pwn.watch: Ransomware incident updates

[high] Broadcom VMware vCenter: Broadcom VMware vCenter Path Traversal Vulnerability

Tue, 18 Aug 2026 00:00:00 GMT

Broadcom VMware vCenter contains a path traversal vulnerability which could allow a threat actor with network access to vCenter to execute arbitrary code. Added to CISA KEV on 2026-08-18.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-08-18: CISA added CVE-2026-59310 to the KEV catalog (due 2026-08-21).

CVEs: CVE-2026-59310

[high] JetBrains TeamCity: JetBrains TeamCity Deserialization of Untrusted Data Vulnerability

Wed, 05 Aug 2026 00:00:00 GMT

JetBrains TeamCity contains a deserialization of untrusted data vulnerability that could allow unauthenticated remote code execution via the agent polling protocol. Added to CISA KEV on 2026-08-05.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-08-05: CISA added CVE-2026-63077 to the KEV catalog (due 2026-08-08).

CVEs: CVE-2026-63077

[high] Cisco Secure Firewall Management Center (FMC): Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability

Wed, 29 Jul 2026 00:00:00 GMT

Cisco Secure Firewall Management Center (FMC) formerly known as Firepower Management Center contains a use of hard-coded password vulnerability that could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems. Added to CISA KEV on 2026-07-29.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-07-29: CISA added CVE-2026-20316 to the KEV catalog (due 2026-08-01).

CVEs: CVE-2026-20316

[high] SonicWall SMA1000 Appliances: SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability

Tue, 14 Jul 2026 00:00:00 GMT

SonicWall SMA1000 Appliances contain a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to potentially cause the appliance to make requests to unintended location. CISA added CVE-2026-15409, CVE-2026-15410 to the Known Exploited Vulnerabilities catalog on 2026-07-14 based on evidence of active exploitation.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-07-14: CISA added CVE-2026-15409, CVE-2026-15410 to the KEV catalog (due 2026-07-17).

CVEs: CVE-2026-15409, CVE-2026-15410

[high] Microsoft SharePoint Server: Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability

Wed, 01 Jul 2026 00:00:00 GMT

Microsoft SharePoint Server contains a deserialization of untrusted data vulnerability which allows an authorized attacker to execute code over a network. Added to CISA KEV on 2026-07-01.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-07-01: CISA added CVE-2026-45659 to the KEV catalog (due 2026-07-04).

CVEs: CVE-2026-45659

[high] PTC Windchill and FlexPLM: PTC Windchill and FlexPLM Improper Input Validation Vulnerability

Thu, 25 Jun 2026 00:00:00 GMT

PTC Windchill and FlexPLM contains an improper input validation vulnerability allowing an unauthenticated, remote attacker to execute arbitrary code by sending a malicious request to the network. Added to CISA KEV on 2026-06-25.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-06-25: CISA added CVE-2026-12569 to the KEV catalog (due 2026-06-28).

CVEs: CVE-2026-12569

[high] Oracle PeopleSoft Enterprise PeopleTools: Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability

Fri, 12 Jun 2026 00:00:00 GMT

Oracle PeopleSoft Enterprise PeopleTools contains a missing authentication for critical function vulnerability which could allow an unauthenticated attacker to obtain takeover of PeopleSoft Enterprise PeopleTools. Added to CISA KEV on 2026-06-12.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-06-12: CISA added CVE-2026-35273 to the KEV catalog (due 2026-06-15).

CVEs: CVE-2026-35273

[high] Check Point Security Gateway: Check Point Security Gateway Improper Authentication Vulnerability

Mon, 08 Jun 2026 00:00:00 GMT

Check Point Security Gateway contains an improper authentication vulnerability in IKEv1 key exchange that could allow an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password. Added to CISA KEV on 2026-06-08.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-06-08: CISA added CVE-2026-50751 to the KEV catalog (due 2026-06-11).

CVEs: CVE-2026-50751

[high] Palo Alto Networks PAN-OS: Palo Alto Networks PAN-OS Authentication Bypass Vulnerability

Fri, 29 May 2026 00:00:00 GMT

Palo Alto Networks PAN-OS contains an authentication bypass vulnerability that allows attackers to bypass security restrictions and establish an unauthorized VPN connection. Added to CISA KEV on 2026-05-29.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-05-29: CISA added CVE-2026-0257 to the KEV catalog (due 2026-06-01).

