Tag Archive for: Greenbone

Greenbone AG

Greenbone Supports DORA Compliance with Vulnerability Detection, Data Sovereignty and Reporting

The global financial sector has been slammed with high-profile cyber incidents, placing trust in financial systems in jeopardy. These cyber attacks are extremely costly and widespread. Large corporations are not the only losers in this battle. Citizens also suffer directly when data protection and the integrity of financial transactions are compromised.

Some of the most impactful breaches of financial entities in the EU and globally include:

  • Equifax (2017): Breached via an unpatched vulnerability in Apache Struts, leading to the theft of Social Security Numbers (SSN), birthdates, addresses and driver’s licenses of 147 million people.
  • UniCredit (2018): Italy’s second-largest bank exposed the Personally Identifiable Information (PII) of 778,000 clients; the Italian DPA finally issued a €2.8 million fine for the breach in 2024.
  • Capital One (2019): A misconfigured firewall was used to breach Capital One to steal the PII of 106 million individuals.
  • Finastra (2023): The UK-based fintech provider servicing global banks, was breached via its secure file-transfer system, resulting in the theft of over 400 GB of sensitive financial data from major banking clients.
  • UBS and Pictet (2025): A third-party cyberattack on Chain IQ exposed the PII of over 130,000 employees, including contact information for top executives.
  • Bybit (2025): North Korean hackers stole $1.5 billion worth of Ethereum from Bybit’s cold wallet, marking the biggest crypto exchange hack ever recorded.

These incidents emphasize the strategic importance of securing financial technology providers. Cyber attacks against banks include fraudulent wire transfers, ATM hacking, POS malware and data theft. Arguably, the impact of sensitive PII being stolen is even worse than simply stealing money. Stolen identities: names, SSNs, addresses and other PII are later sold on darknet marketplaces and used by attackers to commit identity theft, open fraudulent bank accounts or lines of credit and to conduct social engineering against individuals directly. Geopolitical tensions further place data theft victims at risk; hostile nation states and legally ambiguous intelligence brokers collect intelligence on individuals for surveillance, intimidation campaigns or worse.

In response to elevating threats, the Digital Operational Resilience Act, (aka “DORA”) exists to strengthen the EU financial sector’s cybersecurity posture with greater safeguards. This new legal framework is a pivotal piece of legislation within the EU’s financial regulatory framework, to stabilize consumer trust and bolster business confidence.

How OPENVAS SECURITY INTELLIGENCE by Greenbone Supports DORA Compliance:

  • Vulnerability management is a fundamental IT security activity with a well-established benefit to operational resilience. OPENVAS SCAN by Greenbone is an industry leading vulnerability scanner with a proven track record.
  • Our OPENVAS ENTERPRISE FEED has industry leading coverage for CVE detection as well as other network and endpoint vulnerability detection.
  • OPENVAS SCAN can identify the encryption protocols allowed by network services to ensure data-in-transit is compliant with data security best practices.
  • Our compliance scans can attest security hardened configuration for a wide range of operating systems (OS) and applications. This includes certified CIS Benchmarks for Apache HTTPD, Microsoft IIS, NGINX, MongoDB, Oracle, PostgreSQL, Google Chrome, Windows 11 Enterprise, Linux, and more [1][2].
  • All OPENVAS SECURITY INTELLIGENCE components are designed for absolute data sovereignty; your organization’s data never needs to leave the organization.
  • Our core product line is open source, time tested and open to external review by customers and community members alike. This visibility helps streamline third-party ICT service providers auditing.
  • OPENVAS REPORT by Greenbone is specially tailored to support evidence gathering and data retention for compliance reporting.
  • As an active ISO/IEC 27001:2022 and ISO 9001:2015 certified organization, Greenbone is dedicated to the most stringent quality standards for Information Security. Our ISO:14001 certification for Environmental Management Systems shows our continued commitment to things that matter.

The EU’s Digital Operational Resilience Act (DORA)

DORA is an EU regulation published in the Official Journal of the European Union on January 16, 2023, which came into force on January 17, 2025. DORA is part of the EU’s broader Digital Finance Strategy, and its goal is to standardize cybersecurity governance and risk management requirements, strengthening the operational resilience of financial entities in the EU. The act applies to 20 different types of financial entities including banks, insurance companies, investment firms and Information and Communication Technology (ICT) third-party service providers (TPP).

But aren’t financial entities subject to NIS 2 regulation as Essential Entities (EEs)?

Yes, but under Article 4 of NIS 2, financial services firms covered by DORA—such as banks, investment firms, insurance institutions, and financial market infrastructures—must fully adhere to DORA’s requirements when it comes to cybersecurity risk management and incident reporting. Also, any other sector-specific equivalent EU mandates that apply to risk management or incident reporting must take precedence over the corresponding provisions in NIS 2.

Who are the European Supervisory Authorities (ESAs)?

There are three formally designated ESAs responsible for issuing Regulatory Technical Standards (RTS) and Implementing Technical Standards (ITS) which clarify DORA’s requirements. The ESA entities are:

  • The European Banking Authority (EBA) [1]
  • The European Insurance and Occupational Pensions Authority (EIOPA) [2]
  • The European Securities and Markets Authority (ESMA) [3]

What are Regulatory Technical Standards (RTS)?

As the name implies, RTS define the required technical standards that entities covered by DORA must adhere to. RTS documents provide detailed guidance to ensure consistent application of DORA across the EU financial sector [4].

The final draft Regulatory Technical Standards are:

  • ICT risk management framework and simplified ICT risk management framework [5]
  • Criteria for the classification of ICT-related incidents [6]
  • Policy on ICT services supporting critical or important functions provided by TPPs [7]

What are Implementing Technical Standards (ITS)?

ITS are detailed rules that specify how financial entities must comply with obligations. They translate DORA’s general provisions into precise operational, procedural, and reporting standards. ITS address incident reporting, tracking of ICT TPP relationships and assessments, threat-led penetration testing (TLPT), and cyber threat information sharing.

  • The final draft ITS of templates for the register of information [8]

The Scope of DORA’s Impact on IT Security

Here are the fundamental IT security principles that DORA impacts:

  1. Risk Management: DORA mandates that financial entities implement robust IT Risk Management Frameworks (RMF) to reduce their operational risks.
  2. Incident Reporting: Fully regulated entities must report major cybersecurity incidents to their national authorities within 24 hours following a standardized format. However, small, non-interconnected, and exempt entities are eligible for reduced reporting requirements.
  3. Third-Party Risk: DORA establishes stricter oversight and accountability for how financial entities manage their relationships with third-party ICT service providers.
  4. Security Testing: Financial entities must conduct regular security assessments of their digital systems to improve resilience against cyber threats.
  5. Information Sharing: For improved information sharing between financial institutions and relevant authorities, entities are encouraged to report emerging threats if they may be relevant to others.

Summary

High-profile cyberattacks have exposed cracks in the financial sector’s deep digital weaknesses, prompting the EU to enact, and as January 17th, 2025, enforce the Digital Operational Resilience Act (DORA). Greenbone is an ally to support DORA compliance for covered entities with our established and trusted suite of enterprise vulnerability management products and compliance reporting tools. Our products support resilient data sovereignty, and detailed security assessment reporting.

True cyber risk mitigation is not simply about meeting compliance checkboxes. Defenders must be proactive in detecting emerging risks as early as possible to strengthen operational resilience. Greenbone enables early awareness of security vulnerabilities allowing the IT defenders of Europe’s financial entities to fix them before cyber breaches occur.

