Threat Analysis Group on November 12, 2025. This is the seventh zero-day vulnerability addressed in Chrome this year. Exploitation has been observed in targeted attacks, including campaigns against journalists and political dissidents.", "is_search_result": true }, { "title": "CVE-2025-13223 - Vulnerability Details - OpenCVE", "url": "https://app.opencve.io/cve/CVE-2025-13223", "citation_contribution": 195, "snippet": "Exploitation none. Automatable no. Technical Impact total.(Chromium security severity: High)\"}], \"id\": \"CVE-2025-13223\", \"lastModified\": \"2025-11-18T02:15:43.070\", \"metrics\": {\"cvssMetricV31\": [{\"cvssData\": {\"attackComplexity\": \"LOW\", \"attackVector\": \"NETWORK\", \"availabilityImpact\": \"HIGH\", \"baseScore\": 8.8, \"baseSeverity\": \"HIGH\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"scope\": \"UNCHANGED\", \"userInteraction\": \"REQUIRED\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI", "is_search_result": true }, { "title": "Google patches yet another exploited Chrome zero-day ...", "url": "https://www.helpnetsecurity.com/2025/11/18/chrome-cve-2025-13223-exploited/", "citation_contribution": 178, "snippet": "CVE-2025-13223 is a type confusion vulnerability in V8, the JavaScript and WebAssembly engine used by Chrome and Chromium-based browsers. The ...", "is_search_result": true }, { "title": "CISA Adds One Known Exploited Vulnerability to Catalog", "url": "https://www.cisa.gov/news-events/alerts/2025/11/14/cisa-adds-one-known-exploited-vulnerability-catalog", "citation_contribution": 150, "snippet": "CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.", "is_search_result": true } ], "timestamp": "2025-11-19T18:50:24.995953" }, "cache_timestamp": "2025-11-19T18:50:42.226713", "displayed_on_website": false }, { "cve_id": "CVE-2025-1316", "cvss_score": "9.8", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2025-03-04T23:36:59.724Z", "cve_published_date_formatted": "2025-03-04", "kev_date_added": "2025-03-19", "kev_date_added_formatted": "2025-03-19", "kev_due_date": "2025-04-09", "days_to_kev": 15, "days_since_kev": null, "is_new_kev": false, "summary": "Critical OS command injection vulnerability in Edimax IC-7100 IP cameras allows unauthenticated remote code execution via specially crafted network requests. The vulnerability has been added to CISA KEV indicating active exploitation in the wild.", "detailed_analysis": { "vulnerability_type": "OS Command Injection (CWE-78) - improper neutralization of special elements used in OS commands", "affected_products": [ "Edimax IC-7100 IP Camera (all versions)" ], "exploitation_requirements": [ "Network access to camera's web interface", "No authentication required", "No user interaction required" ], "internet_facing_likelihood": "IP cameras are frequently deployed with internet accessibility for remote monitoring purposes. While security best practices recommend against direct internet exposure, many organizations and consumers expose these devices for convenience. Estimated 40-70% of deployments may have some form of internet accessibility through port forwarding, DMZ placement, or cloud services.", "typical_deployment": "IP cameras are network appliances that serve web interfaces for configuration and video streaming. They commonly run HTTP/HTTPS services on standard ports and are designed for network access by administrators and monitoring systems.", "deployment_statistics": "Approximately 50-60% of IP camera deployments have internet accessibility either directly or through VPN/remote access solutions, with many consumer and small business deployments having direct internet exposure due to configuration convenience.", "active_exploitation": "Listed in CISA KEV catalog as of March 19, 2025, indicating confirmed active exploitation in the wild. SSVC assessment shows 'active' exploitation status.", "severity_factors": [ "CVSS 9.8 Critical severity", "No authentication required", "Remote code execution impact", "Active exploitation confirmed", "IoT device with limited security updates", "Vendor unresponsive to coordination attempts" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately isolate affected Edimax IC-7100 cameras from internet access and place behind firewall/VPN", "Contact Edimax support for patches as vendor has been unresponsive to CISA coordination efforts", "Implement network segmentation to isolate IP cameras from critical systems", "Monitor camera access logs and network traffic for suspicious activity", "Consider replacing devices if vendor continues to be unresponsive to security issues", "PATCH PRIORITY: CRITICAL - Active exploitation with RCE capability" ], "risk_assessment": { "exploit_likelihood": "Very High - Active exploitation confirmed, no authentication required, low attack complexity", "impact_assessment": "Critical - Full system compromise with confidentiality, integrity, and availability impact. Potential for lateral movement and surveillance compromise.", "exposure_scope": "Moderate to High - IP cameras are commonly internet-exposed, affecting potentially thousands of devices globally with many in critical infrastructure and enterprise environments" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:45:10.821802", "displayed_on_website": false }, { "cve_id": "CVE-2025-12480", "cvss_score": "9.1", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2025-11-10T14:20:40.677Z", "cve_published_date_formatted": "2025-11-10", "kev_date_added": "2025-11-12", "kev_date_added_formatted": "2025-11-12", "kev_due_date": "2025-12-03", "days_to_kev": 2, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2025-12480 is a critical authentication bypass vulnerability in TrioFox file sharing platforms that allows unauthenticated attackers to access administrative setup pages. The vulnerability is being actively exploited in the wild and has been added to CISA's KEV catalog.", "detailed_analysis": { "vulnerability_type": "Improper Access Control - Authentication Bypass (CWE-284) allowing access to initial setup pages even after setup completion", "affected_products": [ "TrioFox File Sharing Platform" ], "exploitation_requirements": [ "Network access to TrioFox web interface", "No authentication required", "No user interaction required" ], "internet_facing_likelihood": "TrioFox is specifically designed as an internet-facing secure file sharing and remote access platform that eliminates the need for VPN connections. By design, it must be accessible from the internet to fulfill its primary business function of providing external file access to users.", "typical_deployment": "TrioFox is server software that runs as a web-based file sharing and remote access platform, specifically marketed as a VPN replacement for secure remote file access", "deployment_statistics": "Estimated 95%+ of TrioFox deployments are internet-facing, as the platform's core value proposition is providing secure external access to corporate file systems without requiring VPN connections", "active_exploitation": "Confirmed active exploitation by threat group UNC6485, with attackers deploying Cobalt Strike payloads and backdoors. CISA has added this to the Known Exploited Vulnerabilities catalog.", "severity_factors": [ "CVSS 9.1 Critical severity", "No authentication required", "Network attack vector", "Active exploitation confirmed", "Leads to full administrative access", "Remote code execution capability", "Internet-facing by design" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately upgrade to TrioFox version 16.7.10368.56560 or later", "Review all TrioFox access logs for suspicious administrative activities or unauthorized configuration changes", "Implement network monitoring to detect HTTP Host header attacks against TrioFox instances", "Scan for Cobalt Strike beacons or other malware that may have been deployed through this vulnerability", "Consider temporarily blocking access to setup/admin pages at the network level until patching is complete" ], "risk_assessment": { "exploit_likelihood": "CRITICAL - Active exploitation confirmed with public exploit techniques (HTTP Host header attacks) and threat actor activity documented", "impact_assessment": "SEVERE - Complete administrative takeover leading to remote code execution, data exfiltration, and potential lateral movement into corporate networks", "exposure_scope": "HIGH - TrioFox is used by medium and large businesses globally, with most deployments being internet-accessible by design as a VPN replacement solution" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "CVE-2025-12480 is a critical authentication bypass vulnerability affecting Gladinet's Triofox platform. Here's what is known about its exploitation:\n\n- **Affected Applications/Services:** The vulnerability affects internet-facing applications using the Triofox platform, which is used by medium and large businesses for secure file sharing and remote access without a VPN 【4】【1】.\n- **Active Exploitation:** There is confirmed active exploitation of CVE-2025-12480 in the wild 【2】【3】.\n- **Attack Vectors/Exploitation Methods:**\n - Attackers exploit the vulnerability by conducting HTTP Host header attacks 【4】.\n - Successful exploitation allows unauthenticated attackers to bypass authentication and gain administrative access to the application's configuration pages 【1】【8】.\n - Exploit leads to unauthorized admin access and remote code execution 【2】.\n - Attackers have been observed deploying backdoors and Cobalt Strike payloads 【2】.\n- **Targeted Attacks:** A threat cluster tracked by Google Threat Intelligence Group (GTIG) as UNC6485 has been actively exploiting this vulnerability 【5】.\n- **CISA KEV Status:** CISA has added CVE-2025-12480 to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation 【2】【3】.\n- **Technical Details/Internet Exploitability:**\n - CVE-2025-12480 is an improper access control flaw in Triofox versions prior to 16.7.10368.56560 【9】【6】.\n - It allows access to initial setup pages even after setup is complete, leading to potential misuse of the platform and undermining the system's security 【9】【7】.\n - The vulnerability has a CVSS score of 9.1, indicating its critical severity 【6】【1】.\n\nSources:\n- CVE-2025-12480 Impact, Exploitability, and Mitigation Steps | Wiz: https://www.wiz.io/vulnerability-database/cve/cve-2025-12480\n- Triofox CVE-2025-12480 Exploited in Attacks Despite Available Patch: https://dailysecurityreview.com/resources/cve-vulnerability-alerts/triofox-cve-2025-12480-exploited-in-attacks-despite-available-patch/\n- CISA Adds Gladinet and CWP Flaws to KEV Catalog Amid Active ...: https://thehackernews.com/2025/11/cisa-adds-gladinet-and-cwp-flaws-to-kev.html\n- Attackers exploited another Gladinet Triofox zero-day (CVE-2025-12480): https://www.helpnetsecurity.com/2025/11/11/gladinet-triofox-vulnerability-cve-2025-12480/\n- Unauthenticated Remote Access via Triofox Vulnerability ...: https://cloud.google.com/blog/topics/threat-intelligence/triofox-vulnerability-cve-2025-12480", "references": [ { "title": "CVE-2025-12480 Impact, Exploitability, and Mitigation Steps | Wiz", "url": "https://www.wiz.io/vulnerability-database/cve/cve-2025-12480", "citation_contribution": 254, "snippet": "CVE-2025-12480 is a critical authentication bypass vulnerability (CVSS score: 9.1) affecting Gladinet's Triofox file-sharing and remote access platform versions prior to 16.7.10368.56560. The vulnerability was discovered in August 2025 and allows unauthenticated attackers to bypass authentication and access the application's configuration pages. The flaw was actively exploited by a threat ...", "is_search_result": true }, { "title": "Triofox CVE-2025-12480 Exploited in Attacks Despite Available Patch", "url": "https://dailysecurityreview.com/resources/cve-vulnerability-alerts/triofox-cve-2025-12480-exploited-in-attacks-despite-available-patch/", "citation_contribution": 220, "snippet": "Google’s Mandiant confirmed active exploitation of CVE-2025-12480, a critical authentication bypass flaw in Gladinet’s Triofox platform. The vulnerability allows unauthorized admin access and remote code execution, with attackers deploying backdoors and Cobalt Strike payloads against unpatched enterprise environments.", "is_search_result": true }, { "title": "CISA Adds Gladinet and CWP Flaws to KEV Catalog Amid Active ...", "url": "https://thehackernews.com/2025/11/cisa-adds-gladinet-and-cwp-flaws-to-kev.html", "citation_contribution": 172, "snippet": "The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added two security flaws impacting Gladinet and Control Web Panel (CWP) to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation in the wild. The vulnerabilities in question are listed below - CVE-2025-11371 (CVSS score: 7.5) - A vulnerability in files or directories accessible to ...", "is_search_result": true }, { "title": "Attackers exploited another Gladinet Triofox zero-day (CVE-2025-12480)", "url": "https://www.helpnetsecurity.com/2025/11/11/gladinet-triofox-vulnerability-cve-2025-12480/", "citation_contribution": 153, "snippet": "CVE-2025-12480 exploitation and attack details. Gladinet’s Triofox solution is used by medium and large businesses to securely share files and allow users to access them without a VPN.The attackers exploited CVE-2025-12480 on a server running Triofox v16.4.10317.56372, which was released in April 2025 to fix CVE-2025-30406, a deserialization vulnerability affecting Triofox and Gladinet’s MSP-friendly file sharing platform CentreStack. According to its NVD entry, CVE-2025-30406 was exploited as a zero-day beginning in March 2025.", "is_search_result": true }, { "title": "Unauthenticated Remote Access via Triofox Vulnerability ...", "url": "https://cloud.google.com/blog/topics/threat-intelligence/triofox-vulnerability-cve-2025-12480", "citation_contribution": 151, "snippet": "24, 2025, a threat cluster tracked by Google Threat Intelligence Group (GTIG) as UNC6485 exploited the unauthenticated access vulnerability and ...", "is_search_result": true } ], "timestamp": "2025-11-12T15:40:16.303436" }, "cache_timestamp": "2025-11-12T15:40:34.641950", "displayed_on_website": false }, { "cve_id": "CVE-2025-11953", "cvss_score": "9.8", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2025-11-03T16:35:07.168Z", "cve_published_date_formatted": "2025-11-03", "kev_date_added": "2026-02-05", "kev_date_added_formatted": "2026-02-05", "kev_due_date": "2026-02-26", "days_to_kev": 94, "days_since_kev": null, "is_new_kev": false, "summary": "Critical OS command injection vulnerability in React Native Metro Development Server that binds to external interfaces by default. Allows unauthenticated remote attackers to execute arbitrary commands via HTTP POST requests.", "detailed_analysis": { "vulnerability_type": "OS Command Injection (CWE-78) in development server HTTP endpoint", "affected_products": [ "React Native Metro Development Server", "React Native Community CLI" ], "exploitation_requirements": [ "Network access to Metro Development Server", "No authentication required", "Default configuration binds to external interfaces" ], "internet_facing_likelihood": "React Native Metro Development Server is frequently exposed to networks beyond localhost due to default binding configuration. While primarily a development tool, many developer workstations and CI/CD environments expose this service for remote development, testing, and build processes.", "typical_deployment": "Development server software that runs on developer workstations, CI/CD environments, and development infrastructure. Often exposed on corporate networks or cloud development environments for remote access.", "deployment_statistics": "Estimated 40-60% of Metro Development Server instances are network-accessible due to default external binding configuration and common development practices requiring remote access. CI/CD environments and cloud-based development setups frequently expose these services.", "active_exploitation": "Confirmed active exploitation in the wild as early as December 21, 2025. Added to CISA KEV catalog due to evidence of real-world attacks targeting developers worldwide.", "severity_factors": [ "No authentication required", "Default configuration is vulnerable", "Complete system compromise possible", "Targets developer environments with access to source code", "Active exploitation confirmed" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately update @react-native-community/cli-server-api to version 20.0.0 or higher", "Configure Metro Development Server to bind only to localhost using --host 127.0.0.1 flag", "Review network configurations to prevent external access to development servers", "Monitor HTTP traffic to Metro Development Server endpoints for suspicious POST requests", "Patch priority: CRITICAL - Active exploitation targeting developer environments" ], "risk_assessment": { "exploit_likelihood": "Very High - Confirmed active exploitation with simple attack vector requiring only HTTP POST request to exposed service", "impact_assessment": "Critical - Complete system compromise with arbitrary command execution, potential access to source code, credentials, and development infrastructure", "exposure_scope": "Thousands of developer workstations and CI/CD environments globally running React Native development tooling with default network-accessible configurations" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "**CVE-2025-11953**, also known as \"Metro4Shell,\" is a critical **OS command injection vulnerability** affecting the **Metro Development Server** used by the React Native Community CLI 【4】【7】.\n\nHere's what is known about its exploitation:\n\n- **Internet-Facing Applications/Services:** The vulnerability primarily impacts **developer workstations and CI environments** when the Metro development server is accessible beyond `localhost` 【2】. By default, the Metro Development Server binds to external interfaces, making it a potential target 【1】【7】. It does not directly affect production React Native applications 【2】.\n\n- **Evidence of Active Exploitation:** **Yes, there is clear evidence of active exploitation in the wild.** Exploitation was observed as early as **late December 2025** 【5】【8】. VulnCheck reported observing exploitation on their Canary network on December 21, 2025 【5】. This exploitation occurred before widespread public acknowledgment 【3】【11】.\n\n- **Attack Vectors and Exploitation Methods:** The vulnerability allows **unauthenticated network attackers** to execute arbitrary operating system commands 【2】【4】. Attackers can achieve this by sending a **crafted POST request** to the vulnerable server 【1】【4】. On Windows systems, attackers can also execute arbitrary shell commands with fully controlled arguments 【1】【4】.\n\n- **Use in Targeted Attacks:** While specific details about targeted attacks are not extensively detailed, the exploitation of this vulnerability by threat actors to deploy malware targeting software developers worldwide has been reported 【3】. The active exploitation in the wild suggests it is being used in real-world attacks 【5】【8】.\n\n- **CISA Known Exploited Vulnerabilities (KEV) Status:** CVE-2025-11953 has been **added to CISA's Known Exploited Vulnerabilities (KEV) Catalog** 【5】【9】. This addition was based on evidence of active exploitation 【9】.\n\n- **Technical Details about Internet Exploitability:** The Metro Development Server, when not properly configured to bind only to `localhost`, exposes an endpoint vulnerable to OS command injection 【1】. This allows remote attackers to run arbitrary executables or shell commands by sending specially crafted HTTP requests 【1】【4】. The vulnerability is described as a critical RCE (Remote Code Execution) flaw 【10】【12】.\n\nTo mitigate CVE-2025-11953, it is recommended to update `@react-native-community/cli-server-api` to version 20.0.0 or higher, or to explicitly bind the development server to the `localhost` interface using the `--host 127.0.0.1` flag 【6】.\n\nSources:\n- react-native-community/cli has arbitrary OS command injection...: https://github.com/advisories/GHSA-399j-vxmf-hjvr\n- CVE-2025-11953 (Metro4Shell) in React Native Metro ...: https://socradar.io/blog/cve-2025-11953-metro4shell-react-native-metro-rce/\n- Hackers Actively Exploit React Native Metro Server Flaw to Target ...: https://cyberpress.org/exploit-react-native-metro-server-flaw/\n- NVD - CVE-2025-11953: https://nvd.nist.gov/vuln/detail/CVE-2025-11953\n- Metro4Shell: Exploitation of React Native's Metro Server in ...: https://www.vulncheck.com/blog/metro4shell_eitw", "references": [ { "title": "react-native-community/cli has arbitrary OS command injection...", "url": "https://github.com/advisories/GHSA-399j-vxmf-hjvr", "citation_contribution": 389, "snippet": "The Metro Development Server, which is opened by the React Native CLI, binds to external interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST request to the server and run arbitrary executables. On Windows, the attackers can also execute arbitrary shell commands with fully controlled arguments.", "is_search_result": true }, { "title": "CVE-2025-11953 (Metro4Shell) in React Native Metro ...", "url": "https://socradar.io/blog/cve-2025-11953-metro4shell-react-native-metro-rce/", "citation_contribution": 361, "snippet": "Tracked as CVE-2025-11953 and also referred to as Metro4Shell, the vulnerability allows unauthenticated operating system command execution under specific exposure conditions. The issue does not directly impact production React Native applications, but it introduces meaningful risk to developer workstations and CI environments when Metro is accessible beyond localhost.", "is_search_result": true }, { "title": "Hackers Actively Exploit React Native Metro Server Flaw to Target ...", "url": "https://cyberpress.org/exploit-react-native-metro-server-flaw/", "citation_contribution": 275, "snippet": "The vulnerability, tracked as CVE-2025-11953 and nicknamed “Metro4Shell,” allows unauthenticated attackers to execute arbitrary operating system commands on developer machines by sending specially crafted HTTP requests.This represents a critical concern: active exploitation began in December 2025, yet the Exploit Prediction Scoring System (EPSS) assigns only a 0.00405 probability score as of late January 2026, a dangerous disconnect between theoretical risk models and real-world threat activity.", "is_search_result": true }, { "title": "NVD - CVE-2025-11953", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11953", "citation_contribution": 251, "snippet": "This allows unauthenticated network attackers to send a POST request to the server and run arbitrary executables. On Windows, the attackers can also execute arbitrary shell commands with fully controlled arguments. New CVE Received from JFrog 11/03/2025 12:15:32 PM.Reference. https://jfrog.com/blog/cve-2025-11953-critical-react-native-community-cli-vulnerability.", "is_search_result": true }, { "title": "Metro4Shell: Exploitation of React Native's Metro Server in ...", "url": "https://www.vulncheck.com/blog/metro4shell_eitw", "citation_contribution": 260, "snippet": "VulnCheck observed exploitation of CVE-2025-11953 on December 21, 2025, when our Canary network recorded exploitation of a Metro Development Server. The vulnerability, which we jokingly refer to as Metro4Shell, was automatically added to VulnCheck KEV the same day.VulnCheck customers had visibility into exploitation of this vulnerability in November through exploits and Suricata rules developed by the VulnCheck Initial Access Intelligence team.", "is_search_result": true } ], "timestamp": "2026-02-05T20:55:38.514973" }, "cache_timestamp": "2026-02-05T20:55:54.253566", "displayed_on_website": false }, { "cve_id": "CVE-2025-11371", "cvss_score": "7.5", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2025-10-09T16:50:49.117Z", "cve_published_date_formatted": "2025-10-09", "kev_date_added": "2025-11-04", "kev_date_added_formatted": "2025-11-04", "kev_due_date": "2025-11-25", "days_to_kev": 26, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2025-11371 is an unauthenticated Local File Inclusion vulnerability in Gladinet CentreStack and TrioFox file-sharing platforms. This zero-day vulnerability has been actively exploited in the wild and allows attackers to access system files without authentication.", "detailed_analysis": { "vulnerability_type": "Unauthenticated Local File Inclusion (LFI) allowing disclosure of system files", "affected_products": [ "CentreStack", "TrioFox" ], "exploitation_requirements": [ "Network access to web application", "No authentication required", "No user interaction required" ], "internet_facing_likelihood": "CentreStack and TrioFox are enterprise file-sharing and remote access platforms designed specifically for internet-facing deployment. These are web-based SaaS solutions that organizations deploy to provide remote file access to users. Based on their primary function as cloud file-sharing services and remote access platforms, approximately 90-95% of deployments would be internet-facing.", "typical_deployment": "Web-based server applications deployed as internet-facing services to provide file sharing, synchronization, and remote access capabilities to end users", "deployment_statistics": "90-95% of deployments are internet-facing as these products are specifically designed for web-based remote file access and cloud storage services", "active_exploitation": "Confirmed active exploitation in the wild as a zero-day vulnerability. CISA has added this to the Known Exploited Vulnerabilities (KEV) catalog. At least three customers have been targeted in attacks.", "severity_factors": [ "No authentication required", "Direct network exploitation possible", "Active exploitation confirmed", "Can lead to configuration file disclosure and potential RCE", "Affects internet-facing file-sharing platforms", "Zero-day exploitation occurred" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately update to versions newer than 16.7.10368.56560 when available", "Apply vendor-provided temporary mitigations immediately if patches are not yet available", "Monitor web server logs for suspicious requests to UploadDownloadProxy endpoints", "Review access logs for unauthorized file access attempts", "Consider temporarily restricting internet access if updates cannot be applied immediately", "PATCH PRIORITY: EMERGENCY - Active exploitation confirmed with zero-day attacks" ], "risk_assessment": { "exploit_likelihood": "VERY HIGH - Unauthenticated network vulnerability in commonly internet-facing applications with confirmed active exploitation", "impact_assessment": "HIGH - File disclosure can lead to configuration exposure (Web.config with ASP.NET machine keys) potentially enabling remote code execution", "exposure_scope": "HIGH - File-sharing platforms are typically internet-facing by design, exposing most deployments to direct exploitation" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "CVE-2025-11371 is an unauthenticated Local File Inclusion (LFI) vulnerability affecting **Gladinet CentreStack and Triofox** file-sharing and remote access platforms 【1】. Here's what is known about its exploitation:\n\n* **Affected Applications**: The vulnerability affects Gladinet CentreStack and Triofox file-sharing and remote access platforms 【1】【5】.\n* **Internet-Facing Applications**: Yes, CVE-2025-11371 affects internet-facing applications 【3】.\n* **Active Exploitation**: There is evidence of active exploitation of this vulnerability in the wild 【2】【9】. It was exploited as a zero-day vulnerability 【6】【10】.\n* **Attack Vectors**: Attackers exploit a vulnerable `UploadDownloadProxy` endpoint to access files on the server 【4】. They can extract the `Web.config` file, which contains the ASP.NET machine key 【4】.\n* **Exploitation Methods**: Exploiting the LFI vulnerability allows attackers to retrieve configuration keys, leading to potential remote code execution (RCE) 【3】【6】. The vulnerability allows an attacker to access arbitrary files on the host system 【2】.\n* **Targeted Attacks**: The vulnerability has been used in targeted attacks 【3】【8】. At least three customers have been targeted 【5】【11】.\n* **CISA KEV Status**: CISA has added CVE-2025-11371 to its Known Exploited Vulnerabilities (KEV) Catalog 【7】.\n* **Technical Details**: The vulnerability is an unauthenticated LFI, allowing attackers to access arbitrary files on the host system 【1】【2】. Exploitation can lead to remote code execution (RCE) 【3】【6】.\n\nSources:\n- CVE-2025-11371 Impact, Exploitability, and Mitigation Steps | Wiz: https://www.wiz.io/vulnerability-database/cve/cve-2025-11371\n- CVE-2025-11371: Gladinet CentreStack / Triofox Local File Inclusion: https://horizon3.ai/attack-research/vulnerabilities/cve-2025-11371/\n- H-ISAC TLP White: Vulnerability Bulletin: Active Exploitation of ...: https://www.aha.org/h-isac-white-reports/2025-10-10-h-isac-tlp-white-vulnerability-bulletin-active-exploitation-gladinet-centrestack-and-triofox\n- CVE-2025-11371: Unpatched Gladinet Flaw Actively Exploited in the Wild: https://hivepro.com/threat-advisory/cve-2025-11371-unpatched-gladinet-flaw-actively-exploited-in-the-wild/\n- VULNERABILITY BULLETINS - American Hospital Association: https://www.aha.org/system/files/media/file/2025/10/h-isac-tlp-white-vulnerability-bulletin-active-exploitation-of-gladinet-centrestack-and-triofox-products-10-13-2025.pdf", "references": [ { "title": "CVE-2025-11371 Impact, Exploitability, and Mitigation Steps | Wiz", "url": "https://www.wiz.io/vulnerability-database/cve/cve-2025-11371", "citation_contribution": 233, "snippet": "Understand the critical aspects of CVE-2025-11371 with a detailed vulnerability assessment, exploitation potential, affected technologies, and remediation guidance.", "is_search_result": true }, { "title": "CVE-2025-11371: Gladinet CentreStack / Triofox Local File Inclusion", "url": "https://horizon3.ai/attack-research/vulnerabilities/cve-2025-11371/", "citation_contribution": 233, "snippet": "CVE-2025-11371 Gladinet CentreStack / Triofox Local File Inclusion (LFI) | 0-Day Active Exploitation CVE-2025-11371 is an unauthenticated local file inclusion (LFI) vulnerability in Gladinet CentreStack and Triofox that allows an attacker to access arbitrary files on the host system.", "is_search_result": true }, { "title": "H-ISAC TLP White: Vulnerability Bulletin: Active Exploitation of ...", "url": "https://www.aha.org/h-isac-white-reports/2025-10-10-h-isac-tlp-white-vulnerability-bulletin-active-exploitation-gladinet-centrestack-and-triofox", "citation_contribution": 206, "snippet": "On October 9, 2025, Huntress disclosed the observance of active, in-the-wild exploitation of CVE-2025-11371, an unauthenticated local file inclusion (LFI) vulnerability impacting Gladinet CentreStack and TrioFox products.", "is_search_result": true }, { "title": "CVE-2025-11371: Unpatched Gladinet Flaw Actively Exploited in the Wild", "url": "https://hivepro.com/threat-advisory/cve-2025-11371-unpatched-gladinet-flaw-actively-exploited-in-the-wild/", "citation_contribution": 195, "snippet": "The CVE-2025-11371 flaw resides in default configurations of Gladinet CentreStack and TrioFox, where attackers can exploit a vulnerable UploadDownloadProxy endpoint to access files on the server. Through this path, they can extract Web.config, a file that contains the ASP.NET machine key. This key is critical for ViewState integrity and validation.", "is_search_result": true }, { "title": "VULNERABILITY BULLETINS - American Hospital Association", "url": "https://www.aha.org/system/files/media/file/2025/10/h-isac-tlp-white-vulnerability-bulletin-active-exploitation-of-gladinet-centrestack-and-triofox-products-10-13-2025.pdf", "citation_contribution": 123, "snippet": "Oct 10, 2025 On October 9, 2025, Huntress disclosed the observance of active, in-the-wild exploitation of CVE-2025-11371, an unauthenticated local file inclusion (LFI) vulnerability impacting Gladinet CentreStack and TrioFox products. The cybersecurity company has confirmed that three of its customers have been affected so far.", "is_search_result": true } ], "timestamp": "2025-11-04T18:30:57.024677" }, "cache_timestamp": "2025-11-04T18:31:13.376410", "displayed_on_website": false }, { "cve_id": "CVE-2025-10585", "cvss_score": "Not provided in CIRCL data", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1189", "deployment_likelihood": "VERY_LOW", "cve_published_date": "2025-09-24T16:17:11.576Z", "cve_published_date_formatted": "2025-09-24", "kev_date_added": "2025-09-23", "kev_date_added_formatted": "2025-09-23", "kev_due_date": "2025-10-14", "days_to_kev": -1, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2025-10585 is a type confusion vulnerability in Chrome's V8 engine that allows remote code execution via crafted HTML pages. While actively exploited as a zero-day, it requires user interaction to visit malicious websites, making it a client-side attack rather than direct server exploitation.", "detailed_analysis": { "vulnerability_type": "Type confusion vulnerability (CWE-843) in V8 JavaScript and WebAssembly engine allowing heap corruption", "affected_products": [ "Chrome (versions prior to 140.0.7339.185)" ], "exploitation_requirements": [ "User must visit malicious website", "Crafted HTML page delivery", "No authentication required", "Network connectivity for content delivery" ], "internet_facing_likelihood": "Chrome is a client-side web browser, not server software. While Chrome connects to the internet to browse websites, the browser application itself is not deployed as an internet-facing service that accepts incoming connections. Chrome runs on end-user devices and initiates outbound connections to web servers.", "typical_deployment": "Chrome is client software installed on end-user devices (desktops, laptops, mobile devices) for web browsing. It is not server software and does not typically listen for incoming network connections or run as an internet-facing service.", "deployment_statistics": "Less than 1% of Chrome deployments are internet-facing services. Chrome is designed as client software, and while there may be rare cases of automated Chrome instances in cloud environments, the vast majority of Chrome installations are on end-user devices behind NAT/firewalls.", "active_exploitation": "Confirmed active exploitation as zero-day according to CISA KEV catalog. This is the sixth Chrome zero-day actively exploited in 2025.", "severity_factors": [ "High severity assigned by Chrome team", "Active zero-day exploitation", "Potential for remote code execution", "Requires user interaction to trigger", "Client-side vulnerability rather than server-side" ] }, "recommendations": [ "Update Chrome to version 140.0.7339.185 or later immediately", "Enable automatic Chrome updates to prevent future zero-day exposure", "Implement web filtering and security awareness training to reduce malicious site visits", "Monitor for unusual Chrome crash patterns or unexpected behavior" ], "risk_assessment": { "exploit_likelihood": "High for targeted attacks via malicious websites, but low for direct internet exploitation since Chrome is client software that doesn't expose services", "impact_assessment": "High impact on individual users - potential for complete system compromise via remote code execution", "exposure_scope": "Limited to users who visit attacker-controlled websites; not applicable to internet-facing server infrastructure" }, "exploitation_method": "USER_INTERACTION", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "CVE-2025-10585 is a high-severity type confusion vulnerability in Chrome's V8 JavaScript and WebAssembly engine 【3】【5】.\n\nHere's what is known about its exploitation:\n\n* **Internet-facing applications or services**: The vulnerability affects internet-facing applications and services through the Chrome browser 【1】.\n* **Active exploitation**: There is evidence of active exploitation of this vulnerability as a zero-day 【2】.\n* **Attack vectors and exploitation methods**: Exploitation methods involve leveraging the type confusion to gain unauthorized access 【1】【2】. An unauthenticated attacker could potentially gain access to any account on a site if they know or can find the associated email address 【1】.\n* **Targeted attacks**: It is the sixth zero-day vulnerability in Chrome that has been actively exploited or demonstrated as a proof-of-concept in 2025 【6】【1】.\n* **CISA Known Exploited Vulnerabilities status**: CVE-2025-10585 has been added to the CISA Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation 【2】【4】.\n* **Technical details about internet exploitability**: The vulnerability is a type confusion issue in the V8 JavaScript and WebAssembly engine 【3】【5】.\n\nSources:\n- Weekly Recap: Chrome 0-Day, AI Hacking Tools, DDR5 Bit-Flips, npm...: https://thehackernews.com/2025/09/weekly-recap-chrome-0-day-ai-hacking.html\n- CISA Adds One Known Exploited Vulnerability to Catalog: https://www.cisa.gov/news-events/alerts/2025/09/23/cisa-adds-one-known-exploited-vulnerability-catalog\n- CVE-2025-10585 Vulnerability: A New Zero-Day Exploit in ...: https://socprime.com/blog/cve-2025-10585-zero-day-vulnerability/\n- Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog\n- CVE-2025-10585 Impact, Exploitability, and Mitigation Steps | Wiz: https://www.wiz.io/vulnerability-database/cve/cve-2025-10585", "references": [ { "title": "Weekly Recap: Chrome 0-Day, AI Hacking Tools, DDR5 Bit-Flips, npm...", "url": "https://thehackernews.com/2025/09/weekly-recap-chrome-0-day-ai-hacking.html", "citation_contribution": 426, "snippet": "CVE-2025-10585 is the sixth zero-day vulnerability in Chrome that has been either actively exploited or demonstrated as a proof-of-concept (PoC) since the start of the year.\"This vulnerability makes it possible for an unauthenticated attacker to gain access to any account on a site, including accounts used to administer the site, if the attacker knows, or can find, the associated email address,\" Wordfence said. The plugin is installed on more than 12,000 websites. A patch for the flaw was released on August 13, 2025, with exploitation activity beginning on August 22.", "is_search_result": true }, { "title": "CISA Adds One Known Exploited Vulnerability to Catalog", "url": "https://www.cisa.gov/news-events/alerts/2025/09/23/cisa-adds-one-known-exploited-vulnerability-catalog", "citation_contribution": 226, "snippet": "CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.", "is_search_result": true }, { "title": "CVE-2025-10585 Vulnerability: A New Zero-Day Exploit in ...", "url": "https://socprime.com/blog/cve-2025-10585-zero-day-vulnerability/", "citation_contribution": 143, "snippet": "The issue tracked as CVE-2025-10585 is a high-severity type confusion vulnerability in Chrome's V8 JavaScript and WebAssembly engine that lets ...", "is_search_result": true }, { "title": "Known Exploited Vulnerabilities Catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "citation_contribution": 129, "snippet": "CVE-2025-10585. Google Chromium V8 Type Confusion Vulnerability: Google Chromium contains a type confusion vulnerability in the V8 JavaScript and WebAssembly ...", "is_search_result": true }, { "title": "CVE-2025-10585 Impact, Exploitability, and Mitigation Steps | Wiz", "url": "https://www.wiz.io/vulnerability-database/cve/cve-2025-10585", "citation_contribution": 113, "snippet": "CVE-2025-10585 is a type confusion vulnerability discovered in Google Chrome's V8 JavaScript and WebAssembly engine.", "is_search_result": true } ], "timestamp": "2025-09-25T17:25:16.134066" }, "cache_timestamp": "2025-09-25T17:25:36.535146", "displayed_on_website": false }, { "cve_id": "CVE-2025-10035", "cvss_score": "10.0", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2025-09-18T22:01:51.337Z", "cve_published_date_formatted": "2025-09-18", "kev_date_added": "2025-09-29", "kev_date_added_formatted": "2025-09-29", "kev_due_date": "2025-10-20", "days_to_kev": 11, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2025-10035 is a critical deserialization vulnerability in Fortra GoAnywhere MFT's License Servlet that allows unauthenticated remote code execution. This vulnerability has been actively exploited as a zero-day and affects internet-facing managed file transfer servers.", "detailed_analysis": { "vulnerability_type": "Deserialization vulnerability leading to command injection in License Servlet", "affected_products": [ "Fortra GoAnywhere MFT versions <= 7.8.3" ], "exploitation_requirements": [ "Network access to GoAnywhere Admin Console", "Ability to forge license response signature", "No authentication required" ], "internet_facing_likelihood": "GoAnywhere MFT is enterprise managed file transfer software that is frequently deployed as internet-facing infrastructure to facilitate secure file transfers with external partners, customers, and remote employees. The vendor explicitly warns that exploitation is 'highly dependent upon systems being externally exposed to the internet', indicating a significant portion of deployments are internet-accessible.", "typical_deployment": "Server software - GoAnywhere MFT is deployed as enterprise server infrastructure for managed file transfer operations, typically requiring internet connectivity for external file exchange", "deployment_statistics": "Estimated 60-70% of GoAnywhere MFT deployments are internet-facing, as the primary business use case involves secure file transfer with external parties requiring internet accessibility", "active_exploitation": "Confirmed active exploitation as zero-day vulnerability according to web search results. CISA ADP assessment indicates 'active' exploitation status.", "severity_factors": [ "CVSS 10.0 Critical severity", "No authentication required", "Remote code execution capability", "Active zero-day exploitation", "Affects internet-facing file transfer infrastructure", "Previous GoAnywhere vulnerabilities targeted by ransomware groups" ] }, "recommendations": [ "URGENT: Patch immediately to version 7.8.4 or sustain release 7.6.3", "Immediately remove GoAnywhere Admin Console from public internet access", "Implement network segmentation and VPN access for admin interfaces", "Monitor for indicators of compromise and unauthorized system access" ], "risk_assessment": { "exploit_likelihood": "Very High - Active zero-day exploitation confirmed with no authentication required and straightforward network-based attack vector", "impact_assessment": "Critical - Full system compromise possible with command injection leading to complete confidentiality, integrity, and availability loss", "exposure_scope": "High - Large number of enterprise GoAnywhere MFT installations likely internet-facing for business file transfer operations" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Known", "ransomware_first_seen_date": "2026-02-14", "ransomware_days_after_kev": 138, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "CVE-2025-10035 is a critical command injection vulnerability affecting Fortra GoAnywhere MFT. Here's what is known about its exploitation:\n\n* **Internet-facing applications or services:** The vulnerability is highly dependent on systems being externally exposed to the internet 【1】. External vulnerability scans look for vulnerabilities in internet-facing infrastructure to determine which ones can be exploited 【5】.\n* **Evidence of active exploitation in the wild:** CVE-2025-10035 has been actively exploited as a zero-day vulnerability 【6】.\n* **Attack vectors and exploitation methods:** The vulnerability allows an unauthenticated attacker to remotely execute code on the system 【3】. Successful exploitation could allow an attacker with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection 【1】.\n* **Targeted attacks:** While the provided documents do not explicitly confirm CVE-2025-10035 has been used in targeted attacks, it is worth noting that GoAnywhere MFT was previously targeted in 2023 by the Cl0p ransomware group via CVE-2023-0669, resulting in data exfiltration from numerous victims 【2】.\n* **CISA Known Exploited Vulnerabilities status:** There is no mention of CVE-2025-10035 being added to the CISA Known Exploited Vulnerabilities catalog in the provided context.\n* **Technical details about internet exploitability:** The vulnerability is a deserialization vulnerability in Fortra's GoAnywhere MFT's License Servlet 【4】. It allows an unauthenticated attacker to remotely execute some code on the system 【3】. Exploitation is highly dependent on systems being externally exposed to the internet 【1】.