Industry News Roundup

CISA has advised US federal agencies to secure their systems against attacks exploiting vulnerabilities in Cisco and Windows systems. The first flaw (CVE-2023-20118) enables attackers to execute arbitrary commands on RV016, RV042, RV042G, RV082, RV320, and RV325 VPN routers. Cisco says that its Product Security Incident Response Team (PSIRT) is aware of CVE-2023-20025 publicly available proof-of-concept exploit code. The second security bug (CVE-2018-8639) is a Win32k elevation of privilege flaw that enables local attackers logged into the target system to to run run arbitrary code in kernel mode. According to Microsoft this vulnerability impacts client (Windows 7 or later) and server (Windows Server 2008 and up) platforms. CISA noted that "These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise." Microsoft and Cisco have not yet updated their security advisories after CISA tagged the two vulnerabilities as actively exploited in attacks. These flaws make the need to identify vulnerable systems paramount. A robust IT asset management solution can aid in the effort.

Microsoft s most recent Patch Tuesday updates included warnings that a half-dozen Windows security defects have already been exploited in the wild. The company labeled six of the 57 security vulnerabilities patched this month as exploitation detected. It encouraged Windows administrators to prioritize another large batch of code execution flaws. The latest exploited zero-days affected the Microsoft Management Console, Windows NTFS, the Fast FAT File System Driver, and the Win32 Kernel Subsystem. According to Microsoft, the exploited bugs allow security features bypass, remote code execution, privilege escalate via memory corruption issues. IT managers can utilize their IT asset management tools to identify unpatched systems.

CISA recently warned of three critical-severity vulnerabilities in Ivanti Endpoint Manager (EPM) that are being exploited in the wild. The vulnerabilities are tracked as CVE-2024-13159, CVE-2024-13160, and CVE-2024-13161 and are described as absolute path traversal flaws affecting EMP versions 2024 and 2022 SU6 with the November 2024 security update installed. Ivanti issued patches for the security defects in January. The vulnerabilities reside in functions that attempt to read the files in specific directories to calculate their hashes, and which accept user input. IT managers can use then information generated by their IT asset management tools to identify vulnerable systems.

Fortinet customers who yet to patch a critical authentication bypass vulnerability that was disclosed by company in February should act quickly. The vulnerability, labeled CVE-2025-24472, allows remote attackers to get super-admin privileges on affected systems. They exploit a weakness in how Fortinet's FortiOS and FortiProxy technologies handle Client Server Framework proxy requests. Systems with exposed FortiGate firewall management interfaces are at the most risk. FortiGate disclosed the flaw on February 11, along with a patch. CISA and others have in the past repeatedly pointed to products that fall into the category of edge device as technologies that attackers love to target because of the access they provide to victim environments. Stefan Hostetler, senior threat intelligence researcher member at Arctic Wolf noted that "As we predicted in the tail end of 2024, we expect that edge devices will continue to be exploited by cybercriminals in 2025 and beyond. Threat actors are likely to continue capitalizing on misconfiguration and outdated firmware as long as there s more money to be made." This observation underscores the need to use IT asset management tools to identify vulnerable and misconfigured systems.

CISA (U.S. Cybersecurity and Infrastructure Security Agency) recently published a Malware Analysis Report (MAR) on a RESURGE, a new malware call. RESURGE has been used in attacks targeting the flaw CVE-2025-0282 in Ivanti Connect Secure appliances. The malware creates web shells, bypasses integrity checks, and modifies files. It enables credential harvesting, account creation, and privilege escalation. CISA added the Ivanti Connect Secure Vulnerability CVE-2025-0282 to its Known Exploited Vulnerabilities (KEV) catalog in January. The agency noted that Ivanti has released an update that addresses one critical and one high vulnerability in Ivanti Connect Secure, Policy Secure and ZTA Gateways. Successful exploitation of CVE-2025-0282 could lead to unauthenticated remote code execution. CVE-2025-0283 could allow a local authenticated attacker to escalate privileges. IT managers are urged to use their IT asset management tools to identify unpatched systems.

In January 2023 the European Union enacted a revised version of the 2016 Network and Information systems Directive (NIS). This directive is a legislative framework intended to bolster cybersecurity across EU infrastructure. The directive requires EU member states to incorporate enhanced cybersecurity measures into law. The new rules came into effect 18 October 2024. The directive has two main pillars: Duty of Care and Duty to Report. ITAM practices can improve an organization s cybersecurity capabilities. ITAM s role in developing a comprehensive asset inventory plays a key role in identifying potential software vulnerabilities. The NIS2 directive highlights the critical nature of robust asset management practices. By maintaining a comprehensive, up-to-date IT asset inventory, vulnerability management, and collaboration with cybersecurity teams, ITAM can play a vital role in complying with the NIS2 requirements.

