Joseph Lee

October 2025 Threat Report

Just over 4,100 new CVEs emerged in October 2025, representing new attack surfaces and placing pressure on defenders to identify and patch. For operational resilience, organizations need to scan their IT infrastructure often and prioritize mitigation efforts.

A free trial of Greenbone’s OPENVAS BASIC lets defenders scan their enterprise IT estate and stay on top of emerging threats. The trial includes access to Greenbone’s OPENVAS ENTERPRISE FEED, delivering industry-leading coverage for CVEs and other IT security vulnerabilities. This month’s threat report will cover some of the most critical new vulnerabilities being actively exploited, and emerging high-risk CVEs with widespread exposure.

Oracle EBS Exploited in Two Separate Ransomware Campaigns

CVE-2025-61882 (CVSS 9.8, EPSS ~99th pctl) is an unauthenticated remote code execution (RCE) flaw in Oracle E-Business Suite (EBS), actively exploited since at least August 9, 2025 [1][2]. The CVE is being used in mass exploitation campaigns for data-theft and extortion by the Cl0p ransomware [S0611] operator. Public PoC exploits appeared in early October and a detailed technical analysis is available.

Besides CVE-2025-61882, CVE-2025-61884 (CVSS 7.5, EPSS ~93rd pctl), a Server-Side Request Forgery (SSRF) flaw [CWE-918], also in Oracle EBS, was actively exploited in October 2025. CVE-2025-61884 was added to CISA KEV and has been used to deploy ransomware [T1486]. Attacks leveraging CVE-2025-61882 reportedly used data theft for extortion. However, attacks exploiting CVE-2025-61884 have used file encryption for ransom impact.

Both CVEs received alerts from numerous national CERT entities globally [3][4][5][6][7][8][9][10]. Greenbone’s OPENVAS ENTERPRISE FEED includes an active check and remote version check for CVE-2025-61882, and a remote version check for CVE-2025-61884 allowing defenders to identify vulnerable assets. According to Oracle’s official advisories [11][12], versions 12.2.3 to 12.2.14 of EBS are affected.

Smartbedded Meteobridge Now Actively Exploited Via CVE-2025-4008

CVE-2025-4008 (CVSS 8.8, ~97th pctl), published on May 13, 2025, is a remote unauthenticated command injection vulnerability [CWE-77] in Smartbedded Meteobridge, now actively exploited. The flaw resides in the template.cgi script of the Meteobridge web interface, which insecurely implements eval() calls. Exploitation allows attackers to execute arbitrary commands with root privileges on affected devices. Smartbedded Meteobridge is a gateway that connects personal weather stations to public networks. Shodan reveals roughly 70–130 devices exposed on the public internet.

A proof-of-concept (PoC) exploit and full technical write-up were published by ONEKEY, which discovered the flaw during firmware analysis. While the vendor’s official advisory claims that Internet exposure is a “precondition for exploiting any security vulnerability”, insider attacks can also present high risk to organizations. Greenbone is able to detect vulnerable instances of Smartbedded Meteobridge with an active check and remote version check. Users should upgrade to version 6.2 or later.

RediShell: A 13-Year-Old Lua Flaw Allows RCE in Redis

CVE-2025-49844 (CVSS 9.9, EPSS ~90th pctl) allows authenticated RCE on all unpatched Redis instances with Lua scripting enabled. The flaw, nicknamed RediShell, is caused by a use-after-free vulnerability [CWE-416] in the Lua garbage collector. Lua scripting is enabled by default, often with authentication disabled, increasing the risk of weak configuration.

Redis is prevalent in cloud environments and has been a hot target for cryptomining [T1496] and ransomware [T1486] leveraging P2PInfect, Redigo, HeadCrab, and Migo malware. A PoC exploit for CVE-2025-49844 confirms exploitability, along with two additional Lua engine flaws:

Multiple national security alerts have been issued for the CVEs [1][2][3][4][5][6]. OPENVAS ENTERPRISE FEED includes authenticated security checks to identify exposure across many Linux environments. Redis has issued a patch and additional mitigations can be found in the vendor’s official advisory.

Emergency Out-of-Band Patch for Windows Server Update Service and More Microsoft Risks Emerge

Microsoft’s October security update disclosed a total of 201 new CVEs. Two were flagged as “Exploitation Detected” and 14 as “Exploitation more likely”. In addition to these disclosures, an emergency alert was issued by CISA for CVE-2025-59287, affecting the Windows Server Update Service (WSUS). Here are brief descriptions of the most high-risk emerging threats to Microsoft products:

  • CVE-2025-59287 (CVSS 9.8, EPSS ~70th pctl): A flaw in WSUS allows unauthorized RCE when untrusted data is deserialized [CWE-502]. Numerous national CERT alerts have been published, many referencing a public PoC exploit [1][2][3][4][5][6][7][8][9]. Microsoft’s official advisory also acknowledges a PoC exploit exists.
  • CVE-2025-33073 (CVSS 8.8, EPSS ~97th pctl): A Windows SMB vulnerability allows an authorized attacker to remotely achieve privilege escalation [CWE-284] to SYSTEM level. The flaw was added to CISA KEV.
  • CVE-2025-59230 (CVSS 7.8, EPSS ~95 pctl): An elevation of privilege vulnerability [CWE-284] in the Windows Remote Access Connection Manager has been added to CISA KEV.
  • CVE-2025-24990 (CVSS 7.8, EPSS ~91st pctl): The end-of-life (EOL) third party Agere Modem driver in Microsoft Windows is now considered actively exploited. The flaw is due to an untrusted pointer dereference [CWE-822] which can lead to arbitrary code execution.
  • CVE-2025-55315 (CVSS 9.9): A security feature bypass vulnerability in NET Core can lead to HTTP request smuggling [CWE-444]. An authenticated attacker could exploit the flaw to bypass front-end security controls, hijack user sessions, perform request-forgery attacks. A technical description is available increasing the risk. See the official security advisory for affected versions and patches.
  • CVE-2025-59502 (CVSS 7.5, EPSS ~81 pctl): An unauthorized attacker can remotely induce uncontrolled resource consumption [CWE-400] in Windows Remote Procedure Call (RPC) resulting in Denial of Service (DoS). Microsoft classifies the CVE as “Exploitation More Likely”.
  • CVE-2025-47827 (CVSS 4.6): Secure Boot can be bypassed because the igel-flash-driver module improperly verifies a cryptographic signature [CWE-324]. The flaw allows a malicious root filesystem to be mounted from an unverified SquashFS image. Even though the vulnerability arises in IGEL OS, the attack chain has implications for Windows/UEFI systems. Microsoft has flagged this flaw as actively exploited and a technical description with PoC exploit is available.

Greenbone provides robust detection for Microsoft’s recent security updates. The OPENVAS ENTERPRISE FEED includes detection for 156 (78%) of the 201 newly disclosed CVEs affecting Microsoft products.

Defenders Still “Living On the Edge”: Constant Flow of Perimeter Device Flaws

Greenbone’s June 2024 Threat Report first began tracking high-risk vulnerabilities in perimeter network devices. Since then, edge vulnerabilities have continued to surface without abate. In this section, we will review emerging threats to devices meant to protect internal networks from attacks.

F5 Hack: Multiple New Vulnerabilities in F5 Products Disclosed

In October 2025, F5 claimed a “highly sophisticated nation-state” adversary had long-term, persistent access to internal systems, indicating dwell time of at least 12 months. The attackers stole BIG-IP source code and internal vulnerability information. The data theft prompted an urgent publication of CVEs triaged in the F5 vulnerability pipeline.

In total, 44 new CVEs were published for F5 products in October 2025, several were subject of national CERT alerts [1][2][3][4][5][6][7][8][9][10]. Active exploitation has not been reported and no PoC exploits have been published. However, F5 vulnerabilities are often used in ransomware attacks. In response, Greenbone added new security tests for F5 devices, covering 32 (73%) of the 44 new CVEs.

Fresh CVEs in Ivanti Products for Defenders to Patch

Trend Micro’s Zero Day Initiative (ZDI) publicly disclosed 14 unpatched vulnerabilities in Ivanti Endpoint Manager (EPM) after months of unsuccessful coordination with Ivanti. According to reports, Ivanti requested six months to address the flaws. ZDI’s disclosure effectively exposed these flaws as “zero-day” vulnerabilities, meaning attackers could now exploit them before patches are available.

Greenbone is able to detect all of ZDI’s newly disclosed CVEs and Ivanti CVEs disclosed by other security researchers. Greenbone’s OPENVAS ENTERPRISE FEED includes detection tests for all 17 Ivanti CVEs disclosed in October 2025.

Fortinet’s Products Exposed to 32 New CVEs in October

In total, 32 CVEs were published for Fortinet products in October 2025. However, only 17 of these are listed on the vendor’s official advisory page. Greenbone added checks for 21 of the 32 new CVEs, providing high detection coverage for defenders using Fortinet devices. Fortinet has 20 CVEs listed in CISA’s KEV catalog; 13 of these are associated with ransomware attacks indicating high risk for customers.

Critical Unauthenticated RCE in WatchGuard Fireware OS

CVE-2025-9242 (CVSS 9.3, EPSS ~90th pctl) affecting WatchGuard Fireware OS allows unauthenticated RCE. Fireware OS supports the vendor’s firewalls, VPN gateways, policy enforcement and intrusion prevention systems (IPS). Watchtowr security researchers have published a technical description and PoC exploit increasing the risk.

Several alerts have been issued from government agencies regarding CVE-2025-9242 [1][2][3]. The OPENVAS ENTERPRISE FEED includes a remote version check to identify affected appliances. Users should update to version 12.3.1_Update3, 12.5.13, 12.11.4, 2025.1.1 or later and review the vendor’s official advisory for more information.