\n\nSources:\n- A Vulnerability in GoAnywhere Managed File Transfer (MFT) Could Allow ...: https://www.cisecurity.org/advisory/a-vulnerability-in-goanywhere-managed-file-transfer-mft-could-allow-for-command-injection_2025-088\n- CVE-2025-10035: https://arcticwolf.com/resources/blog/cve-2025-10035/\n- Fortra GoAnywhere MFT vulnerability | CVE-2025-10035: https://www.stormshield.com/news/security-alert-fortra-cve-2025-10035-stormshield-products-response/\n- CVE-2025-10035 Impact, Exploitability, and Mitigation Steps: https://www.wiz.io/vulnerability-database/cve/cve-2025-10035\n- 3 Types of Security Scans | Arctic Wolf: https://arcticwolf.com/resources/blog/4-types-of-security-scans/", "references": [ { "title": "A Vulnerability in GoAnywhere Managed File Transfer (MFT) Could Allow ...", "url": "https://www.cisecurity.org/advisory/a-vulnerability-in-goanywhere-managed-file-transfer-mft-could-allow-for-command-injection_2025-088", "citation_contribution": 413, "snippet": "Exploitation of this vulnerability is highly dependent upon systems being externally exposed to the internet. (CVE-2025-10035) Successful exploitation of this vulnerability could allow an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection.", "is_search_result": true }, { "title": "CVE-2025-10035", "url": "https://arcticwolf.com/resources/blog/cve-2025-10035/", "citation_contribution": 303, "snippet": "In 2023, the Cl0p ransomware group targeted GoAnywhere MFT via CVE-2023-0669, resulting in data exfiltration from numerous victims.", "is_search_result": true }, { "title": "Fortra GoAnywhere MFT vulnerability | CVE-2025-10035", "url": "https://www.stormshield.com/news/security-alert-fortra-cve-2025-10035-stormshield-products-response/", "citation_contribution": 223, "snippet": "The vulnerability tracked as CVE-2025-10035 allows an unauthenticated attacker to remotely execute some code on the system, throught the ...", "is_search_result": true }, { "title": "CVE-2025-10035 Impact, Exploitability, and Mitigation Steps", "url": "https://www.wiz.io/vulnerability-database/cve/cve-2025-10035", "citation_contribution": 155, "snippet": "A critical deserialization vulnerability (CVE-2025-10035) was discovered in Fortra s GoAnywhere MFT s License Servlet on September 18, 2025.", "is_search_result": true }, { "title": "3 Types of Security Scans | Arctic Wolf", "url": "https://arcticwolf.com/resources/blog/4-types-of-security-scans/", "citation_contribution": 129, "snippet": "September 19, 2025. CVE-2025-10035: Maximum-Severity Command Injection Vulnerability in Fortra GoAnywhere MFT.External vulnerability scans look at your network from the threat actor’s perspective. They scan external IP addresses and domains, probing for vulnerabilities in internet-facing infrastructure to determine which ones can be exploited.", "is_search_result": true } ], "timestamp": "2025-09-29T17:20:56.306347" }, "cache_timestamp": "2025-09-29T17:21:10.975321", "displayed_on_website": false }, { "cve_id": "CVE-2025-0994", "cvss_score": "8.6", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2025-02-06T16:01:20.000Z", "cve_published_date_formatted": "2025-02-06", "kev_date_added": "2025-02-07", "kev_date_added_formatted": "2025-02-07", "kev_due_date": "2025-02-28", "days_to_kev": 1, "days_since_kev": null, "is_new_kev": false, "summary": "Trimble Cityworks contains a deserialization vulnerability allowing authenticated remote code execution against IIS web servers. CISA reports active exploitation of this vulnerability in the wild.", "detailed_analysis": { "vulnerability_type": "Deserialization vulnerability (CWE-502) allowing remote code execution", "affected_products": [ "Trimble Cityworks", "Trimble Cityworks (with office companion)" ], "exploitation_requirements": [ "Authentication required (high privileges)", "Network access to the web application", "No user interaction required" ], "internet_facing_likelihood": "Trimble Cityworks is an enterprise asset management system that is commonly deployed as a web-based application accessible to municipal workers and contractors. Many deployments are internet-facing to support field workers and remote access scenarios. The vulnerability affects the IIS web server component, which is typically exposed for web-based access.", "typical_deployment": "Server application - web-based enterprise asset management platform running on Microsoft IIS web servers, commonly used by municipalities and utilities for infrastructure management", "deployment_statistics": "Estimated 60-70% of deployments are internet-facing, as the system needs to support field workers, contractors, and remote municipal staff accessing work orders and asset information from various locations", "active_exploitation": "CISA has received reports of active exploitation and added this CVE to the Known Exploited Vulnerabilities (KEV) catalog on 2025-02-07", "severity_factors": [ "Remote code execution capability", "Active exploitation confirmed by CISA", "High CVSS score of 8.6", "Targets critical infrastructure (municipal systems)", "Authentication required reduces immediate risk but doesn't prevent exploitation by compromised accounts" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately upgrade to Cityworks 15.8.9 or later, or Cityworks with office companion 23.10 or later", "Review and reduce IIS identity permissions - ensure IIS is not running with local or domain administrative privileges", "Verify attachment directory configurations are properly restricted", "Monitor web server logs for suspicious deserialization attempts or unusual authentication patterns", "Consider temporarily restricting internet access if immediate patching is not possible", "Patch priority: CRITICAL - apply immediately due to active exploitation" ], "risk_assessment": { "exploit_likelihood": "Very High - Active exploitation confirmed by CISA, vulnerability allows direct RCE with authenticated access", "impact_assessment": "High - Complete compromise of the IIS web server with potential access to municipal infrastructure data and systems", "exposure_scope": "Moderate to High - Municipal and utility organizations worldwide using internet-accessible Cityworks deployments" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:29:29.476210", "displayed_on_website": false }, { "cve_id": "CVE-2025-0411", "cvss_score": "7.0", "attack_vector": "LOCAL", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1204", "deployment_likelihood": "VERY_LOW", "cve_published_date": "2025-01-25T04:28:24.270Z", "cve_published_date_formatted": "2025-01-25", "kev_date_added": "2025-02-06", "kev_date_added_formatted": "2025-02-06", "kev_due_date": "2025-02-27", "days_to_kev": 12, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2025-0411 is a Mark-of-the-Web bypass vulnerability in 7-Zip that allows attackers to deliver malware without Windows security warnings. Despite being listed in CISA KEV, this is a client-side vulnerability requiring user interaction (opening a malicious archive) and does not affect internet-facing servers.", "detailed_analysis": { "vulnerability_type": "Mark-of-the-Web Security Feature Bypass", "affected_products": [ "7-Zip" ], "exploitation_requirements": [ "User must download and open a crafted archive file", "Local access to victim system", "Social engineering to trick user into opening malicious file" ], "internet_facing_likelihood": "7-Zip is a desktop archive utility that is virtually never deployed as an internet-facing service. It is client software designed for end-user file compression/decompression tasks on local systems. Estimated <0.1% of deployments would be internet-accessible.", "typical_deployment": "7-Zip is client-side desktop software installed on end-user workstations for file compression and extraction. It does not run as a network service or daemon and has no inherent server functionality.", "deployment_statistics": "Estimated <0.1% internet-facing - 7-Zip is exclusively client software with no legitimate business case for internet exposure. It operates on local files and does not provide network services.", "active_exploitation": "Listed in CISA KEV indicating active exploitation in the wild, likely through malware delivery campaigns using crafted archives", "severity_factors": [ "CISA KEV listing indicates active exploitation", "Bypasses Windows security warnings", "Enables arbitrary code execution", "Requires user interaction", "Client-side only vulnerability", "Not internet-facing" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Update 7-Zip to the latest version immediately on all systems", "Implement user education about the risks of opening archives from untrusted sources", "Consider application control policies to restrict archive tool execution", "Monitor for suspicious file extraction activities and unexpected executable launches" ], "risk_assessment": { "exploit_likelihood": "High for targeted phishing campaigns, but low for direct internet exploitation since 7-Zip is client software not exposed to the internet", "impact_assessment": "High impact on individual workstations - arbitrary code execution in user context can lead to full system compromise", "exposure_scope": "Minimal internet-facing exposure since 7-Zip is desktop client software, but potentially affects millions of client systems through malware delivery campaigns" }, "exploitation_method": "USER_INTERACTION", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:29:06.942920", "displayed_on_website": false }, { "cve_id": "CVE-2025-0282", "cvss_score": "9.0", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1133", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2025-01-08T22:15:09.386Z", "cve_published_date_formatted": "2025-01-08", "kev_date_added": "2025-01-08", "kev_date_added_formatted": "2025-01-08", "kev_due_date": "2025-01-15", "days_to_kev": 0, "days_since_kev": null, "is_new_kev": false, "summary": "Critical stack-based buffer overflow in Ivanti VPN and secure gateway products allows remote unauthenticated attackers to achieve remote code execution. This vulnerability is actively exploited in the wild and listed in CISA KEV catalog.", "detailed_analysis": { "vulnerability_type": "Stack-based buffer overflow (CWE-121) allowing remote code execution", "affected_products": [ "Ivanti Connect Secure (VPN gateway)", "Ivanti Policy Secure (access control gateway)", "Ivanti Neurons for ZTA (zero trust access gateways)" ], "exploitation_requirements": [ "Network access to vulnerable service", "No authentication required", "No user interaction required", "High attack complexity (CVSS AC:H)" ], "internet_facing_likelihood": "These are enterprise VPN and secure gateway appliances specifically designed to provide remote access services from the internet to internal corporate networks. By their very nature and primary function, they must be internet-accessible to serve remote users and are deployed in DMZ or edge network locations.", "typical_deployment": "Server/appliance software deployed as network infrastructure components at network perimeters to provide secure remote access services", "deployment_statistics": "Estimated 95%+ of deployments are internet-facing as these products serve no functional purpose unless accessible from external networks for remote access", "active_exploitation": "Listed in CISA KEV catalog with active exploitation confirmed. Multiple proof-of-concept exploits and detailed exploitation walkthroughs available from security researchers.", "severity_factors": [ "Critical CVSS score of 9.0", "Remote unauthenticated exploitation", "Full system compromise possible", "Active exploitation in the wild", "Affects enterprise VPN infrastructure", "High-value targets for threat actors" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately update to patched versions: Connect Secure 22.7R2.5+, Policy Secure 22.7R1.2+, Neurons for ZTA 22.7R2.5+", "If immediate patching not possible, consider temporarily blocking external access and implementing workarounds per CISA guidance", "Monitor network traffic for unusual patterns and unauthorized access attempts", "Implement network segmentation to limit potential lateral movement", "Patch priority: EMERGENCY - apply immediately due to active exploitation" ], "risk_assessment": { "exploit_likelihood": "VERY HIGH - Active exploitation confirmed with public exploits available and high-value targets typically internet-exposed", "impact_assessment": "CRITICAL - Complete system compromise allowing attackers to establish persistent access to corporate networks and potentially pivot to internal systems", "exposure_scope": "Thousands of internet-facing Ivanti VPN appliances globally used by enterprises for remote access" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Known", "ransomware_first_seen_date": "2026-06-04", "ransomware_days_after_kev": 512, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:21:48.259565", "displayed_on_website": false }, { "cve_id": "CVE-2025-0111", "cvss_score": "7.1", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2025-02-12T20:58:43.387Z", "cve_published_date_formatted": "2025-02-12", "kev_date_added": "2025-02-20", "kev_date_added_formatted": "2025-02-20", "kev_due_date": "2025-03-13", "days_to_kev": 8, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2025-0111 is an authenticated file read vulnerability in Palo Alto Networks PAN-OS management web interface that allows attackers to read files on the filesystem. This vulnerability is being actively exploited in the wild and is part of CISA's Known Exploited Vulnerabilities catalog.", "detailed_analysis": { "vulnerability_type": "Authenticated file read vulnerability (CWE-73: External Control of File Name or Path)", "affected_products": [ "PAN-OS Firewalls", "Palo Alto Networks NGFW", "Palo Alto Networks PA-Series" ], "exploitation_requirements": [ "Authentication to management interface", "Network access to management web interface" ], "internet_facing_likelihood": "Very high - PAN-OS firewalls are widely deployed as perimeter security devices with management interfaces often exposed to the internet for remote administration. The vendor specifically mentions internet-facing management interfaces in their advisory and provides scanning results showing exposed devices.", "typical_deployment": "PAN-OS runs on enterprise firewall appliances that are typically deployed as perimeter security devices. These firewalls commonly have their management interfaces exposed to the internet for remote administration purposes.", "deployment_statistics": "Estimated 60-80% of PAN-OS deployments have internet-facing management interfaces based on vendor scanning results and common enterprise deployment practices for remote firewall management.", "active_exploitation": "Confirmed active exploitation - Palo Alto Networks has observed exploit attempts chaining this CVE with CVE-2025-0108 and CVE-2024-9474. Added to CISA KEV catalog indicating widespread exploitation.", "severity_factors": [ "Network attack vector", "Active exploitation confirmed", "Widely deployed enterprise product", "Management interface commonly internet-facing", "Can be chained with other vulnerabilities", "High CVSS score of 7.1" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately upgrade to patched versions: 10.1.14-h9+, 10.2.13-h3+, 11.1.6-h1+, or 11.2.4-h4+", "Restrict management interface access to trusted internal IP addresses only", "Enable Threat Prevention signatures (Threat ID 510000 and 510001) if available", "Monitor management interface access logs for suspicious activity", "Patch priority: CRITICAL - immediate patching required due to active exploitation" ], "risk_assessment": { "exploit_likelihood": "Very High - confirmed active exploitation with publicly available details and chaining with other CVEs", "impact_assessment": "High - allows unauthorized file system access which can lead to credential theft, configuration exposure, and lateral movement", "exposure_scope": "Potentially thousands of internet-facing PAN-OS management interfaces globally based on vendor scanning results" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:33:05.657491", "displayed_on_website": false }, { "cve_id": "CVE-2025-0108", "cvss_score": "8.8", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2025-02-12T20:55:34.610Z", "cve_published_date_formatted": "2025-02-12", "kev_date_added": "2025-02-18", "kev_date_added_formatted": "2025-02-18", "kev_due_date": "2025-03-11", "days_to_kev": 6, "days_since_kev": null, "is_new_kev": false, "summary": "Authentication bypass vulnerability in Palo Alto Networks PAN-OS management web interface allows unauthenticated attackers to bypass authentication and invoke PHP scripts that can compromise firewall integrity and confidentiality. This vulnerability is actively exploited in the wild and listed in CISA KEV catalog.", "detailed_analysis": { "vulnerability_type": "Authentication bypass in management web interface enabling unauthorized access to administrative PHP scripts", "affected_products": [ "Palo Alto PAN-OS Firewalls", "Palo Alto Cloud NGFW (not affected)", "Palo Alto Prisma Access (not affected)" ], "exploitation_requirements": [ "Network access to management web interface", "No authentication required", "Management interface exposed to internet or untrusted networks" ], "internet_facing_likelihood": "While Palo Alto Networks recommends securing management interfaces to internal networks only, a significant portion of PAN-OS firewalls have internet-exposed management interfaces. The vendor specifically mentions scanning the internet and finding devices with exposed management interfaces, indicating this is a real-world deployment issue. The risk is highest when management interface is directly accessible from internet or through dataplane interfaces with management profiles.", "typical_deployment": "PAN-OS runs on enterprise firewalls that are by nature deployed at network perimeters. While best practice is to restrict management interface access to internal networks, many deployments expose these interfaces to facilitate remote administration.", "deployment_statistics": "Based on vendor's own internet scanning results and advisory warnings, an estimated 15-25% of PAN-OS deployments have internet-accessible management interfaces, despite security best practices recommending against this configuration.", "active_exploitation": "Confirmed active exploitation in the wild. Palo Alto Networks observed exploit attempts chaining this CVE with CVE-2024-9474 and CVE-2025-0111. Added to CISA KEV catalog indicating widespread exploitation.", "severity_factors": [ "Authentication bypass on security appliances", "Active exploitation confirmed", "Can be chained with other vulnerabilities for complete compromise", "High-value targets (firewalls protecting enterprise networks)", "Management interface compromise enables full device control" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "IMMEDIATE: Restrict management interface access to trusted internal IP addresses only per vendor best practices", "URGENT: Apply vendor patches immediately - multiple hotfixes available across PAN-OS versions 10.1, 10.2, 11.1, and 11.2", "Deploy Threat Prevention signatures (Threat ID 510000 and 510001) if available", "Monitor management interface access logs for suspicious activity", "Verify no unauthorized configuration changes or administrative access", "Patch priority: CRITICAL - Active exploitation targeting internet-facing management interfaces" ], "risk_assessment": { "exploit_likelihood": "VERY HIGH - Active exploitation confirmed with public PoCs available and vulnerability is trivially exploitable against exposed management interfaces", "impact_assessment": "HIGH - Authentication bypass on firewall management interface can lead to complete device compromise, network reconnaissance, policy manipulation, and potential lateral movement into protected networks", "exposure_scope": "Thousands of internet-facing PAN-OS management interfaces globally based on vendor's own scanning results and widespread enterprise deployment of Palo Alto firewalls" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:32:20.448027", "displayed_on_website": false }, { "cve_id": "CVE-2024-8069", "cvss_score": "5.1", "attack_vector": "ADJACENT", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1133", "deployment_likelihood": "MEDIUM", "cve_published_date": "2024-11-12T18:01:15.375Z", "cve_published_date_formatted": "2024-11-12", "kev_date_added": "2025-08-25", "kev_date_added_formatted": "2025-08-25", "kev_due_date": "2025-09-15", "days_to_kev": 286, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2024-8069 is an adjacent network RCE vulnerability in Citrix Session Recording requiring authenticated intranet access. Despite CISA KEV listing indicating active exploitation, the attack vector is limited to adjacent networks, not direct internet exploitation.", "detailed_analysis": { "vulnerability_type": "Deserialization of untrusted data (CWE-502) leading to limited remote code execution with NetworkService privileges", "affected_products": [ "Citrix Session Recording" ], "exploitation_requirements": [ "Authentication required", "Adjacent network access (intranet)", "Low privileges on network" ], "internet_facing_likelihood": "Citrix Session Recording is typically deployed as internal infrastructure for monitoring user sessions within corporate networks. While some deployments may be accessible via VPN or remote access solutions, direct internet exposure is uncommon due to security best practices. Estimated 15-25% of deployments might be accessible from internet through remote access gateways.", "typical_deployment": "Server software deployed internally for session monitoring and compliance purposes within corporate networks", "deployment_statistics": "Approximately 15-25% of deployments potentially accessible from internet through VPN/remote access, but direct internet exposure is discouraged", "active_exploitation": "Listed in CISA KEV catalog indicating confirmed active exploitation in the wild", "severity_factors": [ "CISA KEV listing indicates active exploitation", "Limited to adjacent network access", "Requires authentication", "NetworkService privilege execution", "Internal infrastructure targeting" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Apply vendor patches immediately: Update to version 24.5.200.8+ for Current Release, or appropriate hotfixes for LTSR versions", "Review network access controls and ensure Citrix Session Recording servers are not directly exposed to internet", "Monitor for suspicious authentication attempts and unusual network activity on Session Recording infrastructure", "Audit user accounts with access to Session Recording servers", "HIGH priority patching - active exploitation confirmed despite network limitations" ], "risk_assessment": { "exploit_likelihood": "High for targeted attacks against organizations using Citrix Session Recording, but limited by adjacent network requirement and authentication needs", "impact_assessment": "Moderate - NetworkService privilege execution can lead to lateral movement and access to recorded session data", "exposure_scope": "Limited - primarily affects internal networks, though some exposure possible through remote access solutions" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:11:50.020658", "displayed_on_website": false }, { "cve_id": "CVE-2024-8068", "cvss_score": "5.1", "attack_vector": "ADJACENT", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1068", "deployment_likelihood": "MEDIUM", "cve_published_date": "2024-11-12T17:49:54.285Z", "cve_published_date_formatted": "2024-11-12", "kev_date_added": "2025-08-25", "kev_date_added_formatted": "2025-08-25", "kev_due_date": "2025-09-15", "days_to_kev": 286, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2024-8068 is a privilege escalation vulnerability in Citrix Session Recording that allows an authenticated Active Directory domain user to escalate privileges to NetworkService Account level. Despite being in CISA KEV, this requires existing domain authentication and adjacent network access, making it primarily useful for lateral movement rather than initial access.", "detailed_analysis": { "vulnerability_type": "Privilege escalation vulnerability allowing authenticated domain users to gain NetworkService Account access", "affected_products": [ "Citrix Session Recording" ], "exploitation_requirements": [ "Authenticated user in same Windows Active Directory domain", "Adjacent network access to session recording server", "Low privileges required", "No user interaction needed" ], "internet_facing_likelihood": "Citrix Session Recording is typically deployed as an internal enterprise service for recording and monitoring Citrix Virtual Apps and Desktops sessions. While the service may have network connectivity, it is rarely exposed directly to the internet due to security best practices. Most deployments are internal-facing with access through corporate networks or VPN connections. Estimated 5-15% of deployments might have any form of internet accessibility, usually behind VPN or secure remote access solutions.", "typical_deployment": "Enterprise server software deployed internally to record and monitor virtual desktop and application sessions within corporate networks", "deployment_statistics": "Approximately 5-15% of deployments might be accessible from internet (usually through VPN/secure remote access), with 85-95% being purely internal corporate network deployments", "active_exploitation": "Listed in CISA KEV indicating confirmed active exploitation in the wild, likely used for lateral movement in corporate environments", "severity_factors": [ "CISA KEV listing indicates active exploitation", "Requires existing domain authentication limiting initial attack vector", "Adjacent network access requirement", "Privilege escalation enables further lateral movement", "Medium CVSS score of 5.1" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Apply vendor patches immediately: Update to fixed versions (24.5.200.8 for Current Release, appropriate hotfixes for LTSR versions)", "Monitor for privilege escalation activities and unusual NetworkService account usage", "Review Active Directory audit logs for suspicious authentication patterns", "Implement network segmentation to limit lateral movement potential", "HIGH patch priority due to CISA KEV listing and potential for lateral movement" ], "risk_assessment": { "exploit_likelihood": "Medium - requires existing domain authentication but CISA KEV listing confirms active exploitation", "impact_assessment": "Medium - enables privilege escalation to NetworkService level, facilitating lateral movement and potential access to sensitive session recordings", "exposure_scope": "Limited - primarily affects internal corporate networks with Citrix Session Recording deployments, minimal direct internet exposure" }, "exploitation_method": "OTHER", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:11:30.077267", "displayed_on_website": false }, { "cve_id": "CVE-2024-7694", "cvss_score": "7.2", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2024-08-12T03:00:55.680Z", "cve_published_date_formatted": "2024-08-12", "kev_date_added": "2026-02-17", "kev_date_added_formatted": "2026-02-17", "kev_due_date": "2026-03-10", "days_to_kev": 554, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2024-7694 is an unrestricted file upload vulnerability in TeamT5 ThreatSonar Anti-Ransomware that allows remote attackers with admin privileges to upload malicious files and execute arbitrary system commands. This vulnerability is actively exploited in the wild and listed in CISA KEV catalog.", "detailed_analysis": { "vulnerability_type": "Unrestricted file upload leading to remote code execution (CWE-434)", "affected_products": [ "TeamT5 ThreatSonar Anti-Ransomware (versions ≤ 3.4.5)" ], "exploitation_requirements": [ "Network access to the platform", "Administrator privileges on the product platform", "Ability to upload files" ], "internet_facing_likelihood": "ThreatSonar Anti-Ransomware is a security management platform that typically requires internet connectivity for threat intelligence updates, remote monitoring, and centralized management. Enterprise security platforms are commonly deployed with web-based management interfaces accessible remotely by security teams, making internet exposure highly likely for operational purposes.", "typical_deployment": "Enterprise security server software with web-based management interface for centralized anti-ransomware protection and monitoring", "deployment_statistics": "Estimated 70-80% of deployments are internet-facing as security teams require remote access for monitoring, incident response, and threat analysis. Many organizations expose security management platforms to enable 24/7 SOC operations.", "active_exploitation": "CISA KEV listing confirms active exploitation in the wild with evidence of threat actors targeting this vulnerability", "severity_factors": [ "Direct remote code execution capability", "Affects security infrastructure", "Active exploitation confirmed", "High CVSS score of 7.2", "Targets critical security controls" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately update to version 3.5.0 or install Hotfix-20240715", "Review all file uploads and system activities from admin accounts for suspicious activity", "Implement network segmentation to limit exposure of ThreatSonar platforms", "Monitor for unauthorized file uploads and command execution attempts", "Patch priority level: CRITICAL - Active exploitation confirmed" ], "risk_assessment": { "exploit_likelihood": "Very High - Active exploitation confirmed by CISA KEV listing with relatively low complexity exploitation requiring only admin credentials", "impact_assessment": "High - Complete system compromise with arbitrary command execution capability on security infrastructure", "exposure_scope": "Moderate to High - Enterprise security platforms with significant internet-facing deployment patterns for remote management" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:31:42.168437", "displayed_on_website": false }, { "cve_id": "CVE-2024-7399", "cvss_score": "8.8", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2024-08-09T04:43:29.828Z", "cve_published_date_formatted": "2024-08-09", "kev_date_added": "2026-04-24", "kev_date_added_formatted": "2026-04-24", "kev_due_date": "2026-05-08", "days_to_kev": 623, "days_since_kev": null, "is_new_kev": false, "summary": "Path traversal vulnerability in Samsung MagicINFO 9 Server allows remote attackers to write arbitrary files with system authority. The vulnerability is actively exploited in the wild and listed in CISA KEV catalog.", "detailed_analysis": { "vulnerability_type": "Path traversal (CWE-22) combined with unrestricted file upload (CWE-434) allowing arbitrary file write with system privileges", "affected_products": [ "Samsung MagicINFO 9 Server" ], "exploitation_requirements": [ "Low-privilege authentication", "Network access to server", "No user interaction required" ], "internet_facing_likelihood": "Samsung MagicINFO 9 Server is digital signage management software that organizations commonly deploy as internet-facing services to manage distributed digital displays, kiosks, and signage across multiple locations. Given its purpose of centralized content management and remote display control, approximately 60-80% of deployments are likely internet-accessible to enable remote management of geographically distributed signage infrastructure.", "typical_deployment": "Server application deployed in corporate networks or cloud environments to manage digital signage displays, often requiring internet connectivity for remote content updates and display management", "deployment_statistics": "Estimated 60-80% of deployments are internet-facing due to the distributed nature of digital signage requiring centralized remote management", "active_exploitation": "Listed in CISA Known Exploited Vulnerabilities catalog with evidence of active exploitation in the wild. Arctic Wolf has documented exploitation of this vulnerability.", "severity_factors": [ "High CVSS score of 8.8", "System-level file write capability", "Low attack complexity", "Active exploitation confirmed", "CAPEC-650 web shell upload capability" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately upgrade Samsung MagicINFO 9 Server to version 21.1050 or later", "Review server logs for suspicious file upload attempts or path traversal patterns", "Scan for web shells or unauthorized files in server directories", "Consider temporarily restricting network access until patching is complete", "Implement network segmentation to limit exposure of MagicINFO servers" ], "risk_assessment": { "exploit_likelihood": "Very High - Vulnerability is actively exploited with low attack complexity and requires only low-level authentication", "impact_assessment": "High - Successful exploitation grants system-level file write access, enabling web shell deployment and potential complete server compromise", "exposure_scope": "Organizations using Samsung digital signage infrastructure with internet-facing MagicINFO servers are at immediate risk" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:43:41.352725", "displayed_on_website": false }, { "cve_id": "CVE-2024-6047", "cvss_score": "9.8", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2024-06-17T05:48:42.779Z", "cve_published_date_formatted": "2024-06-17", "kev_date_added": "2025-05-07", "kev_date_added_formatted": "2025-05-07", "kev_due_date": "2025-05-28", "days_to_kev": 324, "days_since_kev": null, "is_new_kev": false, "summary": "Critical OS command injection vulnerability affecting multiple end-of-life GeoVision IP cameras and video servers. Unauthenticated attackers can execute arbitrary system commands remotely over the network with CVSS 9.8 severity.", "detailed_analysis": { "vulnerability_type": "OS Command Injection (CWE-78) allowing unauthenticated remote code execution", "affected_products": [ "GeoVision IP Cameras (BX1500, CB220, EBL1100, EFD1100, FD2410, FD3400, FE3401, FE420, BX130)", "GeoVision Video Servers (VS14, VS03, VS2410, VS28XX, VS216XX, VS04A, VS04H)", "GeoVision License Plate Recognition (DSP LPR V2)", "GeoVision LX Series (LX 4 V2, LX 4 V3)" ], "exploitation_requirements": [ "Network connectivity to device", "No authentication required", "No user interaction required", "Low attack complexity" ], "internet_facing_likelihood": "IP cameras and video servers are frequently deployed as internet-facing devices for remote monitoring, surveillance, and management purposes. Many organizations expose these devices directly to the internet or through port forwarding for remote access.", "typical_deployment": "These are network-attached surveillance devices (IP cameras) and video management servers that typically run embedded web servers and provide network services for video streaming, device management, and remote access", "deployment_statistics": "Estimated 60-80% of IP camera and video server deployments have some form of internet accessibility, either directly exposed or accessible through VPNs/port forwarding, as remote monitoring is a primary use case", "active_exploitation": "Listed in CISA KEV catalog indicating active exploitation in the wild. CISA ADP data shows 'Exploitation: active' status, confirming real-world attacks", "severity_factors": [ "Unauthenticated access required", "Network-based attack vector", "Complete system compromise possible", "All versions affected with no patches available (EOL products)", "Active exploitation confirmed", "High deployment on internet-facing networks" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately isolate or disconnect affected GeoVision devices from internet access", "Replace all affected EOL devices as vendor recommends retirement/replacement with no patches available", "Implement network segmentation to prevent lateral movement if devices are compromised", "Monitor network traffic for unusual command execution or outbound connections from affected devices", "HIGHEST PRIORITY: These are actively exploited EOL devices with no available fixes" ], "risk_assessment": { "exploit_likelihood": "VERY HIGH - Unauthenticated RCE with active exploitation confirmed and no patches available", "impact_assessment": "CRITICAL - Complete device compromise allowing arbitrary command execution, potential botnet recruitment, and network pivot point", "exposure_scope": "Potentially thousands of internet-facing surveillance devices globally, particularly concerning given the widespread deployment of IP cameras and video surveillance systems" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:55:19.195525", "displayed_on_website": false }, { "cve_id": "CVE-2024-58136", "cvss_score": "9.0", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2025-04-10T00:00:00.000Z", "cve_published_date_formatted": "2025-04-10", "kev_date_added": "2025-05-02", "kev_date_added_formatted": "2025-05-02", "kev_due_date": "2025-05-23", "days_to_kev": 22, "days_since_kev": null, "is_new_kev": false, "summary": "Critical vulnerability in Yii 2 framework involving improper protection of behavior attachment mechanism. This is a regression of CVE-2024-4990 that allows remote code execution and has been actively exploited in the wild according to CISA KEV listing.", "detailed_analysis": { "vulnerability_type": "Improper Protection of Alternate Path (CWE-424) leading to behavior attachment bypass and potential remote code execution", "affected_products": [ "Yii 2 Framework (versions 2.x before 2.0.52)" ], "exploitation_requirements": [ "Network access to Yii application", "No authentication required", "No user interaction required" ], "internet_facing_likelihood": "Yii 2 is a PHP web application framework used to build web applications and APIs that are designed to be internet-accessible. Virtually all Yii-based applications are deployed as public-facing web services to serve users, making internet exposure extremely common (95%+ of deployments).", "typical_deployment": "Yii 2 is exclusively a server-side web application framework used to build websites, web applications, and REST APIs. Applications built with Yii are designed to handle HTTP requests from users over the internet.", "deployment_statistics": "Estimated 95%+ of Yii 2 deployments are internet-facing as the framework's primary purpose is building public web applications, e-commerce sites, content management systems, and web APIs that need to be accessible to end users.", "active_exploitation": "Listed in CISA KEV catalog with active exploitation noted from February through April 2025. SSVC assessment indicates active exploitation with total technical impact.", "severity_factors": [ "Critical CVSS score of 9.0", "Network-accessible without authentication", "Scope change indicating container/privilege boundary escape", "Active exploitation in the wild", "Regression of previously patched vulnerability" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately upgrade to Yii 2.0.52 or later versions", "Review application logs for suspicious requests targeting behavior attachment mechanisms", "Implement web application firewall rules to detect exploitation attempts", "Conduct security audit of all Yii-based applications in the environment", "Monitor for unauthorized file uploads or modifications on web servers" ], "risk_assessment": { "exploit_likelihood": "Very High - Active exploitation confirmed in the wild with CISA KEV listing and clear exploitation evidence", "impact_assessment": "Critical - Remote code execution on web servers allowing complete system compromise, data theft, and potential lateral movement", "exposure_scope": "Very Large - Yii 2 is a popular PHP framework with thousands of public-facing applications worldwide potentially affected" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:53:48.144066", "displayed_on_website": false }, { "cve_id": "CVE-2024-57968", "cvss_score": "9.9", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1505", "deployment_likelihood": "HIGH", "cve_published_date": "2025-02-03T00:00:00.000Z", "cve_published_date_formatted": "2025-02-03", "kev_date_added": "2025-03-10", "kev_date_added_formatted": "2025-03-10", "kev_due_date": "2025-03-31", "days_to_kev": 35, "days_since_kev": null, "is_new_kev": false, "summary": "Advantive VeraCore contains an unrestricted file upload vulnerability allowing authenticated remote attackers to upload malicious files to web-accessible directories. This vulnerability is actively exploited in the wild by the XE Group and listed in CISA KEV.", "detailed_analysis": { "vulnerability_type": "Unrestricted file upload (CWE-434) via upload.aspx allowing files to be placed in unintended web-accessible folders", "affected_products": [ "Advantive VeraCore (dental practice management software)" ], "exploitation_requirements": [ "Remote authenticated user access", "Network access to upload.aspx endpoint" ], "internet_facing_likelihood": "VeraCore is dental practice management software that typically includes web portals for patient access, appointment scheduling, and remote staff access. Approximately 70-80% of deployments are likely internet-facing to support patient portals and remote work capabilities.", "typical_deployment": "Web-based server application deployed in dental practices to manage patient records, appointments, billing, and provide patient portal access", "deployment_statistics": "Estimated 70-80% of deployments are internet-facing to enable patient portal access, remote staff access, and cloud-based functionality for dental practices", "active_exploitation": "Confirmed active exploitation by XE Group threat actors. Listed in CISA KEV catalog with dateAdded: 2025-03-10", "severity_factors": [ "Critical CVSS 9.9 score", "Active exploitation in wild", "File upload to web-accessible directories enables web shell deployment", "Healthcare sector targeting", "CISA KEV listing" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately upgrade to VeraCore version 2024.4.2.1 or later", "Review web directories for suspicious uploaded files, particularly .aspx, .php, or other executable files", "Monitor upload.aspx endpoint access logs for suspicious activity", "Implement web application firewall rules to restrict file upload functionality", "Conduct forensic analysis if unauthorized files are found" ], "risk_assessment": { "exploit_likelihood": "Very High - Active exploitation confirmed, requires only authenticated access which attackers can obtain through credential theft or weak authentication", "impact_assessment": "Critical - File upload to web directories can lead to web shell deployment, full server compromise, patient data theft, and ransomware deployment", "exposure_scope": "High - Dental practices commonly expose VeraCore to internet for patient portals and remote access, creating significant attack surface in healthcare sector" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:39:53.657412", "displayed_on_website": false }, { "cve_id": "CVE-2024-57728", "cvss_score": "7.2", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2025-01-15T00:00:00.000Z", "cve_published_date_formatted": "2025-01-15", "kev_date_added": "2026-04-24", "kev_date_added_formatted": "2026-04-24", "kev_due_date": "2026-05-08", "days_to_kev": 464, "days_since_kev": null, "is_new_kev": false, "summary": "SimpleHelp remote support software v5.5.7 and earlier contains a zip slip vulnerability allowing admin users to upload arbitrary files anywhere on the file system and execute code. This remote support software is commonly deployed as internet-facing infrastructure for IT support organizations.", "detailed_analysis": { "vulnerability_type": "Path Traversal (Zip Slip) leading to Remote Code Execution", "affected_products": [ "SimpleHelp Remote Support Software" ], "exploitation_requirements": [ "Admin user privileges", "Network access to SimpleHelp server", "Ability to upload zip files" ], "internet_facing_likelihood": "SimpleHelp is remote support software designed to provide technical support services, which by its nature requires internet connectivity to allow support technicians to connect to client systems. Most deployments would be internet-facing to enable remote support capabilities. Estimated 80-90% of deployments are internet-accessible.", "typical_deployment": "Server application - SimpleHelp runs as a server service that support technicians and end users connect to remotely. The primary business function requires internet accessibility.", "deployment_statistics": "Approximately 80-90% of SimpleHelp deployments are internet-facing since the software's core purpose is to facilitate remote support connections between technicians and clients across different networks.", "active_exploitation": "Listed in CISA KEV catalog indicating active exploitation in the wild. Referenced by Microsoft and TrendMicro as being exploited by ransomware groups including Storm-1175 and DragonForce.", "severity_factors": [ "Remote code execution capability", "Network attack vector", "Active exploitation by ransomware groups", "Affects remote support infrastructure", "Path traversal allows arbitrary file placement" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately update SimpleHelp to version 5.5.8 or later", "Review admin user accounts and audit recent zip file uploads", "Monitor file system for suspicious files in unexpected locations", "Consider temporarily restricting admin upload capabilities until patching is complete", "Implement network segmentation to limit exposure if not already done" ], "risk_assessment": { "exploit_likelihood": "Very High - CISA KEV listing indicates active exploitation by multiple threat actors including ransomware groups", "impact_assessment": "High - Remote code execution with server privileges allows complete system compromise, data theft, and potential lateral movement", "exposure_scope": "High - Remote support software is commonly internet-facing, potentially affecting thousands of IT service providers and organizations using SimpleHelp" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Known", "ransomware_first_seen_date": "2026-06-04", "ransomware_days_after_kev": 41, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:44:01.343096", "displayed_on_website": false }, { "cve_id": "CVE-2024-57727", "cvss_score": "9.1", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2025-01-15T00:00:00.000Z", "cve_published_date_formatted": "2025-01-15", "kev_date_added": "2025-02-13", "kev_date_added_formatted": "2025-02-13", "kev_due_date": "2025-03-06", "days_to_kev": 29, "days_since_kev": null, "is_new_kev": false, "summary": "SimpleHelp remote support software v5.5.7 and earlier contains critical path traversal vulnerabilities allowing unauthenticated attackers to download arbitrary files including server configuration files and hashed passwords. This vulnerability is actively exploited and listed in CISA KEV.", "detailed_analysis": { "vulnerability_type": "Multiple path traversal vulnerabilities (CWE-22) enabling unauthenticated file disclosure", "affected_products": [ "SimpleHelp Remote Support Software (v5.5.7 and earlier)" ], "exploitation_requirements": [ "Network access to SimpleHelp server", "No authentication required", "No user interaction required" ], "internet_facing_likelihood": "SimpleHelp is remote support software designed to provide technical assistance over the internet. By its very nature, it requires internet connectivity to function and is commonly deployed as internet-facing services. Estimated 80-90% of SimpleHelp deployments are internet-accessible as the software's primary purpose is remote support access from anywhere on the internet.", "typical_deployment": "Server application - SimpleHelp runs as a server service that remote technicians and users connect to over the internet for remote support sessions", "deployment_statistics": "Approximately 80-90% of SimpleHelp deployments are internet-facing since remote support software must be accessible from external networks to function properly. Organizations typically expose these services to allow remote assistance capabilities.", "active_exploitation": "Listed in CISA KEV catalog with exploitation marked as 'active', indicating confirmed exploitation in the wild. CISA notes this vulnerability is automatable with total technical impact.", "severity_factors": [ "CVSS 9.1 Critical severity", "No authentication required", "Network attack vector", "Active exploitation confirmed", "Exposes sensitive configuration files and credentials", "Remote support software typically internet-facing" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately upgrade SimpleHelp to version 5.5.8 or later which addresses these path traversal vulnerabilities", "Monitor SimpleHelp server logs for suspicious file access attempts and unusual HTTP requests with path traversal patterns (../, \\..