Tag Archive for: it security

Greenbone AG

Greenbone Supports DORA Compliance with Vulnerability Detection, Data Sovereignty and Reporting

The global financial sector has been slammed with high-profile cyber incidents, placing trust in financial systems in jeopardy. These cyber attacks are extremely costly and widespread. Large corporations are not the only losers in this battle. Citizens also suffer directly when data protection and the integrity of financial transactions are compromised.

Some of the most impactful breaches of financial entities in the EU and globally include:

  • Equifax (2017): Breached via an unpatched vulnerability in Apache Struts, leading to the theft of Social Security Numbers (SSN), birthdates, addresses and driver’s licenses of 147 million people.
  • UniCredit (2018): Italy’s second-largest bank exposed the Personally Identifiable Information (PII) of 778,000 clients; the Italian DPA finally issued a €2.8 million fine for the breach in 2024.
  • Capital One (2019): A misconfigured firewall was used to breach Capital One to steal the PII of 106 million individuals.
  • Finastra (2023): The UK-based fintech provider servicing global banks, was breached via its secure file-transfer system, resulting in the theft of over 400 GB of sensitive financial data from major banking clients.
  • UBS and Pictet (2025): A third-party cyberattack on Chain IQ exposed the PII of over 130,000 employees, including contact information for top executives.
  • Bybit (2025): North Korean hackers stole $1.5 billion worth of Ethereum from Bybit’s cold wallet, marking the biggest crypto exchange hack ever recorded.

These incidents emphasize the strategic importance of securing financial technology providers. Cyber attacks against banks include fraudulent wire transfers, ATM hacking, POS malware and data theft. Arguably, the impact of sensitive PII being stolen is even worse than simply stealing money. Stolen identities: names, SSNs, addresses and other PII are later sold on darknet marketplaces and used by attackers to commit identity theft, open fraudulent bank accounts or lines of credit and to conduct social engineering against individuals directly. Geopolitical tensions further place data theft victims at risk; hostile nation states and legally ambiguous intelligence brokers collect intelligence on individuals for surveillance, intimidation campaigns or worse.

In response to elevating threats, the Digital Operational Resilience Act, (aka “DORA”) exists to strengthen the EU financial sector’s cybersecurity posture with greater safeguards. This new legal framework is a pivotal piece of legislation within the EU’s financial regulatory framework, to stabilize consumer trust and bolster business confidence.

How OPENVAS SECURITY INTELLIGENCE by Greenbone Supports DORA Compliance:

  • Vulnerability management is a fundamental IT security activity with a well-established benefit to operational resilience. OPENVAS SCAN by Greenbone is an industry leading vulnerability scanner with a proven track record.
  • Our OPENVAS ENTERPRISE FEED has industry leading coverage for CVE detection as well as other network and endpoint vulnerability detection.
  • OPENVAS SCAN can identify the encryption protocols allowed by network services to ensure data-in-transit is compliant with data security best practices.
  • Our compliance scans can attest security hardened configuration for a wide range of operating systems (OS) and applications. This includes certified CIS Benchmarks for Apache HTTPD, Microsoft IIS, NGINX, MongoDB, Oracle, PostgreSQL, Google Chrome, Windows 11 Enterprise, Linux, and more [1][2].
  • All OPENVAS SECURITY INTELLIGENCE components are designed for absolute data sovereignty; your organization’s data never needs to leave the organization.
  • Our core product line is open source, time tested and open to external review by customers and community members alike. This visibility helps streamline third-party ICT service providers auditing.
  • OPENVAS REPORT by Greenbone is specially tailored to support evidence gathering and data retention for compliance reporting.
  • As an active ISO/IEC 27001:2022 and ISO 9001:2015 certified organization, Greenbone is dedicated to the most stringent quality standards for Information Security. Our ISO:14001 certification for Environmental Management Systems shows our continued commitment to things that matter.

The EU’s Digital Operational Resilience Act (DORA)

DORA is an EU regulation published in the Official Journal of the European Union on January 16, 2023, which came into force on January 17, 2025. DORA is part of the EU’s broader Digital Finance Strategy, and its goal is to standardize cybersecurity governance and risk management requirements, strengthening the operational resilience of financial entities in the EU. The act applies to 20 different types of financial entities including banks, insurance companies, investment firms and Information and Communication Technology (ICT) third-party service providers (TPP).

But aren’t financial entities subject to NIS 2 regulation as Essential Entities (EEs)?

Yes, but under Article 4 of NIS 2, financial services firms covered by DORA—such as banks, investment firms, insurance institutions, and financial market infrastructures—must fully adhere to DORA’s requirements when it comes to cybersecurity risk management and incident reporting. Also, any other sector-specific equivalent EU mandates that apply to risk management or incident reporting must take precedence over the corresponding provisions in NIS 2.

Who are the European Supervisory Authorities (ESAs)?

There are three formally designated ESAs responsible for issuing Regulatory Technical Standards (RTS) and Implementing Technical Standards (ITS) which clarify DORA’s requirements. The ESA entities are:

  • The European Banking Authority (EBA) [1]
  • The European Insurance and Occupational Pensions Authority (EIOPA) [2]
  • The European Securities and Markets Authority (ESMA) [3]

What are Regulatory Technical Standards (RTS)?

As the name implies, RTS define the required technical standards that entities covered by DORA must adhere to. RTS documents provide detailed guidance to ensure consistent application of DORA across the EU financial sector [4].

The final draft Regulatory Technical Standards are:

  • ICT risk management framework and simplified ICT risk management framework [5]
  • Criteria for the classification of ICT-related incidents [6]
  • Policy on ICT services supporting critical or important functions provided by TPPs [7]

What are Implementing Technical Standards (ITS)?

ITS are detailed rules that specify how financial entities must comply with obligations. They translate DORA’s general provisions into precise operational, procedural, and reporting standards. ITS address incident reporting, tracking of ICT TPP relationships and assessments, threat-led penetration testing (TLPT), and cyber threat information sharing.

  • The final draft ITS of templates for the register of information [8]

The Scope of DORA’s Impact on IT Security

Here are the fundamental IT security principles that DORA impacts:

  1. Risk Management: DORA mandates that financial entities implement robust IT Risk Management Frameworks (RMF) to reduce their operational risks.
  2. Incident Reporting: Fully regulated entities must report major cybersecurity incidents to their national authorities within 24 hours following a standardized format. However, small, non-interconnected, and exempt entities are eligible for reduced reporting requirements.
  3. Third-Party Risk: DORA establishes stricter oversight and accountability for how financial entities manage their relationships with third-party ICT service providers.
  4. Security Testing: Financial entities must conduct regular security assessments of their digital systems to improve resilience against cyber threats.
  5. Information Sharing: For improved information sharing between financial institutions and relevant authorities, entities are encouraged to report emerging threats if they may be relevant to others.

Summary

High-profile cyberattacks have exposed cracks in the financial sector’s deep digital weaknesses, prompting the EU to enact, and as January 17th, 2025, enforce the Digital Operational Resilience Act (DORA). Greenbone is an ally to support DORA compliance for covered entities with our established and trusted suite of enterprise vulnerability management products and compliance reporting tools. Our products support resilient data sovereignty, and detailed security assessment reporting.

True cyber risk mitigation is not simply about meeting compliance checkboxes. Defenders must be proactive in detecting emerging risks as early as possible to strengthen operational resilience. Greenbone enables early awareness of security vulnerabilities allowing the IT defenders of Europe’s financial entities to fix them before cyber breaches occur.

Contact Test Now Buy Here Back to Overview

/by
Markus Feilner

Massive Weaknesses in Government Data Centers, Says Bundesrechnungshof

Germany’s Bundesrechnungshof has sharply criticized the current state of cybersecurity in the federal administration. Der Spiegel quotes a document classified as confidential, which concludes that significant parts of the government’s IT infrastructure have serious security flaws and do not meet the minimum requirements of the Federal Office for Information Security (BSI).