CVE-2025-59978: Junos Space Flaw Lets Authenticated Attackers Inject Malicious Scripts

CVE-2025-59978 (CVSS 9.0) is a stored XSS flaw [CWE-79] in Juniper Networks’ Junos Space. Junos Space is a network‑management and orchestration that provides centralized management of Juniper’s routers, switches and security devices. The vulnerability lets a low-privileged authenticated attacker inject JavaScript <script> tags which execute with a viewing admin’s privileges. No active exploitation or public PoCs are yet known. Greenbone’s OPENVAS ENTERPRISE FEED includes a remote version check to identify vulnerable instances.  All Junos Space versions before 24.1R4 are affected. See the official security advisory for more information.

Local Privilege Escalation Flaw in VMware Exploited In-The-Wild

CVE-2025-41244 (CVSS 7.8), published in September 2025, is now flagged as actively exploited. Multiple sources have linked in-the-wild exploitation to UNC5174, a China-linked threat actor. The flaw is a local privilege escalation [CWE-284] when VMware Tools is managed by Aria Operations with SDMP enabled. Successful exploitation allows a local attacker to escalate privileges to root on the same VM. A technical analysis and PoC exploit are available increasing the risk.

The VMware platform has appeared on CISA KEV 26 times including this latest CVE; 8 of these entries indicate use in ransomware attacks. CERT advisories have been issued from various countries [1][2][3][4]. So far in 2025, a total of 40 CVEs have been issued across all VMware platforms. In response, Greenbone has added detection to both the OPENVAS ENTERPRISE FEED and COMMUNITY feed, covering  36 (90%) of VMware’s 2025 vulnerabilities.

To mitigate attacks, Windows users should update to VMware Tools 12.5.4 (Windows 32-bit: 12.4.9). Linux users should update to vendor-provided open-vm-tools. If you can’t patch immediately, disable SDMP and strictly limit guest access. Specific versions of VMware Aria Operations, VMware Tools, VMware Cloud Foundation, VMware Telco Cloud Platform and VMware Telco Cloud Infrastructure are affected. See the official advisory for more details.

Gladinet CentreStack Flaw Allows Machine Key Theft and RCE

CVE-2025-11371 (CVSS 9.8, EPSS 89th pctl) is an unauthenticated Local File Inclusion (LFI) flaw [CWE-552] that allows remote attackers to read arbitrary files, including the Web.config in Gladinet CentreStack and Triofox. In the wild attacks have been observed where the LFI flaw was exploited to retrieve the machine key from Web.config, then forge ASP.NET ViewState payloads. For RCE, attackers are exploiting another ViewState deserialization: CVE-2025-30406 (CVSS 9.8, EPSS ~99th pctl). A detailed technical description and attack chain analysis is publicly available.

Greenbone’s OPENVAS ENTERPRISE FEED has included detection tests for both CVEs described above since April 2025 [1][2]. CentreStack has published patches for users to prevent exploitation. According to Gladinet’s official advisory, users who can’t patch should disable the temp handler in UploadDownloadProxy’s Web.config to block the unauthenticated /storage/t.dn endpoint abused for LFI.

Zimbra Zero-Day Used to Target Brazilian Military

CVE-2025-27915 (CVSS 5.4, EPSS 97th pctl) is a stored cross-site scripting (XSS) vulnerability [CWE-79] in Zimbra Collaboration Suite (ZCS). The flaw is caused by insufficient sanitization of HTML content contained in .ICS calendar files. As a result, attackers can launch phishing attacks with malicious .ICS calendar invites [T1566.001] to execute arbitrary JavaScript within a victim’s webmail session.

The CVE has been exploited in targeted attacks against the Brazilian military and added to CISA KEV. Belgium’s CERT.be has published a security advisory. ZCS is highly targeted by threat actors; CISA KEV contains 14 CVEs; five associated with ransomware attacks [T1486]. Greenbone’s OPENVAS ENTERPRISE FEED includes remote banner check to identify vulnerable instances. The flaw affects ZCS versions 9.0, 10.0, and 10.1. Users should upgrade to the latest version and be especially cautious handling email attachments.

Critical Kentico Xperience Flaws are Actively Exploited

CVE-2025-2746 and CVE-2025-2747 (both CVSS 9.8) allow unauthenticated remote attackers to gain full administrative control of Kentico Xperience via an authentication bypass [CWE-288] flaw. Both CVEs are actively exploited. Exploitation enables attackers to manipulate or exfiltrate CMS data and deploy malicious payloads with administrative privileges.

A full technical description, and PoC exploits increase the risk of near future exploitation. Multiple national CERT advisories have been published for the new CVEs [1][2][3]. The OPENVAS ENTERPRISE FEED includes an active check for CVE-2025-2746 and an active check and remote version check for CVE-2025-2747. Versions through 13.0.172 and 13.0.178 are affected and the vendor has published hotfixes for mitigation.

New High-Severity Flaw in Zoho ManageEngine ADManager Plus

CVE-2025-10020 (CVSS 8.8, EPSS ~73rd pctl) is an authenticated command injection vulnerability [CWE-77] in the Custom Script component of ManageEngine ADManager Plus. The flaw allows attackers with low-privileged access to gain arbitrary RCE. ManageEngine is a widely used on-prem solution for system administrators, IT operations teams, and security engineers to monitor, automate, and secure IT infrastructures.

Despite no active exploitation, public technical description, or PoC exploit, ManageEngine has historically attracted attention from cyber adversaries. This makes CVE-2025-10020 high risk when combined with stolen credentials or insider attacks. The ManageEngine platform is listed on CISA KEV nine times; twice for ransomware attacks (CVE-2022-47966 and CVE-2021-40539). Updating to version 8024 is strongly recommended.

The OPENVAS ENTERPRISE FEED provides:

  • A remote version check to detect servers vulnerable to CVE-2025-10020
  • Detection tests for all Zoho vulnerabilities listed in CISA KEV including CVE-2022-47966 and CVE-2021-40539 used in ransomware attacks [T1486]
  • Detection tests for >70% of CVEs affecting Zohocorp products from 2021 onward

Flowise Server Gives Attackers RCE and Access to Secrets

CVE-2025-61913 (CVSS 9.9) is a path traversal flaw [CWE-22] in Flowise that lets low-privileged, authenticated attackers read and write arbitrary files, potentially leading to RCE. Flowise is a drag & drop user interface and backend server for building customized large language model (LLM) applications.

CVE-2025-61913 stems from improper input validation of the file_path parameter in WriteFileTool and ReadFileTool. The flaw enables access to sensitive files such as /root/.flowise/encryption.key and /root/.flowise/database.sqlite in Docker, or /etc/passwd, /etc/shadow, and /root/.ssh/id_rsa in non-Docker setups. The vendor has published a full PoC exploit themselves, and at least one other PoC exploit exists [1]. However, in-the-wild exploitation has not been confirmed.

Several other new high-risk CVEs also impact Flowise Server:

Germany’s BSI has issued WID-SEC alerts for all CVEs described above [2][3][4][5]. The OPENVAS ENTERPRISE FEED includes two remote version detection checks which address all aforementioned CVEs affecting Flowise [6][7][8]. Users should update to version 3.0.8 or later and disable ALLOW_BUILTIN_DEP during installation. See the vendor’s official advisory for more information.

CVE-2025-37729: Critical RCE Vulnerability in Elastic Cloud Enterprise

CVE-2025-37729 (CVSS 9.1) affecting Elastic Cloud Enterprise (ECE) allows RCE to authenticated attackers with admin privileges. Exploitation could allow exfiltration of sensitive data due to improper handling of Jinjava template expressions. The vulnerability poses a significant insider threat, particularly in hybrid and multi-cloud environments where ECE is deployed. Spain’s INCIBE CERT has issued a security alert. Greenbone’s OPENVAS ENTERPRISE FEED includes a remote banner check to identify vulnerable instances. According to the vendor’s official advisory, versions 2.5.0 through 3.8.1 and 4.0.0 through 4.0.1 are affected.

Summary

The October 2025 Threat Report only scratches the surface of new software flaws emerging in the past month—and OPENVAS SECURITY INTELLIGENCE’s ability to detect them. October 2025 saw 4,100 new CVEs and novel cyber attack campaigns leveraging both fresh vulnerabilities and already known ones. This past month, high-impact flaws drove ransomware, data-theft, and operational downtime leading to attempts at corporate extortion and lost revenue. Greenbone’s OPENVAS BASIC free trial plus the OPENVAS ENTERPRISE FEED include detection modules for many emerging and legacy CVEs, helping security teams find, triage, and fix vulnerable IT assets.

Contact Test Now Buy Here Back to Overview

/by
Greenbone AG

Greenbone Adds New Compliance Profiles for Huawei EulerOS

Greenbone is excited to announce new compliance policies for Huawei’s EulerOS and openEuler. These compliance policies are the result of close collaboration with Huawei to provide OPENVAS SCAN users with authenticated checks for over 200 key security controls. By thoroughly vetting security settings, defenders gain high degree security assurances and visibility into the security posture of their EulerOS infrastructure.

Out of the box, Operating Systems (OS) are configured for ease of use and flexibility. By default, operating systems are set up to handle almost any task without post-install adjustment. Many unnecessary kernel modules and services are enabled, and security settings are relaxed. For maximum security, organizations need to harden the default post-installation settings to keep critical data and operations secure. Compliance testing turns configuration guidance into verifiable controls so teams can audit security at scale. By verifying hardened security configurations, defenders gain high security assurances that their IT assets are resilient against cyber attack.

OPENVAS SCAN allows IT security teams to automate policy‑driven audits across their IT infrastructure. Our platform already includes a library of compliance profiles for CIS controls in critical cybersecurity areas such as Apache, IIS, NGINX, MongoDB, Oracle, PostgreSQL, Windows and Linux [1][2][3][4] and policies based on national guidance for encryption standards.