\\, etc.)", "HIGHEST priority patching - actively exploited critical vulnerability in internet-facing remote support infrastructure" ], "risk_assessment": { "exploit_likelihood": "Very high - unauthenticated network-based exploitation with confirmed active attacks and public proof-of-concept availability", "impact_assessment": "Critical - attackers can access server configuration files containing secrets, credentials, and sensitive data without authentication", "exposure_scope": "All internet-facing SimpleHelp installations worldwide running version 5.5.7 or earlier are vulnerable to immediate compromise" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Known", "ransomware_first_seen_date": "2026-06-04", "ransomware_days_after_kev": 476, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:31:54.947820", "displayed_on_website": false }, { "cve_id": "CVE-2024-57726", "cvss_score": "9.9", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2025-01-15T00:00:00.000Z", "cve_published_date_formatted": "2025-01-15", "kev_date_added": "2026-04-24", "kev_date_added_formatted": "2026-04-24", "kev_due_date": "2026-05-08", "days_to_kev": 464, "days_since_kev": null, "is_new_kev": false, "summary": "SimpleHelp remote support software v5.5.7 and earlier contains a privilege escalation vulnerability allowing low-privilege technicians to create API keys with excessive permissions, escalating to server admin role. This vulnerability is actively exploited in the wild and listed in CISA KEV.", "detailed_analysis": { "vulnerability_type": "Missing Authorization (CWE-862) - Privilege escalation via API key creation", "affected_products": [ "SimpleHelp Remote Support Software" ], "exploitation_requirements": [ "Low-privilege technician account access", "Network access to SimpleHelp server", "API access" ], "internet_facing_likelihood": "SimpleHelp is remote support software designed for technicians to access client systems remotely. By its very nature, this software requires internet connectivity and is typically deployed as an internet-facing service. Estimated 90-95% of deployments are internet-accessible as the primary use case is remote technical support across networks.", "typical_deployment": "Server application deployed for remote support services - requires internet accessibility for technicians to connect from various locations", "deployment_statistics": "90-95% internet-facing - remote support software must be accessible from external networks to function properly", "active_exploitation": "Listed in CISA KEV catalog indicating active exploitation. Referenced by Microsoft as being exploited by Storm-1175 group in ransomware operations and TrendMicro reports exploitation in DragonForce ransomware campaigns.", "severity_factors": [ "CVSS 9.9 Critical severity", "Active exploitation in ransomware campaigns", "Privilege escalation to admin level", "Network attack vector", "No user interaction required", "Low attack complexity" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately update SimpleHelp to version 5.5.8 or later", "Audit all existing API keys and revoke any unauthorized or suspicious keys", "Review technician account permissions and implement principle of least privilege", "Monitor API key creation and usage for anomalous activity", "Consider temporarily restricting API access until patching is complete" ], "risk_assessment": { "exploit_likelihood": "Very High - Active exploitation confirmed by CISA KEV listing and threat intelligence reports from multiple security vendors", "impact_assessment": "Critical - Complete server compromise through privilege escalation to admin role, enabling data theft, ransomware deployment, and lateral movement", "exposure_scope": "High - Remote support software is widely deployed and typically internet-facing by design, creating significant exposure surface" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Known", "ransomware_first_seen_date": "2026-06-04", "ransomware_days_after_kev": 41, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:44:21.941974", "displayed_on_website": false }, { "cve_id": "CVE-2024-56145", "cvss_score": "9.3", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2024-12-18T20:37:34.301Z", "cve_published_date_formatted": "2024-12-18", "kev_date_added": "2025-06-02", "kev_date_added_formatted": "2025-06-02", "kev_due_date": "2025-06-23", "days_to_kev": 166, "days_since_kev": null, "is_new_kev": false, "summary": "Critical remote code execution vulnerability in Craft CMS affecting all versions since 3.0.0 when PHP register_argc_argv is enabled. This vulnerability allows unauthenticated attackers to execute arbitrary code on vulnerable web servers and is actively exploited in the wild.", "detailed_analysis": { "vulnerability_type": "Remote Code Execution (RCE) via code injection (CWE-94) when PHP register_argc_argv configuration is enabled", "affected_products": [ "Craft CMS 3.x-5.x" ], "exploitation_requirements": [ "Network access to CMS", "PHP register_argc_argv enabled", "No authentication required", "No user interaction required" ], "internet_facing_likelihood": "Craft CMS is a content management system designed specifically for web applications and websites. As a CMS, it is inherently internet-facing by design - approximately 95-100% of Craft CMS deployments are accessible via the internet to serve web content to users.", "typical_deployment": "Craft CMS is server-side web application software that powers websites and web applications. It runs on web servers (Apache, Nginx) and serves content to users over HTTP/HTTPS.", "deployment_statistics": "Estimated 95-100% of Craft CMS installations are internet-facing as the software's primary purpose is to serve web content to public users. Unlike admin tools or internal applications, CMSs require internet connectivity for their core function.", "active_exploitation": "Listed in CISA KEV catalog as of June 2, 2025, indicating active exploitation in the wild. Public exploit code is available on GitHub (Chocapikk/CVE-2024-56145).", "severity_factors": [ "Critical CVSS score of 9.3", "No authentication required", "Direct RCE capability", "Wide version range affected (3.0.0+)", "Active exploitation confirmed", "Public exploit available" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately update Craft CMS to version 3.9.14, 4.13.2, or 5.5.2 depending on your branch", "If immediate patching is not possible, disable PHP register_argc_argv configuration as a temporary mitigation", "Review web server access logs for suspicious POST requests or unusual command execution patterns", "Implement web application firewall rules to block known exploit patterns", "Verify no unauthorized files or web shells have been uploaded to the server", "Patch priority: CRITICAL - patch within 24-48 hours due to active exploitation" ], "risk_assessment": { "exploit_likelihood": "Very High - Vulnerability has public exploits available, is actively exploited in the wild (CISA KEV), requires no authentication, and affects widely-deployed internet-facing CMS software", "impact_assessment": "Critical - Complete server compromise including confidentiality, integrity, and availability impact. Attackers gain full code execution capabilities on the web server", "exposure_scope": "High - Craft CMS is a popular content management system with thousands of internet-facing installations worldwide. All versions from 3.0.0+ are affected across a 4+ year timespan" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:02:51.675789", "displayed_on_website": false }, { "cve_id": "CVE-2024-55591", "cvss_score": "9.6", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2025-01-14T14:08:34.207Z", "cve_published_date_formatted": "2025-01-14", "kev_date_added": "2025-01-14", "kev_date_added_formatted": "2025-01-14", "kev_due_date": "2025-01-21", "days_to_kev": 0, "days_since_kev": null, "is_new_kev": false, "summary": "Critical authentication bypass vulnerability in Fortinet FortiOS and FortiProxy allows remote attackers to gain super-admin privileges via crafted requests to Node.js websocket module. This vulnerability is actively exploited in the wild and listed in CISA KEV.", "detailed_analysis": { "vulnerability_type": "Authentication Bypass Using an Alternate Path or Channel (CWE-288) in Node.js websocket module", "affected_products": [ "Fortinet FortiOS 7.0.0-7.0.16", "Fortinet FortiProxy 7.0.0-7.0.19, 7.2.0-7.2.12" ], "exploitation_requirements": [ "Network access to vulnerable FortiGate/FortiProxy device", "No authentication required", "No user interaction needed", "Low attack complexity" ], "internet_facing_likelihood": "FortiOS (FortiGate firewalls) and FortiProxy are enterprise security appliances that are extensively deployed at network perimeters and are inherently internet-facing by design. These devices serve as the primary gateway between internal networks and the internet, making them 100% exposed to external attack surfaces.", "typical_deployment": "FortiGate firewalls running FortiOS are deployed as perimeter security devices at network boundaries, while FortiProxy devices serve as secure web gateways. Both are infrastructure appliances that require internet connectivity to perform their core functions of traffic inspection, filtering, and security policy enforcement.", "deployment_statistics": "Approximately 95-100% of FortiGate and FortiProxy deployments are internet-facing, as their primary purpose is to serve as the security boundary between internal networks and external threats. These are not optional internet-facing services but core network infrastructure components.", "active_exploitation": "Listed in CISA Known Exploited Vulnerabilities (KEV) catalog with date added 2025-01-14, indicating confirmed active exploitation in the wild. CISA SSVC assessment shows 'active' exploitation status.", "severity_factors": [ "Critical CVSS score of 9.6", "No authentication required (PR:N)", "No user interaction needed (UI:N)", "Network attack vector with low complexity", "Grants super-admin privileges", "Active exploitation confirmed by CISA KEV listing", "Affects widely deployed enterprise security infrastructure" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately upgrade FortiOS to version 7.0.17 or above", "Immediately upgrade FortiProxy to version 7.2.13 or above, or 7.0.20 or above", "Review all administrative access logs for unauthorized super-admin activity", "Implement additional network monitoring for websocket traffic anomalies", "Consider emergency firewall rules to restrict management interface access if patching cannot be immediate", "HIGHEST patch priority - treat as emergency maintenance window requirement" ], "risk_assessment": { "exploit_likelihood": "VERY HIGH - Active exploitation confirmed, no authentication required, widely deployed internet-facing infrastructure", "impact_assessment": "CRITICAL - Complete device compromise with super-admin privileges, potential for network pivot, security policy bypass, and data exfiltration", "exposure_scope": "Hundreds of thousands of internet-facing FortiGate firewalls and FortiProxy devices globally, representing critical infrastructure for enterprises, government, and service providers" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Known", "ransomware_first_seen_date": "2026-06-04", "ransomware_days_after_kev": 506, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:24:05.715806", "displayed_on_website": false }, { "cve_id": "CVE-2024-55550", "cvss_score": "4.4", "attack_vector": "LOCAL", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1068", "deployment_likelihood": "HIGH", "cve_published_date": "2024-12-10T00:00:00.000Z", "cve_published_date_formatted": "2024-12-10", "kev_date_added": "2025-01-07", "kev_date_added_formatted": "2025-01-07", "kev_due_date": "2025-01-28", "days_to_kev": 28, "days_since_kev": null, "is_new_kev": false, "summary": "This vulnerability affects Mitel MiCollab and allows authenticated administrators to read local files through path traversal. Despite being in CISA KEV, it has a LOCAL attack vector and requires administrative privileges, limiting its internet exploitability.", "detailed_analysis": { "vulnerability_type": "Local file read via path traversal (CWE-22) with insufficient input sanitization", "affected_products": [ "Mitel MiCollab" ], "exploitation_requirements": [ "Administrative authentication required", "Local or authenticated access to admin interface", "High privileges already established" ], "internet_facing_likelihood": "While Mitel MiCollab is a collaboration platform that may have internet-facing components, this specific vulnerability requires authenticated administrative access and has a LOCAL attack vector according to CVSS metrics. This indicates the vulnerability cannot be directly exploited over the internet without prior compromise.", "typical_deployment": "Mitel MiCollab is an enterprise collaboration platform that may include web interfaces, but this vulnerability specifically affects local administrative functions", "deployment_statistics": "While collaboration platforms are often internet-accessible, the LOCAL attack vector and administrative privilege requirement means direct internet exploitation is not possible - estimated 0% of deployments vulnerable to direct internet attack", "active_exploitation": "Listed in CISA KEV indicating active exploitation, but likely through post-compromise scenarios where attackers have already gained administrative access", "severity_factors": [ "Requires high privileges (administrative)", "LOCAL attack vector only", "Limited to non-sensitive system information", "No file modification capability", "No privilege escalation possible" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Apply security patches for Mitel MiCollab 9.8 SP2 and earlier versions immediately", "Review administrative access logs for suspicious file access patterns", "Implement additional access controls and monitoring for administrative functions", "HIGH patch priority due to CISA KEV listing despite limited direct internet exposure" ], "risk_assessment": { "exploit_likelihood": "Low for direct internet exploitation due to LOCAL attack vector and administrative privilege requirements, but evidence of active exploitation suggests post-compromise usage", "impact_assessment": "Medium - allows unauthorized file access but limited to non-sensitive information with no modification capabilities", "exposure_scope": "Limited - requires prior administrative compromise, not directly exploitable from internet" }, "exploitation_method": "OTHER", "data_source": "CIRCL", "known_ransomware_use": "Known", "ransomware_first_seen_date": "2026-06-04", "ransomware_days_after_kev": 513, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:21:06.697139", "displayed_on_website": false }, { "cve_id": "CVE-2024-54085", "cvss_score": "10.0", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2025-03-11T14:00:58.643Z", "cve_published_date_formatted": "2025-03-11", "kev_date_added": "2025-06-25", "kev_date_added_formatted": "2025-06-25", "kev_due_date": "2025-07-16", "days_to_kev": 106, "days_since_kev": null, "is_new_kev": false, "summary": "Critical authentication bypass vulnerability in AMI MegaRAC BMC software affecting server management interfaces. Allows remote unauthenticated attackers to bypass authentication through the Redfish Host Interface with no user interaction required.", "detailed_analysis": { "vulnerability_type": "Authentication Bypass by Spoofing (CWE-290) in Baseboard Management Controller software", "affected_products": [ "AMI MegaRAC-SPx versions 12.0 to <12.7 and 13.0 to <13.5" ], "exploitation_requirements": [ "Network access to BMC interface", "No authentication required", "No user interaction needed", "Low attack complexity" ], "internet_facing_likelihood": "BMC (Baseboard Management Controller) software is server infrastructure designed for remote server management. While security best practices recommend keeping BMCs on isolated management networks, research has identified over 1000 exposed servers with vulnerable versions accessible from the internet. Many organizations deploy BMCs with internet access for remote datacenter management.", "typical_deployment": "Server infrastructure software - BMCs are embedded management controllers in enterprise servers that provide out-of-band management capabilities including remote console access, power control, and hardware monitoring", "deployment_statistics": "Estimated 15-25% of BMC deployments are internet-accessible based on research findings of 1000+ exposed vulnerable instances. While best practices recommend network isolation, many organizations expose BMCs for remote management convenience", "active_exploitation": "CISA has confirmed active exploitation in the wild and added this vulnerability to the Known Exploited Vulnerabilities catalog on 2025-06-25", "severity_factors": [ "Critical CVSS 10.0 score", "No authentication required", "Network-based attack vector", "Active exploitation confirmed by CISA", "Complete system compromise possible", "Can lead to firmware modification and physical hardware damage", "Low attack complexity" ] }, "recommendations": [ "Immediately patch AMI MegaRAC-SPx to versions 12.7+ or 13.5+ respectively", "Isolate BMC interfaces from internet access using network segmentation", "Monitor for unauthorized access attempts to BMC interfaces", "Implement strong authentication and network access controls for BMC access" ], "risk_assessment": { "exploit_likelihood": "Very High - Active exploitation confirmed by CISA, simple HTTP request can bypass authentication, no user interaction required", "impact_assessment": "Critical - Complete server compromise, potential for ransomware deployment, firmware modification, and irreversible hardware damage through over-volting", "exposure_scope": "Over 1000 confirmed internet-facing vulnerable servers identified, potentially affecting major server brands using AMI BMC software" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "CVE-2024-54085 is a critical authentication bypass vulnerability affecting **AMI MegaRAC Baseboard Management Controller (BMC) software** 【1】. Here's what is known about its exploitation:\n\n* **Affects internet-facing applications or services:** Yes, search engines have found at least 1000 exposed servers running vulnerable software versions 【2】.\n\n* **Evidence of active exploitation in the wild:** CISA has confirmed active exploitation of this vulnerability 【3】【4】.\n\n* **Attack vectors and exploitation methods:**\n * The vulnerability allows attackers to bypass authentication by sending a simple web request to a vulnerable BMC device over HTTP 【5】.\n * It is an \"Authentication Bypass by Spoofing\" flaw [CWE-290] 【6】【7】.\n * Attackers can bypass authentication remotely through the Redfish Host Interface 【8】【9】.\n * Exploitation is of low complexity and requires no user interaction 【10】.\n\n* **Whether it's been used in targeted attacks:** While specific details on \"targeted attacks\" are not explicitly available, successful exploitation allows an attacker to remotely control the compromised server 【7】【6】, install malware (including ransomware) 【7】【6】, modify firmware 【7】【6】, and cause irreversible physical damage through over-volting 【11】, indicating its potential use in such attacks.\n\n* **CISA Known Exploited Vulnerabilities (KEV) status:** CISA has added CVE-2024-54085 to its KEV catalog, based on evidence of active exploitation 【12】【3】.\n\n* **Technical details about internet exploitability:**\n * The vulnerability has a CVSS score of 10.0, which is critical 【13】【1】.\n * It can be exploited by remote unauthenticated attackers 【10】.\n * Successful exploitation can lead to a loss of confidentiality, integrity, and/or availability 【14】【15】.\n * The vulnerability is found in American Megatrends' (AMI) MegaRAC BMC software 【7】.\n\nSources:\n- CVE-2024-54085 - AMI MegaRAC BMC authentication bypass ...: https://www.broadcom.com/support/security-center/protection-bulletin/cve-2024-54085-ami-megarac-bmc-authentication-bypass-vulnerability\n- Critical MegaRAC bug affects major server brands | Cybernews: https://cybernews.com/security/critical-flaw-affect-server-remote-management-megarac/\n- CISA Adds Three Known Exploited Vulnerabilities to Catalog: https://www.cisa.gov/news-events/alerts/2025/06/25/cisa-adds-three-known-exploited-vulnerabilities-catalog\n- CISA Confirms Active Exploitation of Critical AMI MegaRAC BMC ...: https://dailysecurityreview.com/security-spotlight/cisa-confirms-active-exploitation-of-critical-ami-megarac-bmc-vulnerability-enabling-remote-server-hijack/\n- Actively exploited vulnerability gives extraordinary control over ...: https://arstechnica.com/security/2025/06/active-exploitation-of-ami-management-tool-imperils-thousands-of-servers/", "references": [ { "title": "CVE-2024-54085 - AMI MegaRAC BMC authentication bypass ...", "url": "https://www.broadcom.com/support/security-center/protection-bulletin/cve-2024-54085-ami-megarac-bmc-authentication-bypass-vulnerability", "snippet": "CVE-2024-54085 is a critical (CVSS score 10.0) authentication bypass vulnerability affecting AMI MegaRAC Baseboard Management Controller (BMC)", "is_search_result": true }, { "title": "Critical MegaRAC bug affects major server brands | Cybernews", "url": "https://cybernews.com/security/critical-flaw-affect-server-remote-management-megarac/", "snippet": "Search engines that scan internet-facing devices reveal at least 1000 exposed servers running vulnerable software versions. Researchers confirmed the flaw affects HPE Cray XD670, Asus RS720A-E11-RS24U, and ASRockRack servers. How can the flaw be exploited?", "is_search_result": true }, { "title": "CISA Adds Three Known Exploited Vulnerabilities to Catalog", "url": "https://www.cisa.gov/news-events/alerts/2025/06/25/cisa-adds-three-known-exploited-vulnerabilities-catalog", "snippet": "CVE-2024-54085 AMI MegaRAC SPx Authentication Bypass by Spoofing Vulnerability ; CVE-2024-0769 D-Link DIR-859 Router Path Traversal Vulnerability ...", "is_search_result": true }, { "title": "CISA Confirms Active Exploitation of Critical AMI MegaRAC BMC ...", "url": "https://dailysecurityreview.com/security-spotlight/cisa-confirms-active-exploitation-of-critical-ami-megarac-bmc-vulnerability-enabling-remote-server-hijack/", "snippet": "Tracked as CVE-2024-54085, the flaw allows attackers to take complete control of vulnerable servers with minimal effort and no user interaction. MegaRAC BMC software enables remote management of server hardware, including rebooting, troubleshooting, or system recovery—critical features for cloud service providers and enterprise data centers.", "is_search_result": true }, { "title": "Actively exploited vulnerability gives extraordinary control over ...", "url": "https://arstechnica.com/security/2025/06/active-exploitation-of-ami-management-tool-imperils-thousands-of-servers/", "snippet": "On Wednesday, CISA added CVE-2024-54085 to its list of vulnerabilities known to be exploited in the wild. The notice provided no further details.", "is_search_result": true } ], "timestamp": "2025-09-06T17:40:15.460912" }, "cache_timestamp": "2025-09-06T17:40:33.252963", "displayed_on_website": false }, { "cve_id": "CVE-2024-53704", "cvss_score": "8.2", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1133", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2025-01-09T06:52:16.771Z", "cve_published_date_formatted": "2025-01-09", "kev_date_added": "2025-02-18", "kev_date_added_formatted": "2025-02-18", "kev_due_date": "2025-03-11", "days_to_kev": 40, "days_since_kev": null, "is_new_kev": false, "summary": "Authentication bypass vulnerability in SonicWall firewall SSL VPN authentication mechanism allows remote attackers to bypass authentication without credentials. This affects the SSL VPN service which is specifically designed for internet exposure to provide remote access.", "detailed_analysis": { "vulnerability_type": "Improper Authentication (CWE-287) - Authentication bypass in SSL VPN service", "affected_products": [ "SonicWall Firewalls (Gen7 Hardware, NSv Virtual, TZ80)" ], "exploitation_requirements": [ "Network access to SSL VPN service", "No authentication required (bypassed)", "No user interaction required" ], "internet_facing_likelihood": "SSL VPN services are specifically designed to be internet-facing to provide remote access to corporate networks. These services must be exposed to the internet by design, making this vulnerability extremely dangerous for organizations using SonicWall firewalls with SSL VPN enabled.", "typical_deployment": "SonicWall firewalls are network security appliances that sit at network perimeters. The SSL VPN functionality is specifically intended for remote user access from the internet, requiring direct internet exposure on standard VPN ports.", "deployment_statistics": "Approximately 95-98% of SSL VPN deployments are internet-facing by necessity, as their primary purpose is to provide secure remote access to internal networks for employees, contractors, and partners working from external locations.", "active_exploitation": "Listed in CISA KEV catalog as of 2025-02-18, indicating active exploitation in the wild. CISA SSVC assessment shows 'Exploitation: active' and 'Automatable: yes'.", "severity_factors": [ "Complete authentication bypass", "No user interaction required", "SSL VPN services inherently internet-facing", "Active exploitation confirmed by CISA KEV listing", "High CVSS score of 8.2", "Automatable exploitation" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review VPN access logs immediately, check for unauthorized connections, verify system integrity and look for signs of lateral movement from compromised VPN access", "Emergency patching required - upgrade SonicOS to versions newer than 7.1.1-7058, 7.1.2-7019, and 8.0.0-8035 immediately", "Implement additional access controls and monitoring on SSL VPN services until patching is complete", "Review all VPN user accounts and sessions for unauthorized access", "Consider temporarily disabling SSL VPN if immediate patching is not possible and alternative remote access exists" ], "risk_assessment": { "exploit_likelihood": "Very High - Active exploitation confirmed, no authentication required, SSL VPN services are inherently internet-exposed, and exploitation is automatable", "impact_assessment": "High - Authentication bypass provides unauthorized access to corporate networks, potentially leading to data theft, lateral movement, and full network compromise", "exposure_scope": "Very High - SonicWall has significant market presence in SMB and enterprise firewall markets, and SSL VPN is a commonly used feature that must be internet-facing by design" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Known", "ransomware_first_seen_date": "2026-06-04", "ransomware_days_after_kev": 471, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:32:43.610264", "displayed_on_website": false }, { "cve_id": "CVE-2024-53197", "cvss_score": "7.8", "attack_vector": "LOCAL", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1068", "deployment_likelihood": "VERY_LOW", "cve_published_date": "2024-12-27T13:49:39.260Z", "cve_published_date_formatted": "2024-12-27", "kev_date_added": "2025-04-09", "kev_date_added_formatted": "2025-04-09", "kev_due_date": "2025-04-30", "days_to_kev": 103, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2024-53197 is a Linux kernel vulnerability in the USB audio subsystem that allows out-of-bounds memory access when handling malicious USB audio devices. The vulnerability requires physical access to connect a malicious USB device and has a LOCAL attack vector, making it unsuitable for internet exploitation.", "detailed_analysis": { "vulnerability_type": "Out-of-bounds write in Linux kernel USB audio driver (ALSA)", "affected_products": [ "Linux Kernel" ], "exploitation_requirements": [ "Physical access to target system", "Ability to connect malicious USB audio device", "Local system access" ], "internet_facing_likelihood": "This is a kernel-level USB device handling vulnerability that cannot be exploited over the network. It requires physical connection of a malicious USB audio device to the target system. Linux kernel vulnerabilities of this type are not internet-facing by nature.", "typical_deployment": "This affects the Linux kernel's USB audio subsystem (ALSA) which handles USB audio devices on any Linux system. The vulnerability is in kernel code that processes USB device configurations.", "deployment_statistics": "0% internet-facing - this vulnerability requires physical USB device connection and cannot be exploited remotely over a network connection.", "active_exploitation": "Listed in CISA KEV indicating active exploitation in the wild, likely through malicious USB devices in targeted attacks", "severity_factors": [ "High CVSS score (7.8) due to potential for privilege escalation", "Requires physical access limiting attack surface", "Active exploitation confirmed by CISA KEV listing", "Affects wide range of Linux kernel versions since 2.6.12" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Apply kernel patches immediately for affected Linux distributions", "Implement USB device restrictions and monitoring in sensitive environments", "Review physical security controls for USB port access", "Monitor for suspicious USB device connections in system logs", "HIGH patch priority due to CISA KEV listing and active exploitation" ], "risk_assessment": { "exploit_likelihood": "Low for internet-based attacks (requires physical access), but high for targeted attacks with physical access given CISA KEV listing", "impact_assessment": "High - successful exploitation can lead to privilege escalation and system compromise", "exposure_scope": "Not applicable for internet-facing exploitation - requires physical USB device connection" }, "exploitation_method": "OTHER", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:49:32.180551", "displayed_on_website": false }, { "cve_id": "CVE-2024-53150", "cvss_score": "7.1", "attack_vector": "LOCAL", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1068", "deployment_likelihood": "VERY_LOW", "cve_published_date": "2024-12-24T11:28:50.175Z", "cve_published_date_formatted": "2024-12-24", "kev_date_added": "2025-04-09", "kev_date_added_formatted": "2025-04-09", "kev_due_date": "2025-04-30", "days_to_kev": 106, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2024-53150 is a Linux kernel vulnerability in the USB audio driver that allows out-of-bounds reads when processing malicious USB device descriptors. Despite being in CISA KEV, this is primarily a local privilege escalation issue requiring physical USB device insertion or prior system access.", "detailed_analysis": { "vulnerability_type": "Out-of-bounds read in Linux kernel USB audio driver due to insufficient descriptor length validation", "affected_products": [ "Linux Kernel" ], "exploitation_requirements": [ "Physical USB access or ability to connect USB device", "Malicious USB audio device", "Vulnerable kernel version" ], "internet_facing_likelihood": "The Linux kernel itself is not an internet-facing application but rather the core operating system. While Linux systems may run internet-facing services, this specific vulnerability in the USB audio subsystem requires physical device access and is not directly exploitable over the network. Estimated 0% of direct internet exploitation scenarios.", "typical_deployment": "Linux kernel runs on servers, desktops, and embedded systems. The USB audio functionality is typically used on workstations and desktop systems rather than headless servers.", "deployment_statistics": "While Linux runs on many internet-facing servers, the USB audio subsystem (sound/usb/clock.c) is rarely used on server deployments. Most internet-facing Linux servers are headless without USB audio devices. Estimated <5% of internet-facing Linux systems would have active USB audio subsystems that could be exploited.", "active_exploitation": "Listed in CISA KEV indicating active exploitation, likely through malicious USB devices or in targeted attacks where attackers have physical access or can social engineer USB device insertion", "severity_factors": [ "High CVSS score of 7.1", "CISA KEV listing indicates active exploitation", "Requires physical access or USB device insertion", "Limited to systems with USB audio functionality", "Local attack vector only" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review system logs for unusual USB device connections, kernel panics, or privilege escalation attempts", "Immediately update to patched kernel versions (5.4.287+, 5.10.231+, 5.15.174+, 6.1.120+, 6.6.64+, 6.11.11+, 6.12.2+, or 6.13+)", "Implement USB device restrictions and monitoring on critical systems", "Disable USB audio subsystem if not required for business operations", "Monitor for kernel-level anomalies and privilege escalation attempts" ], "risk_assessment": { "exploit_likelihood": "Medium for targeted attacks with physical access, very low for remote network exploitation as this requires USB device insertion", "impact_assessment": "High local impact with potential for privilege escalation, information disclosure, and system instability through out-of-bounds reads", "exposure_scope": "Limited to systems where attackers can insert malicious USB audio devices or have existing local access to trigger the vulnerability" }, "exploitation_method": "OTHER", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:49:14.242397", "displayed_on_website": false }, { "cve_id": "CVE-2024-53104", "cvss_score": "7.8", "attack_vector": "LOCAL", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1068", "deployment_likelihood": "VERY_LOW", "cve_published_date": "2024-12-02T07:29:27.261Z", "cve_published_date_formatted": "2024-12-02", "kev_date_added": "2025-02-05", "kev_date_added_formatted": "2025-02-05", "kev_due_date": "2025-02-26", "days_to_kev": 65, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2024-53104 is a Linux kernel vulnerability in the UVC video driver that causes out-of-bounds writes during USB camera parsing. Despite being in CISA KEV, this is a local privilege escalation vulnerability requiring physical access or malicious USB devices, not an internet-facing service vulnerability.", "detailed_analysis": { "vulnerability_type": "Out-of-bounds write in Linux kernel UVC video driver during frame parsing", "affected_products": [ "Linux Kernel" ], "exploitation_requirements": [ "Local access to system", "Ability to connect USB UVC camera device", "Low privilege user account" ], "internet_facing_likelihood": "This vulnerability affects the Linux kernel's USB Video Class (UVC) driver, which handles USB cameras. This is not an internet-facing service - it's a local kernel driver that processes USB device descriptors when cameras are connected. There are no network-accessible services involved.", "typical_deployment": "This is kernel driver code that runs on all Linux systems with UVC camera support enabled. It processes USB device descriptors locally when USB cameras are plugged in.", "deployment_statistics": "0% - This vulnerability cannot be exploited over the internet as it requires physical USB device connection or local access to trigger the vulnerable code path in the kernel driver.", "active_exploitation": "Listed in CISA KEV indicating active exploitation, likely through malicious USB devices or local privilege escalation by attackers who already have system access.", "severity_factors": [ "High CVSS score of 7.8", "Kernel-level vulnerability allowing privilege escalation", "Active exploitation confirmed by CISA KEV listing", "Requires local/physical access limiting remote attack surface" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Apply Linux kernel security updates immediately to patched versions (4.19.324+, 5.4.286+, 5.10.230+, 5.15.172+, 6.1.117+, 6.6.61+, 6.11.8+, 6.12.1+, 6.13+)", "Monitor for suspicious USB device connections and unusual privilege escalation attempts", "HIGH PRIORITY: Despite being local-only, the CISA KEV listing indicates this is being actively exploited in targeted attacks" ], "risk_assessment": { "exploit_likelihood": "Low for internet-based attacks (requires local/USB access), but high for targeted attacks with physical access based on CISA KEV listing", "impact_assessment": "High - successful exploitation provides kernel-level code execution and full system compromise with root privileges", "exposure_scope": "Limited to systems where attackers have physical access or can deploy malicious USB devices, not internet-facing attack surface" }, "exploitation_method": "OTHER", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:27:20.314200", "displayed_on_website": false }, { "cve_id": "CVE-2024-50603", "cvss_score": "10.0", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2025-01-08T00:00:00.000Z", "cve_published_date_formatted": "2025-01-08", "kev_date_added": "2025-01-16", "kev_date_added_formatted": "2025-01-16", "kev_due_date": "2025-02-06", "days_to_kev": 8, "days_since_kev": null, "is_new_kev": false, "summary": "Critical unauthenticated OS command injection vulnerability in Aviatrix Controller allowing remote code execution via API endpoints. The vulnerability is actively exploited in the wild and listed in CISA KEV. Aviatrix Controllers are typically deployed as internet-facing cloud management platforms.", "detailed_analysis": { "vulnerability_type": "Unauthenticated OS Command Injection (CWE-78) in API endpoints", "affected_products": [ "Aviatrix Controller" ], "exploitation_requirements": [ "Network access to /v1/api endpoint", "No authentication required", "No user interaction needed" ], "internet_facing_likelihood": "Aviatrix Controllers are multi-cloud network management platforms that require internet connectivity to manage cloud infrastructure across AWS, Azure, GCP, and other providers. These controllers typically expose web interfaces and APIs to the internet for legitimate cloud operations. Estimated 70-80% of deployments are internet-facing as they need to orchestrate cloud networking resources across multiple cloud providers.", "typical_deployment": "Server software deployed as centralized cloud network management platform, typically running as web application with API endpoints exposed for cloud orchestration", "deployment_statistics": "Approximately 70-80% of Aviatrix Controller deployments are internet-facing due to the product's core function of managing multi-cloud network infrastructure, requiring connectivity to multiple cloud providers and remote administration", "active_exploitation": "Listed in CISA Known Exploited Vulnerabilities catalog with active exploitation confirmed. CISA SSVC assessment indicates active exploitation, automatable attacks, and total technical impact.", "severity_factors": [ "CVSS 10.0 Critical severity", "Unauthenticated remote code execution", "Network attack vector", "No privileges required", "Active exploitation in wild", "CISA KEV listing", "Complete system compromise possible" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "EMERGENCY: Immediately upgrade to Aviatrix Controller 7.1.4191 or 7.2.4996+ if running affected versions", "Implement network segmentation to restrict access to Aviatrix Controller management interfaces", "Monitor /v1/api endpoints for suspicious command injection attempts in cloud_type and src_cloud_type parameters", "Review authentication logs and system processes for signs of unauthorized code execution", "Consider temporarily blocking external access to Controller APIs until patching is complete" ], "risk_assessment": { "exploit_likelihood": "VERY HIGH - Unauthenticated RCE with confirmed active exploitation and CISA KEV listing. Simple HTTP requests to API endpoints can trigger command injection.", "impact_assessment": "CRITICAL - Complete system compromise with ability to execute arbitrary OS commands, potentially leading to full infrastructure takeover of multi-cloud environments managed by the controller", "exposure_scope": "HIGH - Aviatrix is a prominent cloud networking vendor with controllers managing critical network infrastructure across major cloud providers. Internet-facing deployments are common for cloud orchestration." }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:24:27.470009", "displayed_on_website": false }, { "cve_id": "CVE-2024-50302", "cvss_score": "5.5", "attack_vector": "LOCAL", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1068", "deployment_likelihood": "VERY_LOW", "cve_published_date": "2024-11-19T01:30:51.300Z", "cve_published_date_formatted": "2024-11-19", "kev_date_added": "2025-03-04", "kev_date_added_formatted": "2025-03-04", "kev_due_date": "2025-03-25", "days_to_kev": 105, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2024-50302 is a Linux kernel HID (Human Interface Device) subsystem vulnerability that allows information disclosure through uninitialized memory in report buffers. Despite being in CISA KEV, this is a LOCAL attack vector vulnerability requiring existing system access, making it unsuitable for direct internet exploitation.", "detailed_analysis": { "vulnerability_type": "Information disclosure via uninitialized memory in Linux kernel HID subsystem report buffers (CWE-908: Use of Uninitialized Resource)", "affected_products": [ "Linux Kernel" ], "exploitation_requirements": [ "Local system access", "Ability to interact with HID devices", "Low-level privileges on the system" ], "internet_facing_likelihood": "This vulnerability affects the Linux kernel's HID (Human Interface Device) subsystem, which handles input devices like keyboards, mice, and touchpads. The HID subsystem is not a network service and does not listen on network ports. It requires local access to the system and interaction with hardware devices. There is essentially 0% chance this can be exploited directly over the internet.", "typical_deployment": "The Linux kernel HID subsystem is infrastructure software that runs on all Linux systems to handle input devices. It is not a server application and does not provide network services.", "deployment_statistics": "0% of deployments are directly internet-facing as this is kernel-level device driver code, not a network service", "active_exploitation": "Listed in CISA KEV indicating active exploitation, likely as part of privilege escalation chains in targeted attacks", "severity_factors": [ "Kernel-level vulnerability", "Information disclosure potential", "Wide deployment across Linux systems", "Requires local access", "Not directly network exploitable" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs for privilege escalation attempts, check for unauthorized access, verify system integrity", "Apply kernel updates immediately to versions 4.19.324, 5.4.286, 5.10.230, 5.15.172, 6.1.117, 6.6.61, 6.11.8, or 6.12+", "Monitor for unusual HID device interactions and privilege escalation attempts", "Patch priority: HIGH (due to CISA KEV listing) but not internet-critical" ], "risk_assessment": { "exploit_likelihood": "High for privilege escalation in environments where attackers have initial local access, but zero likelihood for direct internet exploitation", "impact_assessment": "Information disclosure from kernel memory, potentially leading to further exploitation or privilege escalation", "exposure_scope": "Not applicable for internet exposure - requires local system access" }, "exploitation_method": "OTHER", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:38:28.328838", "displayed_on_website": false }, { "cve_id": "CVE-2024-49035", "cvss_score": "8.7", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2024-11-26T19:40:45.352Z", "cve_published_date_formatted": "2024-11-26", "kev_date_added": "2025-02-25", "kev_date_added_formatted": "2025-02-25", "kev_due_date": "2025-03-18", "days_to_kev": 91, "days_since_kev": null, "is_new_kev": false, "summary": "This is an improper access control vulnerability in Microsoft Partner Center (Partner.Microsoft.com) that allows unauthenticated attackers to elevate privileges over a network. The vulnerability is classified as an 'exclusively-hosted-service' and is actively being exploited in the wild according to CISA KEV.", "detailed_analysis": { "vulnerability_type": "Improper access control / privilege management (CWE-269) allowing unauthenticated privilege escalation", "affected_products": [ "Microsoft Partner Center" ], "exploitation_requirements": [ "Network access to Partner.Microsoft.com", "No authentication required", "User interaction required (UI:R)" ], "internet_facing_likelihood": "Microsoft Partner Center is exclusively a cloud-hosted web service accessible only via the internet at Partner.Microsoft.com. This is 100% internet-facing by design as it's Microsoft's cloud platform for managing partner relationships, licensing, and business operations.", "typical_deployment": "This is exclusively a Microsoft-hosted cloud service, not customer-deployed software. It's a web application that partners access via internet browsers to manage their Microsoft partnership, customer relationships, and licensing.", "deployment_statistics": "100% of deployments are internet-facing as this is a single Microsoft-hosted cloud service, not distributed software that customers deploy locally.", "active_exploitation": "Listed in CISA KEV catalog as of February 25, 2025, indicating active exploitation in the wild with 'active' exploitation status in SSVC scoring.", "severity_factors": [ "High CVSS score of 8.7", "No authentication required for exploitation", "Active exploitation confirmed by CISA", "Affects critical Microsoft partner ecosystem", "Cloud service with broad exposure" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review Partner Center access logs, check for unauthorized account access or privilege changes, verify all partner account configurations and permissions", "This is a Microsoft-hosted service so patching is handled by Microsoft - verify the vulnerability has been addressed by monitoring Microsoft Security Response Center updates", "Monitor Partner Center accounts for unauthorized access, privilege escalation, or configuration changes", "Review and audit all Partner Center user accounts and permissions immediately", "Implement additional monitoring for Partner Center administrative actions and account modifications" ], "risk_assessment": { "exploit_likelihood": "Very High - Unauthenticated network-based exploitation of a widely-used internet-facing service with confirmed active exploitation", "impact_assessment": "High - Privilege escalation in Microsoft Partner Center could allow attackers to access partner data, customer information, licensing details, and potentially manipulate partner relationships or billing", "exposure_scope": "All organizations using Microsoft Partner Center are potentially affected, which includes thousands of Microsoft partners worldwide managing customer relationships and licensing" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:35:14.799130", "displayed_on_website": false }, { "cve_id": "CVE-2024-4885", "cvss_score": "9.8", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2024-06-25T19:48:15.268Z", "cve_published_date_formatted": "2024-06-25", "kev_date_added": "2025-03-03", "kev_date_added_formatted": "2025-03-03", "kev_due_date": "2025-03-24", "days_to_kev": 251, "days_since_kev": null, "is_new_kev": false, "summary": "Critical unauthenticated remote code execution vulnerability in WhatsUp Gold's API endpoint allows attackers to execute arbitrary commands with IIS application pool privileges. This network monitoring software is commonly deployed as an internet-facing service for remote monitoring capabilities.", "detailed_analysis": { "vulnerability_type": "Unauthenticated Remote Code Execution via Path Traversal in API endpoint", "affected_products": [ "WhatsUp Gold 2023.1.0 to 2023.1.2" ], "exploitation_requirements": [ "Network access to WhatsUp Gold API endpoint", "No authentication required", "No user interaction needed" ], "internet_facing_likelihood": "WhatsUp Gold is network monitoring software that organizations frequently deploy as internet-facing services to monitor distributed infrastructure, remote sites, and cloud resources. The software's core function requires network connectivity to monitored devices, and many organizations expose it to the internet for remote access by administrators and monitoring of external resources.", "typical_deployment": "Server application - WhatsUp Gold is enterprise network monitoring software deployed on Windows servers with web-based management interfaces and API endpoints", "deployment_statistics": "Estimated 60-70% of deployments are internet-accessible due to the software's role in monitoring distributed networks and providing remote administrative access", "active_exploitation": "Listed in CISA KEV catalog indicating confirmed active exploitation in the wild", "severity_factors": [ "CVSS 9.8 Critical severity", "No authentication required", "Remote code execution with system privileges", "Affects API endpoint commonly exposed to network", "Active exploitation confirmed by CISA KEV listing" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately upgrade to WhatsUp Gold version 2023.1.3 or later", "If immediate patching is not possible, restrict network access to WhatsUp Gold interfaces to trusted IP ranges only", "Monitor WhatsUp Gold logs for suspicious API calls to GetFileWithoutZip endpoint", "Review system logs for unauthorized command execution or privilege escalation", "Patch priority: EMERGENCY - Apply within 24-48 hours due to active exploitation" ], "risk_assessment": { "exploit_likelihood": "Very High - Unauthenticated RCE with confirmed active exploitation and publicly available technical details", "impact_assessment": "Critical - Full system compromise with ability to execute arbitrary commands with IIS application pool privileges, potential for lateral movement and data exfiltration", "exposure_scope": "Thousands of internet-facing WhatsUp Gold installations globally, particularly in enterprise environments managing distributed network infrastructure" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:35:34.920798", "displayed_on_website": false }, { "cve_id": "CVE-2024-48248", "cvss_score": "8.6", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2025-03-04T00:00:00.000Z", "cve_published_date_formatted": "2025-03-04", "kev_date_added": "2025-03-19", "kev_date_added_formatted": "2025-03-19", "kev_due_date": "2025-04-09", "days_to_kev": 15, "days_since_kev": null, "is_new_kev": false, "summary": "NAKIVO Backup & Replication Director contains an absolute path traversal vulnerability that allows unauthenticated remote attackers to read arbitrary files and potentially achieve remote code execution. The vulnerability is actively being exploited in the wild and is listed in CISA's Known Exploited Vulnerabilities catalog.", "detailed_analysis": { "vulnerability_type": "Absolute Path Traversal (CWE-36) leading to arbitrary file read and potential remote code execution", "affected_products": [ "NAKIVO Backup & Replication Director" ], "exploitation_requirements": [ "Network access to the management interface", "No authentication required", "No user interaction required" ], "internet_facing_likelihood": "NAKIVO Backup & Replication Director is enterprise backup management software that typically runs as a server application with a web-based management interface. Many organizations expose backup management interfaces to the internet for remote administration, especially in cloud and hybrid environments. Estimated 60-70% of deployments may have some level of internet exposure.", "typical_deployment": "Server application with web-based management interface, typically deployed on dedicated backup servers or virtual machines in enterprise environments", "deployment_statistics": "Approximately 60-70% of deployments likely have internet-facing components due to the need for remote management, cloud backup operations, and distributed backup infrastructure management", "active_exploitation": "Listed in CISA KEV catalog with 'Exploitation: active' status, indicating confirmed active exploitation in the wild", "severity_factors": [ "No authentication required", "Network-accessible vulnerability", "Can lead to RCE through credential exposure", "Active exploitation confirmed", "Enterprise backup systems contain sensitive data" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately update to NAKIVO Backup & Replication