CVEs: CVE-2026-0257

[high] Nx Nx Console: Nx Console Embedded Malicious Code Vulnerability

Wed, 27 May 2026 00:00:00 GMT

Nx Console contains an embedded malicious code vulnerability that allowed a malicious version of Nx Console to be published. The compromised extension fetched an obfuscated payload that could harvested credentials from multiple sources on disk and in memory. Added to CISA KEV on 2026-05-27.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-05-27: CISA added CVE-2026-48027 to the KEV catalog (due 2026-06-10).

CVEs: CVE-2026-48027

[high] TanStack TanStack: TanStack Unspecified Vulnerability

Wed, 27 May 2026 00:00:00 GMT

TanStack contains an unspecified vulnerability that allowed malicious versions of the product to be published to the npm registry to publish credential-stealing malware under a trusted identity. Added to CISA KEV on 2026-05-27.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-05-27: CISA added CVE-2026-45321 to the KEV catalog (due 2026-06-10).

CVEs: CVE-2026-45321

[high] WebPros cPanel & WHM and WP2 (WordPress Squared): WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability

Thu, 30 Apr 2026 00:00:00 GMT

WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel. Added to CISA KEV on 2026-04-30.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-04-30: CISA added CVE-2026-41940 to the KEV catalog (due 2026-05-03).

CVEs: CVE-2026-41940

[high] Microsoft Defender: Microsoft Defender Insufficient Granularity of Access Control Vulnerability

Wed, 22 Apr 2026 00:00:00 GMT

Microsoft Defender contains an insufficient granularity of access control vulnerability that could allow an authorized attacker to escalate privileges locally. Added to CISA KEV on 2026-04-22.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-04-22: CISA added CVE-2026-33825 to the KEV catalog (due 2026-05-06).

CVEs: CVE-2026-33825

[high] Microsoft Windows: Microsoft Windows Link Following Vulnerability

Mon, 13 Apr 2026 00:00:00 GMT

Microsoft Windows contains a link following vulnerability that allows for privilege escalation CISA added CVE-2025-60710, CVE-2023-36424 to the Known Exploited Vulnerabilities catalog on 2026-04-13 based on evidence of active exploitation.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-04-13: CISA added CVE-2025-60710, CVE-2023-36424 to the KEV catalog (due 2026-04-27).

CVEs: CVE-2025-60710, CVE-2023-36424

[high] Cisco Secure Firewall Management Center (FMC): Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management

Thu, 19 Mar 2026 00:00:00 GMT

Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain a deserialization of untrusted data vulnerability in the web-based management interface that could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device. Added to CISA KEV on 2026-03-19.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-03-19: CISA added CVE-2026-20131 to the KEV catalog (due 2026-03-22).

CVEs: CVE-2026-20131

[high] SolarWinds Web Help Desk: SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability

Mon, 09 Mar 2026 00:00:00 GMT

SolarWinds Web Help Desk contain a deserialization of untrusted data vulnerability in AjaxProxy that could allow an attacker to run commands on the host machine. Added to CISA KEV on 2026-03-09.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-03-09: CISA added CVE-2025-26399 to the KEV catalog (due 2026-03-12).

CVEs: CVE-2025-26399

[high] BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA): BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection Vuln

Fri, 13 Feb 2026 00:00:00 GMT

BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)contain an OS command injection vulnerability. Successful exploitation could allow an unauthenticated remote attacker to execute operating system commands in the context of the site user. Successful exploitation requires no authentication or user interaction and may lead to system compromise, including unauthorized access, data exfiltration, and service disruption. Added to CISA KEV on 2026-02-13.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-02-13: CISA added CVE-2026-1731 to the KEV catalog (due 2026-02-16).

CVEs: CVE-2026-1731

[high] SmarterTools SmarterMail: SmarterTools SmarterMail Missing Authentication for Critical Function Vulnerability

Thu, 05 Feb 2026 00:00:00 GMT

SmarterTools SmarterMail contains a missing authentication for critical function vulnerability in the ConnectToHub API method. This could allow the attacker to point the SmarterMail instance to a malicious HTTP server which serves the malicious OS command and could lead to command execution. Added to CISA KEV on 2026-02-05.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-02-05: CISA added CVE-2026-24423 to the KEV catalog (due 2026-02-26).