Now, we’re expanding our compliance auditing and reporting capabilities with new policy profiles for Huawei’s EulerOS family. These new offerings bring policy checks right into OPENVAS SCAN’s vulnerability management workflow. These security hardening controls apply to EulerOS, OpenEuler, HCE, and EulerOS Virtualization OSs. Once the policy scans have been executed in OPENVAS SCAN, the results can be viewed as a specialized audit report.

Read on to find out more about how these new compliance profiles help IT security teams harden their security posture against cyber attack.

OPENVAS SCAN Now Includes Compliance Profiles for Huawei EulerOS

Greenbone’s new compliance scans for Huawei EulerOS follow our existing policy deployment model. OPENVAS SCAN’s compliance policies are specialized scan configurations composed of targeted Vulnerability Tests (VTs) that evaluate whether hosts meet defined security requirements. The new compliance policies for EulerOS are distributed to OPENVAS SCAN instances via the OPENVAS ENTERPRISE FEED and COMMUNITY FEED.

The new compliance profile curates families of authenticated security checks specially tailored to EulerOS environments. Authenticated auditing ensures that accurate evidence is collected from each scanned endpoint, providing the highest visibility for security attestation. OPENVAS SCAN also offers customized reporting formats, including an executive compliance report suited for management oversight.

To execute an audit, users can configure remote access for authenticated scans,  select a policy, run the policy scan task, and view an evidence‑rich audit report that shows which controls passed, failed, or require further manual investigation. Policies are managed in OPENVAS SCAN’s Compliance Policies area and executed as vulnerability scans with the same level of control as other scan configurations: alerting, reporting, and scheduling to verify continuous compliance.

What Do the New Huawei EulerOS Compliance Policies Cover?

The new Huawei EulerOS profile’s goal is simple: reduce attack surface by verifying secure settings on every host. The policy scan aggregates over 200 of distinct security checks across Linux networking, services and local configuration. The policy tests resemble the CIS Benchmarks, while aligning with Huawei’s platform specifics requirements. The new EulerOS compliance policies can also be adjusted to support each organization’s internal policy needs.

The new EulerOS compliance policies include:

  • Service Hardening: Ensures unnecessary or insecure network services (e.g., DNS, NFS, RPC, SNMP, HTTP, Avahi) are disabled or not installed to reduce the system’s attack surface.
  • System Configuration and Kernel Security: Validates secure kernel parameters, sysctl settings, ICMP behavior, address space layout randomization (ASLR), and protection mechanisms like dmesg_restrict.
  • Authentication and Access Control: Enforces strong password policies, account lockout rules, sudo configurations, and user access restrictions to prevent unauthorized access.
  • File and Directory Permissions: Checks critical system files (e.g., /etc/passwd, /etc/shadow, SSH keys) and directories for proper ownership and secure permissions.
  • Password Policy Enforcement: Checks for password complexity, minimum length, expiration period, history count, retry limits, and lockout mechanisms to ensure strong authentication hygiene.
  • User Account and Privilege Management: Reviews active user accounts for unused, duplicate, or privileged users; ensures direct root login is disabled and only necessary users have shell access.
  • Boot and Initialization Security: Validates GRUB configurations, bootloader protections, secure boot settings, and kernel module restrictions.
  • Firewall and Network Traffic Control: Ensures proper iptables/nftables/firewalld configurations for INPUT/OUTPUT policies and default zones to limit unauthorized network communication.
  • Package and Software Management: Checks for secure package management practices, disallows installation of unnecessary or insecure software, and confirms that package repositories are configured correctly.
  • CVE Discovery and Vulnerability Detection: Identifies known vulnerabilities (CVEs) present on the system by checking installed packages against vulnerability feeds. This helps prioritize remediation of exploitable software flaws based on real-world threat data.
  • Logging and Auditing: Verifies audit rules for privileged commands, tracks access to sensitive files, configures rsyslog for remote logging, and ensures audit logs are properly stored and managed.

These security checks are implemented as Vulnerability Tests (VTs), grouped into families, and referenced from the EulerOS policy object. OPENVAS SCAN ships with many other platform‑specific VT families—including Huawei EulerOS Local Security Checks—which are enabled inside of the new policies to collect host‑level evidence of CVE exposure in addition to configuration hardening.

Which Huawei EulerOS Distributions are Covered?

Greenbone’s new compliance profiles are designed for the EulerOS ecosystem including distributions for enterprise and cloud deployments. Delivery is simple: the new Huawei EulerOS compliance profiles are provided via OPENVAS COMMUNITY FEED for Greenbone’s OPENVAS SCAN product. Users receive them with routine feed updates similar to other default policies. This ensures your policy content stays up to date without additional maintenance.

Here is a description  of each EulerOS distribution covered in Greenbone’s new compliance profiles and a brief description of the OS-specific security coverage.

EulerOS (Traditional/Enterprise)

Coverage focuses on EulerOS 2.0 service packs published by Huawei. OPENVAS SCAN maps each compliance test to Huawei’s official EulerOS security advisories portal, the EulerOS Security Configuration Baseline, and EulerOS lifecycle information. This includes service packs SP9 and newer.

EulerOS Virtual (VM Editions)

For data centers that rely on EulerOS Virtual for x86_64 and ARM64 architecture, our new compliance profiles recognize EulerOS Virtual versions—including releases 2.9.x, 2.10.x, 2.11.x, 2.12.x, 2.13.x. They also include checks for virtualization‑specific packages and services accordingly (for example, KVM/QEMU components and their hardening/patch levels).

openEuler (Community)

For organizations that standardize on openEuler LTS, Greenbone consumes the CSAF‑formatted advisories published by the openEuler project and aligns compliance checks using OS version awareness. The openEuler lifecycle and downloads page document the available LTS releases and service packs. The compliance profiles support auditing versions 20.03, 22.03, 24.03 based on openEuler Security Configuration Baseline.

Huawei Cloud EulerOS (HCE)

For Huawei Cloud EulerOS (HCE) 2.0 and HCE 3.0 cloud deployments, our new compliance profiles leverage publicly available advisories to validate HCE package baselines and configuration hardening specific to cloud images and managed repositories—recognizing differences such as package managers and repo layout between.

Summary

Greenbone’s new compliance profiles for EulerOS distributions extend OPENVAS SCAN’s capabilities with policy‑driven audits. The policies can be used to attest the hardened security posture of EulerOS, EulerOS Virtual, openEuler and HCE. Delivered through the OPENVAS COMMUNITY FEED, the audits execute authenticated checks to verify secure baselines for a wide scope of attack surface. The profiles are also complemented with detailed technical and executive reporting for stakeholders. These new tools enhance OPENVAS SCAN as a reliable way to harden Huawei-based Linux fleets at enterprise scale.

Contact Test Now Buy Here Back to Overview

/by
Joseph Lee

CVE-2025-64446: A Lurking FortiWeb Vulnerability Proves Critical amid Active Exploitation

Discussion of a new security issue affecting Fortinet’s FortiWeb began circulating online in early October 2025, when cyber deception firm Defused reported capturing a working exploit via honeypot. FortiWeb is Fortinet’s web application firewall (WAF) platform, designed to shield web applications from malicious activity. For over one month, Defused’s revelation mostly lurked in the shadows; no CVE assignment, no acknowledgment from Fortinet. Security researchers recently noted that Fortinet seems to have silently patched the flaw without notifying users beforehand.

The issue finally hit the mainstream on November 13th, when watchTowr Labs posted a full proof-of-concept (PoC) exploit. One day later, the vulnerability was assigned an ID: CVE-2025-64446 (CVSS 9.8, EPSS 97th pctl) is now officially recognized as an actively exploited, critical severity issue in Fortinet FortiWeb. The flaw allows attackers to create rogue admin accounts and execute administrative actions.

Fortinet officially classifies CVE-2025-64446 as a Relative Path Traversal issue [CWE-23]. However, it should also be considered an Authentication Bypass Using an Alternate Path flaw [CWE-288], since URL manipulation allows attackers to access a legacy Common Gateway Interface (CGI) processor, which does not implement proper authentication. Users should consult Fortinet’s official advisory, conduct an immediate assessment to determine their risk, and consider emergency mitigation for this flaw.

A free trial of Greenbone’s OPENVAS BASIC is available for defenders to scan their enterprise IT infrastructure for emerging threats such as CVE-2025-64446 in Fortinet’s FortiWeb appliances.

How the Exploit against CVE-2025-64446 Works

The exploit chain for CVE-2025-64446 combines two core design flaws in FortiWeb:

  • A Relative Path Traversal vulnerability [CWE-23] allows unprotected URL routing between the management interface’s REST API and its CGI processor. This incorrect routing serves as an alternative path to bypass authentication.
  • An Authentication Bypass Using an Alternate Path flaw [CWE-288] in the CGI processor does not perform proper authentication for data provided via a connecting client’s CGIINFO HTTP header.

watchTowr’s Python-based PoC demonstrates how attackers can circumvent FortiWeb’s intended API to  abuse the legacy CGI processor to create unauthorized admin accounts on the device. Here is how the exploit works:

  1. Attackers can communicate with FortiWeb management port over HTTPS (port 443) with certificate validation disabled to avoid hang-ups with self-signed, outdated, or otherwise invalid certificates.
  2. Unpatched FortiWeb appliances do not properly sanitize the URI before applying authorization rules. Unauthenticated users can achieve path traversal by starting their request URL with https://api/v2.0/… while also traversing via ../../../../../ to cgi-bin/fwbcgi.
  3. Source code analysis revealed that FortiWeb’s legacy CGI backend includes a function named cgi_auth(), that blindly trusts any authorization claims provided in the CGIINFO header if the username matches any existing user; including the built-in admin user. This means an unauthenticated attacker can spoof the admin user to gain elevated permissions.
  4. FortiWeb’s CGI processor then processes the rest of the request body with full administrative permissions.
  5. The attacker can submit a malicious JSON object that instructs the system to create a new administrator account with an arbitrary, attacker-controlled username and password to take full control of the device.