The Bundesrechnungshof (BRH) is Germany’s supreme audit institution responsible for the federal government’s budgetary and economic oversight. It examines whether federal authorities, ministries, federal enterprises, and other public institutions are using taxpayers’ money properly, economically, and efficiently. It is independent of both the federal government and the Bundestag.

The report criticizes the lack of a central, cross-departmental information security control system. It also states that the existing security architecture must become more efficient.

Inadequate Governance  and NIS2 Preparation

Another point of criticism concerns the requirements of the NIS 2 Directive [1] [2] [3]. This introduces significant new obligations for federal authorities and KRITIS-related organizations – particularly with regard to prevention, documentation requirements, and BSI oversight. Many institutions are neither technically nor organizationally prepared for this.

The Court of Auditors welcomes the fact that the adjustment of Germany’s debt limit will allow targeted investment in cybersecurity. However, the investments are tied to the demonstrable effectiveness of the measures. In practice, this means only those who can prove their security measures lead to concrete improvements will receive future funding.

Increasing Pressure to Act

The report highlights growing pressure on public administration. The threat landscape continues to worsen, with annual damages in the hundreds of billions. The BRH is calling for a shift toward structured, data-driven, and sustainable security management.

The widespread failure is alarming. Serious weaknesses have been found in almost all data centers of German public authorities – with dramatic consequences for the security, resilience, and trustworthiness of the government’s IT infrastructure. Public authorities and KRITIS operators must take action now and introduce modern vulnerability management.

In many cases, there is not even an emergency power supply, and fewer than one in ten examined data centers meet the BSI’s minimum standards for high availability. According to the investigation, this is concerning: lack of redundancy, outdated systems, and insufficient reliability all jeopardize the functionality of critical infrastructure in the event of a crisis.

Over 180 Billion Euros in Damage Every Year

The damage is already being done: according to current figures, cyberattacks cause over 180 billion euros in damage every year in Germany. Acts of sabotage, hybrid attacks, and blackout scenarios have long been a reality – and the trend is rising.

However, the German BRH identifies many shortcomings: a lack of structured information security, cross-departmental and data-based IT risk management, and appropriate governance . Reliable information is lacking – without which it is impossible to realistically assess risk levels or progress in individual cases, let alone provide evidence.

Greenbone’s Vulnerability Management Helps

When it comes to implementing the right measures and proving their effectiveness, solutions like those offered by Greenbone come into play. Modern vulnerability management provides a decisive strategic advantage. Among other things, it provides a reliable, robust basis to support data-driven decision-making for administrators and management.

Greenbone’s OPENVAS automatically, continuously, and objectively detects, evaluates, and prioritizes vulnerabilities. This creates a reliable foundation for IT governance  structures – even in ministries, government agencies, and other public-sector enterprises. Vulnerability Management also ensures the essential transparency in times of growing accountability – thus becoming a mandatory component rather than a “nice-to-have.”

Greenbone Vulnerability Management reports contain CVSS ratings, trend analyses, and progress indicators. Authorities can use these not only for internal documentation but also to demonstrate measurable improvements to audit offices and ministries.

Equipped for NIS2

The new NIS2 directive tightens requirements for operators of critical infrastructure. It defines new responsibilities, expands BSI controls and reporting obligations, and specifies the software components to be used. As a result, more companies are dealing with the upcoming German version of the regulation.

Greenbone’s solutions actively support public authorities and KRITIS-related organizations in preparing for regulatory audits. Features such as automated vulnerability management, audit-proof reporting, and audit trails provide security, even under increasing regulatory control.

Webinars Help with Prevention – Now Is the Time to Act!

Greenbone customers receive concrete help when it comes to meeting BSI requirements in the data center, preparing for audits, and viewing vulnerability management as part of emergency preparedness. After all, prevention is always cheaper and more effective than crisis management.

The report by the German BRH is a wake-up call – and an opportunity. And because cybersecurity begins with visibility, Greenbone is the right choice. Contact us or attend our webinars – like the latest series for public authorities and KRITIS, offering in-depth information on implementing the NIS 2 Directive, data center hardening, and georedundancy, as well as on the basic structure of vulnerability control . Dates, content, and registration can be found on the website.

Contact Test Now Buy Here Back to Overview

/by
Joseph Lee

LEV: Demystifying the New Vulnerability Metrics in NIST CSWP 41

In 2025, IT security teams are overwhelmed with a deluge of new security risks. The need to prioritize vulnerability remediation is an ongoing theme among IT security and risk analysts. In a haystack of tasks, finding the needles is imperative. Factors compounding this problem include a cybersecurity talent shortage, novel attack techniques, and the increasing rate of CVE (Common Vulnerabilities and Exposures) disclosure.

To meet this need for better precision and efficiency, a wave of new prioritization metrics has emerged. Not that more perspectives on risk are a bad thing, but already overwhelmed defenders find themselves in a difficult position; the choice between pushing forward or pausing to evaluate the value of new metrics.

Released by NIST (National Institute of Standards and Technology) in May 2025, the Likely Exploited Vulnerabilities (or just LEV) metric consolidates historical EPSS (Exploit Prediction Scoring System) time-series, and in-the-wild exploitation status, to compute, among other things, an aggregate risk score. In this article, we will take a dive into what LEV is and the supplemental equations released in NIST’s recent technical whitepaper (NIST CSWP 41).

The Reason Behind LEV (Likely Exploited Vulnerabilities)

LEV uses a CVE’s historical EPSS time-series to calculate a cumulative risk score representing the probability that it has ever been actively exploited. But how is this different from EPSS itself? Isn’t EPSS, a machine learning (ML) model with almost 1,500 predictive features, good enough?

Some academic criticisms have revealed that EPSS can miss critical vulnerabilities. Direct observation of historical EPSS data shows that scores can spike for a very short period of time (1-2 days), then return to a moderate or low baseline. This presents potential problems for defenders using EPSS.

For example, EPSS does not reflect how cybercriminals operate. Industry reports show that attackers exploite vulnerabilities whenever and wherever they are found, even old ones. In other words, attackers don’t say “Let’s not exploit that vulnerability because it’s too old”. Therefore, using only the most current EPSS score can hide severe risk, even those uncovered in the recent past. Defenders may solve this problem by always applying the highest EPSS score in their risk assessment. But another weakness still looms with raw EPSS scores: According to fundamental statistical theory, the accumulation of moderate probability scores should also signify high probability of an event occurring.

LEV addresses this last limitation by calculating a cumulative probability using each CVE’s historical EPSS data. LEV applies the common product-based approach for calculating cumulative probability of at least one event occurring among several independent events. As a result, CVEs which didn’t trigger alerts (even using the max EPSS) now appear as high-risk using LEV.

Mathematical Input and Symbol Reference

This section explains the input variables and mathematical symbols used in the LEV equations.

Input Reference

  A vulnerability (e.g., a CVE) All equations
d A date (without time component) All equations
d0 First date with EPSS data for v All equations
dn The analysis date (usually today) LEV, Expected Exploited, Composite Probability
dkev Date of latest KEV (Known Exploited Vulnerabilities) list update KEV Exploited
LEV (v,d0,dn) Cumulative likelihood vulnerability v is exploited from d0 to dn All equations
EPSS (v,dn) EPSS score for vulnerability v on date dn Composite Probability
KEV (v,dn) 1.0 if v is in KEV list on dn, else 0 Composite Probability
scopedcves CVEs eligible for KEV tracking (where d0 ≤ dkev) KEV Exploited
cves CVEs considered in analysis (where d0 ≤ dn)  

Symbol Reference

Symbol Name Meaning
∀ Universal quantifier “For all” / “For every” similar to a programming loop.
Π Capital Pi A “Product notation” for repeated multiplication over a sequence, similar to how ∑ means repeated addition.
∑ Capital Sigma A “Cumulative notation” for repeated addition over a sequence.
∈ Element of “Is an element of” / “belongs to”. Indicates membership in a set.