version 11.0.0.88174 or later", "If immediate patching is not possible, restrict network access to the management interface and implement additional firewall rules", "Monitor for suspicious file access attempts, especially to credential stores and configuration files", "Review backup system logs for unauthorized access attempts or unusual activity", "Patch priority: CRITICAL - Apply immediately due to active exploitation" ], "risk_assessment": { "exploit_likelihood": "Very High - No authentication required, network accessible, and actively being exploited with public POC code available", "impact_assessment": "High - Arbitrary file read can expose cleartext credentials leading to enterprise-wide compromise and potential access to all backup data", "exposure_scope": "Moderate to High - Enterprise backup solutions are commonly exposed to the internet for remote management, affecting potentially thousands of organizations" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:44:47.892254", "displayed_on_website": false }, { "cve_id": "CVE-2024-45195", "cvss_score": "9.8", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2024-09-04T08:08:59.201Z", "cve_published_date_formatted": "2024-09-04", "kev_date_added": "2025-02-04", "kev_date_added_formatted": "2025-02-04", "kev_due_date": "2025-02-25", "days_to_kev": 153, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2024-45195 is a Critical forced browsing vulnerability in Apache OFBiz allowing unauthorized access to protected application areas without authentication. This vulnerability has active exploitation confirmed by CISA KEV listing and affects enterprise ERP systems commonly deployed as internet-facing web applications.", "detailed_analysis": { "vulnerability_type": "Direct Request (Forced Browsing) - CWE-425 authorization bypass allowing access to protected application functions", "affected_products": [ "Apache OFBiz (Enterprise Resource Planning/ERP system)" ], "exploitation_requirements": [ "Network access to OFBiz web application", "No authentication required", "No user interaction required" ], "internet_facing_likelihood": "Apache OFBiz is an enterprise ERP web application framework designed to be accessed by business users, customers, and partners. The primary function requires web browser access for users to manage business operations including accounting, CRM, e-commerce, warehouse management, and manufacturing. Most enterprise deployments expose OFBiz to the internet for employee remote access and customer self-service portals.", "typical_deployment": "OFBiz is deployed as a web application server providing business management functionality through web interfaces. It serves web pages, APIs, and business services that require network accessibility for users, customers, and business partners.", "deployment_statistics": "Estimated 70-80% of OFBiz deployments are internet-accessible as the software is designed for multi-user business operations requiring remote access by employees, customers, and partners. Enterprise ERP systems like OFBiz typically need internet exposure for business operations.", "active_exploitation": "CISA has added this CVE to the Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild by threat actors", "severity_factors": [ "CVSS 9.8 Critical score", "No authentication required for exploitation", "Network-based attack vector", "Active exploitation confirmed by CISA KEV", "Complete confidentiality, integrity, and availability impact", "Enterprise ERP systems contain sensitive business data" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately upgrade Apache OFBiz to version 18.12.16 or later", "Review web server access logs for suspicious forced browsing attempts or unauthorized access to admin/restricted areas", "Implement web application firewall (WAF) rules to block forced browsing attacks as temporary mitigation", "Monitor for unauthorized changes to business data, user accounts, or system configurations", "Patch priority: EMERGENCY - apply within 24-48 hours due to active exploitation" ], "risk_assessment": { "exploit_likelihood": "Very High - CVSS 9.8 with network attack vector, no authentication required, and confirmed active exploitation by CISA KEV listing", "impact_assessment": "Critical - Complete system compromise including access to sensitive business data, financial records, customer information, and potential for data theft, business disruption, and regulatory compliance violations", "exposure_scope": "High - Enterprise ERP systems are commonly internet-facing for business operations, potentially exposing thousands of OFBiz installations to direct exploitation" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:26:58.679787", "displayed_on_website": false }, { "cve_id": "CVE-2024-43468", "cvss_score": "9.8", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "MEDIUM_RISK", "confidence": "MEDIUM", "mitre_technique": "T1190", "deployment_likelihood": "LOW", "cve_published_date": "2024-10-08T17:35:48.428Z", "cve_published_date_formatted": "2024-10-08", "kev_date_added": "2026-02-12", "kev_date_added_formatted": "2026-02-12", "kev_due_date": "2026-03-05", "days_to_kev": 492, "days_since_kev": null, "is_new_kev": false, "summary": "Critical SQL injection vulnerability in Microsoft Configuration Manager (SCCM) allowing unauthenticated remote code execution. CISA has listed this in their Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild.", "detailed_analysis": { "vulnerability_type": "SQL Injection (CWE-89) leading to Remote Code Execution", "affected_products": [ "Microsoft Configuration Manager (SCCM)" ], "exploitation_requirements": [ "Network access to SCCM web services", "No authentication required", "No user interaction required" ], "internet_facing_likelihood": "While SCCM is primarily designed for internal enterprise device management, some organizations expose SCCM web services to the internet for remote device management, cloud-based deployments, or integration with external systems. Security best practices recommend against internet exposure, but business requirements sometimes override these recommendations. Estimated 10-25% of deployments may have some internet-accessible components.", "typical_deployment": "SCCM is enterprise infrastructure software that manages Windows devices, software deployments, and updates across organizations. It includes web-based components for administration and client communication that may be exposed externally.", "deployment_statistics": "Approximately 15-20% of SCCM deployments likely have internet-facing components, particularly in organizations with remote workers, cloud-hybrid environments, or third-party integration requirements", "active_exploitation": "Listed in CISA KEV catalog indicating confirmed exploitation in the wild. SSVC assessment shows 'active' exploitation status.", "severity_factors": [ "CVSS 9.8 Critical severity", "No authentication required", "Complete system compromise possible", "SQL injection can lead to database access and RCE", "Active exploitation confirmed by CISA" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Apply Microsoft security update immediately to version 5.00.9106 or later", "Review SCCM deployment architecture and minimize internet exposure where possible", "Monitor SCCM logs for suspicious SQL queries or unauthorized administrative actions", "Implement network segmentation to limit SCCM exposure", "PATCH PRIORITY: CRITICAL - Apply within 72 hours due to active exploitation" ], "risk_assessment": { "exploit_likelihood": "HIGH - CISA KEV listing confirms active exploitation, CVSS indicates network-based attack with no authentication required", "impact_assessment": "CRITICAL - Complete system compromise possible, potential for lateral movement across managed enterprise infrastructure, access to sensitive device and user data", "exposure_scope": "Moderate - Limited to organizations that have exposed SCCM components to the internet, but these represent high-value enterprise targets with extensive infrastructure access" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:31:00.387111", "displayed_on_website": false }, { "cve_id": "CVE-2024-42009", "cvss_score": "9.3", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1203", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2024-08-05T00:00:00.000Z", "cve_published_date_formatted": "2024-08-05", "kev_date_added": "2025-06-09", "kev_date_added_formatted": "2025-06-09", "kev_due_date": "2025-06-30", "days_to_kev": 308, "days_since_kev": null, "is_new_kev": false, "summary": "Cross-Site Scripting vulnerability in Roundcube webmail allows attackers to steal and send emails via crafted email messages. Despite high CVSS score and CISA KEV listing, this is client-side XSS requiring user interaction, not direct server compromise.", "detailed_analysis": { "vulnerability_type": "Cross-Site Scripting (XSS) - Desanitization issue in email message display", "affected_products": [ "Roundcube Webmail" ], "exploitation_requirements": [ "User must view malicious email", "Network access to send email", "No authentication to server required" ], "internet_facing_likelihood": "Roundcube is webmail server software that is very commonly deployed as internet-facing to allow users to access email via web browsers. Nearly 100% of Roundcube deployments are internet-accessible by design.", "typical_deployment": "Server application - Roundcube is webmail server software designed to provide web-based email access, requiring internet exposure for user accessibility", "deployment_statistics": "Approximately 95-99% of Roundcube deployments are internet-facing, as the primary purpose is to provide web-based email access to users from anywhere", "active_exploitation": "Listed in CISA KEV catalog with active exploitation noted, indicating real-world attacks targeting this vulnerability", "severity_factors": [ "High impact on email confidentiality and integrity", "Affects government and enterprise email systems", "Active exploitation confirmed", "However, requires user interaction and only compromises user session, not server" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review email access logs, check for unauthorized email activities, verify user account integrity", "Immediately update Roundcube to version 1.5.8 or 1.6.8+ which contain security fixes", "Monitor email server logs for suspicious email viewing patterns or unexpected email sending activities", "Educate users about suspicious emails that might contain XSS payloads", "HIGH patch priority due to CISA KEV listing and confirmed exploitation" ], "risk_assessment": { "exploit_likelihood": "High likelihood of exploitation attempts via phishing emails containing XSS payloads targeting Roundcube users", "impact_assessment": "High impact on email security - attackers can read, steal, and send emails from victim accounts, but cannot directly compromise the server infrastructure", "exposure_scope": "All internet-facing Roundcube installations are potentially affected, which includes many government and enterprise email systems" }, "exploitation_method": "USER_INTERACTION", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:05:00.309185", "displayed_on_website": false }, { "cve_id": "CVE-2024-41713", "cvss_score": "9.1", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2024-10-21T00:00:00.000Z", "cve_published_date_formatted": "2024-10-21", "kev_date_added": "2025-01-07", "kev_date_added_formatted": "2025-01-07", "kev_due_date": "2025-01-28", "days_to_kev": 78, "days_since_kev": null, "is_new_kev": false, "summary": "Critical unauthenticated path traversal vulnerability in Mitel MiCollab NuPoint Unified Messaging component allows remote attackers to view, corrupt, or delete user data and system configurations. This vulnerability is actively exploited and listed in CISA KEV.", "detailed_analysis": { "vulnerability_type": "Unauthenticated path traversal (CWE-22) due to insufficient input validation", "affected_products": [ "Mitel MiCollab" ], "exploitation_requirements": [ "Network access to MiCollab instance", "No authentication required", "No user interaction required" ], "internet_facing_likelihood": "Mitel MiCollab is a unified communications platform commonly deployed as an internet-facing service to support remote workers, mobile users, and external business communications. Estimated 70-80% of deployments are internet-accessible to enable collaboration features.", "typical_deployment": "Enterprise collaboration server software that provides unified messaging, conferencing, and communication services across organizations", "deployment_statistics": "Approximately 70-80% of MiCollab deployments are internet-facing as the platform is designed to support remote workers, mobile applications, and external business communications", "active_exploitation": "Listed in CISA KEV catalog with 'active' exploitation status and marked as automatable with total technical impact", "severity_factors": [ "CVSS 9.1 Critical severity", "No authentication required", "Network exploitable", "High confidentiality and integrity impact", "Active exploitation confirmed", "Automatable exploitation" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately update Mitel MiCollab to version newer than 9.8 SP1 FP2 (9.8.1.201)", "Monitor web server logs for path traversal attempts (../, directory traversal patterns)", "Implement network segmentation if internet exposure is not required", "Review and audit accessed files and configurations for unauthorized modifications", "HIGHEST patch priority - patch within 24-48 hours due to active exploitation" ], "risk_assessment": { "exploit_likelihood": "VERY HIGH - Unauthenticated network-accessible vulnerability with confirmed active exploitation and automation capability", "impact_assessment": "CRITICAL - Attackers can access, modify, or delete sensitive user data and system configurations, potentially leading to complete system compromise", "exposure_scope": "Thousands of internet-facing Mitel MiCollab instances globally, particularly in enterprise environments supporting remote collaboration" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Known", "ransomware_first_seen_date": "2026-06-04", "ransomware_days_after_kev": 513, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:21:26.648694", "displayed_on_website": false }, { "cve_id": "CVE-2024-41710", "cvss_score": "6.8", "attack_vector": "ADJACENT_NETWORK", "cisa_kev_listed": true, "internet_exploitable": "MEDIUM_RISK", "confidence": "HIGH", "mitre_technique": "T1133", "deployment_likelihood": "MEDIUM", "cve_published_date": "2024-08-12T00:00:00.000Z", "cve_published_date_formatted": "2024-08-12", "kev_date_added": "2025-02-12", "kev_date_added_formatted": "2025-02-12", "kev_due_date": "2025-03-05", "days_to_kev": 184, "days_since_kev": null, "is_new_kev": false, "summary": "Mitel SIP phones contain an argument injection vulnerability allowing authenticated administrators to execute arbitrary commands. While these phones are network devices often deployed on corporate networks with some internet exposure, the attack vector is adjacent network and requires high privileges.", "detailed_analysis": { "vulnerability_type": "Argument injection vulnerability in boot process allowing arbitrary command execution", "affected_products": [ "Mitel 6800 Series SIP Phones", "Mitel 6900 Series SIP Phones", "Mitel 6900w Series SIP Phones", "Mitel 6970 Conference Unit" ], "exploitation_requirements": [ "Authentication required", "Administrative privileges needed", "Network access to SIP phone", "Adjacent network access" ], "internet_facing_likelihood": "SIP phones are typically deployed on internal networks but may have internet connectivity for remote work scenarios or direct SIP trunking. Estimated 20-30% of deployments may have some form of internet exposure through VPN connections, remote office setups, or SIP service provider connections. However, direct internet exposure of management interfaces is less common.", "typical_deployment": "SIP phones are network infrastructure devices deployed on corporate networks, often with connectivity to both internal PBX systems and external SIP service providers", "deployment_statistics": "Approximately 25% of deployments may have internet connectivity, but direct exposure of administrative interfaces is typically limited. Most exposure occurs through VPN or managed service provider access.", "active_exploitation": "Listed in CISA KEV catalog indicating confirmed active exploitation in the wild", "severity_factors": [ "High privilege requirement reduces immediate risk", "CISA KEV listing indicates active exploitation", "Network device compromise can enable lateral movement", "Command execution provides full system control", "Adjacent network attack vector limits remote exploitation" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately update Mitel SIP phone firmware to version R6.4.0.HF2 or later", "Review administrative access logs for suspicious activity or unauthorized privilege escalation", "Implement network segmentation to isolate SIP phones from critical network infrastructure", "Audit administrative accounts and implement principle of least privilege", "Monitor network traffic from SIP phones for unusual outbound connections", "Priority: HIGH due to CISA KEV listing and potential for lateral movement" ], "risk_assessment": { "exploit_likelihood": "Medium - requires adjacent network access and administrative privileges, but CISA KEV listing confirms active exploitation", "impact_assessment": "High - arbitrary command execution on network infrastructure device can enable lateral movement and network reconnaissance", "exposure_scope": "Limited to organizations using affected Mitel SIP phone models with network connectivity, estimated tens of thousands of devices globally" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:31:34.336603", "displayed_on_website": false }, { "cve_id": "CVE-2024-40891", "cvss_score": "8.8", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2025-02-04T10:02:48.018Z", "cve_published_date_formatted": "2025-02-04", "kev_date_added": "2025-02-11", "kev_date_added_formatted": "2025-02-11", "kev_due_date": "2025-03-04", "days_to_kev": 7, "days_since_kev": null, "is_new_kev": false, "summary": "Post-authentication command injection vulnerability in Zyxel VMG4325-B10A DSL modem allows authenticated attackers to execute OS commands via Telnet. This is a legacy, unsupported device that is actively exploited in the wild according to CISA KEV listing.", "detailed_analysis": { "vulnerability_type": "Post-authentication command injection (CWE-78) allowing OS command execution", "affected_products": [ "Zyxel VMG4325-B10A DSL Modem" ], "exploitation_requirements": [ "Low-privilege authentication", "Network access to device", "Telnet access to management interface" ], "internet_facing_likelihood": "DSL modems are commonly deployed as internet-facing gateway devices in home and small business environments. These devices typically have management interfaces exposed to WAN for remote administration, making them directly accessible from the internet. Estimated 70-80% of deployments have some level of internet exposure through management interfaces.", "typical_deployment": "Consumer/SOHO DSL modem serving as internet gateway and router, typically deployed at network perimeter with direct internet connectivity", "deployment_statistics": "Approximately 70-80% of DSL modem deployments have management interfaces that could be internet-accessible, either through default configurations, port forwarding, or TR-069 remote management protocols", "active_exploitation": "Listed in CISA KEV catalog as of February 11, 2025, indicating confirmed active exploitation in the wild", "severity_factors": [ "High CVSS score of 8.8", "Active exploitation confirmed by CISA", "Legacy unsupported device with no security updates", "Common internet-facing deployment pattern", "Low authentication requirements" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "IMMEDIATE: Disconnect affected Zyxel VMG4325-B10A devices from internet exposure and replace with supported hardware", "Block external access to device management interfaces through firewall rules", "Monitor network traffic for suspicious command execution or unauthorized administrative access", "PATCH PRIORITY: CRITICAL - However, this is legacy unsupported hardware requiring replacement rather than patching" ], "risk_assessment": { "exploit_likelihood": "Very High - Active exploitation confirmed by CISA KEV, legacy unsupported device with no available patches, commonly internet-facing deployment pattern", "impact_assessment": "High - Full OS command execution leads to complete device compromise, potential network lateral movement, and gateway device control", "exposure_scope": "Moderate to High - Legacy DSL modems still deployed in many home and small business environments with internet-facing management interfaces" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:29:50.218556", "displayed_on_website": false }, { "cve_id": "CVE-2024-40890", "cvss_score": "8.8", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2025-02-04T09:55:38.908Z", "cve_published_date_formatted": "2025-02-04", "kev_date_added": "2025-02-11", "kev_date_added_formatted": "2025-02-11", "kev_due_date": "2025-03-04", "days_to_kev": 7, "days_since_kev": null, "is_new_kev": false, "summary": "Command injection vulnerability in Zyxel VMG4325-B10A DSL router allows authenticated attackers to execute OS commands via crafted HTTP POST requests. This legacy CPE device is commonly internet-facing and is listed in CISA KEV indicating active exploitation.", "detailed_analysis": { "vulnerability_type": "Post-authentication command injection in CGI program allowing OS command execution", "affected_products": [ "Zyxel VMG4325-B10A DSL Router" ], "exploitation_requirements": [ "Low-privilege authentication", "Network access to web interface", "Crafted HTTP POST request" ], "internet_facing_likelihood": "DSL Customer Premise Equipment (CPE) routers like the VMG4325-B10A are specifically designed to provide internet connectivity to homes and small businesses. These devices have public IP addresses assigned by ISPs and commonly expose management interfaces to the internet. Estimated 70-80% of deployments are internet-accessible either intentionally for remote management or through default configurations.", "typical_deployment": "Infrastructure software - DSL gateway/router deployed at customer premises to provide internet connectivity", "deployment_statistics": "Approximately 70-80% internet-facing as these are ISP-provided or ISP-configured devices that often retain default remote management capabilities", "active_exploitation": "Listed in CISA KEV catalog as of February 11, 2025, indicating confirmed active exploitation in the wild", "severity_factors": [ "CISA KEV listing confirms active exploitation", "Command injection leads to full device compromise", "Legacy unsupported device with no patches available", "Internet-facing by design", "Low authentication requirement" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "URGENT: Replace affected VMG4325-B10A devices immediately as they are legacy/unsupported with no patches available", "Disable remote management interfaces if replacement cannot be immediate", "Implement network segmentation to isolate affected devices", "Monitor for suspicious network activity and unauthorized command execution" ], "risk_assessment": { "exploit_likelihood": "Very High - Active exploitation confirmed by CISA KEV listing, low complexity attack with only low-privilege authentication required", "impact_assessment": "High - Full device compromise through OS command execution, potential network lateral movement, internet connectivity disruption", "exposure_scope": "Moderate to High - Legacy device but still deployed in many home/small business environments with internet exposure" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:30:09.386172", "displayed_on_website": false }, { "cve_id": "CVE-2024-38475", "cvss_score": "9.1", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2024-07-01T18:15:12.292Z", "cve_published_date_formatted": "2024-07-01", "kev_date_added": "2025-05-01", "kev_date_added_formatted": "2025-05-01", "kev_due_date": "2025-05-22", "days_to_kev": 304, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2024-38475 is a critical vulnerability in Apache HTTP Server's mod_rewrite module that allows remote attackers to map URLs to unintended filesystem locations, leading to code execution or source code disclosure. This vulnerability affects one of the world's most widely deployed web servers and has been added to CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild.", "detailed_analysis": { "vulnerability_type": "Improper escaping of output in mod_rewrite module allowing filesystem path manipulation leading to code execution or source code disclosure", "affected_products": [ "Apache HTTP Server (versions 2.4.0 through 2.4.59)", "NetApp ONTAP systems" ], "exploitation_requirements": [ "Network access to Apache HTTP Server", "Server must use mod_rewrite with vulnerable substitution patterns", "No authentication required" ], "internet_facing_likelihood": "Apache HTTP Server is primarily designed as a web server and is one of the most commonly deployed internet-facing applications globally. The vast majority of Apache deployments (estimated 80-90%) are internet-facing to serve websites and web applications.", "typical_deployment": "Apache HTTP Server is server software designed specifically to serve web content over HTTP/HTTPS protocols. It is deployed as the foundation for websites, web applications, and API endpoints.", "deployment_statistics": "Approximately 80-90% of Apache HTTP Server deployments are internet-facing, as this is the primary use case for web server software. Apache powers millions of websites globally and is commonly exposed to the internet by design.", "active_exploitation": "CISA has added this CVE to the Known Exploited Vulnerabilities catalog as of May 1, 2025, indicating confirmed active exploitation in the wild. The vulnerability was presented at Black Hat US 2024, increasing public awareness and potential for exploitation.", "severity_factors": [ "CVSS 9.1 Critical score", "No authentication required", "Network exploitable", "Can lead to code execution", "Affects widely deployed web server", "Active exploitation confirmed", "Simple to exploit once vulnerable configuration identified" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review Apache access logs for suspicious URL patterns, check for unauthorized file access, verify web application integrity, and scan for potential web shells or unauthorized code", "Immediately upgrade Apache HTTP Server to version 2.4.60 or later", "Review and audit all mod_rewrite rules, especially those using backreferences or variables as the first segment of substitution", "If immediate patching is not possible, disable mod_rewrite or implement the 'UnsafePrefixStat' flag with extreme caution after ensuring substitutions are properly constrained", "Implement web application firewalls (WAF) with rules to detect path traversal attempts", "Monitor Apache access logs for unusual URL patterns and filesystem access attempts" ], "risk_assessment": { "exploit_likelihood": "Very High - Active exploitation confirmed by CISA KEV listing, affects widely deployed software, and exploitation can be automated once vulnerable configurations are identified", "impact_assessment": "Critical - Successful exploitation can lead to arbitrary code execution on the web server, source code disclosure, and potential full system compromise", "exposure_scope": "Massive - Apache HTTP Server powers millions of websites globally, with the majority being internet-facing. Any Apache server using mod_rewrite with vulnerable substitution patterns is at risk" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:52:44.954727", "displayed_on_website": false }, { "cve_id": "CVE-2024-37079", "cvss_score": "9.8", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2024-06-18T05:43:06.619Z", "cve_published_date_formatted": "2024-06-18", "kev_date_added": "2026-01-23", "kev_date_added_formatted": "2026-01-23", "kev_due_date": "2026-02-13", "days_to_kev": 584, "days_since_kev": null, "is_new_kev": false, "summary": "Critical heap-overflow vulnerability in VMware vCenter Server's DCERPC protocol implementation allows remote code execution via specially crafted network packets. This vulnerability is actively exploited in the wild and affects a core infrastructure product commonly exposed to networks.", "detailed_analysis": { "vulnerability_type": "Heap-overflow vulnerability in DCERPC protocol implementation (CWE-787 Out-of-bounds Write)", "affected_products": [ "VMware vCenter Server", "VMware Cloud Foundation" ], "exploitation_requirements": [ "Network access to vCenter Server", "No authentication required", "No user interaction required" ], "internet_facing_likelihood": "VMware vCenter Server is frequently deployed as internet-facing or network-accessible infrastructure. While security best practices recommend restricting access, many organizations expose vCenter to networks for remote administration, API access, and integration with cloud services. Estimated 40-60% of deployments have some level of network exposure beyond localhost.", "typical_deployment": "Server software - vCenter Server is VMware's centralized management platform for virtualized infrastructure, typically deployed as a critical infrastructure component that manages ESXi hosts and virtual machines", "deployment_statistics": "Approximately 50-70% of vCenter deployments are accessible over corporate networks, with 20-40% having some form of internet or WAN exposure for remote management, disaster recovery, and cloud integration purposes", "active_exploitation": "Listed in CISA KEV catalog as of January 2026, indicating confirmed active exploitation in the wild by threat actors", "severity_factors": [ "Critical CVSS score of 9.8", "No authentication required", "Remote code execution capability", "Affects core virtualization infrastructure", "Active exploitation confirmed", "Low attack complexity" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Apply VMware patches immediately: Update to vCenter Server 8.0 U2d, 8.0 U1e, or 7.0 U3r as appropriate", "Implement network segmentation to limit vCenter Server exposure and monitor DCERPC traffic for anomalies", "EMERGENCY patch priority - treat as critical infrastructure vulnerability with confirmed active exploitation" ], "risk_assessment": { "exploit_likelihood": "Very High - CVSS 9.8 with confirmed active exploitation, no authentication required, and network-based attack vector make this highly attractive to attackers", "impact_assessment": "Critical - Remote code execution on vCenter Server provides complete control over virtualized infrastructure, potentially affecting hundreds or thousands of virtual machines and sensitive data", "exposure_scope": "High - vCenter Server is widely deployed in enterprise environments and often requires network accessibility for legitimate management functions, creating significant exposure surface" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:27:24.272934", "displayed_on_website": false }, { "cve_id": "CVE-2024-29059", "cvss_score": "7.5", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "MEDIUM_RISK", "confidence": "MEDIUM", "mitre_technique": "T1190", "deployment_likelihood": "MEDIUM", "cve_published_date": "2024-03-22T23:09:05.745Z", "cve_published_date_formatted": "2024-03-22", "kev_date_added": "2025-02-04", "kev_date_added_formatted": "2025-02-04", "kev_due_date": "2025-02-25", "days_to_kev": 319, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2024-29059 is an information disclosure vulnerability in .NET Framework that can expose sensitive information through error messages. While CISA has added it to the KEV catalog indicating active exploitation, the vulnerability is limited to information disclosure rather than remote code execution.", "detailed_analysis": { "vulnerability_type": "Information Disclosure via Error Messages (CWE-209)", "affected_products": [ ".NET Framework 4.8", ".NET Framework 4.7/4.7.1/4.7.2", ".NET Framework 4.6.2", ".NET Framework 3.5", ".NET Framework 2.0/3.0", "Windows Server 2022", "Windows Server 2019", "Windows Server 2016", "Windows Server 2012/2012 R2", "Windows Server 2008/2008 R2" ], "exploitation_requirements": [ "Network access to vulnerable .NET application", "No authentication required", "No user interaction required", "Ability to trigger error conditions" ], "internet_facing_likelihood": "Many .NET Framework applications are deployed as web applications, web APIs, and web services that are internet-facing. ASP.NET applications running on IIS are commonly exposed to the internet for business purposes. However, not all .NET Framework installations are internet-facing as the framework is also used for desktop applications and internal services.", "typical_deployment": ".NET Framework is primarily used for web applications (ASP.NET), web services, and APIs that frequently require internet exposure. It's also used for Windows desktop applications and internal services, but the web application use case is significant.", "deployment_statistics": "Approximately 40-60% of .NET Framework deployments are likely internet-facing, particularly those running ASP.NET web applications, web APIs, and web services on IIS servers that serve external customers or partners.", "active_exploitation": "Listed in CISA KEV catalog as of February 4, 2025, indicating confirmed active exploitation in the wild by threat actors", "severity_factors": [ "High CVSS score of 7.5", "No authentication required", "Network attack vector", "Active exploitation confirmed by CISA", "Wide deployment base of .NET Framework", "Information disclosure could enable further attacks" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Apply Microsoft security updates immediately for all affected .NET Framework versions", "Monitor application logs for unusual error patterns or information leakage attempts", "Implement proper error handling to prevent sensitive information disclosure", "Review and harden error page configurations in web applications", "HIGH patch priority due to CISA KEV listing and active exploitation" ], "risk_assessment": { "exploit_likelihood": "High - CISA KEV listing confirms active exploitation, and the vulnerability requires no authentication with network attack vector", "impact_assessment": "Medium - Information disclosure can expose sensitive data, configuration details, or system information that could facilitate further attacks, but does not directly provide system access", "exposure_scope": "Moderate to High - .NET Framework has significant deployment in internet-facing web applications, particularly in enterprise environments using ASP.NET" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:26:35.410971", "displayed_on_website": false }, { "cve_id": "CVE-2024-27443", "cvss_score": "6.1", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1203", "deployment_likelihood": "HIGH", "cve_published_date": "2024-08-12T00:00:00.000Z", "cve_published_date_formatted": "2024-08-12", "kev_date_added": "2025-05-19", "kev_date_added_formatted": "2025-05-19", "kev_due_date": "2025-06-09", "days_to_kev": 280, "days_since_kev": null, "is_new_kev": false, "summary": "This is a Cross-Site Scripting (XSS) vulnerability in Zimbra webmail that requires sending a malicious email with crafted calendar headers to victims. While Zimbra is internet-facing, this XSS only compromises user sessions, not the server itself, making it a phishing attack rather than direct server exploitation.", "detailed_analysis": { "vulnerability_type": "Cross-Site Scripting (XSS) in calendar invite processing", "affected_products": [ "Zimbra Collaboration Server" ], "exploitation_requirements": [ "Crafted email with malicious calendar header", "Victim must view the email in Zimbra webmail classic interface", "User interaction required" ], "internet_facing_likelihood": "Zimbra Collaboration Server is typically deployed as an internet-facing email server for organizations. Nearly 100% of Zimbra deployments are internet-accessible since email servers must receive external mail and provide webmail access to users.", "typical_deployment": "Server application - Zimbra is enterprise email server software that provides email, calendar, and collaboration services via web interface", "deployment_statistics": "Approximately 95-100% of Zimbra deployments are internet-facing as email servers must accept external mail and provide webmail access to users from various locations", "active_exploitation": "Listed in CISA KEV with active exploitation evidence. Referenced in ESET research on Operation Roundpress campaign.", "severity_factors": [ "Active exploitation in wild", "CISA KEV listing", "However, limited to user session compromise", "Requires user interaction", "Does not compromise server directly" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review email logs for suspicious calendar invites, check for unauthorized user actions, verify user account integrity", "Immediately update to Zimbra 9.0.0 P39 or Zimbra 10.0.7 or later", "Monitor email logs for suspicious calendar invitations with unusual headers", "Educate users about suspicious calendar invites and unexpected JavaScript behavior in webmail", "Consider blocking calendar invites from external untrusted sources if operationally feasible" ], "risk_assessment": { "exploit_likelihood": "High for phishing/user session compromise, but low for direct server exploitation since this is XSS affecting user sessions only", "impact_assessment": "Medium - can steal user credentials, perform actions in user context, but cannot directly compromise the Zimbra server infrastructure", "exposure_scope": "Large - Zimbra has significant enterprise deployment base and most instances are internet-facing, but impact limited to individual user sessions rather than server compromise" }, "exploitation_method": "PHISHING", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:59:18.819070", "displayed_on_website": false }, { "cve_id": "CVE-2024-27199", "cvss_score": "7.3", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2024-03-04T17:21:40.081Z", "cve_published_date_formatted": "2024-03-04", "kev_date_added": "2026-04-20", "kev_date_added_formatted": "2026-04-20", "kev_due_date": "2026-05-04", "days_to_kev": 777, "days_since_kev": null, "is_new_kev": false, "summary": "Path traversal vulnerability in JetBrains TeamCity allowing unauthenticated attackers to perform limited admin actions. This CI/CD server is commonly exposed to the internet for developer access and is actively being exploited in the wild.", "detailed_analysis": { "vulnerability_type": "Path traversal (CWE-23) enabling unauthorized administrative actions without authentication", "affected_products": [ "JetBrains TeamCity" ], "exploitation_requirements": [ "Network access to TeamCity server", "No authentication required", "No user interaction required" ], "internet_facing_likelihood": "TeamCity is a CI/CD server that organizations frequently expose to the internet to enable remote developer access, automated deployments, and integration with cloud services. Estimated 60-70% of TeamCity deployments are internet-accessible due to the nature of modern DevOps workflows requiring external connectivity.", "typical_deployment": "Server application - TeamCity is a centralized build and continuous integration server that manages code repositories, build pipelines, and deployment processes", "deployment_statistics": "Approximately 60-70% of TeamCity instances are internet-facing to support remote development teams, cloud integrations, and automated CI/CD pipelines that need external access", "active_exploitation": "Listed in CISA KEV catalog, indicating confirmed active exploitation. References include reports of mass exploitation campaigns targeting TeamCity servers to create rogue administrator accounts.", "severity_factors": [ "No authentication required", "Administrative access possible", "Internet-facing deployment common", "Active exploitation confirmed", "Critical infrastructure (CI/CD) targeted" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately update to TeamCity 2023.11.4 or later", "Review administrator accounts for unauthorized additions", "Audit recent build configurations and deployment activities for tampering", "Monitor TeamCity access logs for suspicious path traversal attempts", "Consider temporarily restricting internet access until patching is complete", "Implement network segmentation to limit TeamCity server exposure" ], "risk_assessment": { "exploit_likelihood": "Very High - CVSS shows no authentication required (PR:N) with network attack vector, active exploitation confirmed, and exploit code publicly available", "impact_assessment": "High - Administrative access to CI/CD infrastructure can lead to supply chain attacks, code tampering, credential theft, and lateral movement into development environments", "exposure_scope": "Significant - TeamCity is widely used in enterprise environments and commonly internet-accessible, making this a high-value target for attackers" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Known", "ransomware_first_seen_date": "2026-06-04", "ransomware_days_after_kev": 45, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:42:36.914507", "displayed_on_website": false }, { "cve_id": "CVE-2024-21413", "cvss_score": "9.8", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1203", "deployment_likelihood": "VERY_LOW", "cve_published_date": "2024-02-13T18:02:24.799Z", "cve_published_date_formatted": "2024-02-13", "kev_date_added": "2025-02-06", "kev_date_added_formatted": "2025-02-06", "kev_due_date": "2025-02-27", "days_to_kev": 359, "days_since_kev": null, "is_new_kev": false, "summary": "Microsoft Outlook Remote Code Execution vulnerability affects client email applications, not server infrastructure. Despite the critical CVSS score and CISA KEV listing, this requires phishing/social engineering to deliver malicious content to Outlook clients rather than direct internet exploitation of servers.", "detailed_analysis": { "vulnerability_type": "Remote Code Execution in email client due to improper input validation (CWE-20)", "affected_products": [ "Microsoft Outlook (Office 2016/2019/2021)", "Microsoft 365 Apps for Enterprise", "Microsoft Office LTSC 2021" ], "exploitation_requirements": [ "Target must receive and process malicious email content", "Social engineering or phishing delivery mechanism", "Victim interaction with email content" ], "internet_facing_likelihood": "Microsoft Outlook is primarily a client-side email application installed on end-user workstations and laptops. While Outlook connects to mail servers over the internet, the vulnerable component is the client application itself, not an internet-facing server service. Outlook as a server component (like Exchange Server) is not listed in the affected products. Estimated <5% of deployments involve Outlook in any server-facing capacity, and those would typically be behind corporate firewalls.", "typical_deployment": "Client-side desktop/laptop application for email, calendar, and contact management. Connects to mail servers (Exchange, Office 365, IMAP/POP3) but runs locally on user devices.", "deployment_statistics": "Less than 5% of Outlook installations are directly internet-accessible. The vast majority are client applications on corporate networks or personal devices that connect outbound to mail services.", "active_exploitation": "Listed in CISA KEV as of February 6, 2025, indicating confirmed exploitation in the wild, likely through targeted phishing campaigns", "severity_factors": [ "Critical CVSS 9.8 score with network attack vector", "No authentication or user interaction required once malicious content is processed", "CISA KEV listing confirms active exploitation", "But requires social engineering delivery mechanism", "Client-side vulnerability limits direct internet exploitation" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review email security logs, check for suspicious email attachments or content, verify endpoint integrity", "Apply Microsoft security updates immediately for all Office/Outlook installations", "Implement email security controls including attachment scanning and link protection", "Monitor for suspicious email patterns and phishing attempts targeting this vulnerability", "Patch priority: CRITICAL for client endpoints, especially those processing external email" ], "risk_assessment": { "exploit_likelihood": "High likelihood through phishing campaigns but very low likelihood of direct internet exploitation due to client-side nature of affected products", "impact_assessment": "Critical impact with full system compromise possible (RCE with high confidentiality, integrity, and availability impact)", "exposure_scope": "Millions of Outlook client installations vulnerable, but exploitation requires successful phishing delivery rather than direct network scanning/exploitation" }, "exploitation_method": "PHISHING", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:28:25.779057", "displayed_on_website": false }, { "cve_id": "CVE-2024-21182", "cvss_score": "7.5", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2024-07-16T22:40:11.035Z", "cve_published_date_formatted": "2024-07-16", "kev_date_added": "2026-06-01", "kev_date_added_formatted": "2026-06-01", "kev_due_date": "2026-06-04", "days_to_kev": 685, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2024-21182 is an unauthenticated network vulnerability in Oracle WebLogic Server allowing unauthorized access to critical data via T3/IIOP protocols. WebLogic Server is commonly deployed as an internet-facing enterprise application server, making this vulnerability highly exploitable from the internet.", "detailed_analysis": { "vulnerability_type": "Unauthenticated network access vulnerability allowing unauthorized data access via T3 and IIOP protocols", "affected_products": [ "Oracle WebLogic Server 12.2.1.4.0", "Oracle WebLogic Server 14.1.1.0.0" ], "exploitation_requirements": [ "Network access to WebLogic Server", "Access to T3 or IIOP protocols", "No authentication required", "No user interaction required" ], "internet_facing_likelihood": "Oracle WebLogic Server is an enterprise Java application server specifically designed to host web applications and services for internet access. The vast majority of WebLogic deployments (estimated 80-90%) are internet-facing to serve web applications, APIs, and enterprise services to external users and customers.", "typical_deployment": "WebLogic Server is enterprise application server software that hosts Java EE applications, web services, and APIs. It is designed as server infrastructure to handle HTTP/HTTPS requests and provide application services.", "deployment_statistics": "Approximately 80-90% of WebLogic Server deployments are internet-facing, as organizations use it to host customer-facing web applications, e-commerce platforms, and public APIs. The T3 and IIOP protocols mentioned in the vulnerability are commonly exposed alongside HTTP services.", "active_exploitation": "Listed in CISA KEV catalog indicating active exploitation in the wild. CISA SSVC assessment shows 'Exploitation: active' and 'Automatable: yes'.", "severity_factors": [ "No authentication required", "Low attack complexity", "Network-accessible attack vector", "Active exploitation confirmed", "High confidentiality impact", "Easily exploitable per Oracle advisory" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Apply Oracle Critical Patch Update July 2024 immediately to affected WebLogic Server versions", "Monitor T3 and IIOP protocol access logs for suspicious unauthorized access attempts", "Consider restricting T3/IIOP protocol access from untrusted networks if not required for legitimate operations", "Implement network segmentation to limit exposure of WebLogic servers", "MAXIMUM patch priority - actively exploited vulnerability in commonly internet-facing infrastructure" ], "risk_assessment": { "exploit_likelihood": "Very High - Unauthenticated network vulnerability with confirmed active exploitation and automation potential in commonly internet-facing server software", "impact_assessment": "High confidentiality impact allowing unauthorized access to critical data and complete access to all WebLogic Server accessible data", "exposure_scope": "Large - WebLogic Server is widely deployed