Cybersecurity and Infrastructure Security Agency (CISA) Archives

CISA orders feds to patch exploited Citrix flaws by Wednesday

28Sep

By RBNo Comments

News

CISA orders feds to patch exploited Citrix flaws by Wednesday

Over the weekend, the Cybersecurity and Infrastructure Security Agency (CISA) instructed U.S. government agencies to protect their systems from attacks that exploit two critical Citrix NetScaler vulnerabilities. Days after national cybersecurity agencies, IT suppliers, and security teams started privately reaching out to Citrix customers and recommending they shut down their NetScaler appliances, Citrix issued security updates to fix the flaws (tracked as CVE-2026-88771 and CVE-2026-88772). For example, the Dutch National Cyber Security Center (NCSC-NL) reportedly alerted organizations in the Netherlands to two critical NetScaler zero-days lacking CVE IDs, which let threat actors inject shellcode straight into memory. On Sunday, Citrix verified that the two vulnerabilities were b...

CISA orders urgent patching of actively exploited Zimbra flaw

24Aug

By RBNo Comments

News

CISA orders urgent patching of actively exploited Zimbra flaw

Within three days, U.S. federal agencies are required by the Cybersecurity and Infrastructure Security Agency (CISA) to fix a vulnerability in Zimbra Collaboration Suite (ZCS) that is being actively exploited. The security vulnerability (identified as CVE-2026-73570) was fixed by the Zimbra security team in version 10.1.20, which was made available on July 20. When SNMP notifications are enabled on the targeted system, a command injection vulnerability in the SNMP monitoring component can be successfully exploited by unauthenticated attackers to obtain remote code execution. An unauthenticated attacker might send specially crafted SMTP queries that may result in the execution of arbitrary operating system commands as the Zimbra user due to incorrect sanitization of untrusted inpu...

CISA: New Langflow flaw actively exploited to hijack AI workflows

27Mar

By RBNo Comments

News

CISA: New Langflow flaw actively exploited to hijack AI workflows

A severe vulnerability known as CVE-2026-33017, which impacts the Langflow framework for creating AI agents, is being actively exploited by hackers, according to a warning from the Cybersecurity and Infrastructure Security Agency (CISA). Threat actors can create public flows without authentication by using the security flaw, which has a critical score of 9.3 out of 10. The government classified the problem as a code injection vulnerability and added it to the list of known exploited vulnerabilities. Hackers began attacking CVE-2026-33017 on March 19, almost 20 hours after the vulnerability warning became public, according to researchers at application security firm Sysdig. At the time, there was no public proof-of-concept (PoC) exploit code read more about CISA New Langflow fl...

CISA Flags Critical WatchGuard Fireware Flaw Exposing 54,000 Fireboxes to No-Login Attacks

13Nov

By RBNo Comments

News

CISA Flags Critical WatchGuard Fireware Flaw Exposing 54,000 Fireboxes to No-Login Attacks

The United States On Wednesday, the Cybersecurity and Infrastructure Security Agency (CISA) included a critical security vulnerability affecting WatchGuard Fireware in its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerability being referred to is CVE-2025-9242 (CVSS score: 9.3), which is an out-of-bounds write vulnerability that impacts Fireware OS versions 11.10.2 through 11.12.4_Update1, 12.0 through 12.11.3, and 2025.1. CISA reported in an advisory that the OS iked process of WatchGuard Firebox has an out-of-bounds write vulnerability, which could enable a remote attacker without authentication to run arbitrary code. Last month, watchTowr Labs disclosed specifics regarding the vulnerability, with the cybersecurity firm indicat...

CISA Sounds Alarm on Critical Sudo Flaw Actively Exploited in Linux and Unix Systems

30Sep

By RBNo Comments

News

CISA Sounds Alarm on Critical Sudo Flaw Actively Exploited in Linux and Unix Systems

Citing evidence of active exploitation in the wild, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a severe security issue affecting the Sudo command-line application for Linux and Unix-like operating systems to its Known Exploited Vulnerabilities (KEV) database on Monday. Specifically, Sudo versions before 1.9.17p1 are vulnerable to CVE-2025-32463 (CVSS score: 9.3). Rich Mirch, a researcher at Stratascale, revealed it in July 2025. According to CISA, Sudo incorporates functionality from an untrusted control sphere vulnerability. Due to this flaw, a local attacker may be able to use sudo's -R (--chroot) option to execute any command as root, even if it isn't specified in the sudoers file. At this time, it is unknown how the vulnerability is being used in a...