Understanding the LEV Equations

LEV is described by the “NIST Cybersecurity White Paper 41” (CSWP 41) as a lower-bound probability (conservative estimate) that a vulnerability has been exploited​. It calculates the cumulative probability that a vulnerability has been exploited at least once during a given time window. Two similar equations are provided: LEV and LEV2. The first has been optimized to reduce CPU load.

In both the LEV and LEV2 equations, each term being multiplied by the product notation Π represents the probability that no exploitation occurred on a given day within the time window. This gives the cumulative probability of no exploitation ever. Subtracting this result from 1 inverts this probability, resulting in the probability of at least one exploitation over the time window.

The two LEV equations are described below:

The Performance Optimized LEV Equation

LEV uses a CVE’s historical EPSS scores, sampled every 30 days (epss(vi, di)), along with a compensating weight when the observation window is shorter than 30 days (i.e. dn​ < 30 days.

The LEV equation proposed in NIST CSWP 41

The High Resolution LEV2 Equation

LEV2 uses the complete historical EPSS time-series rather than sampling scores every 30 days. LEV2 applies weighting by dividing by the duration of the EPSS window (30 days). LEV2 increases the temporal resolution and produces a more reliable score. Short bursts of high EPSS cannot be skipped over, as can happen with the LEV equation shown above. Each daily EPSS value is scaled by 1/30 to preserve consistent risk density across the date range.

The LEV2 equation proposed in NIST CSWP 41

The Supplemental Equations

This section introduces the supplemental equations from NIST’s LEV whitepaper, their mathematical structure and potential use-cases.

Calculating a Composite Risk Score

The supplemental Composite Probability metric described in NIST’s LEV whitepaper simply selects the strongest available signal across three exploitation indicators: EPSS, inclusion in CISA’s (Cybersecurity and Infrastructure Security Agency) KEV list and LEV.

The Composite Probability equation proposed in NIST CSWP 41

By selecting the strongest intelligence signal, Composite Probability supports vulnerability prioritization. This helps reduce blind spots where one signal may be incomplete or outdated. It is especially valuable for prioritizing remediation in large enterprise vulnerability management programs, where choosing what to fix first is a critical challenge.

Estimating Total Number of Exploited CVEs

NIST’s whitepaper also suggests a method to estimate the total number of exploited CVEs during a specified time window and how to estimate the comprehensiveness of a repository of known exploited vulnerabilities.

The Expected Exploited Calculation

The Expected Exploited metric estimates the number of exploited CVEs within a given time window by summing all LEV probabilities from a defined set of vulnerabilities. The equation simply applies the sum (∑) of all LEV probabilities for a set of CVEs to estimate the total number of likely events. Although the NIST CSWP 41 describes it as a lower bound (conservative) estimate, there is no precedent for treating this basic technique as such. In probability theory, it is a fundamental principle that the expected number of events is equal to the sum of the individual event probabilities.

The Expected Exploited equation proposed in NIST CSWP 41

The KEV Exploited Calculation

The KEV Exploited metric estimates how many vulnerabilities are missing from a KEV catalog such as CISA KEV. Quantifying the gap between Expected Exploited and KEV Exploited gives insight into potential underreporting of a KEV catalog. The equation uses the same technique as the Expected Exploited equation above: the sum of all probabilities.

The KEV Exploited equation proposed in NIST CSWP 41

The Revelations of LEV

Here are some ways to visualize the value that LEV can provide to a vulnerability management program. The supplemental Composite Probability equation is best for visualizing the contribution that LEV makes to a more comprehensive CVE risk analysis. Therefore, the observations below all use Composite Probability unless otherwise stated.

The Estimated Total Number of Exploited CVEs

When considering all CVEs since ~1980 (273,979), LEV’s Expected Exploited metric shows that 14.6% of all CVEs (39,925) are likely to have been actively exploited in the wild. This implies that the vast majority of exploitation activity is not accounted for in any known KEV list (e.g. CISA KEV included 1,228 at the time of calculation). However, Expected Exploited does not account for how many individual CVEs may be uncovered at various EPSS thresholds.

The Number of Uncovered High Risk CVEs

To assess how LEV may impact an organization’s ability to uncover risk and prioritize remediation, it is useful to consider how many CVEs are elevated to high risk status at various probability thresholds. The chart below shows how many CVEs would become visible above 50% Composite Probability.

 

Visualizing Risk Migration Using Composite Probability

The Sankey diagram compares the number of CVEs in each risk level. The left side shows maximum EPSS scores, while the right side shows LEV’s Composite Probability. Because Composite Probability is used, by rule, no CVEs can move to a lower probability bucket. The chart reveals a significant shift from the lowest risk bucket to higher risk categories, along with a increase for all other groups when using Composite Probability to estimate risk.

Sankey diagram showing the migration CVEs between risk buckets when using max EPSS and LEV’s Composite Probability metric

Limitations and Criticisms of LEV

While LEV offers valuable insights, it’s important to examine its assumptions and potential shortcomings:

  • The LEV whitepaper does not present empirical validation or comparisons with other statistical models. However, a frequentist approach, using product-based probability, is a well-established method for calculating cumulative probability for a set of independent events.
  • LEV is described as a lower-bound probability. However, there is no academic precedent claiming that the mathematical constructs in NIST CSWP 41 are conservative lower-bounds estimates.
  • LEV is not an opaque prediction system in itself, but it is based on EPSS, which is not a fully public model. While LEV addresses some potential blind-spots, it does depend on EPSS. As EPSS improves, LEV will also benefit from these improvements. For example, EPSS v4 has added malware activity and endpoint detections to its “ground truth” of exploitation in the wild. This will reduce bias towards remotely accessible network vulnerabilities.
  • Defenders should not over-rely on LEV, EPSS, or CVSS to prioritize vulnerabilities. While evidence of active exploitation is the strongest risk signal, this evidence often comes post-hoc – too late for defenders to leverage.

Summary

LEV may offer some enhancements to vulnerability prioritization by aggregating historical EPSS signals into a cumulative exploitation probability. This approach increases visibility for CVEs with a historical duration of moderate EPSS scores. Perhaps the most useful metric is the proposed Composite Probability, which will select the strongest signal from LEV, EPSS, and CISA KEV exploitation status.

Contact Test Now Buy Here Back to Overview

/by
Greenbone AG

Greenbone Audits for Compliance with the CIS Windows 11 Enterprise Benchmark”

Microsoft Windows remains the most widely used desktop operating system in enterprise environments – and also one of the most targeted by threat actors. Insecure configurations are a leading source of security breaches [1][2][3], often exploited to gain initial access [TA0001], escalate privileges [TA0004], steal credentials [TA0006], establish persistent access [TA0003], and move laterally within a network [TA0008]. Many national cybersecurity agencies continue to advocate strongly for organizations to enact policies to strengthen operating system (OS) baseline configurations [4][5][6][7][8].

Securing Windows 11 systems requires more than just patching known vulnerabilities. IT operations should start by deploying security hardened baseline images of Windows and periodically verify their configuration. This means adjusting many hidden or often overlooked settings of Microsoft Windows while disabling some features altogether. Hardened security controls include enforcing strong password and account lockout policies, disabling unnecessary system services like Remote Registry, applying application control rules via AppLocker, configuring advanced audit policies to monitor system activity and more.