CVEs: CVE-2026-24423

[high] SmarterTools SmarterMail: SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerability

Mon, 26 Jan 2026 00:00:00 GMT

SmarterTools SmarterMail contains an unrestricted upload of file with dangerous type vulnerability that could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution. CISA added CVE-2025-52691, CVE-2026-23760 to the Known Exploited Vulnerabilities catalog on 2026-01-26 based on evidence of active exploitation.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-01-26: CISA added CVE-2025-52691, CVE-2026-23760 to the KEV catalog (due 2026-02-16).

CVEs: CVE-2025-52691, CVE-2026-23760

[critical] WatchGuard Firebox: Firebox Out of Bounds Write Vulnerability

Fri, 19 Dec 2025 00:00:00 GMT

WatchGuard Fireware OS iked process contains an out of bounds write vulnerability in the OS iked process. This vulnerability may allow a remote unauthenticated attacker to execute arbitrary code and affects both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when configured with a dynamic gateway peer. Added to CISA KEV on 2025-12-19.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-12-19: CISA added CVE-2025-14733 to the KEV catalog (due 2025-12-26).

CVEs: CVE-2025-14733

[critical] React2Shell: CVSS 10 unauthenticated RCE in React Server Components and Next.js

Fri, 12 Dec 2025 00:00:00 GMT

A flaw in how React Server Components deserialize Flight payloads let an unauthenticated request run code on the server. Next.js App Router apps were affected by default. China-nexus groups including Earth Lamia and Jackpot Panda exploited it within hours of disclosure. CVE-2025-66478 (the Next.js id) was rejected as a duplicate.

Status: closed · Patch: patched · Fixed in: React 19.0.1, React 19.1.2, React 19.2.1, Next.js: patched release lines per the React/Next.js advisory

Latest updates:

2025-12-12: Unit 42 updates its threat brief on ongoing exploitation (source)
2025-12-05: CISA adds CVE-2025-55182 to KEV
2025-12-03: React discloses a critical vulnerability in React Server Components and ships fixes (source)

CVEs: CVE-2025-55182

[critical] Jaguar Land Rover cyberattack stops car production for five weeks

Fri, 14 Nov 2025 00:00:00 GMT

A cyberattack that began on August 31, 2025 forced JLR to shut down IT systems and halt production worldwide from September 1. A phased restart began October 8; UK production was back to normal by November 14. The UK government guaranteed a £1.5B loan to keep JLR's suppliers afloat.

Status: closed · Patch: no-fix-needed

Latest updates:

2025-11-14: UK production returns to normal (source)
2025-10-08: Phased manufacturing restart begins (source)
2025-09-28: UK government guarantees a £1.5B loan to support JLR and suppliers (source)

[critical] Oracle E-Business Suite: E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability

Mon, 20 Oct 2025 00:00:00 GMT

Oracle E-Business Suite contains a server-side request forgery (SSRF) vulnerability in the Runtime component of Oracle Configurator. This vulnerability is remotely exploitable without authentication. Added to CISA KEV on 2025-10-20.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-10-20: CISA added CVE-2025-61884 to the KEV catalog (due 2025-11-10).

CVEs: CVE-2025-61884

[critical] Cl0p extortion campaign via Oracle E-Business Suite zero-day (CVE-2025-61882)

Mon, 20 Oct 2025 00:00:00 GMT

Cl0p-branded extortion emails reached executives from September 29, 2025, claiming theft of Oracle E-Business Suite data. Mandiant tied the campaign to exploitation of an unauthenticated RCE in EBS (SyncServlet), patched as CVE-2025-61882 for EBS 12.2.3 to 12.2.14. A separate July UiServlet SSRF campaign was later tracked as CVE-2025-61884.

Status: closed · Patch: patched · Fixed in: Oracle Security Alert for CVE-2025-61882 (requires the October 2023 CPU as a prerequisite)

Latest updates:

2025-10-20: CISA adds the related EBS SSRF flaw CVE-2025-61884 to KEV (source)
2025-10-06: CISA adds CVE-2025-61882 to KEV
2025-10-04: Oracle publishes a Security Alert for CVE-2025-61882 (source)

CVEs: CVE-2025-61882

[high] Asahi ransomware attack halts orders and beer shipments in Japan (Qilin claims it)

Wed, 15 Oct 2025 00:00:00 GMT

A ransomware attack on September 29, 2025 stopped Asahi Group's order processing, shipments and call centres in Japan and briefly halted its six Japanese beer plants. Asahi confirmed ransomware and possible data theft; Qilin claimed the attack and leaked files it said were stolen.