enterprise application server software with majority of deployments being internet-facing" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:48:16.872917", "displayed_on_website": false }, { "cve_id": "CVE-2024-20953", "cvss_score": "8.8", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2024-02-17T01:50:16.976Z", "cve_published_date_formatted": "2024-02-17", "kev_date_added": "2025-02-24", "kev_date_added_formatted": "2025-02-24", "kev_due_date": "2025-03-17", "days_to_kev": 373, "days_since_kev": null, "is_new_kev": false, "summary": "This is a critical deserialization vulnerability in Oracle Agile PLM that allows complete system takeover via HTTP network access with low privileges. The vulnerability is actively exploited in the wild and listed in CISA KEV.", "detailed_analysis": { "vulnerability_type": "CWE-502: Deserialization of Untrusted Data - allows complete system compromise", "affected_products": [ "Oracle Agile PLM 9.3.6" ], "exploitation_requirements": [ "Low-level authentication required", "Network access via HTTP", "No user interaction needed" ], "internet_facing_likelihood": "Oracle Agile PLM is a web-based Product Lifecycle Management system designed for multi-site collaboration and vendor/partner access. These systems are frequently deployed as internet-facing applications to support global supply chain operations, remote teams, and external stakeholder access. Estimated 70-80% of deployments have some internet exposure due to business requirements for external collaboration.", "typical_deployment": "Enterprise web application server deployed on corporate networks with web interfaces for product development teams, suppliers, and partners", "deployment_statistics": "Approximately 70-80% of Agile PLM deployments are likely internet-accessible due to the collaborative nature of PLM systems requiring access from multiple locations, vendors, and remote teams", "active_exploitation": "CVE is listed in CISA Known Exploited Vulnerabilities (KEV) catalog as of February 24, 2025, indicating confirmed active exploitation in the wild", "severity_factors": [ "Complete system takeover possible", "Network-based attack", "Low authentication requirements", "No user interaction needed", "Active exploitation confirmed", "High CVSS score of 8.8" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately patch Oracle Agile PLM 9.3.6 to the latest version per Oracle's January 2024 CPU advisory", "Review network access logs for suspicious HTTP requests to Agile PLM export functionality", "Implement network segmentation to limit exposure if not already done", "Monitor for unusual authentication patterns or privilege escalations", "HIGHEST patch priority - treat as emergency due to active exploitation and complete system compromise potential" ], "risk_assessment": { "exploit_likelihood": "Very High - vulnerability is easily exploitable with low authentication requirements and active exploitation is confirmed in the wild", "impact_assessment": "Critical - complete system takeover including confidentiality, integrity, and availability impacts on PLM systems containing sensitive product development data", "exposure_scope": "Moderate to High - Oracle Agile PLM has significant enterprise market share and many deployments are internet-facing due to collaboration requirements" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:34:12.571919", "displayed_on_website": false }, { "cve_id": "CVE-2024-20439", "cvss_score": "9.8", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1078", "deployment_likelihood": "HIGH", "cve_published_date": "2024-09-04T16:28:39.669Z", "cve_published_date_formatted": "2024-09-04", "kev_date_added": "2025-03-31", "kev_date_added_formatted": "2025-03-31", "kev_due_date": "2025-04-21", "days_to_kev": 208, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2024-20439 is a critical authentication bypass vulnerability in Cisco Smart License Utility due to hardcoded administrative credentials. Attackers can remotely login with administrative privileges over the CSLU application API without any authentication. Active exploitation has been observed in the wild.", "detailed_analysis": { "vulnerability_type": "Hardcoded static administrative credentials (CWE-912 Hidden Functionality) allowing complete authentication bypass", "affected_products": [ "Cisco Smart License Utility" ], "exploitation_requirements": [ "Network access to CSLU interface", "No authentication required", "No user interaction required" ], "internet_facing_likelihood": "Cisco Smart License Utility is commonly deployed as internet-facing infrastructure to manage licensing for distributed Cisco environments. Many organizations expose CSLU to the internet for centralized license management across geographically distributed networks, cloud deployments, and remote sites. Estimated 60-70% of enterprise deployments are internet-accessible.", "typical_deployment": "CSLU is server software that provides centralized license management for Cisco products. It runs as a network service with API endpoints and is frequently deployed in DMZs or with internet access to communicate with Cisco licensing servers and manage distributed infrastructure.", "deployment_statistics": "Approximately 60-70% of CSLU deployments are internet-facing due to the need for centralized license management across distributed networks, cloud environments, and remote sites requiring internet connectivity for Cisco Smart Licensing services.", "active_exploitation": "Cisco PSIRT confirmed attempted exploitation in the wild as of March 2025. CISA has added this vulnerability to the Known Exploited Vulnerabilities catalog, indicating active threat actor exploitation.", "severity_factors": [ "Critical CVSS 9.8 score", "No authentication required", "Complete administrative access", "Active exploitation confirmed", "Simple exploitation via static credentials", "Network-based attack vector" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately upgrade to fixed CSLU version as recommended by Cisco advisory cisco-sa-cslu-7gHMzWmw", "Implement network segmentation to restrict CSLU access if internet exposure is not required", "Monitor CSLU access logs for unauthorized administrative activity and unknown source IPs", "Change any shared credentials and review all administrative accounts for unauthorized changes", "HIGHEST patch priority - exploit requires no authentication and grants full administrative access" ], "risk_assessment": { "exploit_likelihood": "Very High - trivial exploitation using static credentials with confirmed active exploitation", "impact_assessment": "Critical - complete administrative compromise of license management infrastructure, potential lateral movement to managed Cisco devices", "exposure_scope": "High - thousands of internet-facing CSLU instances globally managing enterprise Cisco licensing" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:46:57.817855", "displayed_on_website": false }, { "cve_id": "CVE-2024-1708", "cvss_score": "8.4", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2024-02-21T15:29:10.091Z", "cve_published_date_formatted": "2024-02-21", "kev_date_added": "2026-04-28", "kev_date_added_formatted": "2026-04-28", "kev_due_date": "2026-05-12", "days_to_kev": 797, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2024-1708 is a critical path traversal vulnerability in ConnectWise ScreenConnect that enables remote code execution on internet-facing remote access servers. This vulnerability is actively exploited in the wild and listed in CISA KEV.", "detailed_analysis": { "vulnerability_type": "Path traversal (CWE-22) leading to remote code execution", "affected_products": [ "ConnectWise ScreenConnect" ], "exploitation_requirements": [ "Network access to ScreenConnect server", "High privileges required", "User interaction required" ], "internet_facing_likelihood": "ConnectWise ScreenConnect is a remote desktop and support software specifically designed to be accessible over the internet. The primary purpose of this software is to provide remote access capabilities, making internet-facing deployment extremely common - estimated 85-95% of deployments are internet-accessible.", "typical_deployment": "Server software deployed as a web-based remote access service that organizations expose to the internet to enable remote desktop support and system administration", "deployment_statistics": "Approximately 85-95% of ScreenConnect deployments are internet-facing as the software's core value proposition is providing remote access from anywhere. Organizations deploy it specifically to allow technicians and users to connect remotely over the internet.", "active_exploitation": "Listed in CISA Known Exploited Vulnerabilities catalog with active exploitation confirmed. Referenced by Microsoft as being exploited by Storm-1175 group in ransomware operations.", "severity_factors": [ "Remote code execution capability", "Affects internet-facing remote access infrastructure", "Active exploitation in the wild", "Used in ransomware campaigns", "High CVSS score of 8.4" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately update to ScreenConnect version 23.9.8 or later", "Implement network segmentation to limit access to ScreenConnect servers", "Monitor for unusual file access patterns and suspicious remote connections", "CRITICAL patch priority - exploit code is available and actively used by threat actors" ], "risk_assessment": { "exploit_likelihood": "Very High - Active exploitation confirmed with vulnerability in CISA KEV and exploit code available", "impact_assessment": "Critical - Remote code execution on systems that provide remote access to internal networks, potential for lateral movement and ransomware deployment", "exposure_scope": "High - ScreenConnect is widely deployed as internet-facing remote access infrastructure across organizations of all sizes" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Known", "ransomware_first_seen_date": "2026-06-04", "ransomware_days_after_kev": 37, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:44:41.303193", "displayed_on_website": false }, { "cve_id": "CVE-2024-13161", "cvss_score": "9.8", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2025-01-14T17:11:32.061Z", "cve_published_date_formatted": "2025-01-14", "kev_date_added": "2025-03-10", "kev_date_added_formatted": "2025-03-10", "kev_due_date": "2025-03-31", "days_to_kev": 55, "days_since_kev": null, "is_new_kev": false, "summary": "Critical absolute path traversal vulnerability in Ivanti Endpoint Manager allowing remote unauthenticated attackers to leak sensitive information. The vulnerability has a CVSS score of 9.8 and is actively being exploited in the wild according to CISA KEV.", "detailed_analysis": { "vulnerability_type": "Absolute Path Traversal (CWE-36) allowing remote file access without authentication", "affected_products": [ "Ivanti Endpoint Manager" ], "exploitation_requirements": [ "Network access to EPM web interface", "No authentication required", "No user interaction needed" ], "internet_facing_likelihood": "Ivanti Endpoint Manager is enterprise endpoint management software that is commonly deployed as a centralized server accessible via web interface. Many organizations deploy EPM with internet-facing access to manage remote endpoints and mobile devices. Estimated 60-70% of deployments have some level of internet exposure through VPN, DMZ deployment, or direct internet access for remote device management.", "typical_deployment": "Ivanti EPM is server software that provides centralized endpoint management through a web-based console. It typically runs on Windows servers and requires network connectivity to managed endpoints.", "deployment_statistics": "Approximately 60-70% of EPM deployments are internet-accessible due to requirements for managing remote workers, mobile devices, and distributed endpoints. Organizations often place EPM in DMZ or provide VPN access for remote management capabilities.", "active_exploitation": "Listed in CISA KEV catalog as of March 10, 2025, indicating confirmed active exploitation in the wild. CISA SSVC assessment shows 'active' exploitation with 'yes' automatable rating.", "severity_factors": [ "No authentication required", "Remote exploitation possible", "High CVSS score of 9.8", "Active exploitation confirmed", "Path traversal can expose sensitive configuration files and credentials", "Potential for lateral movement after information disclosure" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Apply January 2025 security updates immediately: 2024 January-2025 Security Update or 2022 SU6 January-2025 Security Update", "Block external access to EPM console until patching is complete", "Monitor web server logs for suspicious path traversal attempts (../, absolute paths, etc.)", "Review file system access logs for unauthorized file access", "Implement network segmentation to limit EPM exposure", "Patch priority: EMERGENCY - patch within 24-48 hours due to active exploitation" ], "risk_assessment": { "exploit_likelihood": "Very High - vulnerability is being actively exploited with public exploit code available and no authentication required", "impact_assessment": "Critical - absolute path traversal can expose configuration files, credentials, and sensitive system information leading to full system compromise", "exposure_scope": "High - thousands of Ivanti EPM installations globally with many having internet-facing deployments for remote endpoint management" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:38:50.245025", "displayed_on_website": false }, { "cve_id": "CVE-2024-13160", "cvss_score": "9.8", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2025-01-14T17:12:23.237Z", "cve_published_date_formatted": "2025-01-14", "kev_date_added": "2025-03-10", "kev_date_added_formatted": "2025-03-10", "kev_due_date": "2025-03-31", "days_to_kev": 55, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2024-13160 is a critical absolute path traversal vulnerability in Ivanti Endpoint Manager that allows remote unauthenticated attackers to leak sensitive information. This vulnerability is actively exploited in the wild and listed in CISA's Known Exploited Vulnerabilities catalog.", "detailed_analysis": { "vulnerability_type": "Absolute Path Traversal (CWE-36) allowing unauthorized file access", "affected_products": [ "Ivanti Endpoint Manager" ], "exploitation_requirements": [ "Network access to EPM web interface", "No authentication required", "No user interaction needed" ], "internet_facing_likelihood": "Ivanti Endpoint Manager is enterprise endpoint management software that is commonly deployed as an internet-facing web application to allow remote management of endpoints. Many organizations expose EPM to the internet to enable remote endpoint management for distributed workforces, cloud environments, and mobile devices. Estimated 60-70% of EPM deployments have some level of internet exposure.", "typical_deployment": "Server application - EPM is deployed as a centralized management server with web-based console that administrators and agents connect to for endpoint management, software distribution, and security policy enforcement", "deployment_statistics": "Approximately 60-70% of EPM deployments are internet-facing or have internet-accessible components, as organizations need to manage remote endpoints, cloud instances, and mobile devices outside the corporate network perimeter", "active_exploitation": "CISA has added this vulnerability to their Known Exploited Vulnerabilities catalog with exploitation marked as 'active', indicating confirmed exploitation in the wild. CISA SSVC assessment shows 'Exploitation: active' and 'Automatable: yes'", "severity_factors": [ "CVSS 9.8 Critical severity", "Remote unauthenticated exploitation", "Active exploitation confirmed by CISA", "Path traversal can expose sensitive configuration files and credentials", "No user interaction required", "Commonly internet-facing deployment pattern" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Apply the 2024 January-2025 Security Update or 2022 SU6 January-2025 Security Update immediately", "Review web server logs for suspicious path traversal attempts (../, ..\\ patterns)", "Implement network segmentation to limit EPM exposure if internet access is not required", "Monitor file access logs for unauthorized sensitive file access", "Patch priority: IMMEDIATE - actively exploited critical vulnerability in commonly exposed enterprise software" ], "risk_assessment": { "exploit_likelihood": "Very High - vulnerability is actively exploited, requires no authentication, and affects commonly internet-exposed enterprise management software", "impact_assessment": "High - sensitive information disclosure can lead to credential theft, configuration exposure, and potential lateral movement within enterprise networks", "exposure_scope": "Moderate to High - affects enterprise Ivanti EPM deployments, with significant percentage having internet exposure for remote endpoint management" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:39:13.345330", "displayed_on_website": false }, { "cve_id": "CVE-2024-13159", "cvss_score": "9.8", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2025-01-14T17:12:57.652Z", "cve_published_date_formatted": "2025-01-14", "kev_date_added": "2025-03-10", "kev_date_added_formatted": "2025-03-10", "kev_due_date": "2025-03-31", "days_to_kev": 55, "days_since_kev": null, "is_new_kev": false, "summary": "Critical absolute path traversal vulnerability in Ivanti Endpoint Manager allows remote unauthenticated attackers to access sensitive information. The vulnerability is actively exploited in the wild according to CISA KEV listing.", "detailed_analysis": { "vulnerability_type": "Absolute path traversal (CWE-36) allowing unauthorized file system access", "affected_products": [ "Ivanti Endpoint Manager" ], "exploitation_requirements": [ "Network access to the EPM web interface", "No authentication required", "No user interaction required" ], "internet_facing_likelihood": "Ivanti Endpoint Manager is enterprise device management software that is commonly deployed as an internet-facing service to manage remote endpoints, mobile devices, and distributed workforces. Many organizations expose EPM through firewalls or VPNs to enable remote device management capabilities. Estimated 60-70% of deployments have some form of internet accessibility.", "typical_deployment": "Server application deployed as a centralized management platform for endpoint devices across enterprise networks", "deployment_statistics": "Approximately 65% of EPM deployments are internet-accessible to support remote device management, BYOD policies, and distributed workforce scenarios", "active_exploitation": "Listed in CISA KEV catalog with 'Exploitation: active' indicating confirmed exploitation in the wild", "severity_factors": [ "CVSS 9.8 Critical severity", "No authentication required", "Network-accessible", "Active exploitation confirmed", "Path traversal can expose sensitive configuration files and credentials" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Apply January 2025 Security Updates immediately for EPM 2024 and EPM 2022 SU6", "Monitor web server logs for path traversal attempts (../, ..\\ patterns)", "Restrict network access to EPM servers where possible until patching is complete", "Review exposed files and rotate any credentials that may have been compromised" ], "risk_assessment": { "exploit_likelihood": "Very high - vulnerability is being actively exploited with no authentication required and low attack complexity", "impact_assessment": "Critical - path traversal can expose sensitive configuration files, credentials, and potentially lead to full system compromise", "exposure_scope": "High - Ivanti EPM is widely deployed in enterprise environments with many internet-facing instances" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:39:31.659240", "displayed_on_website": false }, { "cve_id": "CVE-2024-12987", "cvss_score": "7.3", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2024-12-27T16:00:13.600Z", "cve_published_date_formatted": "2024-12-27", "kev_date_added": "2025-05-15", "kev_date_added_formatted": "2025-05-15", "kev_due_date": "2025-06-05", "days_to_kev": 139, "days_since_kev": null, "is_new_kev": false, "summary": "Critical OS command injection vulnerability in DrayTek router web management interfaces allowing unauthenticated remote code execution. The vulnerability affects the apmcfgupload endpoint and has been added to CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation.", "detailed_analysis": { "vulnerability_type": "OS Command Injection (CWE-78) in web management interface CGI script", "affected_products": [ "DrayTek Vigor2960 Router", "DrayTek Vigor300B Router" ], "exploitation_requirements": [ "Network access to web management interface", "No authentication required (PR:N in CVSS)", "No user interaction required" ], "internet_facing_likelihood": "DrayTek routers are network infrastructure devices that commonly have their web management interfaces exposed to the internet for remote administration. Many organizations expose router management interfaces for remote maintenance, and these devices are frequently deployed at network perimeters with internet connectivity. Estimated 60-70% of deployments may have internet-accessible management interfaces.", "typical_deployment": "Network infrastructure routers deployed at network perimeters, branch offices, and data centers with web-based management interfaces for remote administration", "deployment_statistics": "Approximately 60-70% of router deployments may have internet-accessible management interfaces for remote administration, particularly in enterprise and branch office environments", "active_exploitation": "Listed in CISA KEV catalog as of May 15, 2025, indicating confirmed exploitation in the wild. Public exploit code is available.", "severity_factors": [ "Unauthenticated remote code execution", "Public exploit available", "CISA KEV listed", "Network infrastructure device", "Command injection allows full system compromise" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately update to firmware version 1.5.1.5 or later", "If patching cannot be done immediately, restrict access to the web management interface to trusted networks only", "Monitor network logs for suspicious requests to /cgi-bin/mainfunction.cgi/apmcfgupload endpoint", "Implement network segmentation to isolate management interfaces from internet access", "Review authentication logs for unauthorized access attempts" ], "risk_assessment": { "exploit_likelihood": "Very High - CISA KEV listing indicates active exploitation, public exploit code available, and no authentication required", "impact_assessment": "Critical - Full system compromise through OS command injection, potential for lateral movement within network infrastructure", "exposure_scope": "Moderate to High - DrayTek routers are deployed globally in enterprise environments, with significant portion having internet-accessible management interfaces" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:58:35.582419", "displayed_on_website": false }, { "cve_id": "CVE-2024-12686", "cvss_score": "6.6", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1133", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2024-12-18T20:23:57.909Z", "cve_published_date_formatted": "2024-12-18", "kev_date_added": "2025-01-13", "kev_date_added_formatted": "2025-01-13", "kev_due_date": "2025-02-03", "days_to_kev": 26, "days_since_kev": null, "is_new_kev": false, "summary": "OS command injection vulnerability in BeyondTrust Remote Support and Privileged Remote Access allowing attackers with administrative privileges to execute commands as site users. This affects remote access platforms that are inherently internet-facing by design and is actively exploited in the wild per CISA KEV.", "detailed_analysis": { "vulnerability_type": "OS Command Injection (CWE-78) allowing privilege escalation from admin to site user context", "affected_products": [ "BeyondTrust Remote Support", "BeyondTrust Privileged Remote Access" ], "exploitation_requirements": [ "Administrative privileges required", "Network access to remote access platform", "High attack complexity" ], "internet_facing_likelihood": "BeyondTrust Remote Support and Privileged Remote Access are remote access platforms designed to provide external connectivity to internal systems. These products are inherently internet-facing by design - their primary function is to allow remote users to access systems over the internet. Estimated 95%+ of deployments are internet-accessible as this is their core business purpose.", "typical_deployment": "These are server-based remote access platforms deployed to provide secure remote connectivity. They function as gateways between internet users and internal corporate networks/systems.", "deployment_statistics": "Approximately 95-98% of deployments are internet-facing since remote access is the primary function. Organizations deploy these specifically to enable external remote access to their networks.", "active_exploitation": "Listed in CISA KEV catalog as of January 13, 2025, indicating confirmed active exploitation in the wild", "severity_factors": [ "Command injection enables arbitrary code execution", "Affects critical remote access infrastructure", "Active exploitation confirmed", "High privileges required reduces immediate risk", "Internet-facing deployment model increases exposure" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately update to BeyondTrust RS/PRA version 24.3.2 or later", "Review administrative access logs for suspicious command execution patterns", "Implement additional monitoring for privilege escalation attempts", "Consider temporary network segmentation if patching cannot be completed immediately", "Audit administrative account access and review recent administrative actions" ], "risk_assessment": { "exploit_likelihood": "High - active exploitation confirmed by CISA KEV listing, though exploitation requires existing administrative privileges which limits immediate attack surface", "impact_assessment": "High - successful exploitation allows command injection and privilege manipulation in critical remote access infrastructure", "exposure_scope": "Very High - BeyondTrust remote access platforms are widely deployed in enterprise environments and are inherently internet-facing by design" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:22:32.806898", "displayed_on_website": false }, { "cve_id": "CVE-2024-11182", "cvss_score": "5.3", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1203", "deployment_likelihood": "HIGH", "cve_published_date": "2024-11-15T10:43:10.960Z", "cve_published_date_formatted": "2024-11-15", "kev_date_added": "2025-05-19", "kev_date_added_formatted": "2025-05-19", "kev_due_date": "2025-06-09", "days_to_kev": 185, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2024-11182 is a stored XSS vulnerability in MDaemon Email Server's webmail component that requires an attacker to send a malicious HTML email to victims. While the email server itself is internet-facing, this vulnerability targets user browser sessions rather than providing direct server access, making it a phishing/social engineering attack vector rather than direct server exploitation.", "detailed_analysis": { "vulnerability_type": "Stored Cross-Site Scripting (XSS) in webmail interface", "affected_products": [ "MDaemon Email Server" ], "exploitation_requirements": [ "Attacker must send malicious HTML email", "Victim must view the email in webmail interface", "JavaScript execution in victim's browser" ], "internet_facing_likelihood": "MDaemon Email Server is typically deployed as an internet-facing service since it must receive emails from external mail servers. The SMTP service (port 25) and webmail interface are commonly exposed to the internet. Estimated 80-90% of deployments are internet-accessible.", "typical_deployment": "MDaemon is an email server software that requires internet connectivity to send/receive emails. It includes SMTP, POP3, IMAP services and a webmail interface that are typically internet-facing", "deployment_statistics": "Approximately 80-90% of MDaemon deployments are internet-facing as the software's primary function requires receiving emails from external sources and providing webmail access", "active_exploitation": "CISA has added this CVE to the Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild", "severity_factors": [ "Active exploitation confirmed by CISA KEV listing", "Low attack complexity", "No authentication required to send malicious email", "However, requires user interaction to view email", "Only compromises user session, not server" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review webmail logs, check for suspicious email content with JavaScript in img tags, verify no unauthorized user sessions", "Immediately upgrade MDaemon Email Server to version 24.5.1c or later", "Review recent email logs for HTML emails containing JavaScript in img tags", "Implement Content Security Policy (CSP) headers for webmail interface if not already present", "Consider temporarily disabling HTML email rendering until patching is complete", "High patch priority due to active exploitation" ], "risk_assessment": { "exploit_likelihood": "High likelihood of continued exploitation attempts via malicious emails, but requires user interaction to view the email in webmail", "impact_assessment": "Moderate impact - attackers can execute JavaScript in user browser context, potentially stealing credentials, session tokens, or performing actions on behalf of users, but cannot directly compromise the email server itself", "exposure_scope": "All internet-facing MDaemon Email Server installations with webmail enabled running versions 24.5.0 and below are potentially affected" }, "exploitation_method": "PHISHING", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:00:00.565430", "displayed_on_website": false }, { "cve_id": "CVE-2024-11120", "cvss_score": "9.8", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2024-11-15T02:00:27.361Z", "cve_published_date_formatted": "2024-11-15", "kev_date_added": "2025-05-07", "kev_date_added_formatted": "2025-05-07", "kev_due_date": "2025-05-28", "days_to_kev": 173, "days_since_kev": null, "is_new_kev": false, "summary": "Critical OS command injection vulnerability in GeoVision video surveillance and license plate recognition devices allows unauthenticated remote attackers to execute arbitrary system commands. The vulnerability is being actively exploited in the wild and affected devices are end-of-life with no patches available.", "detailed_analysis": { "vulnerability_type": "OS Command Injection (CWE-78) allowing arbitrary system command execution", "affected_products": [ "GeoVision GV-VS12 Video Server", "GeoVision GV-VS11 Video Server", "GeoVision GV-DSP LPR V3 License Plate Recognition System", "GeoVision GVLX 4 V2 License Management Device", "GeoVision GVLX 4 V3 License Management Device" ], "exploitation_requirements": [ "Network connectivity to device", "No authentication required", "No user interaction required", "Low attack complexity" ], "internet_facing_likelihood": "GeoVision video surveillance servers and license plate recognition systems are commonly deployed as internet-facing services for remote monitoring, management, and integration with cloud-based security platforms. Video servers especially need internet connectivity for remote viewing and central management across multiple locations.", "typical_deployment": "These are server-class devices that provide video streaming, recording management, and license plate recognition services typically deployed in security infrastructure with web-based management interfaces", "deployment_statistics": "Estimated 60-70% of deployments are internet-accessible as these devices are designed for remote monitoring and management across distributed security installations", "active_exploitation": "Confirmed active exploitation in the wild with related incident reports received. Added to CISA KEV catalog on 2025-05-07 indicating ongoing threat activity", "severity_factors": [ "CVSS 9.8 Critical severity", "Unauthenticated remote exploitation", "Complete system compromise possible", "Active exploitation confirmed", "End-of-life devices with no patches available", "Video surveillance infrastructure typically has high uptime requirements" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "IMMEDIATE: Disconnect affected GeoVision devices from internet exposure until replacement", "Implement network segmentation to isolate affected devices from internet access", "Monitor network traffic for suspicious command injection attempts", "Replace end-of-life devices as vendor recommends - no patches will be released" ], "risk_assessment": { "exploit_likelihood": "Very High - Unauthenticated remote exploitation with confirmed active attacks and low technical complexity", "impact_assessment": "Complete system compromise allowing arbitrary command execution, potential for botnet recruitment, data theft, and lateral movement within network infrastructure", "exposure_scope": "Thousands of internet-facing GeoVision surveillance devices globally, particularly in enterprise and government security installations" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:54:54.789269", "displayed_on_website": false }, { "cve_id": "CVE-2024-0769", "cvss_score": "5.3", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2024-01-21T08:00:05.383Z", "cve_published_date_formatted": "2024-01-21", "kev_date_added": "2025-06-25", "kev_date_added_formatted": "2025-06-25", "kev_due_date": "2025-07-16", "days_to_kev": 521, "days_since_kev": null, "is_new_kev": false, "summary": "D-Link DIR-859 router has a critical path traversal vulnerability in hedwig.cgi that allows remote attackers to access arbitrary files without authentication. This vulnerability is actively exploited and listed in CISA KEV, affecting an end-of-life router model.", "detailed_analysis": { "vulnerability_type": "Path traversal (CWE-22) in HTTP POST request handler allowing unauthorized file access", "affected_products": [ "D-Link DIR-859 Router" ], "exploitation_requirements": [ "Network access to router web interface", "No authentication required", "HTTP POST request capability" ], "internet_facing_likelihood": "Router web management interfaces are commonly exposed to the internet for remote administration, especially in SOHO environments. Estimated 60-80% of consumer routers have some level of internet exposure through port forwarding or direct WAN interface access.", "typical_deployment": "Consumer/SOHO router with web management interface typically accessible from LAN, but often exposed to internet via port forwarding or direct WAN access for remote management", "deployment_statistics": "Approximately 70% of router deployments have some form of internet exposure, either intentionally for remote management or unintentionally through default configurations or port forwarding", "active_exploitation": "Listed in CISA KEV catalog with 'active' exploitation status, indicating confirmed exploitation in the wild", "severity_factors": [ "No authentication required", "Remote network exploitation", "End-of-life product with no patches", "Public exploit available", "Active exploitation confirmed", "Router infrastructure target" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "IMMEDIATE: Replace D-Link DIR-859 routers as they are end-of-life with no security updates available", "Block external access to router management interfaces (ports 80/443/8080) until replacement", "Monitor network traffic for suspicious POST requests to /hedwig.cgi with path traversal patterns", "Implement network segmentation to limit router compromise impact", "CRITICAL priority - active exploitation of internet-facing infrastructure" ], "risk_assessment": { "exploit_likelihood": "Very High - public exploit available, no authentication required, active exploitation confirmed, affects internet-facing router infrastructure", "impact_assessment": "High - path traversal can expose sensitive configuration files, credentials, and potentially lead to full router compromise and network infiltration", "exposure_scope": "Moderate - affects specific end-of-life router model, but routers are commonly internet-exposed and this model may still be widely deployed in SOHO environments" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:06:52.245426", "displayed_on_website": false }, { "cve_id": "CVE-2023-52163", "cvss_score": "8.8", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2025-02-03T00:00:00.000Z", "cve_published_date_formatted": "2025-02-03", "kev_date_added": "2025-12-22", "kev_date_added_formatted": "2025-12-22", "kev_due_date": "2026-01-12", "days_to_kev": 322, "days_since_kev": null, "is_new_kev": false, "summary": "Command injection vulnerability in Digiever DS-2105 Pro NVR devices allows remote code execution via the time_tzsetup.cgi endpoint. This IoT surveillance device is commonly internet-facing for remote monitoring and is actively exploited in the wild.", "detailed_analysis": { "vulnerability_type": "Command injection in time_tzsetup.cgi CGI script allowing arbitrary command execution", "affected_products": [ "Digiever DS-2105 Pro NVR", "Digiever Network Video Recorder devices" ], "exploitation_requirements": [ "Low privileged authentication", "Network access to web interface", "Access to time_tzsetup.cgi endpoint" ], "internet_facing_likelihood": "Network Video Recorders (NVRs) like the Digiever DS-2105 Pro are commonly deployed as internet-facing devices to enable remote surveillance monitoring. Security cameras and NVR systems are frequently exposed to the internet for legitimate remote access by users, making approximately 70-80% of deployments potentially internet-accessible.", "typical_deployment": "This is a Network Video Recorder (NVR) appliance designed for surveillance systems. NVRs are typically deployed as dedicated server appliances that manage IP cameras and provide web-based access for monitoring.", "deployment_statistics": "Approximately 70-80% of NVR deployments are internet-facing to support remote monitoring capabilities. Many organizations and residential users specifically configure these devices for internet access to monitor premises remotely.", "active_exploitation": "Listed in CISA KEV catalog with active exploitation confirmed. Referenced by Fortinet as part of ShadowV2 botnet targeting IoT devices.", "severity_factors": [ "Command injection allows full system compromise", "IoT device with likely weak security controls", "Internet-facing deployment common", "Active exploitation in wild", "Unsupported product with no security updates" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately isolate affected Digiever DS-2105 Pro devices from internet access", "Replace devices with supported alternatives as no patches are available for this end-of-life product", "If continued use necessary, place behind VPN or firewall with strict access controls", "Monitor network traffic for suspicious CGI requests to time_tzsetup.cgi", "PATCH PRIORITY: CRITICAL - but no patches available, requires device replacement" ], "risk_assessment": { "exploit_likelihood": "Very High - Command injection with low authentication requirements, CVSS 8.8, and confirmed active exploitation", "impact_assessment": "Total system compromise with high impact to confidentiality, integrity, and availability. Potential for surveillance data theft and botnet recruitment", "exposure_scope": "Moderate to High - IoT NVR devices with significant internet-facing deployment pattern, though specific product may have limited market share" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:25:08.580771", "displayed_on_website": false }, { "cve_id": "CVE-2023-50224", "cvss_score": "6.5", "attack_vector": "ADJACENT", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1078", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2024-05-03T02:14:42.922Z", "cve_published_date_formatted": "2024-05-03", "kev_date_added": "2025-09-03", "kev_date_added_formatted": "2025-09-03", "kev_due_date": "2025-09-24", "days_to_kev": 488, "days_since_kev": null, "is_new_kev": false, "summary": "Authentication bypass vulnerability in TP-Link TL-WR841N router's httpd service allows unauthenticated attackers to disclose stored credentials via TCP port 80. This is actively exploited and listed in CISA KEV.", "detailed_analysis": { "vulnerability_type": "Authentication bypass leading to credential disclosure in router management interface", "affected_products": [ "TP-Link TL-WR841N Router" ], "exploitation_requirements": [ "Network access to router's management interface", "No authentication required" ], "internet_facing_likelihood": "While CVSS lists this as Adjacent (AV:A), home and SOHO routers are frequently accessible from the internet either intentionally (remote management) or through misconfigurations. Many users enable remote management features, and routers often have UPnP or other services that can expose the management interface. Enterprise deployments may also have management interfaces accessible via VPN or direct internet exposure.", "typical_deployment": "Consumer/SOHO router typically deployed as network gateway device with management interface accessible to local network users", "deployment_statistics": "Estimated 20-40% of router deployments have management interfaces accessible from internet through remote management features, port forwarding, or misconfigurations. Even adjacent network access can be sufficient for compromise in many attack scenarios.", "active_exploitation": "Listed in CISA KEV catalog with 'active' exploitation status, indicating confirmed exploitation in the wild", "severity_factors": [ "No authentication required", "Credential disclosure enables further compromise", "Active exploitation confirmed", "Widely deployed consumer device", "Often inadequately secured" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review router logs, check for unauthorized access, verify admin credentials haven't been changed", "Immediately update firmware to version 12.0 or later if available for your hardware revision", "Disable remote management features if not absolutely necessary", "Change all router credentials immediately after patching", "Implement network segmentation to isolate router management", "Monitor for unauthorized configuration changes" ], "risk_assessment": { "exploit_likelihood": "Very High - No authentication required, active exploitation confirmed, simple HTTP-based attack vector", "impact_assessment": "High - Credential disclosure can lead to complete router compromise, network pivoting, traffic interception, and further lateral movement", "exposure_scope": "Hundreds of thousands of TP-Link routers potentially affected, with significant portion having internet-accessible management interfaces" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:12:31.179229", "displayed_on_website": false }, { "cve_id": "CVE-2023-48365", "cvss_score": "9.6", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2023-11-15T00:00:00.000Z", "cve_published_date_formatted": "2023-11-15", "kev_date_added": "2025-01-13", "kev_date_added_formatted": "2025-01-13", "kev_due_date": "2025-02-03", "days_to_kev": 425, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2023-48365 is an unauthenticated remote code execution vulnerability in Qlik Sense Enterprise for Windows caused by improper HTTP header validation. Attackers can tunnel HTTP requests to execute commands on the backend repository server, leading to complete system compromise.", "detailed_analysis": { "vulnerability_type": "HTTP Request Smuggling leading to unauthenticated remote code execution", "affected_products": [ "Qlik Sense Enterprise for Windows" ], "exploitation_requirements": [ "Network access to Qlik Sense server", "No authentication required", "No user interaction required" ], "internet_facing_likelihood": "Qlik Sense Enterprise is a business intelligence platform that organizations frequently deploy as internet-facing applications to provide dashboard and analytics access to employees, partners, and customers. Estimated 70-80% of deployments are internet-accessible to support remote workforce and external stakeholder access to business intelligence data.", "typical_deployment": "Qlik Sense Enterprise is server software designed to provide web-based business intelligence and data visualization services, typically deployed on Windows servers with web interfaces accessible to users", "deployment_statistics": "Approximately 70-80% of Qlik Sense Enterprise deployments are internet-facing as organizations need to provide remote access to dashboards, reports, and analytics for distributed workforces and external stakeholders", "active_exploitation": "Listed in CISA KEV catalog as of January 13, 2025, indicating active exploitation in the wild. CISA SSVC assessment shows active exploitation with total technical impact", "severity_factors": [ "CVSS 9.6 Critical severity", "No authentication required", "Remote code execution capability", "Active exploitation confirmed", "Scope change in CVSS indicating potential lateral movement", "Incomplete fix of previous CVE-2023-41265" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately apply August 2023 Patch 2 or appropriate version-specific patches (May 2023 Patch 6, February 2023 Patch 10, etc.)", "Monitor HTTP request logs for suspicious header manipulation and request tunneling attempts", "Implement network segmentation to limit exposure if not already done", "Review authentication logs for unauthorized access attempts", "HIGHEST patch priority - treat as emergency maintenance" ], "risk_assessment": { "exploit_likelihood": "Very High - CISA KEV listing confirms active exploitation, no authentication required, and technical details are public", "impact_assessment": "Critical - Unauthenticated RCE allows complete system compromise, data theft, lateral movement, and potential ransomware deployment", "exposure_scope": "High - Qlik Sense Enterprise is widely deployed in large organizations as internet-facing business intelligence platforms, potentially exposing thousands of corporate deployments globally" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Known", "ransomware_first_seen_date": "2026-06-04", "ransomware_days_after_kev": 507, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:22:10.219190", "displayed_on_website": false }, { "cve_id": "CVE-2023-44221", "cvss_score": "7.2", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1133", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2023-12-05T20:10:35.186Z", "cve_published_date_formatted": "2023-12-05", "kev_date_added": "2025-05-01", "kev_date_added_formatted": "2025-05-01", "kev_due_date": "2025-05-22", "days_to_kev": 513, "days_since_kev": null, "is_new_kev": false, "summary": "SonicWall SMA100 SSL-VPN appliances contain an OS command injection vulnerability in the management interface allowing authenticated administrators to execute arbitrary commands. These appliances are specifically designed to be internet-facing and this vulnerability is actively exploited in the wild.", "detailed_analysis": { "vulnerability_type": "OS Command Injection (CWE-78) in SSL-VPN management interface allowing arbitrary command execution", "affected_products": [ "SonicWall SMA100 SSL-VPN (SMA 200, 210, 400, 410, 500v)" ], "exploitation_requirements": [ "Administrative authentication to management interface", "Network access to management interface", "Knowledge of command injection techniques" ], "internet_facing_likelihood": "SonicWall SMA100 devices are SSL-VPN appliances specifically designed to provide secure remote access from the internet. By their very nature and purpose, these devices must be internet-facing to function. The management interface, while intended to be restricted, is often accessible from the same network interfaces. Estimated 90-95% of deployments are internet-accessible.", "typical_deployment": "These are dedicated network security appliances deployed at network perimeters specifically to provide SSL-VPN services to remote users connecting from the internet", "deployment_statistics": "Approximately 90-95% of SonicWall SMA100 deployments are internet-facing as this is their primary function - providing secure remote access services", "active_exploitation": "Listed in CISA KEV catalog as of May 1, 2025, indicating confirmed active exploitation in the wild", "severity_factors": [ "Direct OS command execution capability", "Network-based attack vector", "Affects internet-facing VPN infrastructure", "Active exploitation confirmed", "Administrative access leads to full device compromise" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately update to SonicWall SMA100 firmware version 10.2.1.9-58sv or later", "Restrict management interface access to specific trusted IP addresses or VLANs", "Monitor authentication logs for suspicious administrative logins", "Implement network segmentation to isolate VPN appliances", "Review and audit all administrative accounts and access patterns" ], "risk_assessment": { "exploit_likelihood": "Very High - Active exploitation confirmed via CISA KEV listing, and SonicWall VPN appliances are high-value targets for threat actors", "impact_assessment": "High - Successful exploitation provides OS-level command execution on critical network infrastructure, potentially allowing lateral movement, data theft, or complete network compromise", "exposure_scope": "Significant - SonicWall SMA100 series are widely deployed SSL-VPN solutions in enterprise environments, with most installations necessarily internet-facing" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:53:05.872145", "displayed_on_website": false }, { "cve_id": "CVE-2023-43000", "cvss_score": "8.8", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1189", "deployment_likelihood": "VERY_LOW", "cve_published_date": "2025-11-05T18:33:23.777Z", "cve_published_date_formatted": "2025-11-05", "kev_date_added": "2026-03-05", "kev_date_added_formatted": "2026-03-05", "kev_due_date": "2026-03-26", "days_to_kev": 120, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2023-43000 is a use-after-free vulnerability in WebKit that affects client-side applications (Safari, iOS/iPadOS browsers, macOS Safari). Despite evidence of active exploitation, this requires user interaction to visit malicious websites and does not qualify as direct internet exploitation of public-facing applications.", "detailed_analysis": { "vulnerability_type": "Use-after-free memory corruption vulnerability (CWE-416) in WebKit rendering engine", "affected_products": [ "Safari", "iOS/iPadOS", "macOS" ], "exploitation_requirements": [ "User must visit malicious website", "User interaction required", "Malicious web content processing" ], "internet_facing_likelihood": "The affected products (Safari browser, iOS/iPadOS, macOS) are CLIENT-SIDE applications, not server software. These are web browsers and operating systems that users run on their personal devices. They are NOT typically deployed as internet-facing servers or services that listen for incoming connections. Safari and mobile browsers are endpoint applications that make outbound connections to web servers.", "typical_deployment": "Client-side software: Safari is a web browser, iOS/iPadOS are mobile operating systems, and macOS is a desktop/laptop operating system. These are all END-USER devices and applications, not server infrastructure.", "deployment_statistics": "Less than 1% - The affected products are consumer/enterprise endpoint devices and browsers, not server applications. There are extremely rare edge cases where someone might run a macOS system as a server, but WebKit/Safari would not be the exposed service.", "active_exploitation": "Evidence of exploitation in the wild through the 'Coruna' iOS exploit kit used in targeted attacks, particularly watering hole attacks targeting Ukrainian users by suspected Russian espionage groups", "severity_factors": [ "High CVSS score of 8.8", "Active exploitation evidence", "However, requires user interaction", "Client-side only vulnerability", "No direct network exploitation possible" ] }, "recommendations": [ "Update Safari to version 16.6 or later immediately", "Update iOS/iPadOS to version 16.6 or later", "Update macOS to version 13.5 or later", "Educate users about avoiding suspicious websites and links", "Implement web filtering and security awareness training", "Monitor for indicators of compromise related to the Coruna exploit kit" ], "risk_assessment": { "exploit_likelihood": "LOW for direct internet exploitation - This is a client-side vulnerability requiring user interaction to visit malicious websites. It cannot be directly exploited against internet-facing servers or services.", "impact_assessment": "HIGH impact if successfully exploited (arbitrary code execution), but exploitation vector is social engineering/phishing rather than direct server attack", "exposure_scope": "Affects client devices and browsers, not internet-facing server infrastructure. Risk is through phishing/watering hole attacks rather than direct network exploitation." }, "exploitation_method": "USER_INTERACTION", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": true, "web_search_data": { "query_response": "CVE-2023-43000 is a **use-after-free vulnerability** in the **WebKit rendering engine**, which affects Apple's macOS, iOS, iPadOS, and Safari browsers 【1】 【8】 【2】.