Microsoft s security response team patched over 55 documented software defects in Windows OS and applications. It also identified a privilege escalation bug in Windows Storage and a code execution issue in the Windows Ancillary Function Driver for WinSock. These are flagged for for immediate attention due to active exploitation. The Windows Storage Elevation of Privilege bug enables attackers to delete targeted files on a system. Microsoft also urged Windows administrators to prioritize CVE-2025-21418 as a matter of urgency. It warned that the Windows Ancillary Function Driver for WinSock contains a serious law that provides SYSTEM privileges to a successful attacker. IT managers can utilize the information from their IT asset management solutions to identify p[atched and vulnerable systems.

A recent security advisory published by the US Cybersecurity and Infrastructure Security Agency (CISA), the FBI, and the Multi-State Information Sharing and Analysis Center (MS-ISAC) stated the groups are primarily targeting critical infrastructure organizations, as well as healthcare, government, technology and manufacturing. The three agencies said in the reported that "Beginning early 2021, Ghost actors began attacking victims whose internet-facing services ran outdated versions of software and firmware. This indiscriminate targeting of networks containing vulnerabilities has led to the compromise of organizations across more than 70 countries, including organizations in China." This fact underscores the need for organizations to patch or replace vulnerable systems. Unpatched or obsolete equipment can be identified using an IT asset management tool.

"A remote unauthenticated attacker who successfully exploited this vulnerability would gain the ability to execute arbitrary code within the context of the LDAP service. It managers can use their IT asset management solutions to scan for and identify any unpatched systems.

In the latest Patch Tuesday security patches Microsoft has released fixes for nearly 160 vulnerabilities, 12 which are critical with eight zero-days; three of which are currently known to be under active exploitation. according to Microsoft. Tyler Reguly, associate director of security research and development at Fortra noted that This is definitely one of those months where admins need to step back, take a deep breath, and determine their plan of attack. The three zero days vulnerabilities bring exploited are classified as CVE-2025-21335, CVE-2025-21333 and CVE-2025-21334. They impact Hyper-V which is described by one researcher as being heavily embedded in modern Windows 11 operating systems and used for a range of security tasks including device guard and credential guard, which are listed as elevation of privileges issues. Consequently, patching these vulnerabilities should be at the top of the list for patching this month. IT professionals can utilize their IT asset management tools to identify vulnerable or unpatched systems.

The vulnerabilities involved in these attacks include an admin authentication bypass patched in September, and a remote code execution bug also patched tin September). Two other bugs, an SQL injection and a remote code execution vulnerability were both remediated in October. All four bugs have been tagged as exploited in zero-day attacks. CISA added them to its Known Exploited Vulnerabilities Catalog and ordered Federal Civilian Executive Branch (FCEB) agencies to secure their appliances. In order to t thwart any attacks targeting users systems, the federal agencies "strongly encourage" all network administrators to upgrade their appliances to the latest supported Ivanti CSA version.

The January 2025 security updates also resolve 12 high-severity defects that could lead to remote code execution (RCE), denial-of-service (DoS), and escalation of privilege, some of which could be exploited remotely without authentication. Ivanti also issued patches for a high-severity race condition issue in Application Control Engine that could allow attackers to bypass the application blocking functionality. The company Irecommends that all customers update their Application Control instances to versions 2024.3 HF1, 2024.1 HF4, and 2023.3 HF3. Ivanti also noted that fixes will not be released for Application Control Module for Security Controls. It recommends that customers migrate to Application Control or Neurons for App Control.

As security teams are faced with an increasing number of identified vulnerabilities, vulnerability remediation is slowing at many organizations. According to an analysis by S&P Global Ratings, nearly 75% of organizations are either occasionally or infrequently remediating the vulnerabilities that affect their systems. Paul Alvarez, lead cyber risk expert at S&P Global Ratings said that Our analysis suggests that some organizations that we rate may be slow to remediate highly targeted cyber vulnerabilities, increasing the risk that computer systems could be compromised. The analysis, found that 30% of organizations remediated these vulnerabilities occasionally. CIO s concerned with identifying existing unpatched vulnerabilities can utilize the data from their IT asset management solution to pinpoint at risk devices.

Identity risks, data security risks and third-party risks are all made exacerbated by SaaS sprawl. Each new SaaS account adds a new identity that should be secured and represents a new source of third-party risk. This growing attack surface, much of which is unmanaged in most organizations, becomes an attack surface and becomes an attractive target for cyber-criminals. Data from Nudge Security indicates that the average employee creates a new SaaS account about every two weeks. That constitutes 200 new SaaS accounts per month for an organization with 100 employees. Each one of these SaaS identities expands the organization's attack surface and creates a new avenue for sensitive data to be stolen. Only a solution that can deliver continuous SaaS discovery along with just-in-time prompts can help CIOs to take appropriate steps to secure their accounts and combat this new form of shadow IT.