Status: closed · Patch: no-fix-needed

Latest updates:

2025-10-07: Qilin claims responsibility and leaks data (source)
2025-10-03: Asahi confirms ransomware and possible data exfiltration (source)
2025-09-29: Cyberattack halts orders, shipments and call centres in Japan (source)

[critical] Microsoft Windows: 3 exploited vulnerabilities (CVE-2011-3402, CVE-2013-3918, CVE-2021-43226)

Mon, 06 Oct 2025 00:00:00 GMT

CVE-2011-3402: Microsoft Windows Kernel contains an unspecified vulnerability in the TrueType font parsing engine in win32k.sys in the kernel-mode drivers that allows remote attackers to execute arbitrary code via crafted font data in a Word document or web page. CVE-2013-3918: Microsoft Windows contains an out-of-bounds write vulnerability in the InformationCardSigninHelper Class ActiveX control, icardie.dll. An attacker could exploit the vulnerability by constructing a specially crafted webpage. When a user views the webpage, the vulnerability could allow remote code execution. An attacker who successfully exploited this vulnerability could gain the same user rights as the current user. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. CVE-2021-43226: Microsoft Windows Common Log File System Driver contains a privilege escalation vulnerability that could allow a local, privileged attacker to bypass certain security mechanisms. Added to CISA KEV on 2025-10-06.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-10-06: CISA added CVE-2011-3402 to the KEV catalog (due 2025-10-27).
2025-10-06: CISA added CVE-2013-3918 to the KEV catalog (due 2025-10-27).
2025-10-06: CISA added CVE-2021-43226 to the KEV catalog (due 2025-10-27).

CVEs: CVE-2011-3402, CVE-2013-3918, CVE-2021-43226

[critical] Fortra GoAnywhere MFT: GoAnywhere MFT Deserialization of Untrusted Data Vulnerability

Mon, 29 Sep 2025 00:00:00 GMT

Fortra GoAnywhere MFT contains a deserialization of untrusted data vulnerability allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection. Added to CISA KEV on 2025-09-29.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-09-29: CISA added CVE-2025-10035 to the KEV catalog (due 2025-10-20).

CVEs: CVE-2025-10035

[high] Collins Aerospace MUSE ransomware knocks out check-in at Heathrow, Brussels and Berlin

Wed, 24 Sep 2025 00:00:00 GMT

Ransomware hit RTX's Collins Aerospace MUSE passenger-processing software on September 19, 2025, breaking electronic check-in, bag drop and boarding at several European airports. Airports fell back to manual check-in and handwritten boarding passes; Brussels was still disrupted days later. ENISA confirmed it was ransomware.

Status: closed · Patch: no-fix-needed

Latest updates:

2025-09-24: Collins works on restoring software for affected airlines (source)
2025-09-22: ENISA confirms third-party ransomware behind the disruption (source)
2025-09-20: Disruption expected to stretch into Sunday; Brussels cancels flights (source)

[critical] RARLAB WinRAR: WinRAR Path Traversal Vulnerability

Tue, 12 Aug 2025 00:00:00 GMT

RARLAB WinRAR contains a path traversal vulnerability affecting the Windows version of WinRAR. This vulnerability could allow an attacker to execute arbitrary code by crafting malicious archive files. Added to CISA KEV on 2025-08-12.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-08-12: CISA added CVE-2025-8088 to the KEV catalog (due 2025-09-02).

CVEs: CVE-2025-8088

[critical] ToolShell: mass exploitation of on-prem SharePoint (CVE-2025-53770, CVE-2025-49704, CVE-2025-49706)

Tue, 22 Jul 2025 00:00:00 GMT

Unauthenticated RCE chain against on-premises SharePoint Server, mass-exploited from July 18, 2025. Microsoft observed Linen Typhoon, Violet Typhoon and Storm-2603 exploiting it; Storm-2603 deployed Warlock ransomware. Patching alone is not enough: rotate ASP.NET machine keys and restart IIS. SharePoint Online was not affected.