\n\nHere's a breakdown of what is known about its exploitation:\n\n- **Internet-facing applications or services:** The vulnerability is present in WebKit, which is used by Safari and other applications on Apple devices to render web content. This means **any application that uses WebKit for web rendering could be affected** 【1】.\n\n- **Evidence of active exploitation in the wild:** There is evidence that **CVE-2023-43000 has been exploited in the wild** 【3】 【16】. It was included in the \"Coruna\" iOS exploit kit, which was observed targeting iPhones 【3】 【10】 【4】 【9】.\n\n- **Attack vectors and exploitation methods:** The vulnerability can be triggered by **processing specially crafted web content** 【1】. Attackers can exploit this by luring users to a **malicious website** or injecting malicious content into a trusted site 【1】 【12】. Successful exploitation could lead to **arbitrary code execution** within the context of the affected application 【1】. The exploitability is described as \"easy,\" and the attack can be launched remotely without requiring authentication, but it does require user interaction from the victim 【2】.\n\n- **Use in targeted attacks:** CVE-2023-43000 has been used in **highly targeted operations** 【4】. It was observed as part of the Coruna exploit kit, which was deployed in watering hole attacks targeting Ukrainian users by a suspected Russian espionage group 【4】.\n\n- **CISA Known Exploited Vulnerabilities status:** As of the latest available information, **CVE-2023-43000 is not listed on the CISA Known Exploited Vulnerabilities (KEV) Catalog** 【5】 【11】 【13】. However, CISA regularly updates this catalog based on evidence of active exploitation 【6】 【14】 【15】 【17】.\n\n- **Technical details about internet exploitability:** The vulnerability is a **use-after-free flaw** 【1】 【7】 【8】 【2】. This occurs when memory is freed but still referenced by the application, leading to memory corruption 【1】. The specific technical details of the exploit are not widely disclosed, and an exploit is not publicly available 【2】. Apple addressed this vulnerability with improved memory management 【7】. It was patched by Apple in iOS 16.6 and iPadOS 16.6, released in July 2023 【3】.\n\nSources:\n- WebKit Use After Free in Apple Platforms (CVE-2023-43000): Brief...: https://zeropath.com/blog/webkit-cve-2023-43000-summary\n- CVE-2023-43000 Apple macOS/iOS and iPadOS/Safari Web Content...: https://vuldb.com/?id.331314\n- Coruna iOS Exploit Kit Uses 23 Exploits Across Five Chains Targeting ...: https://thehackernews.com/2026/03/coruna-ios-exploit-kit-uses-23-exploits.html\n- Coruna: The Mysterious Journey of a Powerful iOS Exploit Kit: https://cloud.google.com/blog/topics/threat-intelligence/coruna-powerful-ios-exploit-kit\n- Known Exploited Vulnerabilities Catalog - CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "references": [ { "title": "WebKit Use After Free in Apple Platforms (CVE-2023-43000): Brief...", "url": "https://zeropath.com/blog/webkit-cve-2023-43000-summary", "citation_contribution": 986, "snippet": "CVE-2023-43000 is a use after free vulnerability (CWE-416) in the WebKit rendering engine. The flaw occurs when memory is freed but still referenced by the application, which can lead to memory corruption. In this specific case, the vulnerability could be triggered by processing specially crafted web content. Attackers could exploit this by luring users to a malicious website or injecting malicious content into a trusted site. Successful exploitation could result in arbitrary code execution within the context of the affected application, such as Safari or any app using WebKit for rendering.", "is_search_result": true }, { "title": "CVE-2023-43000 Apple macOS/iOS and iPadOS/Safari Web Content...", "url": "https://vuldb.com/?id.331314", "citation_contribution": 283, "snippet": "This vulnerability is traded as CVE-2023-43000 since 09/14/2023. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Successful exploitation requires user interaction by the victim. The technical details are unknown and an exploit is not available. The structure of the vulnerability defines a possible price range of USD $25k-$100k at the moment (estimation calculated on 11/05/2025).", "is_search_result": true }, { "title": "Coruna iOS Exploit Kit Uses 23 Exploits Across Five Chains Targeting ...", "url": "https://thehackernews.com/2026/03/coruna-ios-exploit-kit-uses-23-exploits.html", "citation_contribution": 287, "snippet": "The exploit kit featured five full iOS exploit chains and a total of 23 exploits, Google Threat Intelligence Group (GTIG) said. It's not effective against the latest version of iOS.It's worth noting that CVE-2023-43000 was addressed by Apple in iOS 16.6 and iPadOS 16.6, released in July 2023. However, the security release notes were updated to include an entry for the vulnerability only on November 11, 2025. The third time the JavaScript framework was detected in the wild was in December 2025.", "is_search_result": true }, { "title": "Coruna: The Mysterious Journey of a Powerful iOS Exploit Kit", "url": "https://cloud.google.com/blog/topics/threat-intelligence/coruna-powerful-ios-exploit-kit", "citation_contribution": 256, "snippet": "Over the course of 2025, GTIG tracked its use in highly targeted operations initially conducted by a customer of a surveillance vendor, then observed its deployment in watering hole attacks targeting Ukrainian users by UNC6353, a suspected Russian espionage group.We collected WebKit RCEs, which included CVE-2024-23222, CVE-2022-48503, and CVE-2023-43000, before the server was shut down. We alerted and worked with CERT-UA to clean up all compromised websites. Full Exploit Chain Collection From Chinese Scam Websites.", "is_search_result": true }, { "title": "Known Exploited Vulnerabilities Catalog - CISA", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "citation_contribution": 184, "snippet": "For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild. Organizations should use the KEV catalog as an input to their vulnerability management prioritization framework. How to use the ...", "is_search_result": true } ], "timestamp": "2026-03-05T19:25:22.452915" }, "cache_timestamp": "2026-03-05T19:25:38.977068", "displayed_on_website": false }, { "cve_id": "CVE-2023-41974", "cvss_score": "7.8", "attack_vector": "LOCAL", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1068", "deployment_likelihood": "VERY_LOW", "cve_published_date": "2024-01-10T22:03:23.430Z", "cve_published_date_formatted": "2024-01-10", "kev_date_added": "2026-03-05", "kev_date_added_formatted": "2026-03-05", "kev_due_date": "2026-03-26", "days_to_kev": 785, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2023-41974 is a use-after-free vulnerability in iOS and iPadOS that allows malicious apps to execute arbitrary code with kernel privileges. While listed in CISA KEV and actively exploited, this affects mobile client devices, not internet-facing servers.", "detailed_analysis": { "vulnerability_type": "Use-after-free (CWE-416) allowing local privilege escalation from app to kernel level", "affected_products": [ "iOS", "iPadOS" ], "exploitation_requirements": [ "Malicious app installation", "User interaction to run the app", "Local access to device" ], "internet_facing_likelihood": "iOS and iPadOS are mobile client operating systems, not server software. These devices are not typically deployed as internet-facing servers. While they connect to the internet, they run client applications and do not expose server services that can be directly exploited over the network. Less than 0.1% of deployments would involve these devices acting as internet-accessible servers.", "typical_deployment": "Consumer and enterprise mobile devices (phones, tablets) used by end users for personal and business applications", "deployment_statistics": "Effectively 0% - iOS/iPadOS devices are client devices that do not run internet-facing server services in typical deployments", "active_exploitation": "Listed in CISA KEV catalog, referenced in Google's threat intelligence blog about the Corona iOS exploit kit, indicating active exploitation in targeted attacks", "severity_factors": [ "Kernel-level code execution", "Active exploitation documented", "Affects widely deployed mobile platforms", "Requires malicious app installation", "LOCAL attack vector limits internet exploitation" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review installed apps, check for unusual device behavior, verify iOS/iPadOS versions", "Immediately update to iOS 17+ or iOS 15.8.7+ depending on device compatibility", "Review and audit installed applications, remove suspicious or untrusted apps", "Implement mobile device management (MDM) policies to prevent unauthorized app installation", "Monitor for signs of device compromise such as unusual network activity or performance issues" ], "risk_assessment": { "exploit_likelihood": "Low for direct internet exploitation - requires malicious app installation and execution on the target device. High likelihood for targeted attacks involving app delivery via other means.", "impact_assessment": "Critical impact once exploited - full kernel-level access allows complete device compromise, data theft, surveillance, and persistence", "exposure_scope": "Millions of iOS/iPadOS devices, but not internet-facing server infrastructure. Risk is through malicious app distribution, not direct network exploitation" }, "exploitation_method": "USER_INTERACTION", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:35:01.054786", "displayed_on_website": false }, { "cve_id": "CVE-2023-39780", "cvss_score": "8.8", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2023-09-11T00:00:00.000Z", "cve_published_date_formatted": "2023-09-11", "kev_date_added": "2025-06-02", "kev_date_added_formatted": "2025-06-02", "kev_due_date": "2025-06-23", "days_to_kev": 630, "days_since_kev": null, "is_new_kev": false, "summary": "Critical OS command injection vulnerability in ASUS RT-AX55 router web management interface. Authenticated attackers can execute arbitrary commands via the qos_bw_rulelist parameter. Listed in CISA KEV with evidence of active exploitation.", "detailed_analysis": { "vulnerability_type": "OS Command Injection (CWE-78) in web management interface", "affected_products": [ "ASUS RT-AX55 Router" ], "exploitation_requirements": [ "Authentication to web interface", "Network access to management interface", "Access to /start_apply.htm endpoint" ], "internet_facing_likelihood": "Very high - ASUS RT-AX55 is a consumer/SMB WiFi router where the web management interface is commonly exposed to the internet for remote administration. Many users enable remote management for convenience, and default configurations often expose the admin interface.", "typical_deployment": "Network infrastructure device - WiFi router deployed at network perimeter with web management interface accessible remotely", "deployment_statistics": "Estimated 60-80% of deployments have internet-accessible management interfaces due to remote administration needs and default configurations that enable external access", "active_exploitation": "Listed in CISA KEV catalog indicating confirmed active exploitation in the wild. Referenced as part of stealthy backdoor campaigns targeting ASUS routers.", "severity_factors": [ "High CVSS score of 8.8", "Active exploitation confirmed", "Network device at security perimeter", "Command injection enables full system compromise", "Commonly internet-facing management interface" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately update ASUS RT-AX55 firmware to latest version addressing CVE-2023-39780", "Disable remote management interface or restrict access to trusted IP ranges only", "Monitor router logs for suspicious authentication attempts and unusual command execution", "Change default administrative credentials if not already done", "Consider network segmentation to isolate management interfaces" ], "risk_assessment": { "exploit_likelihood": "Very high - CISA KEV listing confirms active exploitation, authentication bypass possible through credential attacks, and many devices have exposed management interfaces", "impact_assessment": "Critical - OS command injection allows complete router compromise, network traffic interception, lateral movement, and potential botnet enrollment", "exposure_scope": "Thousands of ASUS RT-AX55 routers worldwide with internet-accessible management interfaces, particularly in SMB and home office environments" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:03:11.534758", "displayed_on_website": false }, { "cve_id": "CVE-2023-38950", "cvss_score": "7.5", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2023-08-03T00:00:00.000Z", "cve_published_date_formatted": "2023-08-03", "kev_date_added": "2025-05-19", "kev_date_added_formatted": "2025-05-19", "kev_due_date": "2025-06-09", "days_to_kev": 655, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2023-38950 is a path traversal vulnerability in ZKTeco BioTime's iclock API that allows unauthenticated attackers to read arbitrary files remotely. This is actively exploited in the wild and listed in CISA's KEV catalog.", "detailed_analysis": { "vulnerability_type": "Unauthenticated path traversal (directory traversal) vulnerability in API endpoint allowing arbitrary file read", "affected_products": [ "ZKTeco BioTime v8.5.5", "ZKBioTime (versions prior to 9.0.120240617.19506)" ], "exploitation_requirements": [ "Network access to the iclock API", "No authentication required", "Crafted payload with path traversal sequences" ], "internet_facing_likelihood": "ZKTeco BioTime is a workforce management and time attendance system that commonly requires internet access for remote employee check-ins, mobile app connectivity, and integration with HR systems. Many organizations deploy these systems with internet-facing interfaces to support remote workers and multiple office locations. Estimated 60-70% of deployments have some level of internet exposure.", "typical_deployment": "BioTime is deployed as a server application that manages biometric time attendance systems, employee databases, and workforce analytics. It typically runs on Windows/Linux servers with web interfaces and APIs for integration with other systems.", "deployment_statistics": "Approximately 60-70% of BioTime deployments are internet-facing due to business requirements for remote access, mobile applications, and multi-site deployments. Organizations often expose the web interface and APIs to support remote workers and integrate with cloud HR systems.", "active_exploitation": "Listed in CISA KEV catalog as of May 2025, indicating confirmed active exploitation in the wild. Exploit code is publicly available on Sploitus/PacketStorm.", "severity_factors": [ "No authentication required", "Direct file system access", "High confidentiality impact", "Network exploitable", "Publicly available exploits", "Active exploitation confirmed" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately upgrade to ZKBioTime version 9.0.120240617.19506 or later", "If immediate patching is not possible, restrict network access to the iclock API and implement WAF rules to block path traversal attempts", "Monitor for suspicious API requests containing '../' or encoded path traversal sequences in iclock API endpoints", "Review system logs for evidence of arbitrary file access attempts", "Implement network segmentation to limit exposure of BioTime systems" ], "risk_assessment": { "exploit_likelihood": "Very High - No authentication required, publicly available exploits, confirmed active exploitation, and straightforward attack vector", "impact_assessment": "High - Arbitrary file read can expose sensitive configuration files, database credentials, user data, and system information leading to further compromise", "exposure_scope": "Moderate to High - ZKTeco is a widely deployed time attendance solution globally, with significant internet-facing deployments in corporate environments" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:58:58.348543", "displayed_on_website": false }, { "cve_id": "CVE-2023-36424", "cvss_score": "7.8", "attack_vector": "LOCAL", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1068", "deployment_likelihood": "VERY_LOW", "cve_published_date": "2023-11-14T17:57:08.919Z", "cve_published_date_formatted": "2023-11-14", "kev_date_added": "2026-04-13", "kev_date_added_formatted": "2026-04-13", "kev_due_date": "2026-04-27", "days_to_kev": 881, "days_since_kev": null, "is_new_kev": false, "summary": "Windows Common Log File System Driver privilege escalation vulnerability affecting Windows client and server operating systems. Requires local access and authentication to exploit, making it unsuitable for direct internet exploitation despite being in CISA KEV.", "detailed_analysis": { "vulnerability_type": "Local privilege escalation in Windows Common Log File System (CLFS) driver via out-of-bounds read (CWE-125)", "affected_products": [ "Windows 10 (all versions 1507-22H2)", "Windows 11 (21H2, 22H2, 23H2)", "Windows Server 2008-2022 (all versions)", "Windows Server Core installations" ], "exploitation_requirements": [ "Local access to target system", "Valid user credentials (PR:L - Low privileges required)", "Ability to execute code locally", "No user interaction required once local access obtained" ], "internet_facing_likelihood": "While Windows Server versions are internet-facing, the CLFS driver vulnerability requires LOCAL attack vector (AV:L). This is an operating system kernel component, not an internet-facing service. The vulnerability cannot be exploited remotely over the network - it requires an attacker to already have local access to the system.", "typical_deployment": "Operating system component present on both client workstations and servers. The affected CLFS driver is a core Windows kernel component used for transaction logging, not a network service.", "deployment_statistics": "0% direct internet exposure - this is a local privilege escalation requiring authenticated local access. Even on internet-facing Windows servers, the CLFS driver itself is not exposed to network traffic.", "active_exploitation": "Listed in CISA KEV catalog indicating active exploitation in the wild, but as a privilege escalation component in attack chains requiring initial local access.", "severity_factors": [ "High CVSS score (7.8) due to complete system compromise potential", "Active exploitation confirmed by CISA KEV listing", "Affects wide range of Windows versions", "Requires local access, limiting attack surface", "Commonly used in post-exploitation for privilege escalation" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized local access, verify system integrity, and audit privileged account activities", "Apply Microsoft security updates immediately for all affected Windows systems", "Monitor for unusual privilege escalation attempts and suspicious local process execution", "Implement enhanced endpoint detection and response (EDR) monitoring for CLFS-related activities", "Review and strengthen local access controls and authentication mechanisms", "Priority: HIGH for patching due to CISA KEV status, but focus on systems where local access is more likely (workstations, terminal servers, systems with multiple users)" ], "risk_assessment": { "exploit_likelihood": "HIGH for privilege escalation once local access is obtained, but VERY LOW for direct internet exploitation due to local attack vector requirement", "impact_assessment": "Complete system compromise with high confidentiality, integrity, and availability impact once exploited locally", "exposure_scope": "No direct internet exposure - affects internal systems where attackers have gained initial local access through other means" }, "exploitation_method": "OTHER", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:39:24.917769", "displayed_on_website": false }, { "cve_id": "CVE-2023-34192", "cvss_score": "9.0", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1203", "deployment_likelihood": "HIGH", "cve_published_date": "2023-07-06T00:00:00.000Z", "cve_published_date_formatted": "2023-07-06", "kev_date_added": "2025-02-25", "kev_date_added_formatted": "2025-02-25", "kev_due_date": "2025-03-18", "days_to_kev": 600, "days_since_kev": null, "is_new_kev": false, "summary": "Cross-site scripting vulnerability in Zimbra Collaboration Suite 8.8.15 affecting the /h/autoSaveDraft function. Despite being in CISA KEV, this is an XSS vulnerability that compromises user sessions rather than the server itself, requiring authenticated user interaction for exploitation.", "detailed_analysis": { "vulnerability_type": "Cross-site Scripting (XSS) - Stored or Reflected", "affected_products": [ "Zimbra Collaboration Suite 8.8.15" ], "exploitation_requirements": [ "Remote authenticated attacker", "User interaction required", "Crafted script execution", "Access to /h/autoSaveDraft function" ], "internet_facing_likelihood": "While Zimbra email servers are very commonly internet-facing (80-90% of deployments), this XSS vulnerability does not compromise the server itself - it compromises user browser sessions through malicious scripts", "typical_deployment": "Zimbra is enterprise email/collaboration server software that is typically deployed as internet-facing to allow webmail access and email services for organizations", "deployment_statistics": "Approximately 80-90% of Zimbra deployments are internet-facing to provide webmail and collaboration services, but XSS attacks target user sessions, not server infrastructure", "active_exploitation": "Listed in CISA KEV catalog as of February 25, 2025, indicating active exploitation in the wild", "severity_factors": [ "High CVSS score of 9.0", "Active exploitation confirmed", "Changed scope in CVSS", "Requires authentication but still weaponizable", "XSS limits impact to user session compromise rather than server takeover" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately update Zimbra Collaboration Suite to version newer than 8.8.15", "Monitor web application logs for suspicious script injection attempts targeting /h/autoSaveDraft", "Implement Content Security Policy (CSP) headers to mitigate XSS attacks", "Review user account activity for signs of session compromise", "HIGH patch priority due to CISA KEV listing and active exploitation" ], "risk_assessment": { "exploit_likelihood": "XSS requires user interaction and only compromises user sessions, not direct server exploitation. Active exploitation confirmed but limited to client-side impact.", "impact_assessment": "User session compromise, potential credential theft, email/data access within compromised user context, but no direct server compromise", "exposure_scope": "Many internet-facing Zimbra servers globally, but exploitation impact limited to individual user sessions rather than server infrastructure" }, "exploitation_method": "USER_INTERACTION", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:34:53.441822", "displayed_on_website": false }, { "cve_id": "CVE-2023-33538", "cvss_score": "8.8", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2023-06-07T00:00:00.000Z", "cve_published_date_formatted": "2023-06-07", "kev_date_added": "2025-06-16", "kev_date_added_formatted": "2025-06-16", "kev_due_date": "2025-07-07", "days_to_kev": 740, "days_since_kev": null, "is_new_kev": false, "summary": "TP-Link routers contain a command injection vulnerability in the /userRpm/WlanNetworkRpm component that allows authenticated attackers to execute arbitrary commands. This vulnerability is actively exploited in the wild and affects commonly deployed home/small business routers that are inherently internet-facing.", "detailed_analysis": { "vulnerability_type": "Command injection vulnerability in router web interface", "affected_products": [ "TP-Link TL-WR940N V2/V4", "TP-Link TL-WR841N V8/V10", "TP-Link TL-WR740N V1/V2" ], "exploitation_requirements": [ "Network access to router web interface", "Low-level authentication (PR:L in CVSS)", "No user interaction required" ], "internet_facing_likelihood": "Very high - these are consumer/SOHO routers that are designed to be internet gateways. By their nature, they have management interfaces that are often exposed to the internet either through default configurations, port forwarding, or remote management features. Conservative estimate: 60-80% of deployments have some form of internet-accessible management interface.", "typical_deployment": "These are home and small office routers that serve as internet gateways. They are infrastructure devices that sit at the network perimeter and commonly have web-based management interfaces accessible from both LAN and WAN sides.", "deployment_statistics": "Estimated 60-80% of deployments are potentially internet-accessible due to: default remote management features, users enabling remote access for convenience, UPnP exposing management ports, or insecure configurations. These are consumer-grade devices often deployed without security hardening.", "active_exploitation": "CISA has added this CVE to the Known Exploited Vulnerabilities (KEV) catalog as of June 2025, indicating confirmed active exploitation in the wild.", "severity_factors": [ "Command injection leading to full device compromise", "Network attack vector with low complexity", "Only requires low-level authentication", "Affects widely deployed consumer routers", "Active exploitation confirmed by CISA KEV listing", "Complete confidentiality, integrity, and availability impact" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately update firmware to latest versions or replace affected devices if patches unavailable", "Disable remote management features and ensure admin interfaces are not accessible from internet", "Change default credentials and implement strong authentication", "Monitor network traffic for unusual command execution or configuration changes", "Consider replacing end-of-life devices that cannot be patched", "PATCH PRIORITY: CRITICAL - Active exploitation with full device compromise" ], "risk_assessment": { "exploit_likelihood": "Very high - CISA KEV listing confirms active exploitation, vulnerability is in commonly accessible router management interfaces, and technical complexity is low with proof-of-concept available", "impact_assessment": "Complete device compromise allowing attackers to: intercept network traffic, modify routing/DNS settings, use device as botnet node, pivot to internal networks, and establish persistent access to target networks", "exposure_scope": "Potentially hundreds of thousands of internet-facing TP-Link routers globally, particularly in home offices and small businesses with limited security controls" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:05:45.672104", "displayed_on_website": false }, { "cve_id": "CVE-2023-27351", "cvss_score": "8.2", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2023-04-20T00:00:00.000Z", "cve_published_date_formatted": "2023-04-20", "kev_date_added": "2026-04-20", "kev_date_added_formatted": "2026-04-20", "kev_due_date": "2026-05-04", "days_to_kev": 1096, "days_since_kev": null, "is_new_kev": false, "summary": "PaperCut NG contains an authentication bypass vulnerability that allows remote attackers to bypass authentication without any user interaction. This vulnerability is actively exploited in the wild and listed in CISA's Known Exploited Vulnerabilities catalog.", "detailed_analysis": { "vulnerability_type": "Authentication bypass in SecurityRequestFilter class due to improper implementation of authentication algorithm", "affected_products": [ "PaperCut NG" ], "exploitation_requirements": [ "Network access to PaperCut NG service", "No authentication required", "No user interaction required" ], "internet_facing_likelihood": "PaperCut NG is a print management server software commonly deployed in corporate environments. While primarily used for internal print management, many organizations expose the web interface to the internet to allow remote workers to manage print jobs, submit documents for printing, and access printing services. The software's web-based management interface and user portal functionality make internet exposure relatively common in hybrid work environments. Estimated 30-40% of deployments have some level of internet accessibility.", "typical_deployment": "PaperCut NG is server software that provides print management, monitoring, and billing services through a web-based interface. It typically runs on Windows or Linux servers and provides both administrative interfaces and user portals for print job management.", "deployment_statistics": "Approximately 30-40% of PaperCut NG deployments are likely internet-facing, particularly in organizations supporting remote work where users need to submit print jobs or manage printing services from external locations. Many organizations expose the user portal functionality to enable remote printing capabilities.", "active_exploitation": "This vulnerability is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating confirmed active exploitation in the wild. The SSVC data shows 'Exploitation: active' status.", "severity_factors": [ "No authentication required", "Network-based attack vector", "Active exploitation confirmed", "High confidentiality impact", "Server-side vulnerability", "Print management systems often contain sensitive corporate documents" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately upgrade PaperCut NG to version 22.0.9 or later which addresses this vulnerability", "Review PaperCut NG access logs for suspicious authentication patterns or unauthorized access attempts", "Consider temporarily restricting internet access to PaperCut NG servers until patching is complete", "Implement network segmentation to limit exposure of PaperCut NG services", "Monitor for unusual print job submissions or administrative actions that may indicate compromise" ], "risk_assessment": { "exploit_likelihood": "Very high - this is a simple authentication bypass with no prerequisites, affecting widely-deployed print management software, with confirmed active exploitation", "impact_assessment": "High - successful exploitation allows unauthorized access to print management systems which may contain sensitive corporate documents, user information, and provide potential pivot points into internal networks", "exposure_scope": "Moderate to high - PaperCut NG is widely used in corporate environments, with an estimated thousands of internet-facing instances globally, particularly in organizations supporting remote work" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Known", "ransomware_first_seen_date": "2026-06-04", "ransomware_days_after_kev": 45, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:41:13.198395", "displayed_on_website": false }, { "cve_id": "CVE-2023-2533", "cvss_score": "8.4", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1204", "deployment_likelihood": "HIGH", "cve_published_date": "2023-06-20T14:45:14.102Z", "cve_published_date_formatted": "2023-06-20", "kev_date_added": "2025-07-28", "kev_date_added_formatted": "2025-07-28", "kev_due_date": "2025-08-18", "days_to_kev": 769, "days_since_kev": null, "is_new_kev": false, "summary": "CSRF vulnerability in PaperCut NG/MF that requires an admin to click a malicious link while logged in. Despite the high CVSS score and CISA KEV listing, this is not direct server exploitation but requires social engineering to trick administrators.", "detailed_analysis": { "vulnerability_type": "Cross-Site Request Forgery (CSRF) leading to potential remote code execution", "affected_products": [ "PaperCut NG/MF" ], "exploitation_requirements": [ "Admin user must be logged into PaperCut interface", "Admin must click specially crafted malicious link", "Social engineering component required", "Network access to PaperCut web interface" ], "internet_facing_likelihood": "PaperCut NG/MF is print management software that includes a web-based administration interface. Many organizations deploy this with internet-accessible admin interfaces for remote management, especially in distributed environments. Estimated 40-60% of deployments may have internet-facing admin interfaces.", "typical_deployment": "PaperCut NG/MF is server software that manages print queues, user authentication, and billing for printers. It includes a web-based administrative interface that administrators use to configure the system. The software is typically deployed on internal networks but admin interfaces are often exposed to the internet for remote management.", "deployment_statistics": "Approximately 40-60% of PaperCut deployments may have internet-accessible admin interfaces, as organizations often need remote access to print management systems across multiple locations", "active_exploitation": "Listed in CISA KEV catalog indicating active exploitation in the wild, likely through targeted phishing campaigns against PaperCut administrators", "severity_factors": [ "Requires social engineering - not direct exploitation", "High privileges required (admin session)", "Can lead to RCE if successfully exploited", "CISA KEV listing indicates active threat actor interest", "User interaction required reduces immediate risk" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately upgrade PaperCut NG/MF to version 22.1.1 or later", "Implement network segmentation to limit admin interface exposure", "Train administrators on phishing awareness and suspicious link identification", "Monitor for unauthorized configuration changes and new user accounts", "Consider implementing additional CSRF protections and multi-factor authentication", "Patch priority: HIGH due to CISA KEV listing and RCE potential" ], "risk_assessment": { "exploit_likelihood": "Medium - requires social engineering to trick administrators, but CISA KEV listing indicates active targeting", "impact_assessment": "High - successful exploitation can lead to remote code execution and full system compromise", "exposure_scope": "Moderate - estimated thousands of internet-facing PaperCut instances globally, but exploitation requires targeted phishing rather than automated scanning" }, "exploitation_method": "USER_INTERACTION", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:09:03.648642", "displayed_on_website": false }, { "cve_id": "CVE-2023-21529", "cvss_score": "8.8", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2023-02-14T19:33:00.590Z", "cve_published_date_formatted": "2023-02-14", "kev_date_added": "2026-04-13", "kev_date_added_formatted": "2026-04-13", "kev_due_date": "2026-04-27", "days_to_kev": 1154, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2023-21529 is a remote code execution vulnerability in Microsoft Exchange Server caused by deserialization of untrusted data (CWE-502). This vulnerability allows authenticated attackers to execute arbitrary code on Exchange servers, which are commonly internet-facing for email services.", "detailed_analysis": { "vulnerability_type": "Remote Code Execution via Deserialization of Untrusted Data (CWE-502)", "affected_products": [ "Exchange Server 2019", "Exchange Server 2016", "Exchange Server 2013" ], "exploitation_requirements": [ "Low privileged authentication (PR:L)", "Network access to Exchange server", "No user interaction required" ], "internet_facing_likelihood": "Exchange servers are predominantly internet-facing as they provide email services (OWA, ActiveSync, EWS, MAPI-over-HTTP) that require external connectivity. Estimated 80-90% of Exchange deployments are internet-accessible to support remote email access and mobile device synchronization.", "typical_deployment": "Exchange Server is enterprise email server software that typically runs as an internet-facing service to provide email access via webmail (OWA), mobile device connectivity, and email client protocols", "deployment_statistics": "Approximately 80-90% of Exchange Server deployments are internet-facing to support remote email access, with most organizations exposing OWA and ActiveSync endpoints for employee access", "active_exploitation": "Listed in CISA KEV catalog indicating active exploitation by threat actors in the wild. Microsoft security blog references Storm-1175 threat group targeting vulnerable web-facing assets including this CVE", "severity_factors": [ "Remote code execution capability", "Network attack vector", "Low authentication requirement", "No user interaction needed", "High impact on confidentiality, integrity, and availability", "Active exploitation in wild" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Apply Microsoft security updates immediately for affected Exchange Server versions", "Monitor Exchange server logs for suspicious authentication attempts and unusual process execution", "Consider temporarily restricting external access to Exchange services until patching is complete", "Implement network segmentation to limit potential lateral movement if compromise occurs" ], "risk_assessment": { "exploit_likelihood": "Very High - Active exploitation confirmed by CISA KEV listing and threat intelligence reports", "impact_assessment": "Critical - Full server compromise possible with high impact on confidentiality, integrity, and availability of email services and potentially entire network", "exposure_scope": "Significant - Exchange servers are widely deployed in enterprise environments and commonly internet-facing, creating large attack surface" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Known", "ransomware_first_seen_date": "2026-06-04", "ransomware_days_after_kev": 52, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:39:00.764015", "displayed_on_website": false }, { "cve_id": "CVE-2023-20118", "cvss_score": "6.5", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2023-04-05T16:05:41.067Z", "cve_published_date_formatted": "2023-04-05", "kev_date_added": "2025-03-03", "kev_date_added_formatted": "2025-03-03", "kev_due_date": "2025-03-24", "days_to_kev": 698, "days_since_kev": null, "is_new_kev": false, "summary": "Command injection vulnerability in Cisco Small Business Router web management interface allows authenticated remote attackers to execute arbitrary commands with root privileges. Proof-of-concept exploits exist and active exploitation has been observed in the wild since March 2025.", "detailed_analysis": { "vulnerability_type": "Command injection (CWE-77) in web-based management interface due to improper validation of user input in HTTP packets", "affected_products": [ "Cisco Small Business RV Series Routers (RV016, RV042, RV042G, RV082, RV320, RV325)" ], "exploitation_requirements": [ "Valid administrative credentials required", "Network access to web management interface", "Crafted HTTP request to web interface" ], "internet_facing_likelihood": "Small business routers commonly have their management interfaces exposed to the internet for remote administration. While best practices recommend against this, many small businesses lack dedicated IT staff and rely on remote management capabilities. Estimated 40-60% of deployments may have internet-accessible management interfaces.", "typical_deployment": "Network infrastructure devices (routers) that serve as internet gateways for small businesses. The web management interface is typically accessible via LAN but often exposed to WAN for remote administration.", "deployment_statistics": "Approximately 50% of small business router deployments likely have management interfaces accessible from the internet due to remote administration needs and lack of proper security configuration", "active_exploitation": "CISA notes that in March 2025, they became aware of attempted exploitation of these vulnerabilities in the wild. Proof-of-concept exploit code is publicly available.", "severity_factors": [ "Root-level command execution", "Network-based attack vector", "Active exploitation in the wild", "Proof-of-concept exploits available", "No software patches available (end-of-life products)", "Requires authentication (reduces likelihood but not impact)" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "IMMEDIATE: Disable web-based management interface if not required, or restrict access to trusted IP addresses only", "Migrate to supported hardware (Cisco recommends upgrading to Meraki or Cisco 1000 Series routers) as no patches will be released", "Monitor for suspicious administrative activities and unauthorized configuration changes", "Implement network segmentation to isolate management interfaces from internet access", "Change default administrative credentials and implement strong authentication" ], "risk_assessment": { "exploit_likelihood": "HIGH - Active exploitation observed, public exploits available, and many deployments likely have exposed management interfaces", "impact_assessment": "CRITICAL - Root-level command execution allows complete device compromise, network pivoting, and potential data interception", "exposure_scope": "Moderate to high - Cisco Small Business routers are widely deployed in SMB environments, with significant percentage having internet-exposed management interfaces" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:37:02.386888", "displayed_on_website": false }, { "cve_id": "CVE-2023-0386", "cvss_score": "7.8", "attack_vector": "LOCAL", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1068", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2023-03-22T00:00:00.000Z", "cve_published_date_formatted": "2023-03-22", "kev_date_added": "2025-06-17", "kev_date_added_formatted": "2025-06-17", "kev_due_date": "2025-07-08", "days_to_kev": 818, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2023-0386 is a local privilege escalation vulnerability in the Linux kernel's OverlayFS subsystem that allows a local user to escalate privileges by exploiting a uid mapping bug when copying capable files between mounts. This requires local access and cannot be exploited directly over the internet, making it a post-compromise escalation tool rather than an initial attack vector.", "detailed_analysis": { "vulnerability_type": "Local privilege escalation in Linux kernel OverlayFS subsystem - uid mapping bug in file capability handling", "affected_products": [ "Linux Kernel", "Debian Linux", "Ubuntu", "Red Hat Enterprise Linux", "CentOS", "SUSE Linux", "Oracle Linux" ], "exploitation_requirements": [ "Local user access to system", "Access to mount points", "Ability to copy files between mounts", "OverlayFS functionality enabled" ], "internet_facing_likelihood": "While Linux systems are commonly internet-facing as servers, this vulnerability requires local access to exploit. The kernel itself is not directly exposed to network attacks - this vulnerability can only be exploited by users who already have local access to the system.", "typical_deployment": "Linux kernel is infrastructure software that runs on servers, workstations, containers, and IoT devices. While many Linux systems are internet-facing servers, the kernel itself is not a network service that accepts direct connections.", "deployment_statistics": "Nearly 100% of Linux deployments are affected, but 0% are directly exploitable over the internet since this requires local access. This is a privilege escalation vulnerability, not a remote code execution vulnerability.", "active_exploitation": "Listed in CISA KEV catalog, indicating active exploitation in the wild. Likely used by attackers who have already gained initial access to escalate privileges.", "severity_factors": [ "High CVSS score of 7.8", "Active exploitation confirmed by CISA KEV listing", "Affects widely deployed Linux kernel", "No authentication required once local access is obtained", "Requires local access limiting initial attack