CISA Known Exploited Vulnerabilities

NAKIVO Backup & Replication before 11.0.0.88174 allows absolute path traversal for reading files via getImageByPath to /c/router (this may lead to remote code execution across the enterprise because PhysicalDiscovery has cleartext credentials).

tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. (The tags v1 through v45.0.7 were affected on 2025-03-14 and 2025-03-15 because they were modified by a threat actor to point at commit 0e58ed8, which contained malicious updateFeatures code.)

An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.2.0 through 7.2.12, 7.0.0 through 7.0.19 may allow a remote unauthenticated attacker with prior knowledge of upstream and downstream devices serial numbers to gain super-admin privileges on the downstream device, if the Security Fabric is enabled, via crafted CSF proxy requests.

CVE-2025-21590 is an improper isolation or compartmentalization vulnerability in Juniper Junos OS that allows a local attacker with high privileges to inject arbitrary code. The vulnerability affects multiple versions of Junos OS prior to specific fixed releases. It has a medium severity score and has been exploited in the wild. A fix is available in the specified patched versions.

An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in Safari 18.3.1, iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, iOS 18.3.2 and iPadOS 18.3.2, iPadOS 17.7.6, macOS Sequoia 15.3.2, visionOS 2.3.2, watchOS 11.4. Maliciously crafted web content may be able to break out of Web Content sandbox. This is a supplementary fix for an attack that was blocked in iOS 17.2. (Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 17.2.).

CVE-2025-24983 is a use-after-free vulnerability in the Microsoft Windows Win32 Kernel Subsystem that allows a local authorized attacker to elevate privileges. This vulnerability has been exploited in the wild and is rated with a high severity score of 7. The vulnerability requires high attack complexity and low privileges but no user interaction. It impacts confidentiality, integrity, and availability with high impact. No specific affected Windows versions or patch information is provided in the available data.

CVE-2025-26633 is a high-severity vulnerability in Microsoft Windows Management Console (MMC) that allows a local unauthorized attacker to bypass a security feature. The vulnerability involves improper neutralization, leading to potential full compromise of confidentiality, integrity, and availability. It has been exploited in the wild and is known to be used in ransomware campaigns. No specific affected versions or patch information is provided in the available data.

A heap-based buffer overflow vulnerability exists in Microsoft Windows NTFS that allows local unauthorized attackers to execute code. This vulnerability has been exploited in the wild and carries a high severity rating.

CVE-2025-24984 is a medium severity information disclosure vulnerability in Microsoft Windows NTFS. It involves insertion of sensitive information into log files, allowing an unauthorized attacker with physical access to potentially read portions of heap memory. The vulnerability affects multiple Windows 10 and Windows Server versions prior to specific fixed releases. Exploitation does not require user interaction but requires physical access. A fix is available in the listed updated versions.

CVE-2025-24985 is an integer overflow vulnerability in the Microsoft Windows Fast FAT File System Driver that allows local attackers to execute code. The vulnerability has a high severity score of 7.8 and has been exploited in the wild. It requires local access with low privileges and user interaction. No specific affected versions or patch information is provided.

CVE-2025-24991 is an out-of-bounds read vulnerability in the Microsoft Windows NTFS file system. It allows an authorized local attacker to disclose information by reading memory outside the intended bounds. The vulnerability affects multiple Windows versions prior to specific fixed releases. It has been exploited in the wild and is rated with a medium severity score of 5.5.

Advantive VeraCore before 2024.4.2.1 allows remote authenticated users to upload files to unintended folders (e.g., ones that are accessible during web browsing by other users). upload.aspx can be used for this.

A SQL injection vulnerability in timeoutWarning.asp in Advantive VeraCore through 2025.1.0 allows remote attackers to execute arbitrary SQL commands via the PmSess1 parameter.

Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.

Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.

Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.

Red Hat has issued a security advisory for a kernel update addressing two vulnerabilities in the Linux kernel. The first vulnerability (CVE-2024-50302) involves the HID core where the report buffer was not zero-initialized, potentially leading to security issues. The second vulnerability (CVE-2024-53197) affects the ALSA usb-audio driver, fixing potential out-of-bound accesses for Extigy and Mbox devices. These issues affect Red Hat Enterprise Linux 9.2 Extended Update Support and related variants. The update requires a system reboot to take effect.