Aligning with these enterprise IT cybersecurity goals, Greenbone is proud to announce the addition of CIS Microsoft Windows 11 Enterprise Benchmark v3.0.0 Level 1 (L1) auditing to our compliance capabilities. This latest enhancement allows our Enterprise feed customers to verify their Windows 11 configurations against the CIS compliance standard and adds to Greenbone’s growing arsenal of CIS compliance policies including Google Chrome, Apache, IIS, NGINX, MongoDB, Oracle, PostgreSQL, Windows, Linux and Docker [1][2]. Read on to find out more about Greenbone’s latest IT security detection capabilities.

Greenbone Adds CIS Microsoft Windows 11 Enterprise Benchmark

The CIS Microsoft Windows 11 Enterprise Benchmark v3.0.0 L1 is now available in the Greenbone Enterprise Feed. This benchmark defines a comprehensive set of security configurations – from Group Policy and registry hardening to built-in feature restrictions – designed to lock down Windows 11 Enterprise in line with industry best practices. With this new addition, Greenbone makes it easier to identify Microsoft Windows misconfigurations before attackers can exploit them.

Our Enterprise vulnerability feed leverages compliance policies to execute tests to verify each automatable CIS L1 requirement. These tests are grouped into scan configurations, allowing security teams to launch targeted assessments across their Windows 11 fleet. Whether aligning with internal security mandates or regulatory frameworks, Greenbone’s audit will confirm your Windows 11 Enterprise settings, ensuring that systems are locked down and that deprecated or risky features are disabled.

Windows Security Is Paramount

Microsoft Windows plays a prominent role in enterprise IT environments, serving as the backbone for endpoints, servers and domain infrastructure. But this ubiquity also makes it a prime target. Insecure Windows configurations can open the door to Remote Code Execution (RCE), credential theft and privilege escalation. A serious cyber breach can result in full domain compromise, ransomware attacks, loss of customer confidence, regulatory fines and even high cost legal action such as class action lawsuits when user data is leaked.

In recent years, national cybersecurity agencies – including Germany’s BSI [9], the U.S. Cybersecurity and Infrastructure Security Agency (CISA) [10] and the Canadian Centre for Cyber Security [11] among others [12][13] – have issued alerts emphasizing the need to harden OS security configurations and disable legacy features that attackers routinely exploit. The increasing frequency and sophistication of adversarial threat actors further underscores the need for proactive Windows security.

Misconfigurations in Windows can have a cascading impact, compromising both the local system and the wider network. That’s why hardening efforts must go beyond vulnerability patching to include robust configuration management. Greenbone’s new CIS Windows 11 Enterprise compliance policy gives defenders the tools they need to strengthen resilience against many critical IT security weaknesses.

How Does the CIS Windows 11 Benchmark Improve Cybersecurity?

The CIS Microsoft Windows 11 Enterprise Benchmark offers a structured approach to securing Microsoft Windows endpoints. It defines configuration settings that could be used for unauthorized access, privilege abuse and system compromise. The benchmark audits a wide range of policies including account security, system services, network configurations, application controls and administrative templates to reduce attack surface and improve system integrity.

The major sections of the CIS Windows 11 benchmark are:

  • Account Policies: Defines policies for password complexity, history, expiration and account lockout thresholds. These settings help enforce strong authentication hygiene and limit brute-force attacks.
  • Local Policies: Focuses on enforcing a wide array of local access controls and system behavior. It covers audit settings, user rights assignments (like who can log in locally or shut down the system) and security options (like guest account status, access tokens, network access, device drivers, firmware options and cryptography requirements) and more.
  • System Services: Reduces attack surface by limiting active system components. Recommends disabling or configuring Windows services that may be unnecessary or expose the system to risk (e.g., Remote Registry, FTP, Bluetooth, OpenSSH, Geolocation service and more).
  • Windows Defender Firewall with Advanced Security: Covers firewall configurations for domain, private and public profiles. Includes rules for logging, connection restrictions and blocking unsolicited inbound traffic to enforce network segmentation and traffic control.
  • Advanced Audit Policy Configuration: Provides granular auditing settings across categories like logon events, object access and policy changes to enhance visibility and compliance.
  • Administrative Templates (Computer): Covers Group Policy settings at the computer level, including UI restrictions, legacy protocol controls, SMB hardening, UAC behavior and device configuration.
  • Administrative Templates (User): Focuses on user-level policies affecting personalization, privacy, desktop behavior, Windows components, telemetry, cloud content, search and Microsoft Store access.

Greenbone Is a CIS Consortium Member

As a member of the CIS consortium, Greenbone is committed to adding additional scan configurations to attest CIS Benchmarks. All our CIS Benchmarks policies are aligned with CIS hardening guidelines and certified by CIS, ensuring maximum security for system audits. Greenbone also has a dedicated compliance view for the Greenbone Security Assistant (GSA) web-interface, to streamline the assessment process for organizations.

Summary

Securing Microsoft Windows 11 Enterprise requires more than patching vulnerabilities – it demands a disciplined approach to configuration management based on proven best practices. By hardening hidden system settings and disabling unnecessary features, security teams can prevent exploitation paths commonly used by attackers to deploy ransomware, exfiltrate data or establish persistence.

With added support for the CIS Microsoft Windows 11 Enterprise Benchmark v3.0.0, Greenbone strengthens its position as a leader in proactive cybersecurity, offering enterprises the tools they need to reduce risk, demonstrate compliance and stay resilient in an increasingly hostile digital landscape. Enterprise Feed subscribers can now audit and verify their Windows 11 configurations with precision and confidence

Contact Test Now Buy Here Back to Overview

/by
Greenbone AG

Greenbone Reduces the Blast Radius of a Cyber Breach

Cyber attacks, like other types of security incidents, range dramatically in scope and impact. When defenders are prepared, an incident may be contained, damage limited, and recovery swift. When caught unprepared, a single incident may result in days or weeks of downtime, lost revenue, tarnished reputation, regulatory penalties or class action settlements [1][2]. In May 2024, Change Healthcare forecasted an expected loss of 1.6 billion Dollar. As of January 2025, the total cost of the Change Healthcare ransomware attack has reached almost 3 billion Dollar [3][4].

The totality of damage caused by an IT security breach, known as the “blast radius”, depends on many factors. These factors include whether vulnerabilities are being managed, if a defense in depth approach to cybersecurity has been applied, network segmentation, effective backup strategies and more. Negligent security hygiene is an open invitation to attackers, resulting in more costly outcomes like extensive data theft, ransomware extortion and even destructive wiper attacks used for industrial sabotage. A recent report found that once inside a network, attackers now deploy ransomware within 48 minutes on average and CVE disclosures are being weaponized into exploits within 18 days.

This article explores the concept of a cyber attack “blast radius” and the role that effective Vulnerability Management plays in containing the fallout from cyber intrusions. With the right controls in place, the damage from a cyber breach can be minimized and worst-case outcomes prevented

What is the “Blast Radius” of a Cyber Breach?

The term “blast radius” is military jargon referring to the physical area damaged by an exploding bomb. In digital systems, the term similarly refers to the extent of damage caused by a cyber attack. How many systems did an attacker compromise? Were they able to subsequently compromise critical systems after initial access? Did they breach adjacent networks or cloud assets?

Far-reaching damage is not a foregone conclusion when hackers gain initial access. Defenders can effectively cut off the attack at an early stage, preventing malicious actors from achieving their ultimate objectives or causing far reaching damage.

The Consequences of a Bigger Blast Radius

While forfeiting unauthorized access to an adversary is bad, it’s the subsequent stages of an attack that keeps IT security managers up at night. The latter stages of a cyber breach such as installing malware on critical assets, exfiltrating sensitive data, or encrypting files have the most profound implications for organizations. As blast radius increases, it is much more likely that an organization will experience a significantly negative impact.

