Tag: cisa
-
U.S. CISA adds Motex LANSCOPE flaw to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Motex LANSCOPE flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Motex LANSCOPE flaw, tracked as CVE-2025-61932 (CVSS v4 score of 9.3), to its Known Exploited Vulnerabilities (KEV) catalog. The flaw is an improper verification of source of a communication…
-
F5 vulnerability highlights weak points in DHS’s CDM program
The Continuous Diagnostics and Mitigation program is oft-praised, but there are areas where it doesn’t yet excel, as a recent CISA emergency directive shows. First seen on cyberscoop.com Jump to article: cyberscoop.com/f5-vulnerability-highlights-weak-points-in-dhss-cdm-program/
-
F5 vulnerability highlights weak points in DHS’s CDM program
The Continuous Diagnostics and Mitigation program is oft-praised, but there are areas where it doesn’t yet excel, as a recent CISA emergency directive shows. First seen on cyberscoop.com Jump to article: cyberscoop.com/f5-vulnerability-highlights-weak-points-in-dhss-cdm-program/
-
Critical Lanscope Endpoint Manager Bug Exploited in Ongoing Cyberattacks, CISA Confirms
Tags: cisa, cve, cyberattack, cybersecurity, endpoint, exploit, flaw, infrastructure, kev, vulnerabilityThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a critical security flaw impacting Motex Lanscope Endpoint Manager to its Known Exploited Vulnerabilities (KEV) catalog, stating it has been actively exploited in the wild.The vulnerability, CVE-2025-61932 (CVSS v4 score: 9.3), impacts on-premises versions of Lanscope Endpoint Manager, specifically Client First seen on thehackernews.com…
-
Report: US Cyber Defense Declines, First Time in 5 Years
CISA Budget and Staffing Cuts Undermine National Cyber Readiness, Officials Warn. Federal cybersecurity reforms have regressed for the first time since 2020, as staffing cuts, diminished agency authority and lost momentum threaten U.S. cyber resilience, according to the Cyberspace Solarium Commission’s 2025 report, which urges immediate action from the White House and Congress. First seen…
-
CISA’s international, industry and academic partnerships slashed
The latest round of sweeping layoffs could hamper the business community’s collaboration with the beleaguered cyber agency. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/cisa-stakeholder-engagement-division-layoffs-critical-infrastructure-international/803433/
-
CISA’s international, industry and academic partnerships slashed
The latest round of sweeping layoffs could hamper the business community’s collaboration with the beleaguered cyber agency. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/cisa-stakeholder-engagement-division-layoffs-critical-infrastructure-international/803433/
-
CISA Flags Highly Exploitable Windows SMB Flaw
Tags: attack, cisa, cybersecurity, exploit, flaw, infrastructure, microsoft, mitigation, network, ntlm, windowsNTLM Reflection Attack Strikes Again. A three-month old flaw in a network protocol for file sharing used by Microsoft is under active exploitation, warns the U.S. Cybersecurity and Infrastructure Security Agency. The flaw’s exploitation bypasses mitigations Microsoft has built over the years to prevent NTLM reflection attacks. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/cisa-flags-highly-exploitable-windows-smb-flaw-a-29778
-
Oracle E-Business Suite Vulnerability Exploited In Ransomware Attacks
Tags: attack, business, cisa, cybersecurity, exploit, infrastructure, oracle, ransomware, vulnerabilityThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that a vulnerability impacting Oracle E-Business Suite customers has seen exploitation in ransomware attacks. First seen on crn.com Jump to article: www.crn.com/news/security/2025/cisa-oracle-e-business-suite-vulnerability-exploited-in-ransomware-attacks
-
CISA confirms hackers exploited Oracle E-Business Suite SSRF flaw
CISA has confirmed that an Oracle E-Business Suite flaw tracked as CVE-2025-61884 is being exploited in attacks, adding it to its Known Exploited Vulnerabilities catalog. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/cisa-confirms-hackers-exploited-oracle-e-business-suite-ssrf-flaw/
-
U.S. CISA adds Oracle, Windows, Kentico, and Apple flaws to its Known Exploited Vulnerabilities catalog
Tags: apple, cisa, cve, cybersecurity, exploit, flaw, infrastructure, kev, oracle, update, vulnerability, windowsU.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Oracle, Windows, Kentico, and Apple flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Oracle, Windows, Kentico, and Apple flaws to its Known Exploited Vulnerabilities (KEV) catalog. Oracle recently released an emergency patch to address an information disclosure flaw, tracked as CVE-2025-61884 (CVSS…