Status: closed · Patch: patched · Fixed in: See Microsoft customer guidance for CVE-2025-53770

Latest updates:

2025-07-22: Microsoft attributes exploitation to Linen Typhoon, Violet Typhoon and Storm-2603 (source)
2025-07-22: CISA adds CVE-2025-49704 and CVE-2025-49706 to KEV
2025-07-20: CISA adds CVE-2025-53770 to KEV and publishes guidance (source)

CVEs: CVE-2025-49704, CVE-2025-49706, CVE-2025-53770

[critical] CitrixBleed 2: NetScaler memory leak exploited to hijack sessions

Thu, 10 Jul 2025 00:00:00 GMT

An out-of-bounds read in NetScaler ADC and Gateway leaked memory, including session tokens, to unauthenticated attackers. GreyNoise saw exploitation from June 23, before public PoCs on July 4. After patching, admins had to kill all active ICA, PCoIP, RDP, AAA and LB sessions.

Status: closed · Patch: patched · Fixed in: 14.1-43.56, 13.1-58.32, 13.1-FIPS/NDcPP 13.1-37.235

Latest updates:

2025-07-10: CISA adds CVE-2025-5777 to KEV
2025-07-04: watchTowr publishes technical analysis; public PoCs follow (source)
2025-06-26: ReliaQuest reports likely targeted exploitation (source)

CVEs: CVE-2025-5777

[high] Ingram Micro SafePay ransomware takes down ordering systems for a week

Thu, 10 Jul 2025 00:00:00 GMT

SafePay ransomware hit IT distributor Ingram Micro around July 3, 2025, taking down its website, ordering systems, the Xvantage platform and Impulse licensing. Ingram Micro took systems offline and restored order processing globally by July 9-10.

Status: closed · Patch: no-fix-needed

Latest updates:

2025-07-09: Order processing restored globally (source)
2025-07-05: Ingram Micro confirms ransomware on internal systems (8-K) (source)
2025-07-03: Outage begins across website and ordering systems (source)

[critical] Fortinet FortiOS: FortiOS Use of Hard-Coded Credentials Vulnerability

Wed, 25 Jun 2025 00:00:00 GMT

Fortinet FortiOS contains a use of hard-coded credentials vulnerability that could allow an attacker to cipher sensitive data in FortiOS configuration backup file via knowledge of the hard-coded key. Added to CISA KEV on 2025-06-25.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-06-25: CISA added CVE-2019-6693 to the KEV catalog (due 2025-07-16).

CVEs: CVE-2019-6693

[critical] Marks & Spencer ransomware (Scattered Spider / DragonForce) halts online orders for 46 days

Tue, 10 Jun 2025 00:00:00 GMT

Scattered Spider got in through social engineering of a third-party IT provider and encrypted M&S's VMware ESXi hosts with DragonForce ransomware over Easter 2025. Contactless payments, Click & Collect and online ordering broke; online orders were paused from April 25 to June 10. M&S put the hit at about £300M of operating profit.

Status: closed · Patch: no-fix-needed

Latest updates:

2025-06-10: Online clothing orders resume after 46 days (source)
2025-05-21: M&S estimates about £300M cost; disruption to last into July (source)
2025-04-29: Attack linked to Scattered Spider and DragonForce ransomware on ESXi (source)

[critical] SAP NetWeaver: NetWeaver Deserialization Vulnerability

Thu, 15 May 2025 00:00:00 GMT

SAP NetWeaver Visual Composer Metadata Uploader contains a deserialization vulnerability that allows a privileged attacker to compromise the confidentiality, integrity, and availability of the host system by deserializing untrusted or malicious content. Added to CISA KEV on 2025-05-15.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-05-15: CISA added CVE-2025-42999 to the KEV catalog (due 2025-06-05).

CVEs: CVE-2025-42999

[critical] SAP NetWeaver Visual Composer zero-day: unauthenticated webshell uploads (CVE-2025-31324)

Thu, 15 May 2025 00:00:00 GMT

A CVSS 10 missing-authorization flaw in the NetWeaver Visual Composer Metadata Uploader let anyone POST JSP webshells to /developmentserver/metadatauploader. ReliaQuest found it while investigating compromises; SAP shipped an emergency fix on April 24, 2025.