Increased blast radius can result in:

  • Longer “Dwell Time”: Lateral movement and persistence techniques can allow attackers to remain undetected for extended periods, gathering intelligence and preparing subsequent attacks.
  • Increased financial losses: Service disruptions and ransomware attacks contribute to higher financial losses, lost revenue from downtime, risk of regulatory penalties and erode business relationships.
  • Increased operational downtime: The impact of operational downtime can reverberate across an organization causing delays, frustration and desynchronizing operations.
  • Loss of sensitive data: Attackers seek to exfiltrate sensitive data to support espionage campaigns or extort victims into paying ransom.
  • Compromised trust: Unauthorized access to messaging systems or third-party assets can erode trust among stakeholders, including customers, employees and business partners.

Greenbone Reduces the Blast Radius of a Cyber Breach

Vulnerability Management is a powerful factor in reducing the so-called “blast radius”. Effective mitigation of security gaps can leave an adversary with no easily accessible means to extend their initial foothold. Vulnerability management is most efficiently and effectively implemented by automatically scanning for security weaknesses throughout a network infrastructure and remediating the attack surface. In doing so, organizations can greatly reduce the potential blast radius of a successful cyber attack and also reduce probability of being breached in the first place.

Threat Mapping helps IT security teams understand their attack surfaces, the locations where adversaries may be able to enter a network. Greenbone’s core capabilities support Threat Mapping efforts with system and service discovery scans and by scanning both network and host attack surfaces allowing defenders to reduce their attack surface by 99%. Furthermore, Greenbone provides real-time reporting and alerts to keep security teams informed of emerging threats, enabling a proactive cybersecurity posture and timely remediation. This proactive, layered approach to cybersecurity reduces the potential blast radius and results in better security outcomes. Defenders are afforded more time to detect an attacker’s presence and eliminate it before catastrophic damage can be done.

The Strongest Defenses with Greenbone Enterprise Feed

The strongest defenses come from Greenbone’s industry leading Enterprise Vulnerability Feed. In total, the Greenbone Enterprise Feed has approximately 180,000 vulnerability tests and counting which can detect both general security compliance weaknesses and application specific vulnerabilities. Our Enterprise Feed adds hundreds of new tests each week to detect the newest emerging threats.

Here is a list of IT assets that Greenbone is designed to scan:

  • Internal network infrastructure: Scanning internal network devices with any type of exposed service, such as databases, file shares, SNMP enabled devices, firewalls, routers, VPN gateways and more.
  • On-premises and cloud servers: Attesting server configurations to ensure compliance with security policies and standards.
  • Workstations: Greenbone scans workstations and other endpoints across all major operating system (Windows, Linux, and macOS) to identify the presence of known software vulnerabilities attesting compliance with cybersecurity standards like CIS Benchmark
  • IoT and peripheral devices: IoT and peripheral devices, such as printers, use the same network protocols for communication as other network services. This allows them to be easily scanned for device and application specific vulnerabilities and common misconfigurations similarly to other network endpoints.

Reducing Network Attack Surface

Network attack surface consists of exposed network services, APIs and websites within an organization’s internal network environment and public facing infrastructure. To scan network attack surfaces, Greenbone builds an inventory of endpoints and listening services within target IP range(s) or a list of hostnames, then scans for known vulnerabilities.

Greenbone’s network vulnerability tests (NVTs) consist of version checks and active checks. Version checks query the service for a version string and then compare it for matching CVEs. Active checks use network protocols to interact with the exposed service to verify whether known exploit techniques are effective. These active checks use the same network communication techniques as real world cyber attacks, but do not seek to exploit the vulnerability. Instead, they simply notify the security team that a particular attack is possible. Anything an attacker can reach via the internet or local network, Greenbone can scan for vulnerabilities.

Reducing Host Attack Surface

Host attack surface is the software and configurations within individual systems that cannot be accessed directly via the network. Reducing the host attack surface minimizes what an attacker can do with initial access. Greenbone’s authenticated scans conduct Local Security Checks (LSC) to assess a system’s internal components for known weaknesses and non-compliant configurations that could allow attackers to escalate their privilege level, access sensitive information, install additional malware or move laterally to other systems.

Greenbone’s Enterprise Feed includes families of LSC for each major operating system including Ubuntu, Debian, Fedora, Red Hat, Huawei, SuSE Linux distributions, Microsoft Windows, macOS and many more.

Post-Breach Tactics: the Second Stage of Cyber Intrusions

Once attackers gain a foothold within a victim’s network, they engage in secondary exploitation techniques to deepen their access and achieve their objectives. In the modern cybercrime ecosystem, Initial Access Brokers (IABs) specialize in gaining unauthorized access. IABs then sell this access to other cybercriminal groups that specialize in second-stage attack tactics such as deploying ransomware or data theft. Similar to breaching the walls of a fortress, after initial access, an organization’s internal network becomes more accessible to attackers.

Some tactics used during the second stage of cyber attack include:

  • Privilege escalation [TA0004]: Attackers seek ways to elevate their access rights, allowing them access to more sensitive data or to execute administrative actions.
  • Lateral movement [TA0008]: Attackers compromise other systems within the victim’s network, extending their access to high-value resources.
  • Persistent remote access [TA0028]: Creating new accounts, deploying backdoors or using compromised credentials, attackers seek to maintain their access even if the initial vulnerability is remediated or their presence is detected.
  • Credential theft [TA0006]: Stolen sensitive data can be processed offline by attackers attempting to crack passwords, break into protected resources or plan social engineering attacks.
  • Accessing messaging systems [T1636]: Accessing organizational messaging platforms or collaboration tools gives access to sensitive information which can be used to conduct social engineering attacks such as spear phishing, even targeting external partners or customers.
  • Encryption for impact [T1486]: Identifying critical assets, financially motivated adversaries seek to maximize impact by deploying ransomware and extorting the victim to return access to the encrypted data.
  • Data exfiltration [TA0010]: Downloading a victim’s sensitive data can be used for espionage and also gives attackers leverage to extort victims into paying to not release it publicly.
  • Denial of Service attacks [T0814]: Service disruption can be used for further extortion or as a distraction to execute other attacks within the victim’s network.

Summary

Blast radius refers to the scope of damage that an adversary imposes during a cyber attack. As attacks progress, adversaries seek to penetrate deeper, gaining access to more sensitive systems and data. Lack of cyber hygiene gives attackers free reign to steal data, deploy ransomware and cause service disruptions and complicates detection and recovery. Minimizing attack surface is crucial for reducing the potential impact of a cyber breach and helps ensure a better security outcome.

Greenbone’s core contribution to cybersecurity is to increase security visibility in real-time, alerting defenders to vulnerabilities and giving them the opportunity to close security gaps, preventing hackers from exploiting them. This includes both network attack surface: public-facing assets, internal network infrastructure, cloud assets and host attack surface: internal software applications, packages and common misconfigurations.

By delivering industry-leading vulnerability detection, Greenbone empowers real-time threat visibility, empowering defenders to proactively ensure that adversaries are decisively neutralized.

Contact Test Now Buy Here Back to Overview

/by
Greenbone AG

Availability of CVE Vulnerability Data in Greenbone Products

Greenbone AG has been consistently committed to an independent and resilient supply chain for the provision of vulnerability data for many years. Against the background of current discussions on the financing and sustainability of the CVE programme of the US organisation MITRE, we would like to inform you about our measures to ensure the continuous provision of important information about vulnerabilities in IT systems.

Since 1999, the CVE system has formed the central basis for the clear identification and classification of security vulnerabilities in IT. Funding for the central CVE database is currently secured by the US government until April 2026. Against this background, Greenbone took structural measures at an early stage to become less dependent on individual data sources.