-
CISA warns of Windows SMB flaw under active exploitation (CVE-2025-33073)
CVE-2025-33073, a Windows SMB Client vulnerability that Microsoft fixed in June 2025, is being exploited by attackers. The confirmation comes from the Cybersecurity and … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/10/21/cisa-warns-of-windows-smb-flaw-under-active-exploitation-cve-2025-33073/
-
CISA Warns of Oracle E-Business Suite SSRF Vulnerability Actively Exploited in Attacks
Tags: attack, business, cisa, cve, cyber, cybersecurity, exploit, flaw, infrastructure, kev, oracle, risk, vulnerabilityThe Cybersecurity and Infrastructure Security Agency (CISA) has added a critical Oracle E-Business Suite vulnerability to its Known Exploited Vulnerabilities catalog after detecting active exploitation in the wild. The security flaw, tracked as CVE-2025-61884, poses significant risks to organizations running the widely-deployed enterprise resource planning software. Critical SSRF Flaw Requires Immediate Action CVE-2025-61884 is a…
-
CISA Warns of Actively Exploited Windows SMB Vulnerability
Tags: cisa, cve, cyber, cybersecurity, exploit, flaw, infrastructure, kev, microsoft, threat, vulnerability, windowsThe Cybersecurity and Infrastructure Security Agency (CISA) has added a critical Microsoft Windows Server Message Block (SMB) vulnerability to its Known Exploited Vulnerabilities catalog, warning that threat actors are actively exploiting the security flaw in the wild. The vulnerability, tracked as CVE-2025-33073, affects the Windows SMB Client and could allow attackers to escalate privileges on…
-
CISA Warns of Actively Exploited Windows SMB Vulnerability
Tags: cisa, cve, cyber, cybersecurity, exploit, flaw, infrastructure, kev, microsoft, threat, vulnerability, windowsThe Cybersecurity and Infrastructure Security Agency (CISA) has added a critical Microsoft Windows Server Message Block (SMB) vulnerability to its Known Exploited Vulnerabilities catalog, warning that threat actors are actively exploiting the security flaw in the wild. The vulnerability, tracked as CVE-2025-33073, affects the Windows SMB Client and could allow attackers to escalate privileges on…
-
Mikrosegmentierung in Zero-Trust-Umgebungen die Integration von richtliniengesteuerten Zugriffen
Die kürzlich veröffentlichte Leitlinie der CISA (Cybersecurity and Infrastructure Security Agency), »Mikrosegmentierung in Zero Trust Teil 1: Einführung und Planung«, bestätigt, dass Mikrosegmentierung eine grundlegende Voraussetzung für Zero Trust ist [1]. Anstatt die Mikrosegmentierung für eine fortgeschrittene Phase von Zero-Trust-Initiativen aufzuheben, können und sollten Unternehmen die granulare Segmentierung als Kernbaustein der Zero-Trust-Architektur priorisieren. Der… First…
-
Mikrosegmentierung in Zero-Trust-Umgebungen die Integration von richtliniengesteuerten Zugriffen
Die kürzlich veröffentlichte Leitlinie der CISA (Cybersecurity and Infrastructure Security Agency), »Mikrosegmentierung in Zero Trust Teil 1: Einführung und Planung«, bestätigt, dass Mikrosegmentierung eine grundlegende Voraussetzung für Zero Trust ist [1]. Anstatt die Mikrosegmentierung für eine fortgeschrittene Phase von Zero-Trust-Initiativen aufzuheben, können und sollten Unternehmen die granulare Segmentierung als Kernbaustein der Zero-Trust-Architektur priorisieren. Der… First…
-
CISA Warns of Active Exploitation of Critical Windows SMB Flaw CVE-2025-33073
The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent alert regarding the active exploitation of a high-severity Windows vulnerability, tracked as CVE-2025-33073. This flaw, rooted in the Server Message Block (SMB) protocol, enables attackers to escalate privileges to SYSTEM level on vulnerable Windows devices, potentially granting full control over affected systems. First seen…
-
CISA Warns of Active Exploitation of Critical Windows SMB Flaw CVE-2025-33073
The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent alert regarding the active exploitation of a high-severity Windows vulnerability, tracked as CVE-2025-33073. This flaw, rooted in the Server Message Block (SMB) protocol, enables attackers to escalate privileges to SYSTEM level on vulnerable Windows devices, potentially granting full control over affected systems. First seen…
-
Five New Exploited Bugs Land in CISA’s Catalog, Oracle and Microsoft Among Targets