Contact Test Now Buy Here Back to Overview

/by
Greenbone AG

OPENVAS: The new name for proven Greenbone security

More than 15 years, OPENVAS has stood for excellent open source security worldwide – from small businesses to public institutions to operators of critical infrastructure. OPENVAS is developed by Greenbone and is behind both Greenbone’s enterprise products and the community versions. The OPENVAS brand inspires global confidence in a highly developed open source solution that stands up well against proprietary competitors.

From now on, we are placing the name OPENVAS at the center of all our activities. Our proven solutions and new products will now appear under a single, strong brand: OPENVAS.

Why we chose OPENVAS

OPENVAS is internationally recognized, stands for trust and open source, and clearly describes what it’s all about: identifying and minimizing digital risks. With the new naming scheme, we are making our solutions even more understandable, functional, and globally consistent. Originally intended only as the name of a technical component, the actual vulnerability scanner, the name has itself as the designation for our established product portfolio. We are happy to embrace this and use our open source established OPENVAS brand in all our product names.

For our users, customers, and partners, this means that everything you value about our solutions remains the same — just under new, more descriptive names. And there’s more to come this year: container scanning, agent-based scanning, a new REST API, and much more.

What does this mean for you specifically?

  • What you know stays the same: Your solutions will work as usual, including all services and security updates.
  • Names that create clarity: Each product name now directly describes its function – saving time and avoiding misunderstandings.
  • Strong brand, clear communication: We operate nationally and internationally under a single name – OPENVAS.

Our proven goal: to offer you the best solution for minimizing digital risks quickly, easily, and transparently.

What does this mean for our existing appliance products?

Our existing products will continue to be updated as usual. At the same time, they will be given new names, with OPENVAS always at the center.

A few examples: OPENVAS SCAN is the new product name for the Greenbone Enterprise Appliances, the while designations will remain unchanged. Familiar performance Greenbone Enterprise EXA will become OPENVAS SCAN EXA, and Greenbone Enterprise 600 will become OPENVAS SCAN 600.

Our free community products will of course continue to be available. We are using the name OPENVAS COMMUNITY EDITION for our free appliance and OPENVAS COMMUNITY FEED for the associated data feed with vulnerability tests and security information.

Greenbone remains – OPENVAS becomes new brand name

Greenbone remains the name of our company – headquartered in Germany and with our subsidiaries in the UK, Italy, and the Netherlands. The name Greenbone has become well established in German-speaking countries, which is why we have decided not to rename Greenbone AG as OPENVAS AG. Internationally, we are much better known as OPENVAS and therefore will operate under the OPENVAS brand: OPENVAS UK, OPENVAS IT, OPENVAS NL.

By strengthening our OPENVAS brand, in over 150 countries around the world we are making our mission visible: to make cybersecurity understandable, trustworthy, and accessible.

Contact Test Now Buy Here Back to Overview

/by
Joseph Lee

June 2025 Threat Report: A Cyber Combat of Attrition

The 2025 IOCTA report from Europol warns that demand for data on the cybercrime underground is surging. How much data has been stolen exactly? Determining exact numbers is impossible. However, the personal information of 190 million individuals including Social Security Numbers (SSN), was stolen from Change Healthcare in a single breach. That’s more than half of the total US population exposed in one incident. That incident pales in comparison to the 2024 National Public Data Breach, which included 272 million distinct SSNs, 420 million distinct addresses, and 161 million distinct phone numbers. In 2024, Europe saw approximately 363 breach notifications per day across surveyed EEA countries. Now, new strains of destructive wiper malware are emerging. In comparison, victims of data theft may soon be considered the “lucky” ones.

Cyber defenders are in a battle of attrition. Managing the continuous onslaught of new threats is a monumental and critical task. In this month’s threat report, we provide insight into the latest wave of wiper malware, new actively exploited vulnerabilities, and emerging threats shaping the global cyber conflict.

New Wave of Wipers Enter the Cyber Combat

Cisco Talos just observed a previously unknown wiper malware dubbed “PathWiper”, leveraged in a destructive attack against Ukrainian critical infrastructure. Wiper most often gets deployed during Cyber Warfare (CW) campaigns, when financial gain is not the primary motive. Whereas ransomware coerces victims into paying for the return of their encrypted data, wipers simply destroy it. Wipers have been used since the start of the Russia-Ukraine war. HermeticWiper was deployed against Ukraine in 2022, crippling government agencies and critical services hours before Russia first invaded.

Cybersecurity analysts also recently noted an emerging ransomware-as-a-service (RaaS) group, Anubis, which has added a wiper option to their custom ransomware payload. Amidst heightened geopolitical tensions, it’s plausible that nation-state threat actors will incentivize willing RaaS operators and hacktivists to carry out destructive attacks for impact.

Wiper attacks themselves aren’t new. Shamoon (aka Disttrack), discovered in 2012, was the first major Wiper malware. Suspected to be developed by Iranian threat actors, it was used to attack Saudi Aramco and other Gulf state organizations. Masquerading as ransomware, NotPetya was another prominent wiper strain that emerged in 2017 with global impact.

Organizations, especially critical infrastructure, need to consider the potential impact that wiper malware could have on their resilience. What if paying ransom is not an option? A well designed backup strategy can enable full or partial data recovery, but downtime also has a financial impact and has even recently resulted in loss of life. Ensuring that mean-time-to-recovery (MTTR) objectives can be realized is key to operational continuity. Of course, diligently closing security gaps before threat actors can exploit them is also essential to a proactive cyber strategy.

Sorting True Risk from “AI-Slop”: Linux CVEs in Flux

The days when Linux attracted fewer cyber attacks have long passed. Linux systems are increasingly targeted by sophisticated actors. Last year, the number of Linux kernel CVEs (Common Vulnerabilities and Exposures) also exploded: the Kernel CNA (CVE Numbering Authority) assigned an average of 55 new CVEs per week in 2024. This growth is sometimes attributed to AI uncovering bugs which are not actually security risks – dubbed “AI slop”. Curl’s creator, Daniel Stenberg, even posted a notice banning “AI slop” bug reports. A related bug report discussion raised the concern of “an attack on our resources to handle security issues”.

On the risk and patch management side of the coin, many defenders don’t have the luxury of conducting a deep investigation into each CVE’s technical feasibility. Conducting technical assessments and analyzing “patch diffs” takes enormous amounts of time. The resulting battle of attrition pits security teams against the clock. To prioritize remediation, they rely on CVSS (Common Vulnerability Scoring System), EPSS (Exploit Prediction Scoring System), exploit status, and environmental factors such as compliance requirements and operational criticality. Security leaders want to see evidence that progress is continuous and that security gaps are closed. This is truly the benefit of using a vulnerability management platform such as Greenbone.

That being said, here are some new high-risk Linux privilege escalation CVEs that gained attention this month:

  • CVE-2023-0386 (CVSS 7.8): Now deemed actively exploited, the Linux kernel’s OverlayFS subsystem allows escalation to root-level by abusing how files with special privileges are copied between certain mounted filesystems.
  • CVE-2025-6019 (CVSS 7.0): A flaw found in Fedora and SUSE distros allows non-root users in the “allow_active” group to execute privileged disk operations such as mounting, unlocking, and formatting devices via D-Bus calls to “udisksd”. The vulnerability is considered easy to exploit, and a public PoC (Proof of Concept) is available, increasing the risk.
  • CVE-2025-32462 and CVE-2025-32463: Two local privilege escalation vulnerabilities were fixed in Sudo 1.9.17p1, released on June 30, 2025. CVE-2025-32462 allows local users to abuse the –host option to escalate privileges on permitted hosts, while CVE-2025-32463 permits unauthorized root access via the —chroot option, even when not explicitly allowed in the sudoers file.
  • CVE-2025-40908 (CVSS 9.1): Unauthenticated attackers can modify existing files simply by processing a crafted YAML file as input, due to improper use of the two-argument open call. Vulnerable systems include any Perl applications or distributions (like Amazon Linux, SUSE, Red Hat, Debian) using YAML‑LibYAML before version 0.903.0.

