High-Severity Vulnerabilities Patched in VMware Aria Operations, NSX, vCenter

Broadcom on Monday announced patches for six vulnerabilities affecting VMware Aria Operations, NSX, vCenter, and VMware Tools products, including four high-severity flaws.

Both Aria Operations and VMware Tools are impacted by a high-severity local privilege escalation bug tracked as CVE-2025-41244.

“A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM,” the vendor explains.

Patches have also been rolled out for a medium-severity issue in VMware Aria Operations that could allow attackers to disclose the credentials of other users (CVE-2025-41245), and a high-severity defect in Tools for Windows that could allow attackers to access other guest VMs (CVE-2025-41246).

Fixes for these vulnerabilities were included in Aria Operations version 8.18.5, Cloud Foundation and vSphere Foundation versions 9.0.1.0 and 13.0.5.0, VMware Tools versions 13.0.5 and 12.5.4, and Telco Cloud Infrastructure versions 8.18.5 and 8.18.5.

VMware resolved a high-severity SMTP header injection bug (CVE-2025-41250) in vCenter that could allow an authenticated attacker with non-administrative privileges to “manipulate the notification emails sent for scheduled tasks”.

Additionally, it patched two high-severity flaws in NSX that could allow attackers to enumerate valid usernames.

The first, CVE-2025-41251, is described as a weak password recovery mechanism issue that could lead to brute-force attacks, while the second, CVE-2025-41252, is described as a username enumeration defect that could lead to unauthorized access attempts.

Advertisement. Scroll to continue reading.

Cloud Foundation and vSphere Foundation version 9.0.1.0, vCenter versions 8.0 U3g and 7.0 U3w, Cloud Foundation versions 5.2.2 and 7.0 U3w (async patch), NSX versions 4.2.2.2, 4.2.3.1, and 4.1.2.7, and NSX-T version 3.2.4.3 contain fixes for these flaws. VMware also published patch instructions for Cloud Foundation and Telco Cloud Infrastructure.

VMware makes no mention of any of these vulnerabilities being exploited in the wild. However, users are advised to update their deployments as soon as possible.

https://www.securityweek.com/high-severity-vulnerabilities-patched-in-vmware-aria-operations-nsx-vcenter/

Recent Fortra GoAnywhere MFT Vulnerability Exploited as Zero-Day

Exploitation of a recently disclosed Fortra GoAnywhere MFT vulnerability started at least one week before patches were released, cybersecurity firm watchTowr reports.

Fortra fixed the security defect, tracked as CVE-2025-10035 (CVSS score of 10/10), on September 18, making no mention of its in-the-wild exploitation, but sharing indicators-of-compromise (IoCs) to help organizations hunt for potential attacks.

The flaw is described as a deserialization vulnerability in the secure file transfer application’s license servlet, which could allow an attacker with a forged license response signature to deserialize a crafted object and achieve command injection.

“Immediately ensure that access to the GoAnywhere Admin Console is not open to the public. Exploitation of this vulnerability is highly dependent upon systems being externally exposed to the internet,” Fortra warned.

According to watchTowr, Fortra was eight days late with its patches for CVE-2025-10035, as the issue had been exploited as a zero-day when discovered on September 11.

“We have been given credible evidence of in-the-wild exploitation of Fortra GoAnywhere CVE-2025-10035 dating back to September 10, 2025. That is eight days before Fortra’s public advisory,” watchTowr notes.

As part of the observed attacks, hackers triggered the vulnerability for remote code execution (RCE), without authentication, to create a backdoor admin account on vulnerable instances.

Then, they leveraged the account to create a web user that provided them with access to the MFT service, and used it to upload and execute various additional payloads.

Advertisement. Scroll to continue reading.

In a technical analysis of the CVE, watchTowr pointed out that there are over 20,000 GoAnywhere MFT instances accessible from the internet, including deployments pertaining to Fortune 500 companies.

Cybersecurity outfit Rapid7, which performed its own in-depth analysis of the security defect, explains that it is not a simple deserialization issue, but a chain of three separate bugs.

“This includes an access control bypass that has been known since 2023, the unsafe deserialization vulnerability CVE-2025-10035, and an as-yet unknown issue pertaining to how the attackers can know a specific private key,” Rapid7 explains.