With our OPENVAS brand, Greenbone is one of the world’s leading open source providers in the IT security ecosystem. We make an active contribution to the development of sustainable, decentralised infrastructures for the provision of vulnerability information – and are already focusing on future-proof concepts that effectively protect our customers from security risks.

Our sovereign data approach includes the following measures, among others:

  • Broad source diversification: Our Systems and our security research team monitor a large number of international information sources in order to be able to react promptly to new threats independently of the official CVE process – even if there is no official CVE entry yet.
  • Integration of alternative databases: We integrate independent vulnerability catalogues such as the European Vulnerability Database (EUVD) into our systems in order to create a stable and geographically diversified information basis.
  • Promotion of open standards: We actively support the dissemination of the CSAF standard (Common Security Advisory Framework), which enables the decentralised and federated distribution of vulnerability information.

These measures ensure that our customers retain unrestricted access to up-to-date vulnerability information, even in the event of changes in the international data ecosystem. This ensures that your IT systems remain fully protected in the future.

Greenbone stands for independent, sovereign and future-proof weak-point supply – even in a changing geopolitical environment.

Contact Test Now Buy Here Back to Overview

/by
Joseph Lee

CVE-2025-34028: Commvault Command Center Actively Exploited for RCE

CVE-2025-34028 (CVSS 10) is a maximum severity flaw in Commvault Command Center, a popular admin console for managing IT security services such as data protection and backups across enterprise environments. As of April 28th, CVE-2025-34028 has been flagged as actively exploited. CVE-2025-34028 also presents heightened risk due to the existence of publicly available proof-of-concept (PoC) exploit code and the fact that Command Center manages the backups and other security configurations for many prominent organizations.

The flaw allows unauthenticated attackers to perform Remote Code Execution (RCE) and to take complete control of a Command Center environment. Given the sensitivity and criticality of IT tasks managed by Commvault, forfeiting complete control has a high potential for disastrous impacts. For example, if backups are disabled, an organization could lose their ability to recover from a ransomware attack. This makes CVE-2025-34028 an attractive target for ransomware operators and financially motivated attackers.

The vulnerability, discovered by Sonny Macdonald of watchTowr Labs, exploits a server-side request forgery (SSRF) [CWE-918] weakness in Command Center’s deployWebpackage.do endpoint. In a successful attack, an adversary uploads a poisoned ZIP archive to a publicly accessible path. The malicious ZIP file is automatically extracted allowing attackers to trigger execution via HTTP GET request to the extracted payload.

CVE-2025-34028 affects versions 11.38.0 to 11.38.19 on both Linux and Windows platforms. Greenbone is able to detect CVE-2025-34028 with an active check that sends a crafted HTTP POST request and checks if the target connects back to the scanner host indicating that it is vulnerable to exploitation. Users of affected versions are urged to apply patches immediately. Let’s further examine the risk posed by CVE-2025-34028.

What is Commvault Command Center?

Commvault Command Center is a web-based interface written in Java that enables organizations to manage data protection, backup, and recovery operations across enterprise environments. Commvault markets itself as a single platform with modular components such as Commvault Complete Backup & Recovery, Commvault HyperScale X and Commvault Disaster Recovery. Most of Commvault’s products rely on the Command Center as their primary management interface. As such, Command Center is used to configure backup jobs, monitor systems, restore data and administer user roles and access.

As of 2025, Commvault maintains roughly 6.2% of the Backup And Recovery market share category, serving over 10,000 organizations globally, across various industries such as banking, healthcare, government and technology. Most of its customers are large enterprises, with 42% having more than 1,000 employees. With Commvault’s adoption among critical sectors including healthcare, government and Fortune 500 companies, the potential impact of this vulnerability is widespread and significant.

A Technical Description of CVE-2025-34028

The discovery and disclosure of CVE-2025-34028 was accompanied by a full technical description and PoC code. Here is a brief summary of the root cause and attack vector for CVE-2025-34028:

The root cause of CVE-2025-34028 is classified as Server-Side Request Forgery (SSRF) [CWE-918]. SSRF vulnerabilities arise when an application is tricked into accessing a remote resource without properly validating it. By exploiting SSRF flaws, an attacker can potentially bypass access controls [CWE-284] such as firewalls that prevent the attackers from accessing the URLs directly. You can think of it as “bouncing” a request off the target in order to bypass security measures. In the case of CVE-2025-34028, the SSRF flaw allows an Unrestricted Upload of File with Dangerous Type [CWE-434].

Here is how the exploit process for CVE-2025-34028 works:

Mixed among the Command Center application endpoints, the researcher found 58 that do not require any form of authentication. Inspecting these unrestricted APIs, researchers discovered the deployWebpackage.do endpoint included a parameter named commcellName, which was used to define the hostname of a URL and which was not filtered for scope. Another parameter, servicePack, defines the local path where the HTTP response to that URL should be stored.

Using a simple directory traversal technique, i.e. prepending the servicePack parameter with “../../” the researcher was able to achieve arbitrary file upload to a custom destination. The Command Center application used a hardcoded filename dist-cc.zip, indicating that the program was expecting a ZIP archive.

When supplying a ZIP archived Java executable (.jsp file), and specifying an unauthenticated route via the servicePack param, a malicious .jsp payload was uploaded, automatically extracted, where it could be accessed directly via an HTTP GET request. This results in execution of the .jsp file by Command Center’s Apache Tomcat web server and unauthenticated, arbitrary RCE on behalf of the attacker.

Mitigating CVE-2025-34028

CVE-2025-34028 affects Commvault Command Center versions 11.38.0 through 11.38.19 on both Linux and Windows platforms and has been resolved in versions 11.38.20 and 11.38.25, with patches released on April 10, 2025. For those unable to update immediately, Commvault recommends isolating the Command Center installation from external network access as a temporary mitigation.

Commvault’s Innovation releases, which are frequent, feature-rich update tracks, are typically updated automatically by the system on a predefined schedule without requiring user action. This is in contrast to Long Term Support (LTS) versions which require manual updates.

Summary

CVE-2025-34028 is a critical severity unauthenticated RCE flaw in Commvault Command Center that doesn’t require user interaction. The vulnerability has been flagged as actively exploited by CISA as of April 2025. CVE-2025-34028 affects Command Center versions 11.38.0–11.38.19 and enables attackers to take full control of backup systems. Commvault is relied upon by many large companies globally for key backup and restoration capabilities making CVE-2025-34028 a hot target for ransomware threat actors. Greenbone is able to detect affected Command Center instances with an active test that uses an HTTP POST request to verify vulnerability.

Contact Test Now Buy Here Back to Overview

/by
Greenbone AG

Intuitive and Clear: Complete Overview of the Security Situation of Your IT Infrastructure – for all Decision-Making Levels

Our newly developed product OPENVAS REPORT integrates the data from practically any number of Greenbone Enterprise Appliances and brings it into a clearly structured dashboard. The user-friendly and comprehensive interface considerably simplifies the protection and safeguarding of even large networks.

Greenbone AG has been developing leading open source technologies for automated vulnerability management since 2008. More than 100,000 installations worldwide rely on the Greenbone community and enterprise editions to strengthen their cyber resilience.

“OPENVAS REPORT stands for innovation from the open source market leader.”

With our new product, we are decisively shortening the path from current security knowledge to the ability to act – faster, clearer and more flexible than ever before,” explains Dr. Jan-Oliver Wagner, CEO of Greenbone AG.

Recognize Hazardous Situations Faster and More Effectively

To protect your digital infrastructures, it is crucial to keep up to date with security-relevant events and to keep the response time to critical incidents as short as possible.

OPENVAS REPORT provides a daily updated, complete overview of the security situation of your IT infrastructure – for all decision-making levels.

Thanks to the connected Greenbone Enterprise Appliances, OPENVAS REPORT automatically recognizes computers and software in the company. Users can mark these with keywords and group and sort them as required – thus maintaining an overview even in very large networks.