Status: closed · Patch: patched · Fixed in: See SAP Security Note for CVE-2025-31324

Latest updates:

2025-05-15: CISA adds the related NetWeaver flaw CVE-2025-42999 to KEV
2025-04-29: CISA adds CVE-2025-31324 to KEV
2025-04-24: SAP releases an emergency fix; ReliaQuest publishes its findings (source)

CVEs: CVE-2025-31324

[critical] Langflow: Missing Authentication Vulnerability

Mon, 05 May 2025 00:00:00 GMT

Langflow contains a missing authentication vulnerability in the /api/v1/validate/code endpoint that allows a remote, unauthenticated attacker to execute arbitrary code via crafted HTTP requests. Added to CISA KEV on 2025-05-05.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-05-05: CISA added CVE-2025-3248 to the KEV catalog (due 2025-05-26).

CVEs: CVE-2025-3248

[critical] Microsoft Windows: Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability

Tue, 08 Apr 2025 00:00:00 GMT

Microsoft Windows Common Log File System (CLFS) Driver contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally. Added to CISA KEV on 2025-04-08.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-04-08: CISA added CVE-2025-29824 to the KEV catalog (due 2025-04-29).

CVEs: CVE-2025-29824

[critical] CrushFTP: Authentication Bypass Vulnerability

Mon, 07 Apr 2025 00:00:00 GMT

CrushFTP contains an authentication bypass vulnerability in the HTTP authorization header that allows a remote unauthenticated attacker to authenticate to any known or guessable user account (e.g., crushadmin), potentially leading to a full compromise. Added to CISA KEV on 2025-04-07.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-04-07: CISA added CVE-2025-31161 to the KEV catalog (due 2025-04-28).

CVEs: CVE-2025-31161

[critical] Ivanti Connect Secure, Policy Secure, and ZTA Gateways: Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability

Fri, 04 Apr 2025 00:00:00 GMT

Ivanti Connect Secure, Policy Secure, and ZTA Gateways contains a stack-based buffer overflow vulnerability that allows a remote unauthenticated attacker to achieve remote code execution. Added to CISA KEV on 2025-04-04.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-04-04: CISA added CVE-2025-22457 to the KEV catalog (due 2025-04-11).

CVEs: CVE-2025-22457

[critical] Fortinet FortiOS and FortiProxy: FortiOS and FortiProxy Authentication Bypass Vulnerability

Tue, 18 Mar 2025 00:00:00 GMT

Fortinet FortiOS and FortiProxy contain an authentication bypass vulnerability that allows a remote attacker to gain super-admin privileges via crafted CSF proxy requests. Added to CISA KEV on 2025-03-18.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-03-18: CISA added CVE-2025-24472 to the KEV catalog (due 2025-04-08).

CVEs: CVE-2025-24472

[critical] Microsoft Windows: 6 exploited vulnerabilities (CVE-2025-24983, CVE-2025-24984, CVE-2025-24985, CVE-2025-24991, CVE-2025-24993, CVE-2025-26633)

Tue, 11 Mar 2025 00:00:00 GMT

CVE-2025-24983: Microsoft Windows Win32 Kernel Subsystem contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally. CVE-2025-24984: Microsoft Windows New Technology File System (NTFS) contains an insertion of sensitive Information into log file vulnerability that allows an unauthorized attacker to disclose information with a physical attack. An attacker who successfully exploited this vulnerability could potentially read portions of heap memory. CVE-2025-24985: Microsoft Windows Fast FAT File System Driver contains an integer overflow or wraparound vulnerability that allows an unauthorized attacker to execute code locally. CVE-2025-24991: Microsoft Windows New Technology File System (NTFS) contains an out-of-bounds read vulnerability that allows an authorized attacker to disclose information locally. CVE-2025-24993: Microsoft Windows New Technology File System (NTFS) contains a heap-based buffer overflow vulnerability that allows an unauthorized attacker to execute code locally. CVE-2025-26633: Microsoft Windows Management Console (MMC) contains an improper neutralization vulnerability that allows an unauthorized attacker to bypass a security feature locally. Added to CISA KEV on 2025-03-11.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-03-11: CISA added CVE-2025-24983 to the KEV catalog (due 2025-04-01).
2025-03-11: CISA added CVE-2025-24984 to the KEV catalog (due 2025-04-01).
2025-03-11: CISA added CVE-2025-24985 to the KEV catalog (due 2025-04-01).