CVE-2025-49113: A Critical Severity CVE in RoundCube Webmail

A recently disclosed vulnerability tracked as CVE-2025-49113 (CVSS 9.9) in RoundCube Webmail allows authenticated attackers to execute arbitrary code on a RoundCube server. A poorly designed PHP deserialization operation [CWE-502] fails to properly validate user input, allowing the “_from” parameter to carry malicious serialized code. Attackers who successfully exploit the bug can potentially gain full control over the RoundCube server to steal data and install command and control (C2) tools for persistent access.

Although CVE-2025-49113 requires valid credentials for exploitation, admin credentials are not required. Technical analysis [1][2], PoC exploits [3][4], and a Metasploit module are available, increasing the potential risk for abuse. An EPSS score of 81 indicates an extremely high probability of exploitation in the near future. Meanwhile, the researcher who discovered the flaw claims that exploit kits are already for sale on underground cybercrime forums. Numerous national CERT agencies have issued alerts for the flaw [5][6][7][8][9], while Shadowserver reported over 84,000 exposed Roundcube services existed in early June.

Greenbone Enterprise Feed includes remote version detection [10][11] and Linux Local Security Checks (LSC) [12][13][14][15][16][17] to identify vulnerable instances of RoundCube Webmail (versions prior to 1.5.10 and 1.6.11). Users are encouraged to apply updates with urgency.

New Critical CVE in Cisco ISE Cloud Has PoC Exploit

CVE-2025-20286 (CVSS 10) is a new flaw affecting Cisco Identity Services Engine (ISE) cloud deployments on AWS, Azure, and Oracle Cloud Infrastructure (OCI). The bug could allow unauthenticated, remote attackers to access sensitive data, perform some limited administrative operations, modify system configurations, and disrupt services. Due to poor software design, identical access credentials [CWE-259] are generated and shared across all connected ISE instances running the same release and platform.

Cisco has acknowledged the existence of a publicly available exploit. The vendor also stated that the vulnerability is only exploitable when the Primary Administration Node is deployed in the cloud. On-premises deployments and several hybrid/cloud VM solutions are not affected. Overall, the widespread use of Cisco ISE in enterprise networks and the availability of exploit code make CVE-2025-20286 a high-risk vulnerability for those with affected configurations. Greenbone includes a version detection test to identify instances that may be vulnerable.

CitrixBleed 2 and Another Actively Exploited Flaw in Citrix NetScaler ADC and Gateway

Dubbed “CitrixBleed 2”, CVE-2025-5777 (CVSS 9.3) is an out-of-bounds read [CWE-125] vulnerability affecting Citrix NetScaler ADC and NetScaler Gateway, which allows unauthenticated, remote attackers to steal valid session tokens from memory by sending malformed HTTP requests. CVE-2025-5777 is due to insufficient input validation – unfortunately, a common, yet easily preventable root cause of software bugs. Exposure of session tokens allows impersonation of legitimate users, resulting in unauthorized access. Security experts speculate that exploitation is imminent, drawing parallels to the original CitrixBleed (CVE-2023-4966) vulnerability leveraged by ransomware groups in high-profile breaches.

Another flaw, CVE-2025-6543 (CVSS 9.8), also affecting Citrix NetScaler ADC and Gateway, was added to CISA KEV, indicating that active exploitation is already underway. CVE-2025-6543 is a memory overflow vulnerability [CWE-119]. While the impact has been officially described as DoS, researchers believe it may come to arbitrary code execution or device takeover, as seen in similar past cases.

Both flaws only impact devices configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA (Authentication, Authorization, and Accounting) virtual servers. Both flaws are the subject of widespread national CERT advisories [1][2][3][4][5][6][7]. Greenbone provides a remote version check to detect CitrixBleed 2 and a remote version check for CVE-2025-6543. Users should patch with urgency.

A Trio of Exploitable Sitecore CMS Flaws

Three new CVEs affecting Sitecore Experience Platform can be chained to allow unauthenticated Remote Code Execution (RCE) . The flaws were disclosed with a full technical description and PoC guidance, making their exploitation highly likely. In the attack chain, CVE-2025-34509 provides initial authenticated access, while CVE-2025-34510 or CVE-2025-34511 are both post-auth RCE flaws. Attackers can first exploit hardcoded credentials to generate a valid session token, then upload a malicious “.aspx” web shell and proceed to execute arbitrary shell commands on the victim’s system. Alternatively, CVE-2025-34511 could be used to execute PowerShell commands instead of uploading a web shell.

Here are brief descriptions of each:

  • CVE-2025-34509 (CVSS 8.2): Hardcoded credentials [CWE-798] allow remote attackers to authenticate using this account to access the admin API.
  • CVE-2025-34510 (CVSS 8.8): A relative path traversal vulnerability [CWE-23] known as “Zip Slip” allows an authenticated attacker to extract malicious files from a ZIP archive into the webroot directory, which could lead to RCE via .aspx web shell.
  • CVE-2025-34511 (CVSS 8.8): An unrestricted file upload vulnerability [CWE-434] in the PowerShell Extensions module allows an attacker to upload arbitrary files, including executable scripts, to any writable location. Although CVE-2025-34511 requires the Sitecore PowerShell Extension to be installed, this is considered a common configuration.

Sitecore is a popular enterprise Content Management System (CMS) used by major global organizations across industries. While it is estimated that Sitecore represents between 0.45% and 0.86% of the global CMS market share [1][2], this user base consists of high-value targets. Greenbone is able to detect vulnerable instances of Sitecore with an active check and a remote version detection test. Patches were released in Sitecore version 10.4 and backported to earlier supported versions, allowing users to upgrade.

Bypass of CVE-2025-23120 in Veeam Backups

CVE-2025-23121 (CVSS 9.9) is a deserialization flaw [CWE-502] that allows authenticated domain users to execute arbitrary code [CWE-94] on Veeam Backup & Replication servers. The vulnerability arises from insecure data processing and is considered a bypass of a previously patched flaw, CVE-2025-23120.

No public PoC exploit is currently available. However, CVEs in Veeam Backup & Replication are often targeted by attackers. Furthermore, the vulnerability only applies to organizations using domain-joined backup servers. However, it presents a serious threat given the importance of backups in ransomware recovery. Attackers may gain valid credentials for authentication via credential theft or use password spraying to target re-used credentials.

Greenbone can remotely detect affected Veeam products and prompt patching to version 12.3.2.3617, which is strongly recommended.

Summary

June 2025 saw the emergence of at least two new wiper malware strains, threatening to impact critical infrastructure and enterprises. Widespread massive data breaches are escalating, impacting organizations and individuals as stolen data gets used for various malicious ends. This month also saw a deluge of newly discovered, critical-severity vulnerabilities in enterprise-grade products, most of which were not covered in this report. Many with PoCs or full exploit kits available within hours of their disclosure. From RoundCube and Cisco ISE to Citrix and Linux systems, high-risk digital weaknesses that demand attention are escalating the cyber war of attrition for defenders worldwide.