How to Mitigate the Emerging Fortinet Vulnerability

FortiWeb users should consult Fortinet’s advisory, conduct an immediate assessment to determine their risk, and consider emergency mitigation for this flaw. The vendor also officially recommends disabling HTTP and HTTPS for internet-facing interfaces until an upgrade can be performed. If a FortiWeb HTTP/HTTPS Management interface is only accessible from internal network endpoints, the risk is reduced.

Organizations running unpatched versions of FortiWeb should consider this a critical priority issue. The following versions of FortiWeb are affected:

  • FortiWeb 8.0.0 through 8.0.1
  • FortiWeb 7.6.0 through 7.6.4
  • FortiWeb 7.4.0 through 7.4.9
  • FortiWeb 7.2.0 through 7.2.11
  • FortiWeb 7.0.0 through 7.0.11
  • FortiWeb 6.4 through 6.4.3 (disclosed by watchTowr Labs [1])
  • FortiWeb 6.3 through 6.3.23 (disclosed by watchTowr Labs)

It’s important to note that Fortinet’s list of affected products is less comprehensive than the one provided by third-party security researchers. The EU’s Cyber Resilience Act (CRA) comes into effect in late 2026, bringing a new measure of legal accountability to software vendors that issue untimely or inaccurate security information to their users. The CRA will require software vendors to report known vulnerabilities and known exploits to ENISA within 24 hours.

Greenbone’s OPENVAS ENTERPRISE FEED Has Got You Covered

Greenbone’s vulnerability test development team assessed this emerging FortiWeb flaw before it was published as a CVE. A version check [1] and active check [2] are now available in the  OPENVAS ENTERPRISE FEED. These detection tests include both version-based checks and active checks that interact with appliances over HTTP to detect vulnerability to the flaw. This dual-layer approach ensures that organizations can reliably identify vulnerable FortiWeb instances.

As new details emerge, Greenbone will refine and expand coverage to ensure that customers can identify affected instances. A free trial of Greenbone’s OPENVAS BASIC is available for defenders to scan their enterprise IT infrastructure for emerging threats such as CVE-2025-64446 in Fortinet’s FortiWeb appliances.

Contact Test Now Buy Here Back to Overview

/by
Joseph Lee

September 2025 Threat Report: New Exploits, Active Campaigns, and Critical CVEs

In total, just over 4,500 CVEs were published in September, exposing defenders to new risk. For operational resilience, organizations need to scan their IT infrastructure to identify where hidden risk could impact their operations. A free trial of Greenbone’s OPENVAS BASIC allows defenders to scan their enterprise IT infrastructure to stay on top of emerging threats. This free trial includes access to Greenbone’s OPENVAS ENTERPRISE FEED, an industry-leading coverage for CVEs and other IT security vulnerabilities.

So far in September, our blog has covered three emerging cyber security events: SessionReaper, an unauthenticated RCE flaw in Adobe Commerce and Magento, CVSS 10 exposed in Fortra GoAnywhere MFT, and an ArcaneDoor espionage campaign actively exploiting a new vulnerability in Cisco ASA and FTD. In this edition of the monthly threat report, we will cover other high-risk threats from September 2025.

Emerging Threats to Linux Systems

Linux OS is the backbone of global IT infrastructure. As attackers increasingly target Linux environments, vulnerability scanning is essential for operational resilience and service continuity. Here are the top vulnerabilities to Linux disclosed in September 2025.

High-Severity Sudo Flaw is Now Actively Exploited

In July, the Greenbone Threat Report flagged an emerging threat: CVE-2025-32463 (CVSS 7.8) permits unauthorized privilege escalation [TA0004] to root by tricking the Linux sudo command (all releases ≥ 1.9.14 and before 1.9.17p1) into loading attacker-controlled shared libraries [T1129]. CVE-2025-32463 is now being actively exploited and has been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog. Canada’s Cyber Centre has issued a new CERT advisory, adding to the existing alerts [1][2][3]. Organizations cannot achieve high resilience while waiting for known vulnerabilities to be flagged as actively exploited. Greenbone added detection tests for CVE-2025-32463 to the OPENVAS ENTERPRISE FEED and COMMUNITY FEED immediately in July 2025, giving users advanced detection and the opportunity to patch.

CVE-2025-38352 POSIX CPU TOCTOU Race in the Linux Kernel
CVE-2025-38352 (CVSS 7.4, EPSS ~70th pctl) is a time-of-check to time-of-use (TOCTOU) flaw [CWE-367] in Linux kernel’s POSIX CPU timers. CVE-2025-38352 allows denial of service (DoS) [T1499] on affected systems and has been added to CISA’s KEV. While no public proof-of-concept (PoC) exploit is available, security researchers have published a detailed technical analysis.

The German BSI has issued two alerts for CVE-2025-38352: one for the Linux kernel [1] and one for Android [2]. Greenbone’s OPENVAS ENTERPRISE FEED and COMMUNITY FEED include patch-level checks for Linux distributions.

High-Severity Vulnerability in Linux UDisks Daemon
CVE-2025-8067 (CVSS 8.5) is a local, unauthenticated privilege escalation [TA0004] flaw in Red Hat Enterprise Linux’s (RHEL) UDisks daemon. The UDisks daemon is a system service for managing storage devices such as hard drives, SSDs, USB drives, optical media, and partitions. The root cause of CVE-2025-8067 is improper handling of negative integer indexes, which can trigger an out-of-bounds memory read [CWE-125]. Exploitation can result in DoS [T1499], or local privilege escalation [T1068] by mapping a loop device to a privileged local file [1].

There’s no indication of active exploitation, but PoC code has been published [2][3]. Germany’s BSI has issued a security advisory [4]. The OPENVAS ENTERPRISE FEED and COMMUNITY FEED include package patch-level checks for many Linux distributions. Patching is the only viable mitigation.

New ImageMagick CVEs Pose DoS and RCE Risks
CVE-2025-53014 (CVSS 9.8), CVE-2025-53019 (CVSS 7.5), and CVE-2025-53101 (CVSS 9.8) arise from improper processing of image filenames [CWE-66] in the ImageMagick packages for Linux. Exploitation could reportedly lead to DoS [T1499] and arbitrary code execution [T1203] in the case of CVE-2025-53101. Although these three CVEs aren’t known to be actively exploited in the wild, the German BSI has issued a CERT-Bund Advisory [WID-SEC-2025-1537]. The OPENVAS ENTERPRISE FEED and COMMUNITY FEED include detection checks across many Linux distributions.

Multiple High-Risk Security Issues in Cisco Products

CVE-2025-20352 and CVE-2025-20312 (both CVSS 7.7) capped off a tumultuous month for Cisco products. Both CVEs were published on September 24th, 2025. CVE-2025-20352 was discovered by Cisco while fulfilling a customer’s technical support case. The flaw was added to CISA KEV five days later and advisories have been issued by several national CERT agencies [1][2][3][4][5][6][7]. Both CVEs are in the Simple Network Management Protocol (SNMP).

CVE-2025-20352 is due to a stack overflow [CWE-121] in the SNMP subsystem of affected products: IOS/IOS XE (all SNMP versions) and Meraki MS390/Catalyst 9300 running Meraki CS 17 or earlier. Exploitation allows authenticated DoS and potentially root-level RCE, depending on the credentials possessed by the attacker. DoS is possible with an SNMPv1/v2c read-only community string or valid SNMPv3 user credentials. To achieve root-level RCE, administrative (privilege 15) credentials for the device are required.

CVE-2025-20312 allows an authenticated remote attacker to cause a DoS. The flaw is caused by improper error handling that allows the system to enter into an infinite loop when parsing crafted SNMP requests [CWE-835]. Exploitation requires a valid SNMP community string with either read-write or read-only permissions. Affected systems are limited to IOS XE switches with both SNMP enabled and WRED for MPLS EXP configured.

No public exploits are available for either CVE. Users who cannot patch may mitigate the vulnerability by limiting SNMP access to trusted network entities and disabling the vulnerable Object Identifiers (OIDs). Cisco has published advisories for each CVE separately [8][9];. The OPENVAS ENTERPRISE FEED provides both authenticated and remote version detection tests for the actively exploited CVE-2025-20352 [10][11] and a remote version detection check for CVE-2025-20312 [12].

Twice-Patched Flaw in SolarWinds Help Desk Still Vulnerable

CVE-2025-26399 (CVSS 9.8) is an unauthenticated RCE vulnerability in SolarWinds Web Help Desk 12.8.7 and all prior versions. The CVE is a patch bypass for CVE-2024-28988, which itself was a bypass for CVE-2024-28986. The original CVE-2024-28986 was added to CISA’s KEV catalog shortly after its disclosure. While there are no confirmed reports of this latest bypass being exploited in the wild, security experts believe exploitation is likely. The root cause remains the same: flawed deserialization of untrusted data [CWE-502] in the product’s AjaxProxy component.

National CERT advisories have been issued by Canada’s CCCS, CERT-FR, and Spain’s INCIBE-CERT. Greenbone’s OPENVAS ENTERPRISE FEED includes a remote banner version check, allowing security teams to identify affected instances. Given the critical severity and history of exploitation, applying the Web Help Desk 12.8.7 Hotfix 1 patch is strongly recommended.