Critical Langflow Flaw Added to CISA KEV List Amid Ongoing Exploitation Evidence

6May

By RBNo Comments

News

Critical Langflow Flaw Added to CISA KEV List Amid Ongoing Exploitation Evidence

With evidence of active exploitation, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a recently revealed major security hole affecting the open-source Langflow platform to its list of known exploited vulnerabilities (KEVs). Tracked as CVE-2025-3248, the vulnerability has a CVSS score of 9.8 out of 10.0. According to CISA, Langflow's /api/v1/validate/code endpoint has a missing authentication vulnerability that enables a remote, unauthenticated attacker to run arbitrary code through carefully constructed HTTP requests. In particular, it has been discovered that the endpoint incorrectly uses Python's built-in exec() function on user-supplied code without sufficient sandboxing or authentication, enabling attackers to run arbitrary commands on the server. ...

RESURGE Malware Exploits Ivanti Flaw with Rootkit and Web Shell Features

31Mar

By RBNo Comments

News

RESURGE Malware Exploits Ivanti Flaw with Rootkit and Web Shell Features

The new virus, RESURGE, was released as part of an exploitation campaign aimed at exploiting a security vulnerability in Ivanti Connect Secure (ICS) equipment that has since been fixed, according to information released by the U.S. Cybersecurity and Infrastructure Security Agency (CISA). While RESURGE has some of the same features as the SPAWNCHIMERA malware strain, such as the ability to survive reboots, it also has unique commands that change how it behaves, the agency stated. The file has backdoor, bootkit, proxy, tunneler, dropper, and rootkit capabilities. Ivanti Connect Secure, Policy Secure, and ZTA Gateways are susceptible to a stack-based buffer overflow vulnerability called CVE-2025-0282, which is linked to the malware's propagation and may allow remote code execution. ...

CISA Adds Critical Flaw in BeyondTrust Software to Exploited Vulnerabilities List

20Dec

By RBNo Comments

News

CISA Adds Critical Flaw in BeyondTrust Software to Exploited Vulnerabilities List

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a significant security flaw affecting BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) products to the Known Exploited Vulnerabilities (KEV) database on Thursday, citing evidence of active exploitation in the field. CVE-2024-12356 (CVSS score: 9.8) is a command injection vulnerability that might be used by an attacker to run arbitrary commands while posing as the site user. CISA claims that BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) have a command injection vulnerability that could allow an unauthorized attacker to insert commands that are executed as site users read more about CISA Adds Critical Flaw in BeyondTrust Software to Exploited Vulnerabilities List. Get up to...

CISA Urges Agencies to Patch Critical “Array Networks” Flaw Amid Active Attacks

26Nov

By RBNo Comments

News

CISA Urges Agencies to Patch Critical “Array Networks” Flaw Amid Active Attacks

Following reports of active exploitation in the wild, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) published a now-patched significant security weakness affecting Array Networks AG and vxAG secure access gateways to its Known Exploited Vulnerabilities (KEV) database on Monday. The vulnerability, identified as CVE-2023-28461 (CVSS score: 9.8), pertains to a situation where authentication is missing, which might be used to remotely execute arbitrary code. In March 2023, the network hardware vendor published fixes (version 9.4.0.484) for the security flaw. According to Array Networks, the Array AG/vxAG remote code execution vulnerability is a web security flaw that enables an attacker to use the flags attribute in the HTTP header to explore the filesystem or run rem...

CISA Adds ScienceLogic SL1 Vulnerability to Exploited Catalog After Active Zero-Day Attack

22Oct

By RBNo Comments

News

CISA Adds ScienceLogic SL1 Vulnerability to Exploited Catalog After Active Zero-Day Attack

Following indications of active exploitation as a zero-day vulnerability, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a critical security issue affecting ScienceLogic SL1 to its Known Exploited Vulnerabilities (KEV) database on Monday. Tracked as CVE-2024-9537 (CVSS v4 score: 9.3), the vulnerability in question is a flaw involving an unidentified third-party component that may allow remote code execution. Since then, versions 12.1.3, 12.2.3, 12.3, and later have fixed the problem. Additionally, fixes for versions 10.1.x, 10.2.x, 11.1.x, 11.2.x, and 11.3.x are now available. The change occurred a few weeks after cloud hosting company Rackspace said it discovered a problem with the ScienceLogic EM7 Portal read more about CISA Adds ScienceLogic SL1 Vulnera...