It’s not “unauthenticated” because the first step is to gain authentication, right?

Contact Test Now Buy Here Back to Overview

/by
Joseph Lee

CVE-2025-25257: Urgent Pre-Auth RCE in FortiWeb Fabric Connector

A fresh vulnerability, CVE-2025-25257 (CVSS 9.6) in Fortinet’s FortiWeb Fabric Connector presents high risk globally. Although the CVE is still only in RESERVED status as of July 14th, 2025, it has already received a national CERT advisory from Belgium’s CERT.be and the Center for Internet Security (CIS) has also issued an alert. More alerts should follow shortly as CVE reaches PUBLISHED status.

Multiple public Proof of Concept (PoC) exploits [1][2] are available, further increasing the risk level.  Users should apply updates with urgency. Greenbone has issued a detection test for this flaw soon after its disclosure, allowing defenders to identify vulnerable systems across their networks. Let’s dig into the details of CVE-2025-25257 to find out what it’s all about.

CVE-2025-25257: Unauthenticated RCE in FortiWeb Fabric Connector

CVE-2025-25257 (CVSS 9.6) is an unauthenticated Remote Code Execution (RCE) flaw in Fortinet FortiWeb Fabric Connector with a critical impact score of CVSS 9.6. The flaw allows both SQL code and Python code to be executed on a victim’s system due to improper neutralization of HTTP headers. Shockingly, this vulnerability exists because the HTTP “Authorization:Bearer” header value is inserted into SQL queries without being sanitized [CWE-89] – which is an unforgivably poor software design. Full technical descriptions and exploits [1][2][3] have been published by watchTowr Labs and other security researchers. This means exploitation should now be considered trivial for all attackers of all skill levels.

In addition to all typical SQL Injection attacks, such as enumerating the database or modifying data, attackers can gain RCE by injecting SQL code to exploit MySQL’s INTO OUTFILE command. By writing an executable .pth file into Python’s site-packages directory (/usr/local/lib/python3.10/site-packages/ in the case of FortiWeb), it will be executed every time a Python script is run. This is because Python’s built-in initialization mechanism (site.py) is triggered during interpreter startup. FortiWeb’s web-based admin console also includes a Python-based CGI script (ml-draw.py), which can be triggered without authentication, completing the exploit-chain.

Although the vulnerability is not yet known to be exploited in the wild, its pre-auth RCE status and historical attacks against Fortinet products indicate that a low-hanging fruit such as CVE-2025-25257 is likely to be exploited soon after disclosure. FortiWeb Fabric Connector is not an edge service. However, local attackers may exploit it to modify FortiWeb WAF configurations, steal sensitive information, or install additional persistent malware.

What Is FortiWeb Fabric Connector?

FortiWeb itself is a Web Application Firewall (WAF), which can be considered an edge security device when deployed in that role. Fabric Connector is a system integration component, designed to facilitate automated coordination between FortiWeb WAF and other Fortinet products such as FortiGate and FortiManager. As other Fortinet devices generate threat data, Fabric Connector can convert that data into real-time security responses within FortiWeb. Luckily, the FortiWeb Fabric Connector is not an edge service, and therefore not typically accessible via the public Internet. However, as a WAF, FortiWeb devices are tasked with blocking malicious traffic from reaching webservers. Therefore, if attackers are able to alter its configuration, they could enable secondary attacks against web-based assets.

Mitigating CVE-2025-25257

CVE-2025-25257 affects FortiWeb versions 7.0.0 through 7.0.10, 7.2.0 through 7.2.10, 7.4.0 through 7.4.7, and 7.6.0 through 7.6.3. Users should upgrade immediately to versions 7.0.11, 7.2.11, 7.4.8 or 7.6.4 or later. If updating is not possible, Fortinet advises users to disable the FortiWeb HTTP/HTTPS administrative interface.

Summary

CVE-2025-25257 offers attackers unauthenticated RCE via Fortinet’s FortiWeb Fabric Connector HTTP API. The flaw is driven by a SQL injection vulnerability that has so far been leveraged to escalate privileges and execute Python code as well. Public PoCs and a national CERT advisory from CERT.be highlight the urgency to patch or otherwise remediate. Greenbone has issued detection tests for this flaw soon after its disclosure, allowing defenders to identify vulnerable systems across their networks.

Contact Test Now Buy Here Back to Overview

/by
Markus Feilner

Massive Weaknesses in Government Data Centers, Says Bundesrechnungshof

Germany’s Bundesrechnungshof has sharply criticized the current state of cybersecurity in the federal administration. Der Spiegel quotes a document classified as confidential, which concludes that significant parts of the government’s IT infrastructure have serious security flaws and do not meet the minimum requirements of the Federal Office for Information Security (BSI).

The Bundesrechnungshof (BRH) is Germany’s supreme audit institution responsible for the federal government’s budgetary and economic oversight. It examines whether federal authorities, ministries, federal enterprises, and other public institutions are using taxpayers’ money properly, economically, and efficiently. It is independent of both the federal government and the Bundestag.

The report criticizes the lack of a central, cross-departmental information security control system. It also states that the existing security architecture must become more efficient.

Inadequate Governance  and NIS2 Preparation

Another point of criticism concerns the requirements of the NIS 2 Directive [1] [2] [3]. This introduces significant new obligations for federal authorities and KRITIS-related organizations – particularly with regard to prevention, documentation requirements, and BSI oversight. Many institutions are neither technically nor organizationally prepared for this.

The Court of Auditors welcomes the fact that the adjustment of Germany’s debt limit will allow targeted investment in cybersecurity. However, the investments are tied to the demonstrable effectiveness of the measures. In practice, this means only those who can prove their security measures lead to concrete improvements will receive future funding.

Increasing Pressure to Act

The report highlights growing pressure on public administration. The threat landscape continues to worsen, with annual damages in the hundreds of billions. The BRH is calling for a shift toward structured, data-driven, and sustainable security management.

The widespread failure is alarming. Serious weaknesses have been found in almost all data centers of German public authorities – with dramatic consequences for the security, resilience, and trustworthiness of the government’s IT infrastructure. Public authorities and KRITIS operators must take action now and introduce modern vulnerability management.

In many cases, there is not even an emergency power supply, and fewer than one in ten examined data centers meet the BSI’s minimum standards for high availability. According to the investigation, this is concerning: lack of redundancy, outdated systems, and insufficient reliability all jeopardize the functionality of critical infrastructure in the event of a crisis.

Over 180 Billion Euros in Damage Every Year

The damage is already being done: according to current figures, cyberattacks cause over 180 billion euros in damage every year in Germany. Acts of sabotage, hybrid attacks, and blackout scenarios have long been a reality – and the trend is rising.

However, the German BRH identifies many shortcomings: a lack of structured information security, cross-departmental and data-based IT risk management, and appropriate governance . Reliable information is lacking – without which it is impossible to realistically assess risk levels or progress in individual cases, let alone provide evidence.

Greenbone’s Vulnerability Management Helps

When it comes to implementing the right measures and proving their effectiveness, solutions like those offered by Greenbone come into play. Modern vulnerability management provides a decisive strategic advantage. Among other things, it provides a reliable, robust basis to support data-driven decision-making for administrators and management.