Sitecore XM, XP, and XC Actively Exploited

CVE-2025-53690 (CVSS 9.0, EPSS ~95th pctl) is a deserialization vulnerability [CWE-502] affecting Sitecore Experience Manager (XM), Experience Platform (XP), Experience Commerce (XC), and some Managed Cloud instances. Unauthenticated attackers can craft malicious __VIEWSTATE payloads to achieve RCE with admin privileges. The vulnerability is under active attack and has been added to CISA’s KEV, joining other exploited SiteCore flaws. At least one Sitecore CVE is known to be leveraged in ransomware attacks.

Attackers are leveraging CVE-2025-53690 to deploy a novel reconnaissance malware dubbed “WEEPSTEEL”. The malware performs host and network discovery [TA0043], exfiltrates sensitive configuration files [TA0010], and escalates privileges [TA0004] by creating local Administrator accounts.

Techniques observed in the attacks include:

The OPENVAS ENTERPRISE FEED includes a remote banner version check for detecting affected Sitecore products. Sitecore’s official advisory strongly urges users to rotate machine keys, enable ViewState MAC, review IoCs, and audit for signs of compromise.

“Exploitation More Likely” for Nine CVEs in Microsoft’s September Patch Cycle

Microsoft’s September patch cycle addresses 97 flaws; 9 rated critical, with the majority rated Important. Affected products include the Windows OS, SMB, NTFS, and NTLM, Microsoft Office, Azure, SQL Server, Hyper-V, DirectX, and more. Microsoft flagged nine vulnerabilities with an “Exploitation More Likely” status:

  • CVE-2025-55234 (CVSS 9.8): Improper authentication [CWE-287] in Windows’ SMB services could allow attackers to replay stolen credentials to gain privileged access under certain conditions. Customers who have not enabled SMB hardening measures are advised to assess their environment and apply either SMB Server signing SMB Server Extended Protection for Authentication (EPA).
  • CVE-2025-55319 (CVSS 9.8): A command injection flaw [CWE-77] in Agentic AI integrations for Visual Studio Code (version 1.0.0 before 1.104.0) allows RCE for an unauthorized attacker. Users should update to the most recent version of Visual Studio Code [1].
  • CVE-2025-54110 (CVSS 8.8): A vulnerability in the Windows kernel involving an integer overflow / wraparound [CWE-190] can allow a local attacker to escape AppContainer Isolation. This can allow privilege escalation to the SYSTEM level and execution of arbitrary code [2].
  • CVE-2025-54918 (CVSS 8.8): An authentication flaw [CWE-287] in NTLM allows an authenticated attacker to remotely escalate privileges to the SYSTEM level, enabling full control of a Windows host [3].
  • CVE-2025-54916 (CVSS 7.8): A buffer handling bug [CWE-120] in the NTFS file system driver can be triggered by specially crafted input, leading to arbitrary code execution for an authenticated local attacker [4].
  • CVE-2025-54098 (CVSS 7.8): Hyper-V virtualization implements improper access control [CWE-284] that permits a malicious guest VM to escape to the host or gain elevated privileges within the hypervisor [5].
  • CVE-2025-54093 (CVSS 7.0): A TOCTOU race condition [CWE-367] in Windows TCP/IP could allow local attackers to gain elevated privileges via precise timing attacks [6].
  • CVE-2025-53803 (CVSS 5.5): A vulnerability in the Windows kernel results in error messages that leak sensitive information [CWE-209] to a local authenticated attacker, including sensitive memory addresses within kernel space [7].
  • CVE-2025-53804 (CVSS 5.5): An information-disclosure vulnerability [CWE-200] in the Windows kernel subsystem enables a local user to determine sensitive memory addresses within kernel space [8].

Organizations that do not attest patch levels across their IT infrastructure are at increased risk of harboring exploitable security gaps that attackers may exploit. Greenbone’s OPENVAS ENTERPRISE FEED frequently updates detection for the latest Microsoft vulnerabilities.

Summary

September 2025 underscored escalating cyber risks for many popular enterprise software platforms. Critical flaws in Fortra GoAnywhere MFT, Cisco ASA/FTD, and Sitecore were among thousands of new CVEs shaping the month’s threat landscape. Active cyber attack campaigns highlight the urgency of proactive vulnerability management. Regular scanning with Greenbone’s OPENVAS ENTERPRISE FEED enables defenders to detect and mitigate emerging risks before attackers exploit them. A free trial of Greenbone’s OPENVAS BASIC allows defenders to stay on top of emerging threats.

Contact Test Now Buy Here Back to Overview

/by
Joseph Lee

ArcaneDoor Espionage Campaign Exploiting High-Risk Cisco ASA and FTD Firewall Flaws

On September 25, 2025, three new CVEs affecting Cisco networking products exploded onto the global cyber security landscape. Two of these were actively exploited as zero-days prior to their disclosure. Greenbone now includes detection tests for all three new high-risk CVEs in the OPENVAS ENTERPRISE FEED.

arcanedoor espionage campaign

CVE-2025-20333 (CVSS 9.9) and CVE-2025-20362 (CVSS 6.5) affect the VPN web server of the Cisco Secure Firewall Adaptive Security Appliance (ASA) and Firewall Threat Defense (FTD) platforms. The VPN web server enables remote devices to access an internal network via SSL/TLS-based VPN. These two CVEs can be chained for full system takeover of unpatched devices. Furthermore, they are reportedly leveraged in ArcaneDoor espionage campaigns. Also, CVE-2025-20363 (CVSS 9.0), while not tagged as actively exploited, has been bundled into most national security advisories addressing the first two flaws. The latter affects an extended list of products: Cisco ASA and FTD, as well as Cisco IOS, IOS XE, and IOS XR under certain configurations.

Greenbone’s OPENVAS ENTERPRISE FEED includes detection checks for each new high-risk CVE [1][2][3][4][5][6][7][8][9]. You can start a free trial to scan your IT environment for these and other cybersecurity vulnerabilities. Below, we discuss aspects of this ongoing situation, including the attack campaign, a brief technical description of the three flaws, and mitigation guidance.

Campaigns Exploiting Cisco ASA 5500-X Devices

CVE-2025-20333 and CVE-2025-20362 were actively exploited as zero-days targeting Cisco ASA 5500-X series devices without Secure Boot. Chained, they give unauthenticated attackers full control of the breached device. Known campaigns leveraging these flaws have deployed RayInitiator and LINE VIPER to achieve persistence [TA0003], execute commands remotely [TA0011], and exfiltrate data [TA0010]. These attacks are attributed to the ArcaneDoor cyber-espionage campaign, which has targeted perimeter network devices since early 2024 and are considered highly sophisticated. Advanced techniques used in the attacks include:

  • Low-level ROMMON (ROM Monitor) tampering [004] and Pre-OS bootkit [T1542.003] for covert persistence between reboots
  • Command-line interface (CLI) interception [008]
  • Disabling system logging [001]
  • Network packet capture [T1040]
  • Bypassing AAA network-device authentication and authorization protocols [004]

No public PoC exploits are available, but CISA and Cisco have confirmed that CVE-2025-20333 and CVE-2025-20362 are already exploited in-the-wild [1][2]. While attacks leveraging CVE-2025-20363 have not been confirmed, the CVE is included in many national CERT advisories covering the first two CVEs [3][4][5][6][7][8][9][10]. Supplemental guidance includes malware analysis from the UK’s NCSC [11] and IoC hunt instructions from CISA [12].

Technical Analysis of New Critical-Risk Cisco CVEs

All three CVEs are caused by improper validation of user-supplied input in HTTPS requests [CWE-20]. When combined, CVE-2025-20333 and CVE-2025-20362 allow attackers to execute arbitrary code as root on the victim’s system. CVE-2025-20333 is the culprit for allowing RCE, but requires valid VPN credentials. CVE-2025-20362 provides authentication bypass. CVE-2025-20363 also allows unauthenticated access to restricted URLs, but across a wider scope of products including: Cisco ASA and FTD software, as well as Cisco IOS, IOS XE, and IOS XR, under certain configurations.

Here is a brief description of each vulnerability:

  • CVE-2025-20333 (CVSS 9.9): Crafted HTTPS requests to the VPN web server can lead to arbitrary RCE as root on the VPN web server for Cisco ASA and FTD devices. The flaw is classified as a Buffer Overflow [CWE-122] that requires valid VPN user credentials for exploitation.
  • CVE-2025-20362 (CVSS 6.5): Unauthenticated attackers achieve authentication bypass to reach restricted URL endpoints on the VPN web server for Cisco ASA and FTD devices. The flaw is due to missing authorization [CWE-862] for sensitive HTTP paths.
  • CVE-2025-20363 (CVSS 9.0): Unauthenticated RCE as root on the VPN web server of Cisco ASA and FTD devices. Low-privilege authenticated attackers may achieve RCE as root on Cisco IOS, Cisco IOS XE, and Cisco IOS XR software. The flaw is a heap-based buffer overflow [CWE-122] caused by improper validation of user-supplied input in HTTP requests.

Mitigation Instructions for Impacted Devices

CISA has issued an Emergency Directive for all federal agencies to immediately remediate the ongoing threat. Users of these products should immediately begin to identify, analyze, and mitigate affected products to protect their operations. For analysis, users should follow CISA’s Core Dump and Hunt Instructions and Cisco’s official Detection Guide.