CVEs: CVE-2025-24983, CVE-2025-24984, CVE-2025-24985, CVE-2025-24991, CVE-2025-24993, CVE-2025-26633

[critical] VMware ESXi: ESXi Arbitrary Write Vulnerability

Tue, 04 Mar 2025 00:00:00 GMT

VMware ESXi contains an arbitrary write vulnerability. Successful exploitation allows an attacker with privileges within the VMX process to trigger an arbitrary kernel write leading to an escape of the sandbox. Added to CISA KEV on 2025-03-04.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-03-04: CISA added CVE-2025-22225 to the KEV catalog (due 2025-03-25).

CVEs: CVE-2025-22225

[critical] Microsoft Windows: Windows Win32k Improper Resource Shutdown or Release Vulnerability

Mon, 03 Mar 2025 00:00:00 GMT

Microsoft Windows Win32k contains an improper resource shutdown or release vulnerability that allows for local, authenticated privilege escalation. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. Added to CISA KEV on 2025-03-03.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-03-03: CISA added CVE-2018-8639 to the KEV catalog (due 2025-03-24).

CVEs: CVE-2018-8639

[critical] SonicWall SonicOS: SonicOS SSLVPN Improper Authentication Vulnerability

Tue, 18 Feb 2025 00:00:00 GMT

SonicWall SonicOS contains an improper authentication vulnerability in the SSLVPN authentication mechanism that allows a remote attacker to bypass authentication. Added to CISA KEV on 2025-02-18.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-02-18: CISA added CVE-2024-53704 to the KEV catalog (due 2025-03-11).

CVEs: CVE-2024-53704

[critical] SimpleHelp: Path Traversal Vulnerability

Thu, 13 Feb 2025 00:00:00 GMT

SimpleHelp remote support software contains multiple path traversal vulnerabilities that allow unauthenticated remote attackers to download arbitrary files from the SimpleHelp host via crafted HTTP requests. These files may include server configuration files and hashed user passwords. Added to CISA KEV on 2025-02-13.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-02-13: CISA added CVE-2024-57727 to the KEV catalog (due 2025-03-06).

CVEs: CVE-2024-57727

[critical] Sophos CyberoamOS: CyberoamOS (CROS) SQL Injection Vulnerability

Thu, 06 Feb 2025 00:00:00 GMT

CyberoamOS (CROS) contains a SQL injection vulnerability in the WebAdmin that allows an unauthenticated attacker to execute arbitrary SQL statements remotely. Added to CISA KEV on 2025-02-06.

Status: closed · Patch: unpatched · Fixed in: None: CISA says the product is end-of-life; discontinue use

Latest updates:

2025-02-06: CISA added CVE-2020-29574 to the KEV catalog (due 2025-02-27).

CVEs: CVE-2020-29574

[critical] SonicWall SMA1000 Appliances: SMA1000 Appliances Deserialization Vulnerability

Fri, 24 Jan 2025 00:00:00 GMT

SonicWall SMA1000 Appliance Management Console (AMC) and Central Management Console (CMC) contain a deserialization of untrusted data vulnerability, which can enable a remote, unauthenticated attacker to execute arbitrary OS commands. Added to CISA KEV on 2025-01-24.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-01-24: CISA added CVE-2025-23006 to the KEV catalog (due 2025-02-14).

CVEs: CVE-2025-23006

[critical] Fortinet FortiOS and FortiProxy: FortiOS and FortiProxy Authentication Bypass Vulnerability

Tue, 14 Jan 2025 00:00:00 GMT

Fortinet FortiOS and FortiProxy contain an authentication bypass vulnerability that may allow an unauthenticated, remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module. Added to CISA KEV on 2025-01-14.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-01-14: CISA added CVE-2024-55591 to the KEV catalog (due 2025-01-21).

CVEs: CVE-2024-55591

[critical] Qlik Sense: Sense HTTP Tunneling Vulnerability

Mon, 13 Jan 2025 00:00:00 GMT

Qlik Sense contains an HTTP tunneling vulnerability that allows an attacker to escalate privileges and execute HTTP requests on the backend server hosting the software. Added to CISA KEV on 2025-01-13.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-01-13: CISA added CVE-2023-48365 to the KEV catalog (due 2025-02-03).

CVEs: CVE-2023-48365