Greenbone’s OPENVAS automatically, continuously, and objectively detects, evaluates, and prioritizes vulnerabilities. This creates a reliable foundation for IT governance  structures – even in ministries, government agencies, and other public-sector enterprises. Vulnerability Management also ensures the essential transparency in times of growing accountability – thus becoming a mandatory component rather than a “nice-to-have.”

Greenbone Vulnerability Management reports contain CVSS ratings, trend analyses, and progress indicators. Authorities can use these not only for internal documentation but also to demonstrate measurable improvements to audit offices and ministries.

Equipped for NIS2

The new NIS2 directive tightens requirements for operators of critical infrastructure. It defines new responsibilities, expands BSI controls and reporting obligations, and specifies the software components to be used. As a result, more companies are dealing with the upcoming German version of the regulation.

Greenbone’s solutions actively support public authorities and KRITIS-related organizations in preparing for regulatory audits. Features such as automated vulnerability management, audit-proof reporting, and audit trails provide security, even under increasing regulatory control.

Webinars Help with Prevention – Now Is the Time to Act!

Greenbone customers receive concrete help when it comes to meeting BSI requirements in the data center, preparing for audits, and viewing vulnerability management as part of emergency preparedness. After all, prevention is always cheaper and more effective than crisis management.

The report by the German BRH is a wake-up call – and an opportunity. And because cybersecurity begins with visibility, Greenbone is the right choice. Contact us or attend our webinars – like the latest series for public authorities and KRITIS, offering in-depth information on implementing the NIS 2 Directive, data center hardening, and georedundancy, as well as on the basic structure of vulnerability control . Dates, content, and registration can be found on the website.

Contact Test Now Buy Here Back to Overview

/by
Greenbone AG

Greenbone Audits for Compliance with the CIS Windows 11 Enterprise Benchmark”

Microsoft Windows remains the most widely used desktop operating system in enterprise environments – and also one of the most targeted by threat actors. Insecure configurations are a leading source of security breaches [1][2][3], often exploited to gain initial access [TA0001], escalate privileges [TA0004], steal credentials [TA0006], establish persistent access [TA0003], and move laterally within a network [TA0008]. Many national cybersecurity agencies continue to advocate strongly for organizations to enact policies to strengthen operating system (OS) baseline configurations [4][5][6][7][8].

Securing Windows 11 systems requires more than just patching known vulnerabilities. IT operations should start by deploying security hardened baseline images of Windows and periodically verify their configuration. This means adjusting many hidden or often overlooked settings of Microsoft Windows while disabling some features altogether. Hardened security controls include enforcing strong password and account lockout policies, disabling unnecessary system services like Remote Registry, applying application control rules via AppLocker, configuring advanced audit policies to monitor system activity and more.

Aligning with these enterprise IT cybersecurity goals, Greenbone is proud to announce the addition of CIS Microsoft Windows 11 Enterprise Benchmark v3.0.0 Level 1 (L1) auditing to our compliance capabilities. This latest enhancement allows our Enterprise feed customers to verify their Windows 11 configurations against the CIS compliance standard and adds to Greenbone’s growing arsenal of CIS compliance policies including Google Chrome, Apache, IIS, NGINX, MongoDB, Oracle, PostgreSQL, Windows, Linux and Docker [1][2]. Read on to find out more about Greenbone’s latest IT security detection capabilities.

Greenbone Adds CIS Microsoft Windows 11 Enterprise Benchmark

The CIS Microsoft Windows 11 Enterprise Benchmark v3.0.0 L1 is now available in the Greenbone Enterprise Feed. This benchmark defines a comprehensive set of security configurations – from Group Policy and registry hardening to built-in feature restrictions – designed to lock down Windows 11 Enterprise in line with industry best practices. With this new addition, Greenbone makes it easier to identify Microsoft Windows misconfigurations before attackers can exploit them.

Our Enterprise vulnerability feed leverages compliance policies to execute tests to verify each automatable CIS L1 requirement. These tests are grouped into scan configurations, allowing security teams to launch targeted assessments across their Windows 11 fleet. Whether aligning with internal security mandates or regulatory frameworks, Greenbone’s audit will confirm your Windows 11 Enterprise settings, ensuring that systems are locked down and that deprecated or risky features are disabled.

Windows Security Is Paramount

Microsoft Windows plays a prominent role in enterprise IT environments, serving as the backbone for endpoints, servers and domain infrastructure. But this ubiquity also makes it a prime target. Insecure Windows configurations can open the door to Remote Code Execution (RCE), credential theft and privilege escalation. A serious cyber breach can result in full domain compromise, ransomware attacks, loss of customer confidence, regulatory fines and even high cost legal action such as class action lawsuits when user data is leaked.

In recent years, national cybersecurity agencies – including Germany’s BSI [9], the U.S. Cybersecurity and Infrastructure Security Agency (CISA) [10] and the Canadian Centre for Cyber Security [11] among others [12][13] – have issued alerts emphasizing the need to harden OS security configurations and disable legacy features that attackers routinely exploit. The increasing frequency and sophistication of adversarial threat actors further underscores the need for proactive Windows security.

Misconfigurations in Windows can have a cascading impact, compromising both the local system and the wider network. That’s why hardening efforts must go beyond vulnerability patching to include robust configuration management. Greenbone’s new CIS Windows 11 Enterprise compliance policy gives defenders the tools they need to strengthen resilience against many critical IT security weaknesses.

How Does the CIS Windows 11 Benchmark Improve Cybersecurity?

The CIS Microsoft Windows 11 Enterprise Benchmark offers a structured approach to securing Microsoft Windows endpoints. It defines configuration settings that could be used for unauthorized access, privilege abuse and system compromise. The benchmark audits a wide range of policies including account security, system services, network configurations, application controls and administrative templates to reduce attack surface and improve system integrity.

The major sections of the CIS Windows 11 benchmark are:

  • Account Policies: Defines policies for password complexity, history, expiration and account lockout thresholds. These settings help enforce strong authentication hygiene and limit brute-force attacks.
  • Local Policies: Focuses on enforcing a wide array of local access controls and system behavior. It covers audit settings, user rights assignments (like who can log in locally or shut down the system) and security options (like guest account status, access tokens, network access, device drivers, firmware options and cryptography requirements) and more.
  • System Services: Reduces attack surface by limiting active system components. Recommends disabling or configuring Windows services that may be unnecessary or expose the system to risk (e.g., Remote Registry, FTP, Bluetooth, OpenSSH, Geolocation service and more).
  • Windows Defender Firewall with Advanced Security: Covers firewall configurations for domain, private and public profiles. Includes rules for logging, connection restrictions and blocking unsolicited inbound traffic to enforce network segmentation and traffic control.
  • Advanced Audit Policy Configuration: Provides granular auditing settings across categories like logon events, object access and policy changes to enhance visibility and compliance.
  • Administrative Templates (Computer): Covers Group Policy settings at the computer level, including UI restrictions, legacy protocol controls, SMB hardening, UAC behavior and device configuration.
  • Administrative Templates (User): Focuses on user-level policies affecting personalization, privacy, desktop behavior, Windows components, telemetry, cloud content, search and Microsoft Store access.

Greenbone Is a CIS Consortium Member

As a member of the CIS consortium, Greenbone is committed to adding additional scan configurations to attest CIS Benchmarks. All our CIS Benchmarks policies are aligned with CIS hardening guidelines and certified by CIS, ensuring maximum security for system audits. Greenbone also has a dedicated compliance view for the Greenbone Security Assistant (GSA) web-interface, to streamline the assessment process for organizations.