Modern, User-friendly Dashboard

The OPENVAS REPORT Dashboard offers modern, user-friendly and highly flexible access for users who work with it on a daily basis. For example, filtering or sorting according to the general severity or specific risk of the vulnerabilities is possible. Companies can thus put together their own customized views, which always show an up-to-date picture of the risk situation in the company network.

Complete Overview

OPENVAS REPORT allows you to record and evaluate your company’s security situation at a glance. Thanks to its simple, clear user guidance, it prepares even the most complex data in a readable and understandable way, thus speeding up decision-making in critical situations.

With flexible and customizable filter options, OPENVAS REPORT considerably simplifies the day-to-day work of administrators and security officers.

Flexible Interfaces

The extensive export functions allow OPENVAS REPORT to be integrated even more deeply into the infrastructure, for example to process external data with OPENVAS REPORT.

Function Added value for your company
Comprehensive asset visibility Complete overview of all IT assets and their vulnerabilities in a single interface – for a complete assessment of your current security situation.
User-friendly dashboards A clearly structured, interactive dashboard makes complex vulnerability information understandable at a glance and accelerates well-founded decisions.
Flexible data processing A wide range of export, API and automation options can be seamlessly integrated into existing workflows and adapted to individual operational requirements.
Efficient data consolidation Aggregates results from multiple scanners and locations in a central database – reduces administrative effort and improves response time.
Customizable classification of vulnerabilities The severity levels and freely definable tags make it possible to precisely map internal compliance and risk models.
Extended reporting functions Target group-specific reports (C-Level, Audit, Operations) can be generated at the touch of a button: filters and drill-down links provide focused insights into critical security problems.

Learn More

Are you interested in a demo or a quote? Contact our sales team and find out more about OPENVAS REPORT. Write to us:sales@greenbone.net or contact us directly. We will be happy to help you!

Contact Test Now Buy Here Back to Overview

/by
Joseph Lee

March 2025 Threat Report: Who Do You Trust?

When it comes to protecting your organization from digital threats, who should you trust? Reality dictates that high-resilience IT security is forged from a network of strong partnerships, defense in depth; layered security controls, and regular auditing. Defensive posture needs to be monitored, measured and continuously improved. While vulnerability management has always been a core security control, it is nonetheless a fast moving target. In 2025, continuous and prioritized mitigation of security threats can have a big impact on security outcomes as adversarial time-to-exploit diminishes.

In March 2025’s monthly Threat Report, we will highlight the importance of vulnerability management and Greenbone’s industry leading vulnerability detection by reviewing the most recent critical threats. But these new threats only scratch the surface. In March 2025, Greenbone added 5,283 new vulnerability tests to our Enterprise Feed. Let’s jump into some of the important insights from a highly active threat landscape.

The US Treasury Breach: How Did It Happen?

In late December 2024, the U.S. Treasury Department disclosed that its network was breached by Chinese state-backed hackers and subsequently leveraged sanctions in early January 2025. Forensic investigations have tracked the root-cause to a stolen BeyondTrust API key. The vendor has acknowledged 17 other customers breached by this flaw. Deeper investigation has revealed that the API key was stolen via a flaw in a PostgreSQL built-in function for escaping untrusted input.

When invalid two-byte UTF-8 characters are submitted to a vulnerable PostgreSQL function, only the first byte is escaped, allowing a single quote to pass through unsanitized which can be leveraged to trigger an SQL Injection [CWE-89] attack. The exploitable functions are PQescapeLiteral(), PQescapeIdentifier(), PQescapeString() und PQescapeStringConn(). All versions of PostgreSQL before 17.3, 16.7, 15.11, 14.16, and 13.19 are affected as well as numerous products that depend on these functions.

CVE-2024-12356, (CVSS 9.8) and CVE-2024-12686, (CVSS 7.2) have been issued for BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) and CVE-2025-1094 (CVSS 8.1) addresses the flaw in PostgreSQL. The issue is the subject of several national CERT advisories including Germany’s BSI Cert-Bund (WID-SEC-2024-3726) and the Canadian Centre for Cybersecurity (AV25-084). The flaw has been added to CISA’s known exploited vulnerabilities (KEV) list, and a Metasploit module that exploits vulnerable BeyondTrust products is available, increasing the risk. Greenbone is able to detect the CVEs (Common Vulnerabilities and Exposures) discussed above both in BeyondTrust products or instances of PostgreSQL vulnerable to CVE-2025-1094.

Advanced fined 3.1 Million Pound for Lack of Technical Controls

This month, the UK’s Information Commissioner’s Office (ICO) imposed a 3.07 million Pound fine on Advanced Computer Software Group Ltd. under the UK GDPR for security failures. The case is evidence of how the financial damage caused by a ransomware attack can be further exacerbated by regulatory fines. The initial proposed amount was even higher at 6.09 million Pound. However, since the victim exhibited post-incident cooperation with the NCSC (National Cyber Security Centre), NCA (National Crime Agency) and NHS (National Health Service), a voluntary settlement of 3,076,320 Pound was approved. While operational costs and extortion payments have not been publicly disclosed, they likely add between 10 to 20 million Pound to the incident’s total costs.

Advanced is a major IT and software provider to healthcare organizations including the NHS. In August 2022, Advanced was compromised, attackers gained access to its health and care subsidiary resulting in a serious ransomware incident. The breach disrupted critical services including NHS 111 and prevented healthcare staff from accessing personal data on 79,404 individuals, including sensitive care information.

The ICO concluded that Advanced had incomplete MFA coverage, lacked comprehensive vulnerability scanning and had deficient patch management practices at the time of the incident – factors that collectively represented a failure to implement appropriate technical and organizational measures. Organizations processing sensitive data must treat security controls as non-negotiable. Inadequate patch management remains one of the most exploited gaps in modern attack chains.

Double Trouble: Backups Are Critical to Ransomware Mitigation

Backups are an organization’s last defense against ransomware and most sophisticated advanced persistent threat (APT) actors are known to target their victim’s backups. If a victim’s backups are compromised, submission to ransom demands is more likely. In 2025, this could mean multi-million Dollar losses. In March 2025, two new significant threats to backup services were revealed; CVE-2025-23120, a new critical severity flaw in Veeam was disclosed, and campaigns targeting CVE-2024-48248 in NAKIVO Backup & Replication were observed. Identifying affected systems and patching them is therefore an urgent matter.

In October 2024, our threat report alerted about another vulnerability in Veeam (CVE-2024-40711) being used in ransomware attacks. Overall, CVEs in Veeam Backup and Replication have a high conversion rate for active exploitation, PoC (Proof of Concept) exploits, and use in ransomware attacks. Here are the details for both emerging threats:

  • CVE-2024-48248 (CVSS 8.6): Versions of NAKIVO Backup & Replication before 11.0.0.88174 allow unauthorized Remote Code Execution (RCE) via a function called getImageByPath which allows files to be read remotely. This includes database files containing cleartext credentials for each system that NAKIVO connects to and backs up. A full technical description and proof-of-concept is available and this vulnerability is now tracked as actively exploited.
  • CVE-2025-23120 (CVSS 9.9): Attackers with domain user access can trigger deserialization of attacker-controlled data through the .NET Remoting Channel. Veeam attempts to restrict dangerous types via a blacklist, but researchers discovered exploitable classes (xmlFrameworkDs and BackupSummary) not on the list. These extend .NET’s DataSet class – a well-known RCE vector – allowing arbitrary code execution as SYSTEM on the backup server. The flaw is the subject of national CERT alerts globally including HK, CERT.be, and CERT-In. As per Veeam’s advisory, upgrading to version 12.3.1 is the recommended way to mitigate the vulnerability.