surface" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs for unusual privilege escalation activities, check for unauthorized root access, verify system integrity", "URGENT: Update Linux kernel to patched versions (6.2-rc6 and later have fixes)", "Monitor for unusual file operations involving OverlayFS mounts and capability changes", "Review user access logs for signs of privilege escalation attempts", "Consider disabling OverlayFS if not required for operations", "Implement additional monitoring for setuid file operations and capability changes" ], "risk_assessment": { "exploit_likelihood": "Very high for systems where attackers have already gained local access. Zero for direct internet exploitation as this requires local user access to the system.", "impact_assessment": "Complete system compromise once exploited - allows local user to gain root privileges with full system control", "exposure_scope": "All unpatched Linux systems are vulnerable, but only exploitable by users with existing local access. Not directly exploitable from the internet." }, "exploitation_method": "OTHER", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:06:07.718187", "displayed_on_website": false }, { "cve_id": "CVE-2022-48503", "cvss_score": "8.8", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1203", "deployment_likelihood": "VERY_LOW", "cve_published_date": "2023-08-14T22:40:49.354Z", "cve_published_date_formatted": "2023-08-14", "kev_date_added": "2025-10-20", "kev_date_added_formatted": "2025-10-20", "kev_due_date": "2025-11-10", "days_to_kev": 798, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2022-48503 is a WebKit bounds check vulnerability affecting Apple's client-side products (Safari, iOS, macOS, etc.) that allows arbitrary code execution when processing malicious web content. While listed in CISA KEV indicating active exploitation, this is a client-side vulnerability requiring user interaction rather than a server-side exploit.", "detailed_analysis": { "vulnerability_type": "WebKit bounds check vulnerability allowing arbitrary code execution through malicious web content processing", "affected_products": [ "Safari", "iOS/iPadOS", "macOS", "tvOS", "watchOS" ], "exploitation_requirements": [ "User must visit malicious website", "User interaction required", "Malicious web content processing" ], "internet_facing_likelihood": "The affected products are primarily client-side applications and operating systems, not internet-facing servers. Safari is a web browser, iOS/iPadOS are mobile operating systems, macOS is a desktop OS, tvOS is for Apple TV devices, and watchOS is for Apple Watches. None of these are typically deployed as internet-facing server applications.", "typical_deployment": "Client-side applications and consumer operating systems running on end-user devices (laptops, phones, tablets, TVs, watches)", "deployment_statistics": "Less than 1% of deployments would be internet-facing. These are primarily consumer and enterprise client devices, not server infrastructure", "active_exploitation": "Listed in CISA KEV catalog indicating active exploitation in the wild, likely through malicious websites targeting users", "severity_factors": [ "High CVSS score of 8.8", "Arbitrary code execution possible", "No authentication required", "But requires user interaction", "Client-side vulnerability limits server compromise potential" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Update Safari to version 15.6 or later immediately", "Update iOS/iPadOS to version 15.6 or later", "Update macOS to Monterey 12.5 or later", "Update tvOS to version 15.6 or later", "Update watchOS to version 8.7 or later", "Implement web filtering to block known malicious domains", "Train users on safe browsing practices", "HIGH patch priority for client systems" ], "risk_assessment": { "exploit_likelihood": "High likelihood for client-side exploitation through malicious websites, but very low likelihood for direct internet server compromise as these are not server applications", "impact_assessment": "High impact on individual client devices with potential for arbitrary code execution, but limited to client-side compromise rather than server infrastructure", "exposure_scope": "Millions of client devices potentially affected, but minimal internet-facing server exposure since these are consumer/client products" }, "exploitation_method": "USER_INTERACTION", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:20:05.391147", "displayed_on_website": false }, { "cve_id": "CVE-2022-43939", "cvss_score": "8.6", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2023-04-03T18:10:32.141Z", "cve_published_date_formatted": "2023-04-03", "kev_date_added": "2025-03-03", "kev_date_added_formatted": "2025-03-03", "kev_due_date": "2025-03-24", "days_to_kev": 700, "days_since_kev": null, "is_new_kev": false, "summary": "Authentication bypass vulnerability in Pentaho Business Analytics Server allows attackers to circumvent security restrictions using non-canonical URLs. The vulnerability leads to SSTI (Server-Side Template Injection) and code execution according to exploit references.", "detailed_analysis": { "vulnerability_type": "Authentication bypass via non-canonical URL path manipulation (CWE-647) leading to Server-Side Template Injection and remote code execution", "affected_products": [ "Pentaho Business Analytics Server" ], "exploitation_requirements": [ "Network access to server", "No authentication required", "No user interaction needed" ], "internet_facing_likelihood": "Pentaho Business Analytics Server is specifically designed as a web-based business intelligence platform that organizations commonly deploy as internet-facing applications to provide dashboard and reporting access to users, partners, and customers. These servers typically run on standard web ports and are intended for broad user access.", "typical_deployment": "Web-based server application providing business analytics dashboards, reports, and data visualization. Commonly deployed as internet-facing services in enterprise environments.", "deployment_statistics": "Estimated 70-80% of Pentaho deployments are internet-facing as the primary use case is providing web-based analytics access to distributed users and stakeholders across organizations", "active_exploitation": "Listed in CISA KEV catalog indicating confirmed active exploitation in the wild. PacketStorm reference shows proof-of-concept for authentication bypass leading to SSTI and code execution.", "severity_factors": [ "No authentication required", "Network accessible", "Leads to remote code execution", "Active exploitation confirmed", "High CVSS score of 8.6", "Internet-facing deployment common" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately update to Pentaho Business Analytics Server version 9.4.0.1 or 9.3.0.2 or later", "Review web server access logs for suspicious URL patterns or non-canonical path attempts", "Implement network segmentation to limit exposure if not already done", "Monitor for unexpected code execution or template injection attempts", "Verify no unauthorized accounts or backdoors have been created" ], "risk_assessment": { "exploit_likelihood": "Very High - CISA KEV listing confirms active exploitation, CVSS shows no authentication required with network attack vector, and public exploits demonstrate authentication bypass leading to RCE", "impact_assessment": "High - Authentication bypass leading to potential remote code execution on business analytics servers containing sensitive organizational data", "exposure_scope": "Significant - Pentaho servers are commonly internet-facing for business intelligence access, potentially exposing thousands of vulnerable instances globally" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:36:40.123307", "displayed_on_website": false }, { "cve_id": "CVE-2022-43769", "cvss_score": "8.8", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2023-04-03T17:47:45.737Z", "cve_published_date_formatted": "2023-04-03", "kev_date_added": "2025-03-03", "kev_date_added_formatted": "2025-03-03", "kev_due_date": "2025-03-24", "days_to_kev": 700, "days_since_kev": null, "is_new_kev": false, "summary": "Hitachi Vantara Pentaho Business Analytics Server contains a Spring Template injection vulnerability allowing authenticated attackers to execute arbitrary code. This affects web services that improperly sanitize user input containing Spring templates, leading to server-side template injection (SSTI).", "detailed_analysis": { "vulnerability_type": "Server-Side Template Injection (SSTI) in Spring templates via improper input sanitization", "affected_products": [ "Pentaho Business Analytics Server" ], "exploitation_requirements": [ "Low-privilege authentication required", "Network access to web services", "Access to vulnerable web service endpoints" ], "internet_facing_likelihood": "Pentaho Business Analytics Server is enterprise business intelligence software designed to provide analytics dashboards and reports to business users. While it can be deployed internally, many organizations expose analytics platforms to the internet or through VPNs for remote access by employees, partners, and customers. Estimated 60-70% of deployments have some form of internet accessibility.", "typical_deployment": "Server application - Pentaho BA Server is web-based business intelligence software that runs as a server application, typically deployed on application servers with web interfaces for user access", "deployment_statistics": "Approximately 60-70% of Pentaho deployments are internet-accessible either directly or through corporate portals/VPNs, as business analytics platforms need to serve remote users, mobile workers, and external stakeholders", "active_exploitation": "Listed in CISA KEV catalog as of March 2025, indicating confirmed active exploitation in the wild. PacketStorm reference shows authentication bypass and code execution exploit available.", "severity_factors": [ "High CVSS score of 8.8", "Active exploitation confirmed by CISA KEV listing", "Code execution possible", "Authentication bypass possible", "Network attack vector", "No user interaction required" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately update to Pentaho Business Analytics Server version 9.4.0.1 or 9.3.0.2 or later", "Review web server logs for suspicious template injection attempts or unusual property setting requests", "Implement network segmentation to limit access to Pentaho servers", "Monitor for unauthorized code execution or file modifications", "Patch priority: CRITICAL - immediate patching required due to active exploitation" ], "risk_assessment": { "exploit_likelihood": "Very High - CISA KEV listing confirms active exploitation, low complexity attack with readily available exploit code", "impact_assessment": "High - Complete server compromise possible with confidentiality, integrity, and availability impacts. Potential for lateral movement and data theft", "exposure_scope": "Medium to High - Pentaho is used by enterprise organizations, with many deployments potentially internet-accessible for business users" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:36:18.870398", "displayed_on_website": false }, { "cve_id": "CVE-2022-40799", "cvss_score": "8.8", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2022-11-29T00:00:00.000Z", "cve_published_date_formatted": "2022-11-29", "kev_date_added": "2025-08-05", "kev_date_added_formatted": "2025-08-05", "kev_due_date": "2025-08-26", "days_to_kev": 980, "days_since_kev": null, "is_new_kev": false, "summary": "Critical command injection vulnerability in D-Link DNR-322L Cloud Network Video Recorder allowing authenticated attackers to execute OS-level commands via the 'Backup Config' functionality. This network device is commonly internet-facing for remote monitoring purposes and is actively exploited according to CISA KEV.", "detailed_analysis": { "vulnerability_type": "OS Command Injection via Data Integrity Failure in Backup Configuration", "affected_products": [ "D-Link DNR-322L Network Video Recorder" ], "exploitation_requirements": [ "Low-privilege authentication", "Network access to web interface", "Access to Backup Config functionality" ], "internet_facing_likelihood": "Network Video Recorders are commonly deployed as internet-facing services to enable remote monitoring, cloud connectivity, and mobile app access. Estimated 60-70% of deployments are internet-accessible for business functionality.", "typical_deployment": "Network appliance/server designed for video surveillance with web management interface, typically deployed with internet connectivity for remote access", "deployment_statistics": "Approximately 60-70% internet-facing as the device is marketed as a 'Cloud Network Video Recorder' requiring internet connectivity for primary functionality including remote monitoring and mobile access", "active_exploitation": "Listed in CISA Known Exploited Vulnerabilities (KEV) catalog as of August 2025, indicating confirmed active exploitation in the wild", "severity_factors": [ "High CVSS score of 8.8", "OS command execution capability", "Network-accessible attack vector", "Low authentication requirement", "Active exploitation confirmed", "IoT device with typically weak security practices" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately update D-Link DNR-322L firmware to version newer than 2.60B15 if available, or isolate devices from internet if no patch exists", "Implement network segmentation to restrict internet access to video surveillance infrastructure", "Monitor authentication logs and backup configuration access for suspicious activity", "Consider replacing end-of-life D-Link devices with supported alternatives" ], "risk_assessment": { "exploit_likelihood": "Very high - active exploitation confirmed via CISA KEV listing, requires only low-privilege authentication, and affects commonly internet-facing network appliances", "impact_assessment": "Complete system compromise with OS-level command execution leading to potential data theft, lateral movement, and device takeover for botnet participation", "exposure_scope": "Moderate - affects specific D-Link model but many deployments are internet-accessible due to cloud/remote monitoring requirements" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:10:08.397114", "displayed_on_website": false }, { "cve_id": "CVE-2022-37055", "cvss_score": "9.8", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2022-08-28T16:05:21.000Z", "cve_published_date_formatted": "2022-08-28", "kev_date_added": "2025-12-08", "kev_date_added_formatted": "2025-12-08", "kev_due_date": "2025-12-29", "days_to_kev": 1198, "days_since_kev": null, "is_new_kev": false, "summary": "Critical buffer overflow vulnerability in D-Link GO-RT-AC750 wireless routers affecting cgibin and hnap_main components. This vulnerability is actively exploited in the wild and listed in CISA KEV, allowing unauthenticated remote code execution.", "detailed_analysis": { "vulnerability_type": "Classic Buffer Overflow (CWE-120) in web interface CGI components", "affected_products": [ "D-Link GO-RT-AC750 Wireless Router" ], "exploitation_requirements": [ "Network access to router's web interface", "No authentication required", "No user interaction needed" ], "internet_facing_likelihood": "Wireless routers are nearly universally internet-facing by design. They serve as the primary gateway between internal networks and the internet, with web management interfaces accessible from both LAN and often WAN sides. Estimated 95%+ of deployments are internet-accessible.", "typical_deployment": "Home and small business wireless routers that provide internet connectivity and network services. These devices sit at network perimeters with direct internet exposure.", "deployment_statistics": "95%+ of wireless router deployments are internet-facing as they function as gateways. Many have management interfaces accessible from WAN side either by default or user configuration.", "active_exploitation": "CISA has added this CVE to the Known Exploited Vulnerabilities catalog indicating confirmed active exploitation in the wild. SSVC assessment shows 'active' exploitation status.", "severity_factors": [ "Critical CVSS score of 9.8", "No authentication required", "Network attack vector", "Active exploitation confirmed", "Router devices typically unpatched", "Direct internet exposure" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately update firmware to latest version from D-Link security bulletins", "If patches unavailable, disable remote management access from WAN/internet", "Implement network segmentation to limit router compromise impact", "Monitor network traffic for unusual outbound connections", "Replace with supported router models if patches are not available", "HIGH PRIORITY patching - active exploitation makes this extremely urgent" ], "risk_assessment": { "exploit_likelihood": "Very High - CVSS 9.8 with network vector, no authentication required, and confirmed active exploitation. Buffer overflows in router CGI are commonly exploited.", "impact_assessment": "Complete device compromise allowing attackers to control network traffic, intercept communications, pivot to internal networks, and establish persistent access points.", "exposure_scope": "All D-Link GO-RT-AC750 routers with vulnerable firmware versions that are internet-accessible, which represents the vast majority of deployments for this consumer router model." }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:23:42.547151", "displayed_on_website": false }, { "cve_id": "CVE-2022-23748", "cvss_score": "7.8", "attack_vector": "LOCAL", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1204", "deployment_likelihood": "LOW", "cve_published_date": "2022-11-17T00:00:00.000Z", "cve_published_date_formatted": "2022-11-17", "kev_date_added": "2025-02-06", "kev_date_added_formatted": "2025-02-06", "kev_due_date": "2025-02-27", "days_to_kev": 812, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2022-23748 is a DLL sideloading vulnerability in mDNSResponder.exe from Audinate Dante Application Library. Despite being listed in CISA KEV, this is a local attack requiring user interaction to execute the malicious DLL alongside the legitimate executable.", "detailed_analysis": { "vulnerability_type": "DLL Sideloading (CWE-114: Process Control)", "affected_products": [ "Audinate Dante Application Library for Windows (versions prior to and including 1.2.0)" ], "exploitation_requirements": [ "Local file system access", "User execution of mDNSResponder.exe", "Ability to place malicious DLL in accessible location" ], "internet_facing_likelihood": "Very low - Dante Application Library is audio networking software primarily used in local network environments for professional audio applications. The mDNSResponder.exe component handles local network discovery and is not designed to be internet-facing. Typical deployments are in closed audio production networks.", "typical_deployment": "Client/application software - The Dante Application Library is used by audio production software and hardware for networked audio applications. It runs as a client component on workstations and audio equipment, not as an internet-facing server.", "deployment_statistics": "Less than 5% of deployments would be internet-accessible. This is specialized audio networking software used in professional audio environments, recording studios, and live sound applications where internet exposure would be against security best practices.", "active_exploitation": "Listed in CISA KEV indicating active exploitation, but exploitation likely occurs through phishing, malware delivery, or insider threats rather than direct internet attack.", "severity_factors": [ "CVSS 7.8 HIGH severity", "Listed in CISA KEV", "Requires local access and user interaction", "Attack vector is LOCAL not NETWORK", "Specialized software with limited deployment scope" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Update Audinate Dante Application Library to version 1.2.1 or later immediately", "Implement application whitelisting to prevent unauthorized DLL loading", "Monitor for suspicious DLL files in application directories", "Educate users about phishing and malware risks that could lead to local exploitation" ], "risk_assessment": { "exploit_likelihood": "Medium for targeted environments - requires social engineering or existing system access to place malicious DLLs", "impact_assessment": "High impact if exploited - complete system compromise with HIGH confidentiality, integrity, and availability impact", "exposure_scope": "Limited - affects specialized audio networking software not commonly internet-exposed" }, "exploitation_method": "USER_INTERACTION", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:28:46.748559", "displayed_on_website": false }, { "cve_id": "CVE-2022-20775", "cvss_score": "7.8", "attack_vector": "LOCAL", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1068", "deployment_likelihood": "HIGH", "cve_published_date": "2022-09-30T18:45:26.687Z", "cve_published_date_formatted": "2022-09-30", "kev_date_added": "2026-02-25", "kev_date_added_formatted": "2026-02-25", "kev_due_date": "2026-02-27", "days_to_kev": 1244, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2022-20775 is a local privilege escalation vulnerability in Cisco SD-WAN Software CLI that allows authenticated, local attackers to execute commands as root. While the affected products are commonly internet-facing, the vulnerability itself requires existing local access and cannot be directly exploited over the internet.", "detailed_analysis": { "vulnerability_type": "Local privilege escalation through improper CLI access controls, allowing execution of malicious commands to gain root privileges", "affected_products": [ "Cisco Catalyst SD-WAN", "Cisco Catalyst SD-WAN Manager", "Cisco SD-WAN vContainer", "Cisco SD-WAN vEdge Cloud", "Cisco SD-WAN vEdge Router" ], "exploitation_requirements": [ "Authenticated local access required", "Low-privilege user account on the system", "Access to application CLI interface", "No user interaction needed once local access obtained" ], "internet_facing_likelihood": "While Cisco SD-WAN products are commonly deployed as internet-facing network infrastructure for WAN connectivity and management, this specific vulnerability requires local CLI access and cannot be directly exploited over the internet. The products themselves may be internet-accessible for management purposes.", "typical_deployment": "Cisco SD-WAN products are typically deployed as network infrastructure components providing WAN connectivity, routing, and centralized management. SD-WAN Manager often provides web-based management interfaces that may be internet-accessible.", "deployment_statistics": "Estimated 70-80% of SD-WAN deployments have some internet-facing management components, but this vulnerability specifically affects the local CLI and requires prior system access", "active_exploitation": "Cisco PSIRT confirmed attempted exploitation of this vulnerability in February 2026, leading to its inclusion in CISA's KEV catalog", "severity_factors": [ "HIGH: Active exploitation confirmed by vendor", "HIGH: Complete system compromise possible (root access)", "MEDIUM: Requires existing local access", "HIGH: No workarounds available", "HIGH: Affects critical network infrastructure" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs for suspicious CLI commands, check for unauthorized privilege escalation, verify system integrity and user accounts", "Immediately update to fixed software releases as provided by Cisco - no workarounds are available", "Monitor CLI access logs for suspicious command execution patterns", "Review and audit local user accounts and access permissions", "Implement principle of least privilege for local system access", "HIGH priority patching due to confirmed active exploitation" ], "risk_assessment": { "exploit_likelihood": "Medium for direct internet exploitation (requires local access first), but HIGH for post-compromise privilege escalation given confirmed active exploitation", "impact_assessment": "Critical - successful exploitation provides complete system compromise with root-level access to SD-WAN infrastructure", "exposure_scope": "Limited direct internet exposure due to local access requirement, but significant impact on organizations with compromised SD-WAN systems" }, "exploitation_method": "OTHER", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:33:08.356355", "displayed_on_website": false }, { "cve_id": "CVE-2022-0492", "cvss_score": "7.8", "attack_vector": "LOCAL", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1068", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2022-03-03T00:00:00.000Z", "cve_published_date_formatted": "2022-03-03", "kev_date_added": "2026-06-02", "kev_date_added_formatted": "2026-06-02", "kev_due_date": "2026-06-05", "days_to_kev": 1552, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2022-0492 is a Linux kernel privilege escalation vulnerability in the cgroups v1 release_agent feature that allows bypassing namespace isolation. This is a local exploit requiring existing access to a system or container, commonly used for Docker container escapes.", "detailed_analysis": { "vulnerability_type": "Privilege escalation through cgroups v1 release_agent feature abuse in Linux kernel", "affected_products": [ "Linux Kernel", "Docker containers", "Kubernetes clusters", "Container platforms", "Linux servers", "Cloud instances" ], "exploitation_requirements": [ "Local access to system", "Access to container with privileged capabilities", "Ability to write to cgroup release_agent", "Low-privileged user access" ], "internet_facing_likelihood": "While Linux systems are extremely common on internet-facing servers, this vulnerability requires LOCAL access first. The kernel itself is not directly exposed to network exploitation - an attacker needs existing access to the system or container before exploiting this flaw. This is a post-compromise privilege escalation vulnerability.", "typical_deployment": "Linux kernel runs on virtually all Linux systems including servers, containers, cloud instances, and workstations. However, kernel vulnerabilities typically require local access or prior system compromise to exploit.", "deployment_statistics": "Nearly 100% of internet-facing Linux servers run the affected kernel, but direct network exploitation is not possible. This requires existing local access or container access to exploit.", "active_exploitation": "Listed in CISA KEV indicating active exploitation. Commonly used in container escape scenarios where attackers have initial access to containers and use this to escape to the host system.", "severity_factors": [ "High privilege escalation potential", "Container escape capability", "Namespace isolation bypass", "Requires local/container access", "Active exploitation confirmed", "Widely deployed kernel versions affected" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs for suspicious cgroup activity, check for unauthorized privilege escalation, verify container isolation integrity", "Apply kernel security updates immediately across all Linux systems", "Review container security policies and disable unnecessary privileged capabilities", "Implement container runtime security monitoring to detect escape attempts", "Monitor cgroup activity and release_agent usage for anomalies", "Audit existing container deployments for signs of compromise" ], "risk_assessment": { "exploit_likelihood": "High for systems where attackers already have local access or container access. Not directly exploitable from internet without prior compromise.", "impact_assessment": "Complete system compromise through privilege escalation, container escape to host system, potential lateral movement in containerized environments", "exposure_scope": "Millions of Linux systems affected, but requires local access vector for exploitation rather than direct internet exploitation" }, "exploitation_method": "OTHER", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:48:38.674863", "displayed_on_website": false }, { "cve_id": "CVE-2021-43798", "cvss_score": "7.5", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2021-12-07T18:25:10.000Z", "cve_published_date_formatted": "2021-12-07", "kev_date_added": "2025-10-09", "kev_date_added_formatted": "2025-10-09", "kev_due_date": "2025-10-30", "days_to_kev": 1402, "days_since_kev": null, "is_new_kev": false, "summary": "Grafana instances are vulnerable to directory traversal attacks allowing unauthorized access to local files through crafted URLs. This affects internet-facing Grafana dashboards commonly exposed for monitoring and observability purposes. The vulnerability has been actively exploited in the wild.", "detailed_analysis": { "vulnerability_type": "Directory traversal (CWE-22) allowing arbitrary file read through path manipulation in URL endpoints", "affected_products": [ "Grafana (versions 8.0.0 through 8.3.0)" ], "exploitation_requirements": [ "Network access to Grafana instance", "No authentication required", "Knowledge of vulnerable URL pattern" ], "internet_facing_likelihood": "Grafana is primarily a web-based monitoring and observability platform designed to display dashboards and metrics. Most production deployments expose Grafana to the internet or corporate networks to allow teams to access monitoring dashboards. Business requirements typically mandate internet accessibility for remote teams, DevOps monitoring, and stakeholder visibility into system metrics. Estimated 80-90% of Grafana deployments are network-accessible.", "typical_deployment": "Server application - Grafana runs as a web server application that hosts monitoring dashboards and visualization interfaces, typically deployed on dedicated servers or containerized environments", "deployment_statistics": "Approximately 80-90% of Grafana instances are deployed as network-accessible web applications since the primary use case requires team access to monitoring dashboards from various locations", "active_exploitation": "Listed in CISA KEV catalog indicating confirmed active exploitation in the wild. Multiple exploit proofs-of-concept and security advisories document real-world attacks", "severity_factors": [ "No authentication required", "Simple exploitation via URL manipulation", "High deployment prevalence", "Active exploitation confirmed", "Direct file system access", "Potential exposure of sensitive configuration files" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately upgrade to patched versions: 8.0.7, 8.1.8, 8.2.7, or 8.3.1+", "Review web server logs for suspicious requests containing '../' patterns or attempts to access /public/plugins/ endpoints", "Implement network segmentation to limit Grafana exposure if internet access is not required", "Monitor file system access logs for unauthorized file reads", "Patch priority: CRITICAL - Apply immediately due to active exploitation and ease of exploitation" ], "risk_assessment": { "exploit_likelihood": "Very High - Exploitation is trivial requiring only HTTP requests to vulnerable endpoints, no authentication needed, and active exploitation is confirmed", "impact_assessment": "High - Attackers can read arbitrary files from the server file system, potentially exposing configuration files, credentials, certificates, and other sensitive data", "exposure_scope": "Large - Grafana is widely deployed across organizations for monitoring infrastructure, with most instances accessible over networks for legitimate business purposes" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:18:17.461390", "displayed_on_website": false }, { "cve_id": "CVE-2021-43226", "cvss_score": "7.8", "attack_vector": "LOCAL", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1068", "deployment_likelihood": "VERY_LOW", "cve_published_date": "2021-12-15T14:15:12.000Z", "cve_published_date_formatted": "2021-12-15", "kev_date_added": "2025-10-06", "kev_date_added_formatted": "2025-10-06", "kev_due_date": "2025-10-27", "days_to_kev": 1391, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2021-43226 is a local privilege escalation vulnerability in the Windows Common Log File System (CLFS) driver that requires local access and low-level privileges to exploit. While it affects both client and server Windows systems, it cannot be exploited directly over the internet as it requires local system access.", "detailed_analysis": { "vulnerability_type": "Elevation of Privilege vulnerability in Windows Common Log File System Driver", "affected_products": [ "Windows 10 (multiple versions)", "Windows Server 2019", "Windows Server 2016", "Windows Server 2012/2012 R2", "Windows Server 2008/2008 R2", "Windows 11", "Windows 8.1", "Windows 7" ], "exploitation_requirements": [ "Local access to target system", "Low-level user privileges on the system", "Ability to execute code locally" ], "internet_facing_likelihood": "The Windows Common Log File System Driver is an internal OS component that manages transaction logs for the file system. It is not a network service and does not listen on network ports. This vulnerability cannot be exploited remotely over the internet as it requires local system access to interact with the CLFS driver. 0% of deployments are directly internet-exploitable.", "typical_deployment": "CLFS is a core Windows operating system component present on all Windows installations, both client and server systems. It provides transactional logging services for applications and the operating system itself.", "deployment_statistics": "0% internet-facing - CLFS is an internal kernel driver component that does not expose network interfaces or services", "active_exploitation": "Listed in CISA KEV catalog indicating active exploitation in the wild, likely used as a privilege escalation component in multi-stage attacks", "severity_factors": [ "High CVSS score of 7.8", "Confirmed active exploitation (CISA KEV)", "Affects wide range of Windows versions", "Local privilege escalation enables further attack progression", "No user interaction required once local access is obtained" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Apply December 2021 Windows security updates immediately across all affected systems", "Monitor for unusual privilege escalation activities and unauthorized administrative access", "Implement endpoint detection and response (EDR) solutions to detect exploitation attempts", "Review access controls and limit local logon rights where possible", "Patch priority: HIGH - due to active exploitation despite requiring local access" ], "risk_assessment": { "exploit_likelihood": "High for systems where attackers have already gained initial access through other means (phishing, web exploits, etc.). This vulnerability is commonly used as a second-stage privilege escalation tool.", "impact_assessment": "High impact once exploited - allows elevation to SYSTEM privileges, enabling full system compromise, persistence mechanisms, lateral movement, and data access", "exposure_scope": "Not directly internet-exploitable, but affects millions of Windows systems that could be targeted through other attack vectors followed by local privilege escalation" }, "exploitation_method": "OTHER", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:16:30.376089", "displayed_on_website": false }, { "cve_id": "CVE-2021-39935", "cvss_score": "6.8", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2021-12-13T15:47:59.000Z", "cve_published_date_formatted": "2021-12-13", "kev_date_added": "2026-02-03", "kev_date_added_formatted": "2026-02-03", "kev_due_date": "2026-02-24", "days_to_kev": 1513, "days_since_kev": null, "is_new_kev": false, "summary": "Server-Side Request Forgery (SSRF) vulnerability in GitLab CI Lint API allows unauthorized external users to perform internal network requests. GitLab instances are commonly internet-facing, making this vulnerability directly exploitable over the network without authentication.", "detailed_analysis": { "vulnerability_type": "Server-Side Request Forgery (SSRF) in CI Lint API", "affected_products": [ "GitLab Community Edition", "GitLab Enterprise Edition" ], "exploitation_requirements": [ "Network access to GitLab instance", "No authentication required", "Access to CI Lint API endpoint" ], "internet_facing_likelihood": "GitLab is primarily designed as a web-based Git repository management and DevOps platform that requires internet connectivity for collaboration. The vast majority of GitLab deployments (estimated 80-90%) are internet-facing to support distributed development teams, CI/CD pipelines, and external integrations.", "typical_deployment": "GitLab is server software deployed as a web application platform for source code management, continuous integration, and DevOps workflows. It serves web interfaces and APIs that teams access remotely.", "deployment_statistics": "Approximately 85-90% of GitLab instances are internet-facing as the platform's core value proposition requires remote access for development teams, automated CI/CD systems, and third-party integrations.", "active_exploitation": "Listed in CISA KEV catalog indicating confirmed exploitation in the wild by threat actors", "severity_factors": [ "No authentication required", "Changed scope in CVSS indicating potential to access other systems", "High confidentiality impact", "Server-side vulnerability affecting the GitLab application directly", "Wide version range affected (10.5 through 14.5.x)" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately upgrade to GitLab 14.3.6, 14.4.4, or 14.5.2 or later versions", "Review GitLab access logs for suspicious CI Lint API requests from unauthorized external sources", "Monitor internal network traffic for unexpected outbound connections from GitLab servers", "Implement network segmentation to limit GitLab server's ability to access internal resources", "Patch priority: CRITICAL - Active exploitation confirmed" ], "risk_assessment": { "exploit_likelihood": "Very High - No authentication required, network accessible, confirmed active exploitation, and straightforward SSRF attack vector", "impact_assessment": "High - SSRF can lead to internal network reconnaissance, access to internal services, potential data exfiltration, and lateral movement capabilities", "exposure_scope": "Very High - GitLab is widely deployed across organizations with most instances internet-facing for development collaboration" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:28:32.585111", "displayed_on_website": false }, { "cve_id": "CVE-2021-32030", "cvss_score": "9.8", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2021-05-06T14:54:31.000Z", "cve_published_date_formatted": "2021-05-06", "kev_date_added": "2025-06-02", "kev_date_added_formatted": "2025-06-02", "kev_due_date": "2025-06-23", "days_to_kev": 1488, "days_since_kev": null, "is_new_kev": false, "summary": "Authentication bypass vulnerability in ASUS router administrator interfaces allows unauthenticated remote attackers to gain full administrative access. The vulnerability affects router web management interfaces that are commonly exposed to the internet for remote administration.", "detailed_analysis": { "vulnerability_type": "Authentication bypass in router administrator web interface", "affected_products": [ "ASUS GT-AC2900 Router", "ASUS Lyra Mini Router" ], "exploitation_requirements": [ "Network access to router admin interface", "No authentication required", "No user interaction required" ], "internet_facing_likelihood": "Very high - router management interfaces are frequently exposed to the internet for remote administration by users and businesses. Many consumer and small business routers have WAN-side management enabled by default or are configured for remote access.", "typical_deployment": "Network infrastructure devices (routers) with web-based administration interfaces that are commonly accessible from the internet", "deployment_statistics": "Estimated 40-60% of deployments are internet-facing, as many users enable remote management for convenience, and some routers ship with WAN management enabled by default", "active_exploitation": "Listed in CISA KEV catalog, indicating active exploitation in the wild. SSVC data shows 'Exploitation: active' status.", "severity_factors": [ "Critical CVSS score of 9.8", "No authentication required", "Complete compromise of device", "Router acts as network gateway", "Active exploitation confirmed", "Simple exploitation technique" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review router logs, check for unauthorized configuration changes, verify admin credentials haven't been modified", "Immediately update firmware to patched versions: GT-AC2900 to 3.0.0.4.386.42643+ and Lyra Mini to 3.0.0.4_384_46630+", "Disable WAN-side management interface if not required for business operations", "Implement network segmentation to limit impact of router compromise", "Monitor for unusual network traffic patterns and unauthorized access attempts", "PATCH PRIORITY: CRITICAL - Patch immediately due to active exploitation" ], "risk_assessment": { "exploit_likelihood": "Very High - Simple authentication bypass with no user interaction required, actively exploited in the wild", "impact_assessment": "Critical - Complete administrative control over network gateway device, potential for network traffic interception, configuration tampering, and lateral movement", "exposure_scope": "Significant - Thousands of ASUS routers potentially exposed globally with WAN management enabled" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:01:46.336177", "displayed_on_website": false }, { "cve_id": "CVE-2021-30952", "cvss_score": "8.8", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1203", "deployment_likelihood": "VERY_LOW", "cve_published_date": "2021-08-24T18:50:52.000Z", "cve_published_date_formatted": "2021-08-24", "kev_date_added": "2026-03-05", "kev_date_added_formatted": "2026-03-05", "kev_due_date": "2026-03-26", "days_to_kev": 1654, "days_since_kev": null, "is_new_kev": false, "summary": "WebKit integer overflow vulnerability in Apple client operating systems requiring user interaction with malicious web content. Despite CISA KEV listing, this affects client-side web browsers, not internet-facing servers, making it unsuitable for T1190 exploitation.", "detailed_analysis": { "vulnerability_type": "Integer overflow in WebKit web engine leading to arbitrary code execution when processing malicious web content", "affected_products": [ "Safari", "iOS/iPadOS", "macOS", "watchOS", "WebKit-based applications" ], "exploitation_requirements": [ "User must visit malicious website or open malicious web content", "WebKit-based browser or application must process the content", "No authentication required for the malicious content itself" ], "internet_facing_likelihood": "The affected products are client-side operating systems and browsers, not server applications. While these devices connect to the internet, they do not typically run internet-facing server services that would be directly exploitable via T1190. The vulnerability requires the victim's device to process malicious web content, not direct exploitation of a listening service.", "typical_deployment": "Consumer and enterprise client devices including iPhones, iPads, Macs, and Apple Watches. These are end-user devices, not servers.", "deployment_statistics": "Less than 1% of deployments would involve these Apple devices running internet-facing server services. The vast majority are client devices behind firewalls/NAT.", "active_exploitation": "Listed in CISA KEV catalog indicating active exploitation in the wild. However, exploitation likely occurs through malicious websites or phishing campaigns targeting end users.", "severity_factors": [ "High CVSS score of 8.8", "Arbitrary code execution capability", "No authentication required", "Active exploitation documented", "Requires user interaction", "Affects client devices, not servers" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review browser history, check for unauthorized access, verify system integrity on affected Apple devices", "Update all Apple devices to patched versions: iOS/iPadOS 15.2+, macOS 12.1+, watchOS 8.3+, Safari 15.2+", "Monitor for suspicious web browsing activity and unusual process execution", "Implement web filtering to block known malicious domains", "Educate users about avoiding suspicious websites and links" ], "risk_assessment": { "exploit_likelihood": "Low for direct internet exploitation as this targets client devices, not servers. High for exploitation through malicious websites targeting end users.", "impact_assessment": "Complete device compromise possible with arbitrary code execution, but requires user interaction with malicious content", "exposure_scope": "Millions of Apple devices globally, but exploitation requires social engineering or malicious website visits rather than direct network attacks" }, "exploitation_method": "USER_INTERACTION", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:34:38.783485", "displayed_on_website": false }, { "cve_id": "CVE-2021-26829", "cvss_score": "5.4", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1204", "deployment_likelihood": "HIGH", "cve_published_date": "2021-06-11T11:05:23.000Z", "cve_published_date_formatted": "2021-06-11", "kev_date_added": "2025-11-28", "kev_date_added_formatted": "2025-11-28", "kev_due_date": "2025-12-19", "days_to_kev": 1631, "days_since_kev": null, "is_new_kev": false, "summary": "Stored XSS vulnerability in OpenPLC ScadaBR system settings that requires user interaction. Despite CISA KEV listing, this targets user sessions rather than the server infrastructure itself.", "detailed_analysis": { "vulnerability_type": "Stored Cross-Site Scripting (XSS) via system_settings.shtm", "affected_products": [ "OpenPLC ScadaBR" ], "exploitation_requirements": [ "Low privileges required (PR:L)", "User interaction required (UI:R)", "Network access to web interface" ], "internet_facing_likelihood": "ScadaBR is a SCADA (Supervisory Control and Data Acquisition) system commonly used for industrial control systems. While some deployments may be internet-facing for remote monitoring, security best practices strongly recommend against direct internet exposure of SCADA systems. However, many organizations still expose these systems for convenience.", "typical_deployment": "Industrial control system server software, typically deployed on internal networks but sometimes exposed to internet for remote access", "deployment_statistics": "Estimated 20-40% of deployments may be internet-facing despite security recommendations against it, particularly in smaller industrial facilities or remote monitoring scenarios", "active_exploitation": "Listed in CISA KEV catalog indicating active exploitation by threat actors, specifically mentioned in context of Russian-aligned hacktivist attacks against OT/ICS systems", "severity_factors": [ "Stored XSS allows persistent malicious content", "SCADA systems often have privileged access to industrial controls", "Targets critical infrastructure", "Active exploitation confirmed", "However, only compromises user sessions, not server itself" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately upgrade OpenPLC ScadaBR to patched versions (>0.9.1 on Linux, >1.12.4 on Windows)", "Implement network segmentation to isolate SCADA systems from internet access", "Deploy web application firewalls with XSS protection", "Monitor for suspicious administrative actions and unauthorized configuration changes", "Implement Content Security Policy (CSP) headers to mitigate XSS attacks" ], "risk_assessment": { "exploit_likelihood": "Medium - requires user interaction but active exploitation confirmed in critical infrastructure attacks", "impact_assessment": "Medium - can lead to session hijacking and unauthorized administrative actions in industrial control systems, but does not directly compromise the server", "exposure_scope": "Limited but critical - affects industrial control systems that may be internet-facing despite security recommendations" }, "exploitation_method": "USER_INTERACTION", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:22:17.323635", "displayed_on_website": false }, { "cve_id": "CVE-2021-26828", "cvss_score": "8.8", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2021-06-11T11:10:58.000Z", "cve_published_date_formatted": "2021-06-11", "kev_date_added": "2025-12-03", "kev_date_added_formatted": "2025-12-03", "kev_due_date": "2025-12-24", "days_to_kev": 1636, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2021-26828 is a critical file upload vulnerability in OpenPLC ScadaBR that allows authenticated remote