Summary

Securing Microsoft Windows 11 Enterprise requires more than patching vulnerabilities – it demands a disciplined approach to configuration management based on proven best practices. By hardening hidden system settings and disabling unnecessary features, security teams can prevent exploitation paths commonly used by attackers to deploy ransomware, exfiltrate data or establish persistence.

With added support for the CIS Microsoft Windows 11 Enterprise Benchmark v3.0.0, Greenbone strengthens its position as a leader in proactive cybersecurity, offering enterprises the tools they need to reduce risk, demonstrate compliance and stay resilient in an increasingly hostile digital landscape. Enterprise Feed subscribers can now audit and verify their Windows 11 configurations with precision and confidence

Contact Test Now Buy Here Back to Overview

/by
Markus Feilner

Dwell time: Attackers Are Striking Faster and Disguising Themselves Better

Security experts are observing a worrying trend: the time to exploit (TTE), i.e. the time between a security vulnerability becoming known and being exploited by malicious actors, has been falling dramatically in recent times.

At the same time, attackers are becoming increasingly skilled at concealing their presence in a successfully hacked network. Experts refer to the time it takes to establish a foothold and then gain unauthorized access to company resources before being detected (and removed) as “dwell time”. The shorter this time, the better for those under attack. Even the most talented hacker needs time and can cause more (permanent) damage the longer they remain undetected and unobserved.

The Enemy Is Listening – and May Already Be There

Alarmingly, dwell time is increasingly reaching months or even years, as was the case with Sony and the US Office for Personal Management. There, attackers were able to operate undisturbed for more than twelve months. As a result, more than 10 terabytes of data were stolen from the Japanese technology group.

The fear of hidden intruders is great; after all, no one can say with certainty whether a malicious listener is already on their own network. It happens. In the 2015 Bundestag hack, for example, it was not the Bundestag’s own monitoring system that informed the German authorities about strange activities by third parties (Russian APT hacker groups) on the Bundestag network, but a “friendly” intelligence service. How long and how many actors had already been active in the network at that point remained unclear. The only thing that was clear was that there was more than one, and that the friendly intelligence services had been watching for some time.

Detection, Prevention and Response Increasingly Critical

This makes it more important to ensure that attackers do not gain access to the system in the first place. But this is becoming increasingly difficult: as reported by experts at Google’s Mandiant, among others, the response time available to companies and software operators between the discovery of a vulnerability and its exploitation has fallen rapidly in recent years, from 63 days in 2018 to just over a month in recent years.

Less and Less Time to Respond

In 2023, administrators had an average of only five days to detect and close vulnerabilities. Today it is already less than three days.

But that’s not all. In the past, security vulnerabilities were often exploited after patches became available, i.e., after experienced administrators had already secured their systems and installed the latest patches. These so-called “N-day vulnerabilities” should not really be a problem, as fixes are available.

Improved Discipline with Side Effects: Attackers Learn

Unfortunately, in the past, discipline (and awareness) was not as strong in many companies, and the issue was neglected, inadvertently contributing to the spread of automated attack methods such as worms and viruses. But there is good news here too: in 2022, attacks via N-day vulnerabilities still accounted for 38% of all attacks, but by 2023 this figure will fall to just 30%.

At first glance, this sounds good because administrators can find and fix known vulnerabilities for which patches are available more quickly and effectively. After years of poor discipline and a lack of update and patch strategies, the major and successful ransomware incidents have certainly also helped to convey the scope and importance of proper vulnerability management to the majority of those responsible.

Two-thirds Are now Zero-days

But there is also a downside to these figures: more than two-thirds of all attacks are now based on zero-day vulnerabilities, i.e., security gaps for which there is no patch yet – in 2023, this figure was as high as 70%. Criminal groups and attackers have reacted, learned and professionalized, automated and greatly accelerated their activities.

Without automation and standardization of processes, without modern, well-maintained and controlled open-source software, administrators can hardly keep up with developments. Who can claim to be able to respond to a new threat within three days?

Powerless? Not with Greenbone

When attackers can respond faster to new, previously unknown vulnerabilities and have also learned to hide themselves better, there can only be one answer: the use of professional vulnerability management. Greenbone solutions allow you to test your network automatically. Reports on the success of measures give administrators a quick overview of the current security status of your company.

Contact Test Now Buy Here Back to Overview

/by
Joseph Lee

Attackers Advance on Two New Ivanti EPMM Flaws

Just last month, CVE-2025-22457 (CVSS 9.8) affecting Ivanti Connect Secure, Policy Secure, and ZTA Gateways was recognized as a vector for ransomware. Now, two new CVEs have been added to the growing list of high-risk Ivanti vulnerabilities; CVE-2025-4427 and CVE-2025-4428 affecting Ivanti EPMM (Endpoint and Patch Management Mobile) are under active exploitation.

Greenbone includes active check and version detection tests addressing both new CVEs and many other flaws in Ivanti products, allowing users to identify vulnerable instances, proceed with the patch process and verify security compliance once patches have been applied. In this blog post we will review the technical details of both new CVEs and assess the role that Ivanti has played in the global cyber risk calculus.

Two New CVEs in Ivanti EPMM Combine for Unauthorized Access

At the time of disclosure, Ivanti admitted that on-premises EPMM customers had already been breached. However, cloud security firm Wiz claims that self-managed cloud instances have also been effectively exploited by attackers. A full technical description of the attack chain is publicly available, making exploit development easier for attackers and further increasing the risk.

Here is a brief summary of each CVE:

  • CVE-2025-4427 (CVSS 5.3): An authentication bypass in the API component of Ivanti EPMM 12.5.0.0 and prior allows attackers to access protected resources without proper credentials via the API.
  • CVE-2025-4428 (CVSS 7.2): Remote Code Execution (RCE) in the API component of Ivanti EPMM 12.5.0.0 and prior allows authenticated attackers to execute arbitrary code via crafted API requests.

Ivanti has released patches to remediate the flaws. Users should update EPMM to at least version 11.12.0.5, 12.3.0.2, 12.4.0.2 or 12.5.0.1. If immediate patching is not possible, Ivanti recommends restricting API access using either the built-in Portal ACLs (Access Control Lists with the “API Connection” type) or an external WAF (Web Application Firewall). Network-based ACLs are discouraged by the vendor, since they may block some EPMM functionality. While these mitigations reduce risk, they can impact functionality for certain EPMM integrations, such as Microsoft Autopilot and Graph API. Ivanti also offers an RPM file which can be used to patch EPMM via SSH command line access.

The Invanti EPMM Exploit Chain

The exploit chain in Ivanti EPMM begins with CVE-2025-4427. Due to an insecure configuration in the application’s security.xml file, certain endpoints (specifically /rs/api/v2/featureusage) partially process requests if the format parameter is provided. This pre-auth processing allowed unauthenticated requests to access functions that should be protected. This access control flaw caused by CVE-2025-4427 sets the stage for RCE via CVE-2025-4428.

CVE-2025-4428 allows RCE via an Expression Language (EL) injection via HTTP requests. If the format parameter supplied in a request is invalid as per the EPMM’s specification (neither “cve” or “json”), its value is appended to an error message without sanitization and logged via Spring Framework’s message templating engine. By supplying specially crafted values in the format parameter, attackers can execute arbitrary Java code because the logged message is evaluated as an EL formatted string.