If a breach is identified, compromised devices should be disconnected but not powered off, and Incident Response Plans (IRP) and eviction processes should be activated. Victims should notify the relevant regional authorities and submit their core dump(s) for analysis. Malware analysis for RayInitiator and LINE VIPER has been published from the UK’s NCSC [1]. Cisco’s official advisories can be consulted for more detailed information [2][3][4]. Platforms vulnerable to CVE-2025-20333 and CVE-2025-20362 include:

ASA hardware, ASA-Service Module (ASA-SM), ASA Virtual (ASAv), and ASA firmware on Firepower 2100/4100/9300. Affected Cisco ASA software versions are:

  • 12 – < 9.12.4.72
  • 14 – < 9.14.4.28
  • 16 – < 9.16.4.85
  • 17 – < 9.17.1.45
  • 18 – < 9.18.4.67
  • 19 – < 9.19.1.42
  • 20 – < 9.20.4.10
  • 22 – < 9.22.2.14
  • 23 – < 9.23.1.19

Cisco FTD appliances with software versions:

  • 0 – < 7.0.8.1
  • 1 – all versions
  • 2 – < 7.2.10.2
  • 3 – all versions
  • 4 – < 7.4.2.4
  • 6 – < 7.6.2.1
  • 7 – < 7.7.10.1

CVE-2025-20363 affects the aforementioned ASA and FTD products and all releases of Cisco IOS, Cisco IOS XE with Remote Access SSL VPN enabled and Cisco IOS XR Software versions 6.8 and 6.9 (32-bit on ASR 9001) with the HTTP server enabled. Cisco NX-OS Software, 64-bit IOS XR, IOS/IOS XE without SSL VPN enabled, and ASA/FTD without WebVPN/SSL VPN features configured are not affected.

Summary

The coordinated disclosure of CVE-2025-20333, CVE-2025-20362, and CVE-2025-20363 has triggered a global security response. Combined, the CVEs have potential for full system compromise of Cisco ASA and FTD devices as well as devices using Cisco IOS, IOS XE, and IOS XR software with certain configurations. An ongoing ArcaneDoor espionage campaign has been identified leveraging CVE-2025-20333 and CVE-2025-20362 against legacy ASA 5500-X devices.

Security agencies, including CISA and national CERTs, have issued urgent mitigation guidance, stressing immediate patching, forensic investigation, and IRP activation. Greenbone has released detection checks for all three vulnerabilities in the OPENVAS ENTERPRISE FEED to help organizations rapidly identify and remediate exposure. Start a free trial today to scan your IT environment for these and other cybersecurity risks.

Contact Test Now Buy Here Back to Overview

/by
Greenbone AG

Italy’s Cybersecurity Wake-Up Call: Why 2025 Is the Year Everything Changed

Cybersecurity has moved from boardroom buzzword to front-page reality in Italy this year. Walk into any conference room, attend any summit, or join any industry discussion, and you’ll hear the same urgent conversations: companies are under pressure from increasingly sophisticated cyber threats. However, there’s also something new happening – a wave of innovation and collaboration that’s finally matching the scale of the challenge.cybersecurity in italy key insights Kopie

From Abstract Risks to Real Solutions

The year started strong at ITASEC in February, where something refreshing emerged. Instead of the usual doom-and-gloom presentations about theoretical vulnerabilities, real solutions were finally taking center stage. Organizations shared practical strategies for balancing compliance requirements like NIS2 with the daily reality of cyberattacks.

The sessions on OPENVAS and enterprise solutions revealed a crucial shift: companies are moving beyond endless vulnerability spreadsheets toward actionable intelligence. The message was clear: staying informed isn’t enough anymore. Organizations need concrete guidance on their next steps in the future.

But beneath the optimism, a sobering truth emerged from every conversation: Italy remains one of Europe’s most targeted countries. Participants weren’t shy about asking the hard questions: Why do our defenses still lag behind the threats? What will it actually take to turn the tide?

AI: The Double-Edged Sword

March brought CyberSec 2025 in Milan, where artificial intelligence dominated every discussion. The atmosphere was electric, with equal parts of excitement and apprehension. Everyone agreed that AI could revolutionize security operations, making them faster and smarter. But there was a catch: AI also creates entirely new attack surfaces.

The concerns were legitimate. AI models can be manipulated or stolen if not properly secured. That’s why approaches like keeping solutions fully on-premise and updating AI models only through controlled feeds have become so critical. It’s about getting the benefits of automation and intelligence without sacrificing security integrity.

As Dirk Boeing, Security Engineer at Greenbone , emphasized in the interview: “AI isn’t just a buzzword for us – it’s a practical tool that, when used responsibly, helps organizations fight back against cyber attacks.”

The New Reality of Vulnerability Management

The Security Summit later in March highlighted another fundamental shift: the end of occasional scanning as an acceptable security practice. Today’s threat landscape demands continuous, robust monitoring. We saw organizations learning to prioritize critical vulnerabilities, streamline remediation processes, and even transform regulatory compliance from a burden into a competitive advantage.

What stood out was the growing recognition that enterprise solutions offer something community editions simply can’t match: stable feeds, accurate detection, and secure on-premise deployment that goes far beyond basic functionality.

The Numbers Don’t Lie

These conference insights take on new urgency when having a look at what’s actually happening in Italy. The first half of 2025 alone brought 1,549 cyber incidents – a staggering 53% increase compared to 2024. Even more concerning: 346 of these were classified as serious, confirmed-impact events, representing a 98% year-over-year increase.

The attacks aren’t discriminating. Critical sectors like public administration, healthcare, and energy have all been hit hard. Take the attack on April 2 on Mobilità di Marca (MOM), Treviso’s public transport company, which knocked out electronic ticketing services for days. It’s a perfect example of how digital infrastructure vulnerabilities can disrupt everyday life.

Smaller companies aren’t escaping either. April reports showed the telecommunications sector getting hammered by spear-phishing attacks, with numerous organizations suffering significant breaches.

What’s Next: Proactive Defense Is the Only Defense

Every expert at every conference has been saying the same thing: continuous monitoring and proactive vulnerability management aren’t just “nice-to-haves” anymore. They’re survival requirements. The escalating frequency and sophistication of attacks demand a fundamental shift from reactive firefighting to proactive defense strategies.

Mark Your Calendar: October Events You Can’t Miss

The conversation continues this October, with three major events putting Rome at the center of Italy’s cybersecurity evolution:

AFCEA TechNet Europe Rome 2025 (October 1 – 2) brings together defense experts, industry leaders, and technology innovators to explore emerging threats and cutting-edge solutions.

Cybertech Europe (October 21 – 22) offers the chance to connect with top cybersecurity minds, see live demonstrations, and dive deep into the challenges and solutions shaping Italy’s digital resilience.

Richmond Cyber Resilience Forum (October 28 – 30) is a meeting point between demand and supply of innovative solutions. Here, Italian companies meet industry experts to discover trends and strategies of cybersecurity.

OPENVAS S.r.l. will be at all three events, showcasing enterprise-grade vulnerability management solutions, sharing insights on AI-driven security, and demonstrating how organizations can transform compliance from a checkbox exercise into a proactive defense strategy.

The Path Forward

2025 is proving to be a pivotal year for Italian cybersecurity. The threats are real and growing, but so is our collective response. Each conference, each collaboration, and each new innovation brings us closer to transforming today’s challenges into tomorrow’s resilience.

The question isn’t whether you’ll face a cyberattack, it’s whether you’ll be ready when it happens. Don’t wait for the wake-up call. The time to strengthen your cyber defenses is now.

Ready to turn insights into action? Connect with us at the upcoming October events, or reach out today to learn how enterprise-grade vulnerability management can transform your organization’s security position.

Contact Test Now Buy Here Back to Overview

/by
Joseph Lee

CVSS 10 in Fortra GoAnywhere MFT – Patch Now!

CVE-2025-10035 (CVSS 10.0) is a new critical severity vulnerability in Fortra GoAnywhere MFT (Managed File Transfer). This maximum-risk CVE could provide attackers with unauthenticated remote command execution (RCE). Greenbone can detect vulnerable systems and all users should patch with urgency. 

blog banner cvss 10 in fortra goanywhere

GoAnywhere MFT is a centralized Managed File Transfer (MFT) platform enabling file exchanges between business partners, customers, and within an organization. The application also provides auditing and compliance reporting.

The root cause of this CVE is a deserialization flaw [CWE-502] in Fortra GoAnywhere MFT’s License Servlet that allows attackers to forge a license response signature to inject and execute arbitrary commands [CWE-77]. Although in-the-wild exploitation has not been confirmed, Fortra GoAnywhere has been a hot target for ransomware attacks in the past. In 2023, CVE-2023-0669 (CVSS 7.2) was targeted by Clop ransomware operator, resulting in multiple high-profile breaches. No public PoCs for CVE-2025-10035 are available yet, but a detailed technical analysis is. However, this technical analysis does not include a complete exploit chain – some exploit chain details remain unconfirmed.

CVE-2025-10035 has prompted national CERT alerts from Canada’s Canadian Centre for Cyber Security [1], the Netherlands’ NCSC-NL [2], and India’s CERT-In [3]. Also, Germany’s BSI assigned an alert [WID-SEC-2025-2090], and a CVSS Temporal score of 8.7, reflecting an unverified exploitation status (E:U), availability of official remediation (RL:O), and strong confidence in the report (RC:C).

A remote version check was swiftly added to Greenbone’s OPENVAS ENTERPRISE FEED, allowing defenders to identify vulnerable instances of Fortra GoAnywhere MFT.

Risk Assessment for CVE-2025-10035 in Fortra GoAnywhere

Going simply by the CVSS 10 rating, the risk posed by CVE-2025-10035 is extremely high if GoAnywhere’s Admin Console is exposed to the Internet. According to the analysis, attack complexity is considered low, no user interaction is required, and exploitation could result in complete system takeover.

However, public exposure is not a prerequisite for exploitation. Instances on a private network could also be exploited via so-called “malicious insider” threats or trusted third-parties [T1199]. Verizon’s 2025 DBIR (Data Breach Investigations Report) identifies Privilege Misuse (described as nefarious schemes from insider threats) as the primary root cause of 8% of breaches studied from 2024. This is a surprising figure, which erodes the belief that only public-facing vulnerabilities pose a primary threat to cyber resilience.