Greenbone is able to detect vulnerable NAKIVO and Veeam instances. Our Enterprise Feed has an active check [1] and version check [2] for CVE-2024-48248 in NAKIVO Backup & Replication, and a remote version check [3] for the Veeam flaw.

IngressNightmare: Unauthenticated Takeover in 43% of Kubernetes Clusters

Kubernetes is the most popular enterprise container orchestration tool globally. Its Ingress feature is a networking component that manages external access to services within a cluster, typically HTTP and HTTPS traffic. A vulnerability dubbed IngressNightmare has exposed an estimated 43% of Kubernetes clusters to unauthenticated remote access – approximately 6,500 clusters, including Fortune 500 companies.

The root-cause is excessive default privileges [CWE-250] and unrestricted network accessibility [CWE-284] in the Ingress-NGINX Controller tool, based on NGINX reverse proxy. IngressNightmare allows attackers to gain complete unauthorized control over workloads, APIs or sensitive resources in multi-tenant and production-grade clusters. A full technical analysis is available from the researchers at Wiz, who pointed out that K8 Admission Controllers are directly accessible without authentication by default, presenting an appealing attack surface to hackers.

The full attack trajectory to achieve arbitrary RCE against an affected K8 instance requires exploiting Ingress-NGINX. First, CVE-2025-1974 (CVSS 9.8) to upload a binary payload as the request body. It should be larger than 8kb in size while specifying a Content-Length header larger than the actual content size. This triggers NGINX to store the request body as a file, and the incorrect Content-Length header means the file will not be deleted as the server waits for more data [CWE-459].

The second stage of this attack requires exploiting CVE-2025-1097, CVE-2025-1098, or CVE-2025-24514 (CVSS 8.8). These CVEs all similarly fail to properly sanitize input [CWE-20] submitted to Admission Controllers. Ingress-NGINX converts Ingress objects to configuration files and validates them with the nginx -t command, allowing attackers to execute a limited set of NGINX configuration directives. Researchers found the ssl_engine module can be triggered to load the shared library binary payload uploaded in the first stage. Although exploitation is not trivial and no public PoC code exists yet, sophisticated threat actors will easily convert the technical analysis into effective exploits.

The Canadian Centre for Cyber Security has issued a CERT advisory (AV25-161) for IngressNightmare. Patched Ingress-NGINX versions 1.12.1 and 1.11.5 are available and users should upgrade as soon as possible. If upgrading the Ingress NGINX Controller is not immediately possible, temporary workarounds can help reduce risk. Strict network policies can restrict access to a cluster’s Admission Controllers allowing access to only the Kubernetes API Server. Alternatively, the Admission Controller component of Ingress-NGINX can be disabled entirely.

Greenbone is able to detect IngressNightmare vulnerabilities with an active check that verifies the presence of all CVEs mentioned above [1][2].

CVE-2025-29927: Next.js Framework Under Attack

A new vulnerability in Next.js, CVE-2025-29927 (CVSS 9.4) is considered high risk due the framework’s popularity and the simplicity of exploitation [1][2]. Adding to the risk, PoC exploit code is publicly available and Akamai researchers have observed active scans probing the Internet for vulnerable apps. Several national CERTs (Computer Emergency Response Teams) have issued alerts for the issue including CERT.NZ, Australian Signals Directorate (ASD), Germany’s BSI Cert-Bund (WID-SEC-2025-062), and the Canadian Centre for Cyber Security (AV25-162).

Next.js is a React middleware framework for building full-stack web applications. Middleware refers to components that sit between two or more systems and handle communication and orchestration. For web-applications, middleware converts incoming HTTP requests into responses and is often also responsible for authentication and authorization. Due to CVE-2025-29927, attackers can bypass Next.js middleware authentication and authorization simply by setting a malicious HTTP header.

If using HTTP headers seems like a bad idea for managing a web application’s internal process flow, CVE-2025-29927 is the evidence. Considering user-provided headers were not correctly distinguished from internal ones, this vulnerability should attain the status of egregious negligence. Attackers can bypass authentication by simply adding the `x‑middleware‑subrequest` header to a request and overloading it with at least as many values as the MAX_RECURSION_DEPTH which is 5. For example:

`x-middleware-subrequest: middleware:middleware:middleware:middleware:middleware`

The flaw is fixed in Next.js versions 15.2.3, 14.2.25, 13.5.9 and 12.3.5, and users should follow the vendor’s upgrade guide. If upgrading is infeasible, it is recommended to filter the `x-middleware-subrequest` header from HTTP requests. Greenbone is able to detect vulnerable instances of Next.js with an active check and a version check.

Summary

The March 2025 threat landscape was shaped by vulnerable and actively exploited backup systems, unforgivably weak authentication logic, high-profile regulatory fines and numerous other critical software vulnerabilities. From the U.S. Treasury breach to the Advanced ransomware fallout, the theme is clear: trust doesn’t grow on trees. Cybersecurity resilience must be earned; forged through layered security controls and backed up by accountability.

Greenbone continues to play a vital role by providing timely detection tests for new emerging threats and standardized compliance audits that support a wide array of enterprise architectures. Organizations that want to stay ahead of cyber crime need to proactively scan their infrastructure and close security gaps as they appear.

Contact Test Now Buy Here Back to Overview

 

/by
Dirk Boeing

The CPU as a Weakness: how to Manage Hardware Risks with Confidence

Vulnerabilities in IT environments appear in different forms. The most common ones are likely software vulnerabilities that have not been patched. Then there are weak passwords, misconfigurations or network switches that have been EOL for five years. However, another type of security gap sometimes causes significant confusion during the scans: hardware vulnerabilities.

We have become accustomed to the continuous emergence of software vulnerabilities, and hopefully, it is now standard practice for every company to regularly scan its network for vulnerabilities and apply patches. Unfortunately, mistakes are not limited to software developers – CPU developers are not immune either. CPU vulnerabilities often arise from design flaws, allowing malicious actors to exploit unintended side effects to access sensitive data. Unlike software vulnerabilities, which can often be resolved through patches or updates, hardware vulnerabilities require either microcode updates or fundamental architectural changes in future processor designs.

Microcode Updates

The only way to mitigate CPU vulnerabilities is by applying microcode updates, which are typically distributed through the operating system or sometimes even through firmware (UEFI/BIOS). Microcode is a low-level software layer within the processor that translates higher-level machine instructions into specific internal operations.

While end users do not traditionally update microcode themselves, manufacturers like Intel provide relevant updates to patch certain vulnerabilities without requiring a full hardware replacement. However, these updates often introduce performance loss, as they disable or modify certain CPU optimizations to prevent exploitation. In some cases, this can even lead to performance reductions of up to 50%.

Flaws on different levels

Since these vulnerabilities exist at the CPU level, tools like the Greenbone Enterprise Appliance detect and report them. However, this can lead to misconceptions, as users might mistakenly believe that the reported vulnerabilities originate from the operating system. It is crucial to understand that these are not OS vulnerabilities; rather, they are architectural flaws in the processor itself. The vulnerabilities are detected by checking for the absence of appropriate microcode patches when an affected CPU is identified. For example, if a scan detects a system that lacks Intel’s microcode update for Downfall, it will be reported as vulnerable. However, this does not mean that the OS itself is insecure or compromised.

Performance or safety?

In the end, mitigating CPU vulnerabilities always involves trade-offs, and users must decide which approach best suits their needs. In principle, there are three options to choose from:

  • Apply microcode updates and accept significant performance degradation in compute-heavy workloads.
  • Forego certain microcode updates and accept the risks if the probability of exploitation is low in their environment.
  • Replace the affected hardware with CPUs that are not vulnerable to these issues.

Ultimately, the decision depends on the specific use case and risk tolerance of the organization or individual responsibles.

Contact Test Now Buy Here Back to Overview

/by