Researchers have pointed out these risks associated with message templating engines are well documented and rebuked Ivanti’s claims that the vulnerability was due to a flaw in a third-party library, rather than their own oversight. Also, if the conditions leading to exploitation of CVE-2025-4428 sounds familiar, it is reminiscent of the infamous Log4Shell vulnerability. Like Log4Shell, CVE-2025-4428 results from passing unsanitized user input into an expression engine which will interpret special commands from a formatted string. In the case of Log4Shell, malicious string formatting in JNDI lookups (e.g., ${jndi:ldap://…}), could trigger RCE.

Risk Assessment: Attackers Advance on Ivanti Flaws

Ivanti has been in the hot seat for the past few years. Attackers have often exploited flaws in Ivanti’s products to gain initial access to their victim’s networks. Across all product lines, the vendor has been the subject of 61 Critical severity (CVSS >= 9.0) CVEs since the start of 2023. 30 of these have been added to CISA KEV (Known Exploited Vulnerabilities of the Cybersecurity and Infrastructure Security Agency), although the true tally of actively exploited flaws may be higher. Ivanti CVEs have a high conversion rate for use in ransomware attacks; CISA notes 8 CVEs in this category.

In early 2024, the European Commission, ENISA, CERT-EU and Europol issued a joint statement addressing active exploitation of Ivanti Connect Secure and Policy Secure Gateway products. In the US, CISA directed all federal civilian agencies to disconnect these products and assume they had been breached [1][2]. CISA, the FBI and cybersecurity agencies from the UK, Australia and Canada issued a joint advisory warning of ongoing exploitation. By late 2024, CISA had also alerted to active exploitation of Ivanti Cloud Service Appliances (CSA), warning that both state-sponsored and financially motivated threat actors were successfully targeting unpatched systems.

In 2025, on January 8th, CISA warned that newly disclosed CVE-2025-0282 and CVE-2025-0283 in Ivanti Connect Secure, Policy Secure and ZTA Gateways were also under active exploitation. Unfortunately, attackers continue to advance on new flaws in Ivanti’s products well into 2025 including CVE-2025-22457 [3][4] and now, two new CVEs in EPMM discussed above.

Dennis Kozak replaced Jeff Abbott as Ivanti’s CEO effective January 1, 2025 despite a mid-2024 pledge from Mr. Abbot for improved product security. No public statement was made linking the succession to the Utah company’s security challenges, however it happened with only a few weeks’ notice. Executives have not been called to testify before US congress as many other cybersecurity leaders have following high-risk incidents including Sudhakar Ramakrishna (CEO of SolarWinds), Brad Smith (President of Microsoft) and George Kurtz (CEO of CrowdStrike).

Echoes from EPMM’s Past: CVE-2023-35078 and CVE-2023-35082

In addition to the vortex of vulnerabilities discussed above, CVE-2023-35078 (CVSS 9.8) and CVE-2023-35082 (CVSS 9.8), disclosed in July and August 2023 respectively, also provided unauthenticated RCE for Ivanti EPMM. Public exploitation kicked off almost immediately after their disclosure in 2023.

CVE-2023-35078 was exploited to breach the Norwegian government, compromising data from twelve ministries [3][4]. CISA issued an urgent advisory (AA23-214A) citing confirmed exploitation by Advanced Persistent Threat (APT) actors and advising all federal agencies to take immediate mitigation steps. Even back in 2023, the speed and breadth of the attacks underscored Ivanti’s growing profile as a repeat offender, enabling espionage and financially motivated cybercrime.

Summary

Ivanti EPMM is susceptible to two new vulnerabilities; CVE-2025-4427 and CVE-2025-4428 can be combined for unauthorized remote code execution. Now under active exploitation, they underscore a troubling pattern of high-severity flaws in Ivanti products. Ivanti has released patches to remediate the flaws and users should update EPMM to at least version 11.12.0.5, 12.3.0.2, 12.4.0.2 or 12.5.0.1.

Greenbone’s vulnerability detection capabilities extend to include tests for CVE-2025-4427 and CVE-2025-4428 allowing Ivanti EPMM users to identify all vulnerable instances and verify security compliance once patches have been applied.

/by
Greenbone AG

Greenbone Reduces the Blast Radius of a Cyber Breach

Cyber attacks, like other types of security incidents, range dramatically in scope and impact. When defenders are prepared, an incident may be contained, damage limited, and recovery swift. When caught unprepared, a single incident may result in days or weeks of downtime, lost revenue, tarnished reputation, regulatory penalties or class action settlements [1][2]. In May 2024, Change Healthcare forecasted an expected loss of 1.6 billion Dollar. As of January 2025, the total cost of the Change Healthcare ransomware attack has reached almost 3 billion Dollar [3][4].

The totality of damage caused by an IT security breach, known as the “blast radius”, depends on many factors. These factors include whether vulnerabilities are being managed, if a defense in depth approach to cybersecurity has been applied, network segmentation, effective backup strategies and more. Negligent security hygiene is an open invitation to attackers, resulting in more costly outcomes like extensive data theft, ransomware extortion and even destructive wiper attacks used for industrial sabotage. A recent report found that once inside a network, attackers now deploy ransomware within 48 minutes on average and CVE disclosures are being weaponized into exploits within 18 days.

This article explores the concept of a cyber attack “blast radius” and the role that effective Vulnerability Management plays in containing the fallout from cyber intrusions. With the right controls in place, the damage from a cyber breach can be minimized and worst-case outcomes prevented

What is the “Blast Radius” of a Cyber Breach?

The term “blast radius” is military jargon referring to the physical area damaged by an exploding bomb. In digital systems, the term similarly refers to the extent of damage caused by a cyber attack. How many systems did an attacker compromise? Were they able to subsequently compromise critical systems after initial access? Did they breach adjacent networks or cloud assets?

Far-reaching damage is not a foregone conclusion when hackers gain initial access. Defenders can effectively cut off the attack at an early stage, preventing malicious actors from achieving their ultimate objectives or causing far reaching damage.

The Consequences of a Bigger Blast Radius

While forfeiting unauthorized access to an adversary is bad, it’s the subsequent stages of an attack that keeps IT security managers up at night. The latter stages of a cyber breach such as installing malware on critical assets, exfiltrating sensitive data, or encrypting files have the most profound implications for organizations. As blast radius increases, it is much more likely that an organization will experience a significantly negative impact.

Increased blast radius can result in:

  • Longer “Dwell Time”: Lateral movement and persistence techniques can allow attackers to remain undetected for extended periods, gathering intelligence and preparing subsequent attacks.
  • Increased financial losses: Service disruptions and ransomware attacks contribute to higher financial losses, lost revenue from downtime, risk of regulatory penalties and erode business relationships.
  • Increased operational downtime: The impact of operational downtime can reverberate across an organization causing delays, frustration and desynchronizing operations.
  • Loss of sensitive data: Attackers seek to exfiltrate sensitive data to support espionage campaigns or extort victims into paying ransom.
  • Compromised trust: Unauthorized access to messaging systems or third-party assets can erode trust among stakeholders, including customers, employees and business partners.

Greenbone Reduces the Blast Radius of a Cyber Breach

Vulnerability Management is a powerful factor in reducing the so-called “blast radius”. Effective mitigation of security gaps can leave an adversary with no easily accessible means to extend their initial foothold. Vulnerability management is most efficiently and effectively implemented by automatically scanning for security weaknesses throughout a network infrastructure and remediating the attack surface. In doing so, organizations can greatly reduce the potential blast radius of a successful cyber attack and also reduce probability of being breached in the first place.