Technical Analysis of CVE-2025-10035 in Fortra GoAnywhere

GoAnywhere’s License Servlet is used for activating the GoAnywhere MFT license bundle as part of the setup, renewal, and migration processes. The License Servlet involves Java deserialization of the encoded “SignedObject”. In the case of CVE-2025-10035, this deserialization process could reportedly lead to RCE.

Analysis from Watchtowr evidences a pre-authentication flaw that returns an auth token via the Unlicensed.xhtml page, even when an instance has already been licensed. A malformed HTTP GET request to the route such as /goanywhere/license/Unlicensed.xhtml/x? erroneously creates a valid license-request token and returns it encrypted within a bundled data object. This occurs because the error handler function, AdminErrorHandlerServlet, internally generates a valid license-request token, associates it with the unauthenticated session, and returns it to the user within the aforementioned serialized data object. This data bundle is encrypted with a hard-coded key, which can be decrypted offline to reveal the GUID auth token in plaintext.

Once the GUID token is recovered, unauthenticated attackers can use it to access the License Servlet endpoint POST /goanywhere/lic/accept/<GUID> … bundle=<payload> passing a malicious, serialized payload. However, the attack mechanism for deserializing the payload is yet unknown because the payload needs to be signed by Fortra’s own valid private key. Security researchers have pointed to potential mechanisms such as a stolen private key or the existence of malicious payload(s) having been mistakenly signed by Fortra’s private key.

Mitigating CVE-2025-10035 in Fortra GoAnywhere

Fortra has released a security advisory [FI-2025-012] with mitigation instructions for CVE-2025-10035. Full mitigation requires upgrading to a fixed release: either to 7.8.4 (latest) or 7.6.3 (Sustain). Temporary mitigation can be achieved by restricting Admin Console access.

Fortra also advises all users to hunt for Indicators of Compromise (IoC), namely stack trace logs indicating an error for the SignedObject.getObject. Presence of this string strongly suggests the instance has been exploited by attackers. Following best practices, affected parties may also want to provide status updates to customers and other third-party stakeholders.

Summary

CVE-2025-10035 is a CVSS 10, maximum severity deserialization flaw in GoAnywhere MFT which may allow unauthenticated RCE. In 2023 attackers leveraged another CVE in GoAnywhere MFT for widespread exploitation, and national CERTs have issued alerts, signifying high risk. The OPENVAS ENTERPRISE FEED includes a version check to detect vulnerable instances in their infrastructure. End users should identify public-facing and locally deployed instances and patch with urgency.

Contact Test Now Buy Here Back to Overview

/by
Greenbone AG

Change in the Greenbone AG Executive Board

Dr. Jan-Oliver Wagner

After many years at the helm of Greenbone, our co-founder, Dr Jan-Oliver Wagner, is stepping down from active operational management. We would like to thank Dr Wagner for his extraordinary commitment and all that he has achieved for Greenbone since its foundation.

 

 

 

 

Elmar Geese

The new CEO is Elmar Geese, who has been part of Greenbone’s management team since 2019. With this change in leadership, we are focusing on continuity and stability for our customers, employees and shareholders.

Contact Test Now Buy Here Back to Overview

/by
Joseph Lee

SessionReaper: Account Takeover and Unauthenticated RCE in Magento and Adobe Commerce

!

Update

February 2nd, 2026

Reports from multiple security vendors have confirmed that CVE-2025-54236 (aka “SessionReaper”) has transitioned to active, real-world exploitation. A full technical write-up has been published and the Sansec Threat Research team, who originally disclosed CVE-2025-54236, claims that Proof-of-concept (PoC) exploits are circulating.

On October 22nd 2025, the Sansec Threat Research Team reported blocking live exploitation attempts, including PHP web shell deployments, and warned that more than 60% of Magento stores remained unpatched at the time. Soon after, the Akamai Security Intelligence Group reported hundreds of exploitation attempts targeting over 130 distinct hosts within their cloud infrastructure.

CVE-2025-54236 (CVSS 9.1) is an account-takeover flaw that may result in unauthenticated remote code execution (RCE) under certain conditions. Dubbed “SessionReaper”, CVE-2025-54236 affects Adobe Commerce, Adobe Commerce B2B, and Magento Open Source web applications. The root cause is Improper Input Validation [CWE-20] in the REST API. Adobe’s official advisory describes the issue as a security feature bypass although no further explanation is provided.

Blog Banner

The exploit chain for CVE-2025-54236 starts with a nested deserialization vulnerability [CWE-502] and results in a malicious session for a customer account. Security researchers from Sansec claim that Remote Code Execution (RCE) is possible when file-based session storage is used and that other attack chains may also exist, such as RCE via Redis or database session storage. Blaklis is credited with the discovery and responsible disclosure of CVE-2025-54236 via the Hackerone platform.

A full technical description, PoC, or full exploit kits are not yet publicly available. However, France’s CERT-FR has issued a public advisory for the vulnerability. Greenbone’s OPENVAS ENTERPRISE FEED already includes a remote banner check to identify vulnerable systems and verify patch status.

Risk Assessment for CVE-2025-54236 (aka “SessionReaper”)

Magento Open Source (released in 2008) and its commercial counterpart Adobe Commerce are widely used e-commerce platforms. As of 2024, they power in the order of 200-250,000 live/active stores, putting Magento among the leading global e-commerce platforms. This wide usage makes it an attractive target for attackers.

Previous vulnerabilities in Magento have been leveraged in mass exploitation attacks within hours [1][2][3][4] of their disclosure. In this case, Adobe’s patch was accidentally leaked publicly, giving attackers a head start on developing exploit code. If exploited, attackers could install malware [T1105] in an attempt to covertly maintain persistent access [TA0003] to the victim’s infrastructure. This could lead to future attacks, such as stealing payment card information to make fraudulent transactions [T1657], stealing other sensitive information [TA0010], conducting phishing [T1566] attacks against customers of the website, or deploying ransomware against the victim [T1486].

Mitigating CVE-2025-54236 (aka “SessionReaper”)

CVE-2025-54236 affects Adobe Commerce, Adobe Commerce B2B, and Magento Open Source across multiple versions, as well as the Custom Attributes Serializable module on all platforms and deployment methods [1]. However, Adobe’s own knowledge base seems to provide contradictory information, stating that the Custom Attributes Serializable module versions 0.1.0 – 0.4.0 are affected, but also advises upgrading the module to version 0.4.0 or higher.

Users are advised to install the hotfix patch provided by Adobe or update to the latest version immediately to protect their online business operations and customers. Users should also conduct a thorough assessment to determine whether their instance has already been compromised and if found, remove the infection. Adobe has also released a developer guide to help users adjust to any necessary changes in the web application’s REST API. The OPENVAS ENTERPRISE FEED includes a remote banner check to identify vulnerable systems.

Summary

CVE-2025-54236 poses a critical risk to Magento and Adobe Commerce users. For attackers, the flaw enables account takeover and potentially unauthenticated RCE on a victim’s infrastructure. Defenders should identify vulnerable systems and patch them immediately. Greenbone’s OPENVAS ENTERPRISE FEED can help to identify vulnerable web applications and verify remediation status. IT security teams should also audit their systems to detect potential breaches and remove infections if any indicators of compromise (IoC) are found.

Contact Test Now Buy Here Back to Overview

/by
Joseph Lee

August 2025 Threat Report: Fast-Moving, High-Risk Vulnerabilities

The August 2025 Threat Report underscores how quickly high-risk vulnerabilities can shift from disclosure to active exploitation. Citrix, Fortinet, N-able, and Trend Micro flaws were weaponized within days. Other critical flaws in highly targeted software, such as Microsoft Exchange, emerged. Mainstream enterprise applications, such as Docker Desktop, Git, and Zoom, were also exposed to new vulnerabilities this month. Let’s review some of the biggest cyber threats that emerged in August 2025.

Blogbanner Thread report august 2025

Trio of High-Risk Citrix NetScaler CVEs: One Actively Exploited

Citrix alerted its customers to active exploitation of CVE-2025-7775 and two additional high-risk CVEs. The trio affect NetScaler ADC and NetScaler Gateway in various configurations. So far, only CVE-2025-7775 has been added to CISA’s Known Exploited Vulnerabilities (KEV). Multiple National CERT alerts have been issued globally [1][2][3][4][5][6][7]. Users of affected products should patch with urgency.

  • CVE-2025-7775 (CVSS 9.8, EPSS ≥92nd pctl): A memory overflow [CWE-119] allows Remote Code Execution (RCE) or Denial of Service (DoS) when NetScaler is configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server.
  • CVE-2025-6543 (CVSS 9.8): A memory overflow [CWE-119] leads to unintended control flow and DoS when NetScaler is configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server.
  • CVE-2025-7776 (CVSS 8.8): A memory overflow [CWE-119] leads to unpredictable behavior and DoS when NetScaler is configured as Gateway (VPN virtual server, ICA Proxy, CVPN, or RDP Proxy) with a PC-over-IP (PCoIP) profile. PCoIP is a remote display protocol used for virtual desktop access.

Another high-risk flaw affecting NetScaler ADC and Gateway, dubbed “CitrixBleed 2”, just emerged in June 2025, and was actively exploited in ransomware attacks soon after disclosure. Greenbone’s OPENVAS ENTERPRISE FEED includes a remote version detection test for these three new CVEs, and for CitrixBleed 2.

Emergency Patch for Microsoft Exchange Hybrid Deployment

CVE-2025-53786 (CVSS 8.0) is a high-risk post-authentication privilege escalation flaw in Microsoft Exchange hybrid-joined configurations. In a hybrid deployment, an on-premises Active Directory (AD) domain is synchronized with a cloud-based Azure AD; devices and services are recognized by both. If exploited, CVE-2025-53786 allows an attacker with admin access to an on-premises Exchange Server to move laterally to Microsoft 365 Exchange Online [CWE-287] and potentially modify authentication processes for persistence [T1556.007].