The company flagged the access control bypass in February 2023, when Fortra patched a pre-authentication remote code execution bug in GoAnywhere MFT that had been exploited as a zero-day.

Both watchTowr and Rapid7 underline that they could not find the private key ‘serverkey1’ required to forge the license response signature, which is required for the successful exploitation of CVE-2025-10035.

The two companies note that the security defect’s exploitation is possible if the private key was leaked and attackers got hold of it, if the attackers trick a license server into signing the malicious signature, or the attackers have access to serverkey1 by unknown means.

https://www.securityweek.com/recent-fortra-goanywhere-mft-vulnerability-exploited-as-zero-day/

Cisco Firewall Zero-Days Exploited in China-Linked ArcaneDoor Attacks

Cisco on Thursday released emergency patches for two firewall vulnerabilities exploited as zero-days in attacks linked to the ArcaneDoor espionage campaign.

Tracked as CVE-2025-20333 (CVSS score of 9.9) and CVE-2025-20362 (CVSS score of 6.5), the bugs impact the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) software.

The issues, Cisco explains, exist because user-supplied input in HTTP(S) requests is not properly validated, allowing a remote attacker to send crafted requests and execute arbitrary code with root privileges or access a restricted URL without authentication.

The attacker needs valid VPN user credentials to exploit the critical-severity defect, but can exploit the medium-severity one without authentication.

Both vulnerabilities, Cisco notes in a fresh alert, were discovered after it was called in May 2025 to assist with investigating attacks targeting government organizations, in which ASA 5500-X series devices with VPN web services enabled were compromised.

As part of the attacks, which Cisco linked to the ArcaneDoor espionage campaign flagged last year, the zero-days allowed hackers to deploy malware, run commands, and likely exfiltrate data from the compromised devices.

“Attackers were observed to have exploited multiple zero-day vulnerabilities and employed advanced evasion techniques such as disabling logging, intercepting CLI commands, and intentionally crashing devices to prevent diagnostic analysis,” Cisco explains.

While it has yet to be confirmed by the wider cybersecurity community, there is some evidence suggesting that the hackers behind the ArcaneDoor campaign are based in China.

Advertisement. Scroll to continue reading.

The threat actor was seen tampering with the devices’ read-only memory (ROM) to ensure persistence across reboots and software updates. These modifications were possible because the compromised devices do not support Secure Boot and Trust Anchor.

According to Cisco, the hackers successfully compromised 5512-X, 5515-X, and 5585-X devices, which have been discontinued, as well as 5525-X, 5545-X, and 5555-X models, which will be discontinued on September 30, 2025.

The vulnerable ASA software runs on ASA 5505-X, 5506H-X, 5506W-X, 5508-X, and 5516-X devices, and on all Firepower and Secure Firewall models, but these products support Secure Boot and Trust Anchors and Cisco has not observed their successful compromise.

Users are advised to update their devices as soon as possible, as the fixed release will automatically check the ROM and remove the attackers’ persistence mechanism. Users are also advised to rotate all passwords, certificates, and keys following the update.

“In cases of suspected or confirmed compromise on any Cisco firewall device, all configuration elements of the device should be considered untrusted,” Cisco notes. The company also released a detection guide to help organizations hunt for potential compromise associated with the ArcaneDoor campaign.

The UK’s National Cyber Security Centre (NCSC) published a technical analysis (PDF) of the malware identified in the observed attacks, recommending that the vulnerable ASA 5500-X series models that have been or will soon be discontinued be replaced as soon as possible.

“The NCSC is calling on network defenders using affected products to urgently investigate this activity and has published new analysis of the malware components – dubbed RayInitiator and LINE VIPER – to assist with detection and mitigation,” NCSC notes.

On Thursday, the US cybersecurity agency CISA added both CVE-2025-20333 and CVE-2025-20362 to its Known Exploited Vulnerabilities (KEV) catalog, urging federal agencies to address them within one day.

CISA also issued Emergency Directive ED 25-03, mandating that federal agencies identify all Cisco ASA and Firepower devices in their environments, collect memory files, and send them to CISA for forensic analysis by the end of the day on September 26.

“CISA is directing agencies to account for all Cisco ASA and Firepower devices, collect forensics and assess compromise via CISA-provided procedures and tools, disconnect end-of-support devices, and upgrade devices that will remain in service. These actions are directed to address the immediate risk, assess compromise, and inform analysis of the ongoing threat actor campaign,” CISA notes.