users to upload and execute arbitrary JSP files. This vulnerability enables direct remote code execution on SCADA/HMI systems that are commonly internet-facing for remote monitoring and control operations.", "detailed_analysis": { "vulnerability_type": "Unrestricted file upload leading to remote code execution (CWE-434)", "affected_products": [ "OpenPLC ScadaBR (SCADA/HMI System)", "ScadaBR Linux versions through 0.9.1", "ScadaBR Windows versions through 1.12.4" ], "exploitation_requirements": [ "Network access to ScadaBR web interface", "Valid authentication credentials", "Access to view_edit.shtm endpoint" ], "internet_facing_likelihood": "ScadaBR is SCADA/HMI software designed for industrial control and monitoring. While security best practices recommend against internet exposure, approximately 40-60% of SCADA systems are internet-facing due to business requirements for remote monitoring, vendor support, and operational convenience. The web-based nature of ScadaBR increases the likelihood of internet exposure.", "typical_deployment": "ScadaBR is deployed as a server application providing web-based SCADA/HMI functionality for industrial control systems, building automation, and process monitoring", "deployment_statistics": "Estimated 40-60% of deployments are internet-facing based on common SCADA deployment patterns where remote access is required for operations, maintenance, and vendor support despite security recommendations", "active_exploitation": "Listed in CISA KEV catalog as of December 3, 2025, indicating confirmed active exploitation in the wild", "severity_factors": [ "Remote code execution capability", "SCADA/industrial control system targeting", "Web-accessible interface commonly exposed to internet", "Active exploitation confirmed by CISA KEV listing", "High CVSS score of 8.8", "Affects critical infrastructure components" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately upgrade ScadaBR to versions newer than 0.9.1 (Linux) or 1.12.4 (Windows)", "Audit all file uploads and look for suspicious JSP files in web directories", "Implement network segmentation to isolate SCADA systems from internet access", "Enable comprehensive logging and monitoring for authentication and file upload activities", "Patch priority: CRITICAL - Apply immediately due to active exploitation" ], "risk_assessment": { "exploit_likelihood": "Very High - Active exploitation confirmed, authentication bypass possible with stolen credentials, technical exploitation straightforward", "impact_assessment": "Critical - Full system compromise, potential disruption of industrial processes, data theft, and lateral movement to other industrial systems", "exposure_scope": "Medium to High - Industrial control systems globally, with significant impact on critical infrastructure and manufacturing operations" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:23:19.933121", "displayed_on_website": false }, { "cve_id": "CVE-2021-22681", "cvss_score": "9.8", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2021-03-03T17:59:43.000Z", "cve_published_date_formatted": "2021-03-03", "kev_date_added": "2026-03-05", "kev_date_added_formatted": "2026-03-05", "kev_due_date": "2026-03-26", "days_to_kev": 1828, "days_since_kev": null, "is_new_kev": false, "summary": "Critical authentication bypass vulnerability in Rockwell Automation industrial control systems allowing unauthenticated attackers to bypass verification mechanisms and authenticate with Logix controllers over the network. This vulnerability is actively exploited and listed in CISA KEV catalog.", "detailed_analysis": { "vulnerability_type": "Authentication bypass due to insufficiently protected credentials (CWE-522) allowing unauthenticated network access to industrial control systems", "affected_products": [ "Rockwell Automation Studio 5000 Logix Designer", "RSLogix 5000", "CompactLogix Controllers", "ControlLogix Controllers", "GuardLogix Controllers", "DriveLogix Controllers", "SoftLogix Controllers" ], "exploitation_requirements": [ "Network connectivity to target controller", "No authentication required", "No user interaction required" ], "internet_facing_likelihood": "Many industrial control systems are increasingly connected to corporate networks and internet for remote monitoring, maintenance, and data collection. While security best practices recommend air-gapping, studies show 30-40% of industrial control systems have some level of internet connectivity either directly or through corporate network connections.", "typical_deployment": "These are industrial control system components typically deployed in manufacturing, energy, water treatment, and other critical infrastructure environments. Controllers often run network services for remote programming and monitoring.", "deployment_statistics": "Estimated 30-40% of deployments have internet connectivity either direct or through corporate networks, driven by Industry 4.0 initiatives and remote operations requirements", "active_exploitation": "Listed in CISA Known Exploited Vulnerabilities catalog indicating confirmed active exploitation in the wild", "severity_factors": [ "CVSS 9.8 Critical severity", "No authentication required", "Network attack vector", "Affects critical infrastructure systems", "Active exploitation confirmed", "Complete compromise of confidentiality, integrity, and availability" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately patch affected Rockwell Automation systems to latest versions", "Implement network segmentation to isolate industrial control systems from internet", "Deploy monitoring for unauthorized authentication attempts to Logix controllers", "Verify all remote access is properly authenticated and logged", "Consider this CRITICAL priority patching due to active exploitation" ], "risk_assessment": { "exploit_likelihood": "Very High - Unauthenticated network-based attack with confirmed active exploitation and public proof-of-concept availability", "impact_assessment": "Critical - Complete compromise of industrial control systems can lead to operational disruption, safety incidents, and potential physical damage to industrial processes", "exposure_scope": "High - Thousands of internet-connected Rockwell Automation systems worldwide, particularly in critical infrastructure sectors" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:34:16.782381", "displayed_on_website": false }, { "cve_id": "CVE-2021-22555", "cvss_score": "8.3", "attack_vector": "ADJACENT_NETWORK", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1068", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2021-07-07T11:20:10.668Z", "cve_published_date_formatted": "2021-07-07", "kev_date_added": "2025-10-06", "kev_date_added_formatted": "2025-10-06", "kev_due_date": "2025-10-27", "days_to_kev": 1552, "days_since_kev": null, "is_new_kev": false, "summary": "Linux kernel netfilter heap out-of-bounds write vulnerability allowing privilege escalation and DoS. Requires adjacent network access and high attack complexity. Despite high deployment, this is primarily a privilege escalation vulnerability requiring existing local or adjacent network access.", "detailed_analysis": { "vulnerability_type": "Heap out-of-bounds write in Linux kernel netfilter x_tables.c component", "affected_products": [ "Linux Kernel", "Ubuntu", "Red Hat Enterprise Linux", "SUSE Linux", "Debian", "CentOS", "Amazon Linux" ], "exploitation_requirements": [ "Adjacent network access", "High attack complexity", "No privileges required", "No user interaction" ], "internet_facing_likelihood": "While Linux systems are extremely prevalent on internet-facing servers (estimated 70%+ of web servers), this specific vulnerability has CVSS Attack Vector: ADJACENT_NETWORK, meaning it cannot be directly exploited over the internet. It requires adjacent network access, limiting direct internet exploitation.", "typical_deployment": "Linux kernel is infrastructure software deployed on servers, workstations, containers, IoT devices, and embedded systems across all environments", "deployment_statistics": "Nearly 100% of Linux deployments include the kernel, but only adjacent network attackers can exploit this vulnerability directly. Internet exploitation would require chaining with other vulnerabilities.", "active_exploitation": "Listed in CISA KEV indicating active exploitation in the wild, likely for privilege escalation in post-compromise scenarios", "severity_factors": [ "High CVSS score (8.3)", "Privilege escalation capability", "Wide kernel deployment", "Adjacent network limitation", "High attack complexity" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Apply kernel updates immediately - patch to versions containing fixes for netfilter x_tables.c heap overflow", "Monitor for unusual privilege escalation attempts and suspicious netfilter/iptables activity", "Review network segmentation to limit adjacent network access", "Patch priority: HIGH for all Linux systems, especially those in multi-tenant or less trusted network environments" ], "risk_assessment": { "exploit_likelihood": "High for adjacent network attackers or post-compromise scenarios. Limited for direct internet exploitation due to ADJACENT_NETWORK attack vector requirement.", "impact_assessment": "Complete system compromise possible - full confidentiality, integrity, and availability impact with scope change", "exposure_scope": "Massive - affects Linux kernel versions since 2.6.19-rc1, but exploitation requires adjacent network positioning rather than direct internet access" }, "exploitation_method": "OTHER", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:15:46.488738", "displayed_on_website": false }, { "cve_id": "CVE-2021-22175", "cvss_score": "6.8", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2021-06-11T15:30:12.000Z", "cve_published_date_formatted": "2021-06-11", "kev_date_added": "2026-02-18", "kev_date_added_formatted": "2026-02-18", "kev_due_date": "2026-03-11", "days_to_kev": 1713, "days_since_kev": null, "is_new_kev": false, "summary": "Server-Side Request Forgery (SSRF) vulnerability in GitLab allows unauthenticated attackers to make requests to internal networks when webhook internal network requests are enabled. This affects GitLab instances from version 10.5 through multiple 13.x versions and is actively exploited according to CISA KEV.", "detailed_analysis": { "vulnerability_type": "Server-Side Request Forgery (SSRF) - CWE-918", "affected_products": [ "GitLab" ], "exploitation_requirements": [ "Network access to GitLab instance", "Webhook internal network requests enabled", "No authentication required" ], "internet_facing_likelihood": "GitLab is primarily deployed as a web-based Git repository management platform that requires internet access for collaboration. Most GitLab instances are internet-facing to allow developers remote access, CI/CD integration, and team collaboration. Estimated 80-90% of GitLab deployments are internet-accessible.", "typical_deployment": "GitLab is server software deployed as a web application for Git repository hosting, issue tracking, and DevOps workflows. It runs as a web server with multiple components and typically listens on ports 80/443.", "deployment_statistics": "Approximately 85% of GitLab deployments are internet-facing as the platform's core value proposition requires remote developer access, webhook integrations with external services, and CI/CD pipeline connectivity.", "active_exploitation": "Listed in CISA Known Exploited Vulnerabilities catalog with addition date of 2026-02-18, indicating confirmed active exploitation in the wild.", "severity_factors": [ "No authentication required", "Network attack vector", "Changed scope in CVSS indicating potential access beyond the vulnerable component", "High confidentiality impact", "Active exploitation confirmed by CISA KEV listing" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review GitLab logs for suspicious webhook requests, check for unauthorized internal network access, verify system integrity", "Immediately upgrade GitLab to version 13.6.7+, 13.7.7+, or 13.8.4+ depending on your current branch", "Review webhook configurations and disable internal network requests if not required", "Monitor GitLab access logs for unusual SSRF attempts targeting internal resources", "Implement network segmentation to limit internal network exposure from GitLab instances", "Patch priority: CRITICAL - Apply immediately due to active exploitation" ], "risk_assessment": { "exploit_likelihood": "Very High - No authentication required, network-based attack vector, and confirmed active exploitation by threat actors", "impact_assessment": "High - SSRF can lead to internal network reconnaissance, access to sensitive internal services, potential data exfiltration, and pivot points for further attacks", "exposure_scope": "Large - GitLab is widely deployed across organizations as internet-facing development infrastructure, with thousands of instances potentially vulnerable" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:32:25.145383", "displayed_on_website": false }, { "cve_id": "CVE-2021-22054", "cvss_score": "7.5", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2021-12-17T16:10:18.000Z", "cve_published_date_formatted": "2021-12-17", "kev_date_added": "2026-03-09", "kev_date_added_formatted": "2026-03-09", "kev_due_date": "2026-03-23", "days_to_kev": 1543, "days_since_kev": null, "is_new_kev": false, "summary": "VMware Workspace ONE UEM console contains an unauthenticated SSRF vulnerability that allows remote attackers to access sensitive information. This enterprise mobility management platform is commonly exposed to the internet for device management purposes.", "detailed_analysis": { "vulnerability_type": "Server-Side Request Forgery (SSRF) - CWE-918", "affected_products": [ "VMware Workspace ONE UEM" ], "exploitation_requirements": [ "Network access to UEM console", "No authentication required" ], "internet_facing_likelihood": "VMware Workspace ONE UEM console is an enterprise mobility management platform that is commonly deployed as an internet-facing service. Organizations typically expose UEM consoles to the internet to allow device enrollment, management, and policy enforcement for mobile devices and endpoints across distributed workforces. Estimated 70-80% of deployments are internet-accessible.", "typical_deployment": "Server application - VMware Workspace ONE UEM is enterprise server software that manages mobile devices, applications, and content across an organization", "deployment_statistics": "Approximately 70-80% of UEM deployments are internet-facing to support remote device management, BYOD programs, and distributed workforce mobility requirements", "active_exploitation": "Listed in CISA Known Exploited Vulnerabilities catalog with active exploitation confirmed. Referenced by GreyNoise for SSRF exploitation surge.", "severity_factors": [ "Unauthenticated access", "Network-based exploitation", "Access to sensitive information", "Active exploitation in the wild", "Enterprise-critical infrastructure" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately patch to VMware Workspace ONE UEM console 20.0.8.37+, 20.11.0.40+, 21.2.0.27+, or 21.5.0.37+ depending on your version branch", "Monitor UEM console access logs for suspicious outbound requests and unauthorized data access attempts", "Implement network segmentation to limit SSRF impact if not already patched", "PATCH PRIORITY: CRITICAL - Apply patches immediately due to active exploitation" ], "risk_assessment": { "exploit_likelihood": "Very High - Vulnerability is unauthenticated, remotely exploitable, and actively being exploited according to CISA KEV listing", "impact_assessment": "High - Allows unauthorized access to sensitive information in enterprise mobility management systems, potentially exposing device data, user information, and corporate policies", "exposure_scope": "Significant - VMware Workspace ONE UEM is widely deployed in enterprise environments, with majority of installations internet-facing for mobile device management" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:35:20.997288", "displayed_on_website": false }, { "cve_id": "CVE-2021-21311", "cvss_score": "7.2", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2021-02-11T20:55:15.000Z", "cve_published_date_formatted": "2021-02-11", "kev_date_added": "2025-09-29", "kev_date_added_formatted": "2025-09-29", "kev_due_date": "2025-10-20", "days_to_kev": 1691, "days_since_kev": null, "is_new_kev": false, "summary": "Adminer, a popular PHP-based database management tool, contains an SSRF vulnerability (CWE-918) that allows unauthenticated attackers to make server-side requests. This vulnerability is actively exploited in the wild and listed in CISA's KEV catalog.", "detailed_analysis": { "vulnerability_type": "Server-Side Request Forgery (SSRF) - CWE-918", "affected_products": [ "Adminer (PHP database management tool)" ], "exploitation_requirements": [ "Network access to Adminer web interface", "No authentication required", "No user interaction required" ], "internet_facing_likelihood": "Adminer is frequently deployed as a web-accessible database administration tool on internet-facing servers. Many organizations deploy it for remote database management, making it commonly accessible via web browsers over the internet. Estimated 60-80% of deployments are internet-accessible due to its purpose as a web-based administration interface.", "typical_deployment": "Adminer is server software - a single PHP file that provides web-based database management functionality, typically deployed on web servers alongside web applications for database administration", "deployment_statistics": "Approximately 70% of Adminer deployments are likely internet-facing, as it's designed for remote database administration and often deployed on web servers to provide convenient database access to developers and administrators", "active_exploitation": "Listed in CISA KEV catalog with 'Exploitation: active' status, indicating confirmed active exploitation in the wild", "severity_factors": [ "CVSS 7.2 (High severity)", "No authentication required (PR:N)", "No user interaction needed (UI:N)", "Network attack vector", "Changed scope (S:C)", "Active exploitation confirmed", "Simple to exploit (AC:L)" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately update Adminer to version 4.7.9 or later", "Remove or restrict network access to Adminer installations if not required", "Implement network segmentation to limit access to database administration tools", "Monitor web server logs for suspicious SSRF attempts and unusual outbound connections", "Consider replacing with more secure database administration solutions if possible" ], "risk_assessment": { "exploit_likelihood": "Very High - SSRF vulnerability with no authentication required, simple exploitation, and confirmed active exploitation in the wild", "impact_assessment": "High - SSRF can lead to internal network reconnaissance, access to internal services, potential data exfiltration, and further lateral movement", "exposure_scope": "Moderate to High - Adminer is widely used for web-based database administration and commonly exposed to the internet for remote access" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:13:56.073581", "displayed_on_website": false }, { "cve_id": "CVE-2021-20035", "cvss_score": "6.5", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2021-09-27T17:20:12.000Z", "cve_published_date_formatted": "2021-09-27", "kev_date_added": "2025-04-16", "kev_date_added_formatted": "2025-04-16", "kev_due_date": "2025-05-07", "days_to_kev": 1297, "days_since_kev": null, "is_new_kev": false, "summary": "OS Command Injection vulnerability in SonicWall SMA100 management interface allows remote authenticated attackers to execute arbitrary commands as 'nobody' user. The vulnerability is actively exploited in the wild according to CISA KEV listing.", "detailed_analysis": { "vulnerability_type": "OS Command Injection (CWE-78) in management interface", "affected_products": [ "SonicWall SMA100 (versions 9.0.0.10-28sv and earlier, 10.2.0.7-34sv and earlier, 10.2.1.0-17sv and earlier)" ], "exploitation_requirements": [ "Network access to management interface", "Valid authentication credentials", "Low attack complexity" ], "internet_facing_likelihood": "SonicWall SMA100 is a secure remote access appliance designed specifically to provide VPN and remote access services. The management interface is commonly exposed to the internet for administrative purposes, making this vulnerability highly exploitable from external networks.", "typical_deployment": "Network appliance/server software - SonicWall SMA100 is deployed as a dedicated remote access appliance that provides secure connectivity services", "deployment_statistics": "Approximately 80-90% of SMA100 deployments have management interfaces accessible from the internet, as these are remote access appliances that require external connectivity for both user access and administrative management", "active_exploitation": "Listed in CISA KEV catalog on 2025-04-16, indicating confirmed active exploitation in the wild", "severity_factors": [ "Command injection allows arbitrary code execution", "Affects critical network infrastructure", "Active exploitation confirmed", "Management interface commonly internet-facing", "Authentication required but often uses default/weak credentials" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately update to patched firmware versions newer than the affected ranges", "Restrict management interface access to trusted IP ranges only", "Monitor authentication logs for suspicious login attempts and command execution", "Implement network segmentation to limit blast radius if compromised", "Patch priority: CRITICAL - Apply immediately due to active exploitation" ], "risk_assessment": { "exploit_likelihood": "Very High - Active exploitation confirmed, authentication bypass techniques common for network appliances, and management interfaces frequently exposed", "impact_assessment": "High - Command injection can lead to device compromise, network pivoting, and potential access to internal networks protected by the appliance", "exposure_scope": "Thousands of internet-facing SonicWall SMA100 appliances globally, particularly affecting organizations relying on remote access infrastructure" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:49:52.487254", "displayed_on_website": false }, { "cve_id": "CVE-2020-9715", "cvss_score": "7.8", "attack_vector": "LOCAL", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1203", "deployment_likelihood": "VERY_LOW", "cve_published_date": "2020-08-19T00:00:00.000Z", "cve_published_date_formatted": "2020-08-19", "kev_date_added": "2026-04-13", "kev_date_added_formatted": "2026-04-13", "kev_due_date": "2026-04-27", "days_to_kev": 2063, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2020-9715 is a use-after-free vulnerability in Adobe Acrobat and Reader that allows arbitrary code execution. This affects client-side PDF applications that require user interaction to open malicious documents, not internet-facing servers.", "detailed_analysis": { "vulnerability_type": "Use-after-free vulnerability (CWE-416) leading to arbitrary code execution", "affected_products": [ "Adobe Acrobat", "Adobe Reader" ], "exploitation_requirements": [ "User must open malicious PDF document", "No authentication required", "Local access to vulnerable application" ], "internet_facing_likelihood": "Adobe Acrobat and Reader are desktop client applications for viewing and editing PDF documents. They are not designed as server software and are virtually never deployed as internet-facing services. These applications run on end-user workstations and laptops for document processing.", "typical_deployment": "Desktop client software installed on individual user workstations for PDF viewing and editing. Not server software.", "deployment_statistics": "Less than 1% of deployments would be internet-facing. These are client applications, not server services. Any internet exposure would be against security best practices.", "active_exploitation": "Listed in CISA KEV catalog indicating active exploitation in the wild, likely through malicious PDF documents distributed via email or web downloads", "severity_factors": [ "High severity due to arbitrary code execution", "Requires user interaction to open malicious PDF", "Client-side application, not server", "CISA KEV listed indicates active exploitation" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Update Adobe Acrobat and Reader to versions newer than 2020.009.20074 immediately", "Implement PDF scanning and sandboxing solutions for email attachments", "Train users to be cautious when opening PDF documents from untrusted sources", "Consider application whitelisting or enhanced endpoint protection", "HIGH priority patching for all desktop installations" ], "risk_assessment": { "exploit_likelihood": "Low for direct internet exploitation as this affects client applications, but high for targeted attacks via malicious PDF documents", "impact_assessment": "High impact if exploited - arbitrary code execution can lead to full system compromise on the affected workstation", "exposure_scope": "Minimal internet-facing exposure as these are client applications, but potentially affects millions of desktop installations through malicious document distribution" }, "exploitation_method": "USER_INTERACTION", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:39:44.089325", "displayed_on_website": false }, { "cve_id": "CVE-2020-7796", "cvss_score": "9.8", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2020-02-18T21:14:22.000Z", "cve_published_date_formatted": "2020-02-18", "kev_date_added": "2026-02-17", "kev_date_added_formatted": "2026-02-17", "kev_due_date": "2026-03-10", "days_to_kev": 2191, "days_since_kev": null, "is_new_kev": false, "summary": "SSRF vulnerability in Zimbra Collaboration Suite when WebEx zimlet is installed and JSP is enabled. This is a critical server-side vulnerability in a commonly internet-facing email/collaboration platform with active exploitation confirmed by CISA KEV listing.", "detailed_analysis": { "vulnerability_type": "Server-Side Request Forgery (SSRF) - CWE-918", "affected_products": [ "Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7" ], "exploitation_requirements": [ "WebEx zimlet must be installed", "Zimlet JSP must be enabled", "Network access to Zimbra server" ], "internet_facing_likelihood": "Zimbra Collaboration Suite is an enterprise email and collaboration platform that is typically deployed as internet-facing to serve email and web collaboration services to users. Estimated 85-95% of Zimbra deployments are internet-accessible as this is required for email functionality and remote user access.", "typical_deployment": "Server software - enterprise email and collaboration platform requiring internet exposure for email delivery, webmail access, and collaboration features", "deployment_statistics": "Approximately 90% of Zimbra deployments are internet-facing as email servers must be accessible for mail delivery and users need remote webmail access", "active_exploitation": "Listed in CISA Known Exploited Vulnerabilities catalog with active exploitation evidence as of February 2026", "severity_factors": [ "CVSS 9.8 Critical severity", "No authentication required", "Network-based attack vector", "High impact on confidentiality, integrity, and availability", "SSRF can lead to internal network reconnaissance and potential RCE", "Active exploitation in the wild" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately upgrade to Zimbra 8.8.15 Patch 7 or later", "If immediate patching is not possible, disable WebEx zimlet or JSP functionality as temporary mitigation", "Monitor for unusual outbound network requests from Zimbra servers that could indicate SSRF exploitation", "Review network logs for evidence of internal network scanning or unauthorized external requests", "Patch priority: CRITICAL - deploy emergency patches immediately" ], "risk_assessment": { "exploit_likelihood": "Very High - SSRF vulnerabilities are easily exploitable over the network without authentication, and this specific CVE has confirmed active exploitation", "impact_assessment": "Critical - SSRF can lead to internal network reconnaissance, data exfiltration, and potential remote code execution depending on internal services accessible", "exposure_scope": "High - Zimbra is widely deployed in enterprise environments as email infrastructure, with most installations being internet-facing by necessity" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:31:21.393791", "displayed_on_website": false }, { "cve_id": "CVE-2020-29574", "cvss_score": "9.8", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2020-12-11T16:03:47.000Z", "cve_published_date_formatted": "2020-12-11", "kev_date_added": "2025-02-06", "kev_date_added_formatted": "2025-02-06", "kev_due_date": "2025-02-27", "days_to_kev": 1518, "days_since_kev": null, "is_new_kev": false, "summary": "Critical SQL injection vulnerability in Cyberoam OS WebAdmin interface allows unauthenticated remote attackers to execute arbitrary SQL statements. This affects network security appliances that are typically deployed as internet-facing gateway devices.", "detailed_analysis": { "vulnerability_type": "Unauthenticated SQL injection in WebAdmin interface", "affected_products": [ "Cyberoam OS (network security appliances)", "Sophos Cyberoam firewalls" ], "exploitation_requirements": [ "Network access to WebAdmin interface", "No authentication required" ], "internet_facing_likelihood": "Cyberoam devices are network security appliances (firewalls/UTM) that are specifically designed to be deployed at network perimeters with internet-facing management interfaces. Estimated 80-90% of deployments have internet-accessible WebAdmin interfaces for remote management.", "typical_deployment": "Server/infrastructure software - these are dedicated network security appliances that sit at network boundaries and require management access from external locations", "deployment_statistics": "Approximately 80-90% of Cyberoam deployments are internet-facing as they are perimeter security devices designed for gateway deployment with remote management capabilities", "active_exploitation": "Listed in CISA KEV catalog as of February 6, 2025, indicating confirmed active exploitation in the wild", "severity_factors": [ "No authentication required", "Remote code execution potential via SQL injection", "Network security device compromise", "CISA KEV listing confirms active exploitation", "CVSS 9.8 Critical severity" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Apply Sophos security updates for Cyberoam OS immediately", "Review WebAdmin access logs for suspicious SQL injection attempts", "Implement network segmentation to limit WebAdmin interface exposure", "Monitor database activity for unauthorized queries or data access", "Patch priority: CRITICAL - immediate action required" ], "risk_assessment": { "exploit_likelihood": "Very high - unauthenticated SQL injection with confirmed active exploitation and public awareness", "impact_assessment": "Critical - complete compromise of network security appliance, potential for network pivoting, data exfiltration, and security bypass", "exposure_scope": "Thousands of internet-facing Cyberoam/Sophos network security appliances globally with exposed WebAdmin interfaces" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:28:01.950251", "displayed_on_website": false }, { "cve_id": "CVE-2020-2883", "cvss_score": "9.8", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2020-04-15T13:29:50.000Z", "cve_published_date_formatted": "2020-04-15", "kev_date_added": "2025-01-07", "kev_date_added_formatted": "2025-01-07", "kev_due_date": "2025-01-28", "days_to_kev": 1728, "days_since_kev": null, "is_new_kev": false, "summary": "Critical unauthenticated deserialization vulnerability in Oracle WebLogic Server allowing complete server takeover via network protocols IIOP and T3. This vulnerability is actively exploited in the wild and is listed in CISA's Known Exploited Vulnerabilities catalog.", "detailed_analysis": { "vulnerability_type": "Unauthenticated deserialization vulnerability in Oracle WebLogic Server Core component leading to complete server takeover", "affected_products": [ "Oracle WebLogic Server 10.3.6.0.0", "Oracle WebLogic Server 12.1.3.0.0", "Oracle WebLogic Server 12.2.1.3.0", "Oracle WebLogic Server 12.2.1.4.0" ], "exploitation_requirements": [ "Network access to IIOP or T3 protocols", "No authentication required", "No user interaction required" ], "internet_facing_likelihood": "WebLogic Server is an enterprise Java application server that is very commonly deployed as internet-facing infrastructure to host web applications, web services, and enterprise applications. Approximately 70-80% of WebLogic deployments are internet-accessible as they serve public-facing business applications.", "typical_deployment": "WebLogic Server is enterprise application server software deployed to host Java web applications, web services, and enterprise applications for organizations. It typically runs on dedicated servers with ports exposed for client access.", "deployment_statistics": "Estimated 70-80% of WebLogic Server deployments are internet-facing as organizations use it to host customer-facing web applications, APIs, and enterprise services that require internet access.", "active_exploitation": "Listed in CISA Known Exploited Vulnerabilities catalog as of January 2025, indicating confirmed active exploitation in the wild. Multiple exploit references and proof-of-concept code available.", "severity_factors": [ "CVSS 9.8 Critical severity", "No authentication required", "Complete server takeover possible", "Easily exploitable", "Active exploitation confirmed", "Affects widely-deployed enterprise application server" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Apply Oracle Critical Patch Update immediately for all affected WebLogic Server versions", "Implement network segmentation to limit exposure of WebLogic Server instances", "Monitor T3 and IIOP protocol traffic for suspicious activity", "Review access logs for evidence of exploitation attempts or successful compromise", "Consider disabling T3 protocol if not required for business operations", "HIGHEST patch priority - patch within 24-48 hours due to active exploitation" ], "risk_assessment": { "exploit_likelihood": "Very High - CVSS indicates easy exploitation with no authentication required, and active exploitation is confirmed via CISA KEV listing", "impact_assessment": "Complete server compromise allowing attackers full control over WebLogic Server instances, potentially leading to data theft, lateral movement, and service disruption", "exposure_scope": "Potentially thousands of internet-facing WebLogic Server instances globally, as it's widely used enterprise application server software" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:20:45.882577", "displayed_on_website": false }, { "cve_id": "CVE-2020-25079", "cvss_score": "8.8", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2020-09-02T15:33:07.000Z", "cve_published_date_formatted": "2020-09-02", "kev_date_added": "2025-08-05", "kev_date_added_formatted": "2025-08-05", "kev_due_date": "2025-08-26", "days_to_kev": 1798, "days_since_kev": null, "is_new_kev": false, "summary": "Command injection vulnerability in D-Link IP cameras' web management interface allows authenticated attackers to execute arbitrary commands. These cameras are commonly deployed with internet-facing web interfaces for remote monitoring.", "detailed_analysis": { "vulnerability_type": "Authenticated command injection in web application CGI script", "affected_products": [ "D-Link DCS-2530L IP Camera", "D-Link DCS-2670L IP Camera" ], "exploitation_requirements": [ "Network access to camera web interface", "Valid authentication credentials", "Access to ddns_enc.cgi endpoint" ], "internet_facing_likelihood": "D-Link IP cameras are commonly deployed as internet-facing devices for remote surveillance monitoring. Many users configure port forwarding or place these cameras in DMZ networks to enable remote access. Estimated 60-70% of deployments have some form of internet accessibility.", "typical_deployment": "These are IP surveillance cameras with built-in web servers that provide configuration interfaces and video streaming capabilities. Primary use cases include home security, small business monitoring, and remote surveillance applications.", "deployment_statistics": "Approximately 60-70% of IP camera deployments are internet-accessible either through direct exposure, port forwarding, or cloud services, as remote monitoring is a primary use case for these devices.", "active_exploitation": "Listed in CISA KEV catalog indicating confirmed exploitation in the wild. CISA added this on 2025-08-05 with 'active' exploitation status.", "severity_factors": [ "Command injection enables full system compromise", "Commonly internet-facing deployment pattern", "Active exploitation confirmed by CISA KEV listing", "Authentication bypass often possible through default/weak credentials", "Network attack vector with no user interaction required" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately update to firmware version 1.06.01 Hotfix or later for DCS-2530L devices", "For DCS-2670L devices through version 2.02, check vendor for updated firmware or implement compensating controls", "Remove devices from direct internet exposure and implement VPN access for remote management", "Change default credentials and implement strong authentication", "Monitor web server logs for suspicious CGI requests to ddns_enc.cgi", "HIGHEST patch priority - actively exploited IoT vulnerability" ], "risk_assessment": { "exploit_likelihood": "Very high - authenticated command injection with confirmed active exploitation and commonly exposed attack surface", "impact_assessment": "Complete system compromise allowing arbitrary command execution, potential pivot point into internal networks, surveillance system manipulation", "exposure_scope": "Thousands of internet-facing D-Link IP cameras globally, particularly affecting home users and small businesses with direct internet exposure" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:09:48.085160", "displayed_on_website": false }, { "cve_id": "CVE-2020-25078", "cvss_score": "7.5", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2020-09-02T15:33:18.000Z", "cve_published_date_formatted": "2020-09-02", "kev_date_added": "2025-08-05", "kev_date_added_formatted": "2025-08-05", "kev_due_date": "2025-08-26", "days_to_kev": 1798, "days_since_kev": null, "is_new_kev": false, "summary": "D-Link DCS-2530L and DCS-2670L IP cameras expose an unauthenticated /config/getuser endpoint that allows remote disclosure of administrator passwords. This vulnerability enables direct network exploitation against internet-facing security cameras commonly deployed for remote monitoring.", "detailed_analysis": { "vulnerability_type": "Unauthenticated information disclosure - administrator password exposure via API endpoint", "affected_products": [ "D-Link DCS-2530L IP Camera", "D-Link DCS-2670L IP Camera" ], "exploitation_requirements": [ "Network access to camera", "No authentication required", "Access to /config/getuser endpoint" ], "internet_facing_likelihood": "High likelihood of internet exposure. IP security cameras are commonly deployed as internet-facing devices to enable remote monitoring, surveillance, and management. These devices are frequently exposed to the internet either directly or through port forwarding for remote access by users, security companies, and monitoring services. Estimated 60-80% of deployments have some form of internet accessibility.", "typical_deployment": "Network appliance/IoT device - IP security cameras are deployed as standalone network devices with web interfaces for configuration and video streaming, commonly accessible remotely", "deployment_statistics": "Approximately 60-80% of IP camera deployments are internet-accessible for remote monitoring purposes, either through direct exposure, port forwarding, or cloud services", "active_exploitation": "Listed in CISA KEV catalog indicating confirmed active exploitation in the wild", "severity_factors": [ "No authentication required", "Direct password disclosure", "Internet-facing deployment common", "IoT device with limited security controls", "Active exploitation confirmed" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately update D-Link DCS-2530L to version 1.06.01 Hotfix or later", "Replace D-Link DCS-2670L devices (no patch available for versions through 2.02)", "Implement network segmentation to isolate cameras from direct internet access", "Deploy cameras behind VPN or secure remote access solutions", "Monitor for unauthorized access attempts to /config/getuser endpoint", "Change all default and current administrator passwords immediately", "Patch priority: CRITICAL - immediate action required" ], "risk_assessment": { "exploit_likelihood": "Very High - no authentication required, simple HTTP request to exposed endpoint, active exploitation confirmed", "impact_assessment": "High - complete administrator credential compromise leading to full device control, video feed access, and potential network lateral movement", "exposure_scope": "Potentially thousands of internet-facing D-Link IP cameras globally, particularly in small business and residential deployments" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:09:26.315159", "displayed_on_website": false }, { "cve_id": "CVE-2020-24363", "cvss_score": "8.8", "attack_vector": "ADJACENT_NETWORK", "cisa_kev_listed": true, "internet_exploitable": "MEDIUM_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "HIGH", "cve_published_date": "2020-08-31T15:49:15.000Z", "cve_published_date_formatted": "2020-08-31", "kev_date_added": "2025-09-02", "kev_date_added_formatted": "2025-09-02", "kev_due_date": "2025-09-23", "days_to_kev": 1828, "days_since_kev": null, "is_new_kev": false, "summary": "TP-Link TL-WA855RE V5 WiFi range extender allows unauthenticated attackers on the same network to perform factory reset via TDDP_RESET POST request and then set new administrative password. This vulnerability is actively exploited and listed in CISA KEV.", "detailed_analysis": { "vulnerability_type": "Unauthenticated factory reset leading to authentication bypass and administrative access", "affected_products": [ "TP-Link TL-WA855RE V5 WiFi Range Extender" ], "exploitation_requirements": [ "Network access to the device", "No authentication required", "Ability to send POST request to device" ], "internet_facing_likelihood": "WiFi range extenders are commonly deployed in home and small office environments where they may be accessible from guest networks or misconfigured to be internet-accessible. While primarily designed for local network use, many are inadvertently exposed through UPnP, port forwarding, or weak network segmentation. Estimated 15-25% may have some form of internet accessibility.", "typical_deployment": "Infrastructure device - WiFi range extender typically deployed in homes and small offices to extend wireless network coverage", "deployment_statistics": "Approximately 15-25% of deployments may be internet-accessible through various misconfigurations, UPnP exposure, or intentional remote management setups", "active_exploitation": "Listed in CISA KEV catalog indicating confirmed active exploitation in the wild", "severity_factors": [ "No authentication required", "Complete device takeover possible", "Active exploitation confirmed", "Simple POST request exploitation", "Device reset capability" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Immediately update firmware to latest version from TP-Link support site", "Disable remote management features if not required", "Ensure device is not accessible from internet - check firewall rules and UPnP settings", "Change default administrative credentials and verify current admin password", "Monitor device logs for unauthorized reset attempts or configuration changes", "Consider network segmentation to isolate IoT devices from critical systems" ], "risk_assessment": { "exploit_likelihood": "HIGH - Simple unauthenticated POST request with confirmed active exploitation", "impact_assessment": "HIGH - Complete device compromise allowing attacker to control WiFi infrastructure, potentially intercept traffic, or use as pivot point", "exposure_scope": "MEDIUM - Thousands of vulnerable devices potentially accessible via internet through misconfigurations or intentional remote access setups" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T11:12:10.176844", "displayed_on_website": false }, { "cve_id": "CVE-2020-15069", "cvss_score": "9.8", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "HIGH_RISK", "confidence": "HIGH", "mitre_technique": "T1190", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2020-06-29T17:30:18.000Z", "cve_published_date_formatted": "2020-06-29", "kev_date_added": "2025-02-06", "kev_date_added_formatted": "2025-02-06", "kev_due_date": "2025-02-27", "days_to_kev": 1683, "days_since_kev": null, "is_new_kev": false, "summary": "Critical buffer overflow vulnerability in Sophos XG Firewall's HTTP/S Bookmarks feature that allows remote code execution without authentication. This vulnerability affects firewall appliances that are inherently internet-facing and is actively exploited in the wild.", "detailed_analysis": { "vulnerability_type": "Buffer overflow leading to remote code execution", "affected_products": [ "Sophos XG Firewall" ], "exploitation_requirements": [ "Network access to firewall", "No authentication required", "Target must have clientless access/user portal enabled" ], "internet_facing_likelihood": "Firewall appliances are designed to be internet-facing by their very nature, sitting at network perimeters and handling external traffic. Nearly 100% of Sophos XG Firewall deployments would be internet-accessible.", "typical_deployment": "Network security appliances deployed at network perimeters with interfaces exposed to the internet", "deployment_statistics": "95%+ of deployments are internet-facing as firewalls must process traffic between internal networks and the internet", "active_exploitation": "Listed in CISA KEV catalog indicating confirmed active exploitation in the wild", "severity_factors": [ "No authentication required", "Remote code execution", "Critical network infrastructure", "Active exploitation", "Internet-facing by design", "CVSS 9.8 Critical severity" ] }, "recommendations": [ "CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity", "Apply Hotfix HF062020.1 immediately for all Sophos XG Firewall v17.x systems", "Monitor firewall logs for suspicious activity in the user portal/clientless access features", "Consider temporarily disabling clientless access features until patching is complete", "Verify firewall configuration and check for unauthorized changes", "HIGHEST patch priority - critical infrastructure vulnerability with active exploitation" ], "risk_assessment": { "exploit_likelihood": "VERY HIGH - No authentication required, simple buffer overflow, active exploitation confirmed, affects internet-facing infrastructure", "impact_assessment": "CRITICAL - Full system compromise of network security appliance, potential for lateral movement, network monitoring bypass", "exposure_scope": "All internet-facing Sophos XG Firewall deployments running v17.x through v17.5 MR12 with clientless access enabled" }, "exploitation_method": "DIRECT_NETWORK", "data_source": "CIRCL", "known_ransomware_use": "Unknown", "ransomware_first_seen_date": null, "ransomware_days_after_kev": null, "deployment_analysis": {}, "web_search_used": false, "web_search_data": null, "cache_timestamp": "2026-06-03T10:27:39.449580", "displayed_on_website": false }, { "cve_id": "CVE-2020-11023", "cvss_score": "6.9", "attack_vector": "NETWORK", "cisa_kev_listed": true, "internet_exploitable": "LOW_RISK", "confidence": "HIGH", "mitre_technique": "T1203", "deployment_likelihood": "VERY_HIGH", "cve_published_date": "2020-04-29T00:00:00.000Z", "cve_published_date_formatted": "2020-04-29", "kev_date_added": "2025-01-23", "kev_date_added_formatted": "2025-01-23", "kev_due_date": "2025-02-13", "days_to_kev": 1730, "days_since_kev": null, "is_new_kev": false, "summary": "CVE-2020-11023 is a cross-site scripting (XSS) vulnerability in jQuery that allows execution of untrusted JavaScript code in victims' browsers when processing malicious HTML with