Exploitation, including authentication bypass, lateral movement [TA0008], and data exfiltration [TA0010], was demonstrated at Black Hat 2025. Despite no observed exploitation in the wild, Microsoft has assigned a status of “Exploitation More Likely”. CISA has issued an Emergency Directive (ED 25-02) and warned that CVE-2025-53786 could result in total domain compromise across hybrid environments. Numerous government CERT agencies have also issued alerts [1][2][3][4][5][6][7]. The OPENVAS ENTERPRISE FEED includes two remote version detection tests to identify vulnerable instances of Microsoft Exchange [8][9].

Max-Severity Flaw in Cisco Secure Firewall Management Center

CVE-2025-20265 (CVSS 10) is an RCE flaw in Cisco Secure Firewall Management Center (FMC) physical and virtual appliances if configured with RADIUS for web-based authentication or for SSH for management access. The flaw is caused by improper input handling, which can result in command injection downstream in the authentication process [CWE-74]. Unauthenticated attackers may inject arbitrary shell commands and have them executed with elevated privileges.

Public exploit code or active attacks have not yet been observed. However, Cisco edge devices have historically been targeted by APT adversaries [1][2][3]. Considering the edge locality of FMC deployments and the maximum CVSS, CVE-2025-20265 warrants urgency. Cisco has published security patches, and contrastingly stated that no workarounds exist while also advising users that disabling RADIUS authentication is a temporary mitigation. Greenbone’s OPENVAS ENTERPRISE FEED includes a version detection test to remotely identify unpatched FMC devices.

FortiSIEM Exploited and Other High-Risk CVEs in Fortinet Products

Fortinet was the subject of several high-risk vulnerabilities in August. In total, 14 CVEs were issued for Fortinet products — six were rated CVSS High or Critical. Several national CERT advisories cover the three most critical CVEs from this group [1][2][3], while others address only the most severe — CVE-2025-25256 [4][5][6][7][8] — which has been flagged by Fortinet as actively exploited. The OPENVAS ENTERPRISE FEED includes a version check and active check to identify FortiSIEM devices vulnerable to CVE-2025-25256, and a family of vulnerability tests dedicated to Fortinet CVEs, including those mentioned below and others.

  • CVE-2025-25256 (CVSS 9.8, EPSS ≥95th pctl): Improper neutralization of special elements used in an OS command [CWE-78] allows an unauthenticated remote attacker to execute unauthorized commands via requests to the phMonitor service on TCP port 7900. Fortinet acknowledges active exploitation in the wild. A full technical description and proof-of-concept (PoC) exploit are available. FortiSIEM 5.4 and various sub-versions of FortiSIEM 6 and 7 are affected.
  • CVE-2024-26009 (CVSS 8.1): An authentication bypass using an alternate path or channel vulnerability [CWE-288] allows an unauthenticated attacker to take control of a managed device via malicious FortiGate to FortiManager Protocol (FGFM) requests. Exploitation requires a FortiGate device to be managed by FortiManager, and for the attacker to know the FortiManager’s serial number. Various versions of FortiOS, FortiPAM, and FortiSwitchManager are affected.
  • CVE-2025-52970 (CVSS 8.1): Improper handling of parameters [CWE-233] allows an unauthenticated remote attacker with possession of sensitive information for the target device and an existing user to log in as any user on the device via a specially crafted HTTP request. Various sub-versions of FortiWeb 7 are affected.

Two New N-Able CVEs Actively Exploited

Two new CVEs impacting N-able’s N‑central present a high risk to organizations using the software. Both new CVEs have been added to CISA’s KEV list and national CERT alerts were issued by NCSC.nl [1], the Canadian Cyber Centre [2], and South Korea’s K‑CERT [3]. N‑central is a Remote Monitoring and Management (RMM) platform widely used to monitor and manage networks and systems. Although exploiting either vulnerability requires authentication, credential theft [TA0006], password reuse [T1078], insider threats, and other possible attack trajectories elevate risk.

  • CVE-2025-8876 (CVSS 8.8, EPSS ≥95th pctl): Unsanitized input is injected into OS shell commands [CWE-78], allowing RCE with the N-central application’s privileges.
  • CVE‑2025‑8875 (CVSS 7.8, EPSS ≥93rd pctl): Insecure deserialization of untrusted data [CWE-502] may allow attackers to craft object “gadget” chains for arbitrary RCE or unauthorized application state changes.

Versions of N-central prior to 2025.3.1 are affected. One day after the CVEs were published, Shadowserver reported ~1,000 unpatched N‑central servers exposed on the internet. Two weeks later, most remain unpatched. The OPENVAS ENTERPRISE FEED can remotely detect vulnerable versions of N-central, allowing defenders to apply mitigations.

New Critical Trend Micro Apex One Flaw Under Attack

CVE-2025-54948 (CVSS 9.8, EPSS ≥94th pctl) and CVE-2025-54987 (CVSS 9.8, EPSS ≥63rd pctl) are unauthenticated RCE vulnerabilities affecting on-premises Trend Micro Apex One Management Console. Both CVEs represent the same flaw, but for different CPU architectures. The culprit is a pre-authentication OS-command-injection flaw [CWE-78] via malicious file upload. A compromised device gives attackers direct access to an organization’s security infrastructure. Successful exploitation requires either remote or physical access, making internet-exposed instances particularly high-risk. However, local network instances may also offer attackers an opportunity for lateral movement [TA0008] after they gain initial access [TA0001] to a victim’s network.

According to Trend Micro, active exploitation is underway and CISA has added CVE-2025-54948 to the KEV catalog, where it joins many other exploited Apex One flaws going back to 2021. National CERT advisories have been issued by government agencies globally [1][2][3][4][5]. Apex One (on‑prem) 2019 (14.0) version 14.0.0.14039 and earlier are affected. Consult the official advisory for mitigation instructions and a custom tool that disables the Remote Install Agent function. Greenbone’s OPENVAS ENTERPRISE FEED includes a local detection test to identify affected endpoints.

Git Repository Cloning Flaw Actively Exploited

CVE-2025-48384 (CVSS 8.0, EPSS ≥88th pctl), issued in early July 2025, has been added to CISA’s KEV and exploitation is considered trivial. The flaw is described as an arbitrary file write when cloning a specially crafted repository containing sub-modules that use a ‘recursive’ flag — i.e. git clone –recursive <repo> — an option used to automatically fetch sub-modules when cloning a repository. The flaw is due to mishandling of trailing carriage return (CR) characters in configuration values, potentially resulting in RCE. Attackers must trick a victim into cloning a malicious Git repository to achieve exploitation.

A full technical description and exploits containing malicious .gitmodules files are already available online [1][2][3]. INCIBE-CERT has issued an alert [4] and CISA has added the CVE to its KEV list [5]. The flaw affects many versions of Git up to 2.50.0. The OPENVAS ENTERPRISE FEED and COMMUNITY FEED include local package detection tests for CVE-2025-48384.

Container Escape in Docker Desktop for Windows and macOS

CVE-2025-9074 (CVSS 9.3) is a container escape vulnerability in Docker Desktop for Windows and macOS. The flaw allows attackers to gain unauthorized access to a victim’s host system when running a malicious container. The Docker Engine API was found to be accessible without authentication via TCP/IP at 192.168.65.7:2375. This channel bypasses normal socket restrictions and renders Docker’s Enhanced Container Isolation (ECI) ineffective. On Windows, attackers can mount and overwrite system DLLs to gain full administrative control. On macOS, host file system access is more limited due to OS-level safeguards. Linux instances are not affected.

PoCs indicate that exploitation is trivial — just a few lines of Python or a simple HTTP request can compromise a vulnerable instance of Docker Desktop. A detailed technical write-up, existence of at least one public exploit, and Docker’s widespread use elevate the risk posed by CVE-2025-9074. The OPENVAS ENTERPRISE FEED includes a version detection test for Windows installations.

Critical Flaw in Zoom Client for Windows Allows Unauthenticated RCE

CVE-2025-49457 (CVSS 9.6) affects multiple Zoom products for Windows including Zoom Workplace, VDI, Rooms, Rooms Controller, and Meeting SDK prior to version 6.3.10. The flaw is caused by an untrusted search path vulnerability [CWE-426] due to improper DLL path handling. Known as “DLL side-loading“, this flaw happens when the Windows LoadLibrary() API function is called without specifying a fully qualified file path. In that case, Windows follows its default DLL search order. If attackers can place a file in a searched directory, it will be loaded and executed. Therefore, CVE-2025-49457 is especially dangerous in combination with social engineering [T1566], or insider threats, which continue to be prevalent in 2025. Exploitation provides privilege escalation to an attacker, potentially to the Windows SYSTEM level, and arbitrary code execution.

Malaysia’s MyCERT [1] and Hong Kong’s CERT-HK [2] have issued advisories. The issue is patched in Zoom version 6.3.10 and later, and organizations should verify update status. Although many desktop applications, such as Zoom, support automatic updates, it’s still critical for defenders to verify patch status across their IT fleets. The OPENVAS ENTERPRISE FEED includes an active check to identify vulnerable Zoom applications.

Summary

The August 2025 Threat Report highlights new high-risk vulnerabilities across popular platforms. Defenders faced an intense month with new Citrix NetScaler flaws being actively exploited soon after CitrixBleed 2 was exposed, an emergency Microsoft Exchange patch, a maximum-severity Cisco Secure Firewall CVE, and emerging exploitation of Fortinet, N-able, and Trend Micro products. New Docker Desktop, Git, and Zoom vulnerabilities also add to this month’s list of threats. Greenbone’s OPENVAS SECURITY INTELLIGENCE reduces the burden on security teams by delivering fast and reliable detection and assurance on organization-wide patch levels.

Contact Test Now Buy Here Back to Overview

/by