Threat Mapping helps IT security teams understand their attack surfaces, the locations where adversaries may be able to enter a network. Greenbone’s core capabilities support Threat Mapping efforts with system and service discovery scans and by scanning both network and host attack surfaces allowing defenders to reduce their attack surface by 99%. Furthermore, Greenbone provides real-time reporting and alerts to keep security teams informed of emerging threats, enabling a proactive cybersecurity posture and timely remediation. This proactive, layered approach to cybersecurity reduces the potential blast radius and results in better security outcomes. Defenders are afforded more time to detect an attacker’s presence and eliminate it before catastrophic damage can be done.

The Strongest Defenses with Greenbone Enterprise Feed

The strongest defenses come from Greenbone’s industry leading Enterprise Vulnerability Feed. In total, the Greenbone Enterprise Feed has approximately 180,000 vulnerability tests and counting which can detect both general security compliance weaknesses and application specific vulnerabilities. Our Enterprise Feed adds hundreds of new tests each week to detect the newest emerging threats.

Here is a list of IT assets that Greenbone is designed to scan:

  • Internal network infrastructure: Scanning internal network devices with any type of exposed service, such as databases, file shares, SNMP enabled devices, firewalls, routers, VPN gateways and more.
  • On-premises and cloud servers: Attesting server configurations to ensure compliance with security policies and standards.
  • Workstations: Greenbone scans workstations and other endpoints across all major operating system (Windows, Linux, and macOS) to identify the presence of known software vulnerabilities attesting compliance with cybersecurity standards like CIS Benchmark
  • IoT and peripheral devices: IoT and peripheral devices, such as printers, use the same network protocols for communication as other network services. This allows them to be easily scanned for device and application specific vulnerabilities and common misconfigurations similarly to other network endpoints.

Reducing Network Attack Surface

Network attack surface consists of exposed network services, APIs and websites within an organization’s internal network environment and public facing infrastructure. To scan network attack surfaces, Greenbone builds an inventory of endpoints and listening services within target IP range(s) or a list of hostnames, then scans for known vulnerabilities.

Greenbone’s network vulnerability tests (NVTs) consist of version checks and active checks. Version checks query the service for a version string and then compare it for matching CVEs. Active checks use network protocols to interact with the exposed service to verify whether known exploit techniques are effective. These active checks use the same network communication techniques as real world cyber attacks, but do not seek to exploit the vulnerability. Instead, they simply notify the security team that a particular attack is possible. Anything an attacker can reach via the internet or local network, Greenbone can scan for vulnerabilities.

Reducing Host Attack Surface

Host attack surface is the software and configurations within individual systems that cannot be accessed directly via the network. Reducing the host attack surface minimizes what an attacker can do with initial access. Greenbone’s authenticated scans conduct Local Security Checks (LSC) to assess a system’s internal components for known weaknesses and non-compliant configurations that could allow attackers to escalate their privilege level, access sensitive information, install additional malware or move laterally to other systems.

Greenbone’s Enterprise Feed includes families of LSC for each major operating system including Ubuntu, Debian, Fedora, Red Hat, Huawei, SuSE Linux distributions, Microsoft Windows, macOS and many more.

Post-Breach Tactics: the Second Stage of Cyber Intrusions

Once attackers gain a foothold within a victim’s network, they engage in secondary exploitation techniques to deepen their access and achieve their objectives. In the modern cybercrime ecosystem, Initial Access Brokers (IABs) specialize in gaining unauthorized access. IABs then sell this access to other cybercriminal groups that specialize in second-stage attack tactics such as deploying ransomware or data theft. Similar to breaching the walls of a fortress, after initial access, an organization’s internal network becomes more accessible to attackers.

Some tactics used during the second stage of cyber attack include:

  • Privilege escalation [TA0004]: Attackers seek ways to elevate their access rights, allowing them access to more sensitive data or to execute administrative actions.
  • Lateral movement [TA0008]: Attackers compromise other systems within the victim’s network, extending their access to high-value resources.
  • Persistent remote access [TA0028]: Creating new accounts, deploying backdoors or using compromised credentials, attackers seek to maintain their access even if the initial vulnerability is remediated or their presence is detected.
  • Credential theft [TA0006]: Stolen sensitive data can be processed offline by attackers attempting to crack passwords, break into protected resources or plan social engineering attacks.
  • Accessing messaging systems [T1636]: Accessing organizational messaging platforms or collaboration tools gives access to sensitive information which can be used to conduct social engineering attacks such as spear phishing, even targeting external partners or customers.
  • Encryption for impact [T1486]: Identifying critical assets, financially motivated adversaries seek to maximize impact by deploying ransomware and extorting the victim to return access to the encrypted data.
  • Data exfiltration [TA0010]: Downloading a victim’s sensitive data can be used for espionage and also gives attackers leverage to extort victims into paying to not release it publicly.
  • Denial of Service attacks [T0814]: Service disruption can be used for further extortion or as a distraction to execute other attacks within the victim’s network.

Summary

Blast radius refers to the scope of damage that an adversary imposes during a cyber attack. As attacks progress, adversaries seek to penetrate deeper, gaining access to more sensitive systems and data. Lack of cyber hygiene gives attackers free reign to steal data, deploy ransomware and cause service disruptions and complicates detection and recovery. Minimizing attack surface is crucial for reducing the potential impact of a cyber breach and helps ensure a better security outcome.

Greenbone’s core contribution to cybersecurity is to increase security visibility in real-time, alerting defenders to vulnerabilities and giving them the opportunity to close security gaps, preventing hackers from exploiting them. This includes both network attack surface: public-facing assets, internal network infrastructure, cloud assets and host attack surface: internal software applications, packages and common misconfigurations.

By delivering industry-leading vulnerability detection, Greenbone empowers real-time threat visibility, empowering defenders to proactively ensure that adversaries are decisively neutralized.

Contact Test Now Buy Here Back to Overview

/by
Greenbone AG

Availability of CVE Vulnerability Data in Greenbone Products

Greenbone AG has been consistently committed to an independent and resilient supply chain for the provision of vulnerability data for many years. Against the background of current discussions on the financing and sustainability of the CVE programme of the US organisation MITRE, we would like to inform you about our measures to ensure the continuous provision of important information about vulnerabilities in IT systems.

Since 1999, the CVE system has formed the central basis for the clear identification and classification of security vulnerabilities in IT. Funding for the central CVE database is currently secured by the US government until April 2026. Against this background, Greenbone took structural measures at an early stage to become less dependent on individual data sources.

With our OPENVAS brand, Greenbone is one of the world’s leading open source providers in the IT security ecosystem. We make an active contribution to the development of sustainable, decentralised infrastructures for the provision of vulnerability information – and are already focusing on future-proof concepts that effectively protect our customers from security risks.

Our sovereign data approach includes the following measures, among others:

  • Broad source diversification: Our Systems and our security research team monitor a large number of international information sources in order to be able to react promptly to new threats independently of the official CVE process – even if there is no official CVE entry yet.
  • Integration of alternative databases: We integrate independent vulnerability catalogues such as the European Vulnerability Database (EUVD) into our systems in order to create a stable and geographically diversified information basis.
  • Promotion of open standards: We actively support the dissemination of the CSAF standard (Common Security Advisory Framework), which enables the decentralised and federated distribution of vulnerability information.

These measures ensure that our customers retain unrestricted access to up-to-date vulnerability information, even in the event of changes in the international data ecosystem. This ensures that your IT systems remain fully protected in the future.

Greenbone stands for independent, sovereign and future-proof weak-point supply – even in a changing geopolitical environment.

Contact Test Now Buy Here Back to Overview

/by