Sep 29, 2025
7 new incidents, 0 with updates.
Started
- ClosedCriticalPatched
Fortra GoAnywhere MFT: GoAnywhere MFT Deserialization of Untrusted Data Vulnerability
Fortra GoAnywhere MFT contains a deserialization of untrusted data vulnerability allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection. Added to CISA KEV on 2025-09-29.
Fortra GoAnywhere MFTClosed Sep 29, 2025
- ClosedCriticalPatched
Cl0p extortion campaign via Oracle E-Business Suite zero-day (CVE-2025-61882)
Cl0p-branded extortion emails reached executives from September 29, 2025, claiming theft of Oracle E-Business Suite data. Mandiant tied the campaign to exploitation of an unauthenticated RCE in EBS (SyncServlet), patched as CVE-2025-61882 for EBS 12.2.3 to 12.2.14. A separate July UiServlet SSRF campaign was later tracked as CVE-2025-61884.
Oracle E-Business SuiteClosed Oct 20, 2025
- ClosedCriticalPatched
Sudo: Inclusion of Functionality from Untrusted Control Sphere Vulnerability
Sudo contains an inclusion of functionality from untrusted control sphere vulnerability. This vulnerability could allow local attacker to leverage sudo’s -R (--chroot) option to run arbitrary commands as root, even if they are not listed in the sudoers file. Added to CISA KEV on 2025-09-29.
SudoClosed Sep 29, 2025
- ClosedHighPatched
Adminer: Server-Side Request Forgery Vulnerability
Adminer contains a server-side request forgery vulnerability that, when exploited, allows a remote attacker to obtain potentially sensitive information. Added to CISA KEV on 2025-09-29.
AdminerClosed Sep 29, 2025
- ClosedHighNo fix needed
Asahi ransomware attack halts orders and beer shipments in Japan (Qilin claims it)
A ransomware attack on September 29, 2025 stopped Asahi Group's order processing, shipments and call centres in Japan and briefly halted its six Japanese beer plants. Asahi confirmed ransomware and possible data theft; Qilin claimed the attack and leaked files it said were stolen.
Asahi Group Holdings (Japan operations)Closed Oct 15, 2025
- ClosedHighPatched
Cisco IOS and IOS XE: IOS and IOS XE Software SNMP Denial of Service and Remote Code Execution Vulnerability
Cisco IOS and IOS XE contains a stack-based buffer overflow vulnerability in the Simple Network Management Protocol (SNMP) subsystem that could allow for denial of service or remote code execution. A successful exploit could allow a low-privileged attacker to cause the affected system to reload, resulting in a DoS condition, or allow a high-privileged attacker to execute arbitrary code as the root user and obtain full control of the affected system. Added to CISA KEV on 2025-09-29.
Cisco IOS and IOS XEClosed Sep 29, 2025
- ClosedMediumPatched
Libraesva Email Security Gateway: Email Security Gateway Command Injection Vulnerability
Libraesva Email Security Gateway (ESG) contains a command injection vulnerability which allows command injection via a compressed e-mail attachment. Added to CISA KEV on 2025-09-29.
Libraesva Email Security GatewayClosed Sep 29, 2025