On Thursday, Cisco also released patches for CVE-2025-20363 (CVSS score of 9.0), a remote code execution bug that can be exploited without authentication on devices running ASA and FTD software, but requires authentication on products running IOS, IOS XE, and IOS XR software.

“An attacker could exploit this vulnerability by sending crafted HTTP requests to a targeted web service on an affected device after obtaining additional information about the system, overcoming exploit mitigations, or both. A successful exploit could allow the attacker to execute arbitrary code as root, which may lead to the complete compromise of the affected device,” the company notes.

CVE-2025-20363 does not appear to have been exploited in the wild, although Cisco mentions it in the alert detailing the observed compromise.

https://www.securityweek.com/cisco-firewall-zero-days-exploited-in-china-linked-arcanedoor-attacks/

GeoServer Flaw Exploited in US Federal Agency Hack

The US cybersecurity agency CISA has shared details on the exploitation of a year-old GeoServer vulnerability to compromise a federal civilian executive branch (FCEB) agency.

The exploited bug, tracked as CVE-2024-36401 (CVSS score of 9.8) and leading to remote code execution (RCE), was disclosed on June 30, 2024, two weeks before CISA added it to the KEV catalog.

On July 11, 2024, four days before CISA’s alert, a threat actor exploited the bug to gain access to a GeoServer instance pertaining to the victim agency, then moved laterally to a web server and to an SQL server.

“On each server, they uploaded (or attempted to upload) web shells such as China Chopper, along with scripts designed for remote access, persistence, command execution, and privilege escalation. The cyber threat actors also used living-off-the-land (LOTL) techniques,” CISA explains in a fresh report.

On July 24, ten days after the bug was added to the KEV list, the threat actor exploited the same vulnerability in another GeoServer instance belonging to the same agency.

The attackers dropped web shells and created cron jobs and user accounts to maintain persistence, and then attempted to escalate privileges, including by exploiting the Dirty COW vulnerability in the Linux kernel.

Advertisement. Scroll to continue reading.

“After compromising web service accounts, they escalated their local privileges to transition away from these service accounts (it is unknown how they escalated privileges),” CISA explains.

The threat actor also used brute force attacks to obtain passwords allowing it to move laterally and elevate privileges, performed reconnaissance using readily available tools, downloaded payloads using PowerShell, and deployed the Stowaway multi-level proxy tool for command-and-control (C&C).

“The cyber threat actors remained undetected in the organization’s environment for three weeks before the organization’s SOC identified the compromise using their EDR tool,” CISA notes.

According to the cybersecurity agency, the victim was within the KEV-required patching window for the GeoServer bug, but lacked procedures for bringing in third parties for assistance, did not detect the activity on July 15, 2024, when it missed an EDR alert on Stowaway, and did not have endpoint protection implemented on the web server.

While CISA has not attributed the attack to a specific threat actor, the China Chopper web shell is typically used in attacks by China-linked threat actors such as APT41 (Brass Typhoon), Gallium (Granite Typhoon), and Hafnium (Silk Typhoon).

Believed to have orchestrated last year’s US Treasury hack, Silk Typhoon is known for targeting critical infrastructure organizations worldwide, and for hacking multiple industries in North America.

“China Chopper has been around for over a decade, and it’s the same web shell used in the 2021 Exchange attacks. The real issue is that attackers chained a well-known exploit, moved laterally, and remained inside the network for nearly three weeks before anyone noticed, even with EDR deployed. That’s the modern danger we’re dealing with. It’s not exotic zero-days, but gaps that go unpatched and undetected until it’s too late,” Tuskira CEO and co-founder Piyush Sharma said.

https://www.securityweek.com/geoserver-flaw-exploited-in-us-federal-agency-hack/

Libraesva Email Security Gateway Vulnerability Exploited by Nation-State Hackers

Libraesva has addressed a vulnerability in its integrated email security platform that has been exploited in the wild.

Tracked as CVE-2025-59689 (CVSS score of 6.1), the flaw is described as a command injection issue that could lead to the execution of arbitrary commands as a non-privileged user.

According to Libraesva’s advisory, the bug could be exploited via malicious emails containing crafted compressed attachments.