Tags: business, cisa, cve, cybersecurity, exploit, flaw, infrastructure, kev, microsoft, oracle, vulnerabilityThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added five security flaws to its Known Exploited Vulnerabilities (KEV) Catalog, officially confirming a recently disclosed vulnerability impacting Oracle E-Business Suite (EBS) has been weaponized in real-world attacks.The security defect in question is CVE-2025-61884 (CVSS score: 7.5), which has been described as a First seen…
-
High-severity Windows SMB flaw now exploited in attacks
CISA says threat actors are now actively exploiting a high-severity Windows SMB privilege escalation vulnerability that can let them gain SYSTEM privileges on unpatched systems. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/cisa-high-severity-windows-smb-flaw-now-exploited-in-attacks/
-
Behind the struggle for control of the CVE program
Following a funding scare that nearly shuttered the CVE program, outside experts and CISA are positioning to take charge of the 25-year-old system before the next funding crisis hits. First seen on cyberscoop.com Jump to article: cyberscoop.com/cve-program-funding-crisis-nvd-cisa-alternatives/
-
Network security devices endanger orgs with ’90s era flaws
Tags: access, application-security, apt, authentication, breach, cisa, cisco, citrix, cloud, control, cve, cyber, cybersecurity, dos, email, endpoint, exploit, finance, firewall, firmware, flaw, government, group, incident response, infrastructure, injection, ivanti, jobs, linux, mitigation, mobile, network, open-source, penetration-testing, programming, regulation, remote-code-execution, reverse-engineering, risk, risk-management, router, service, software, threat, tool, vpn, vulnerability, zero-day2024 networking and security device zero-day flaws Product CVE Flaw type CVSS Check Point Quantum Security Gateways and CloudGuard Network Security CVE-2024-24919 Path traversal leading to information disclosure 8.6 (High) Cisco Adaptive Security Appliance CVE-2024-20359 Arbitrary code execution 6.6 (Medium) Cisco Adaptive Security Appliance CVE-2024-20353 Denial of service 8.6 (High) Cisco Adaptive Security Appliance …
-
ISMG Editors: Inside the FBI’s Scattered Lapsus Takedown
Also: Continued Turmoil at CISA, MSSP Level Blue’s Acquisition of Cybereason. In this week’s panel, four ISMG editors discussed the FBI’s takedown of Scattered Lapsus$ Hunters, turmoil inside CISA amid the U.S. federal government shutdown and how LevelBlue’s acquisition of Cybereason signals big shifts in the XDR and MDR markets. First seen on govinfosecurity.com Jump…
-
Cybersecurity Snapshot: F5 Breach Prompts Urgent U.S. Gov’t Warning, as OpenAI Details Disrupted ChatGPT Abuses
Tags: ai, attack, awareness, backdoor, breach, business, chatgpt, china, cisa, cloud, control, corporate, cve, cyber, cybersecurity, data, data-breach, defense, detection, exploit, framework, fraud, governance, government, group, hacker, incident, infrastructure, Internet, iran, law, LLM, malicious, malware, mitigation, monitoring, network, openai, organized, phishing, privacy, resilience, risk, russia, scam, security-incident, service, software, strategy, supply-chain, technology, threat, training, update, vulnerabilityF5’s breach triggers a CISA emergency directive, as Tenable calls it “a five-alarm fire” that requires urgent action. Meanwhile, OpenAI details how attackers try to misuse ChatGPT. Plus, boards are increasing AI and cyber disclosures. And much more! Key takeaways A critical breach at cybersecurity firm F5, attributed to a nation-state, has triggered an urgent…
-
CISA Warns of Critical Vulnerability in Adobe Experience Manager Forms
CISA urges immediate patching of Adobe Experience Manager Forms to fix a critical remote code execution flaw. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/cisa-warns-of-critical-vulnerability-in-adobe-experience-manager-forms/
-
CISA Warns of Critical Vulnerability in Adobe Experience Manager Forms
CISA urges immediate patching of Adobe Experience Manager Forms to fix a critical remote code execution flaw. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/cisa-warns-of-critical-vulnerability-in-adobe-experience-manager-forms/
-
Critical AEM Vulnerability (CVE-2025-54253) Actively Exploited, Says CISA
A new vulnerability in Adobe Experience Manager (AEM) Forms has been confirmed as actively exploited in the wild, prompting the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to add it to its Known Exploited Vulnerabilities (KEV) catalog. The flaw, tracked as CVE-2025-54253, affects Adobe Experience Manager (AEM) Forms on Java Enterprise Edition (JEE) and was…