“This occurs due to an improper sanitization during the removal of active code from files contained in some compressed archive formats,” the company explains.

The CVE is triggered with specific archive formats containing payloads that exploit an improper input sanitization bug to execute arbitrary shell commands.

The security defect affects Libraesva ESG versions 4.5 through 5.5, but fixes were released only for ESG 5.x versions, as the 4.x versions have been discontinued.

Libraesva pushed the patches to both cloud and on-premise ESG deployments and says all appliances are now running a fixed software iteration.

Customers running on-premise ESG 4.x versions are advised to manually update to a patched 5.x version as soon as possible, given that the vulnerability has been exploited.

Advertisement. Scroll to continue reading.

“One confirmed incident of abuse has been identified. The threat actor is believed to be a foreign hostile state entity,” Libraesva says.

“The single‑appliance focus underscores the precision of the threat actor (believed to be a foreign hostile state) and highlights the importance of rapid, comprehensive patch deployment,” the company notes.

In addition to resolving the flaw, Libraesva’s patches scan for indicators-of-compromise (IoCs) and contain a self-assessment module that checks the patch integrity and hunts for residual threats.

An integrated solution, Libraesva ESG protects email services from phishing, BEC, and advanced threats, and is suited for all types of organizations, including small and medium-sized businesses and large enterprises.

https://www.securityweek.com/libraesva-email-security-gateway-vulnerability-exploited-by-nation-state-hackers/

Unpatched Vulnerabilities Expose Novakon HMIs to Remote Hacking

Some of the industrial control system (ICS) products made by Taiwan-based Novakon are affected by serious vulnerabilities, and the vendor does not appear to have released any patches.

A subsidiary of iBASE Technology, Novakon designs and manufactures human-machine interfaces (HMIs), industrial PCs, and IIoT solutions. The company serves 18 countries across North America, Europe and Asia. Marketing materials show that 40,000 units of Novakon’s 7” HMIs have been deployed in global data centers.

Researchers at CyberDanube, an IT/OT penetration testing and security consulting company, discovered that Novakon’s HMIs are affected by five types of vulnerabilities.

According to an advisory published by CyberDanube, the HMIs are affected by an unauthenticated buffer overflow allowing remote code execution with root privileges, a directory traversal that exposes files, and a couple of weak authentication issues that allow access to the device and applications.

The security firm’s researchers also discovered missing protection mechanisms and unnecessarily high permissions for certain processes.

Sebastian Dietz, security researcher at CyberDanube, told SecurityWeek that the vulnerabilities can be exploited remotely without authentication.

“An unauthenticated attacker could leverage these vulnerabilities to execute high privilege code on these devices,” Dietz explained. “As HMI devices are used to interact with machines and systems (eg, PLCs, production lines) in critical infrastructure, gaining arbitrary code execution could have severe consequences.”

Dietz noted that it’s difficult to determine how many devices may be vulnerable to attacks, “as they are normally deployed in critical infrastructure and (hopefully) not directly exposed via the internet”.

Advertisement. Scroll to continue reading.

CyberDanube said Novakon has been sent a report describing its findings, but the vendor did not provide any feedback and ignored a vast majority of its communication attempts.

Novakon has not responded to SecurityWeek’s request for comment.

https://www.securityweek.com/unpatched-vulnerabilities-expose-novakon-hmis-to-remote-hacking/

Payment System Vendor Took Year+ to Patch Infinite Card Top-Up Hack: Security Firm

SEC Consult, a cybersecurity consulting firm under Eviden, says payment solutions company KioSoft took a long time to address a serious vulnerability affecting some of its NFC-based cards.

KioSoft manufactures unattended self-service payment machines, including for laundromats, arcades, vending machines, and car washes. The company is based in Florida and has offices in seven countries around the world. Its website claims it has deployed over 41,000 kiosks and 1.6 million payment terminals across 35 countries.

SEC Consult researchers discovered back in 2023 that some of KioSoft’s stored-value cards — digital wallets that customers reload for use at specific payment terminals — are affected by a vulnerability (CVE-2025-8699) that can be exploited for free balance top-ups. The hack relies on the fact that the balance is stored locally on the card rather than a secure online database.

The impacted cards identified by SEC Consult relied on MiFare Classic NFC card technology, which is known to have significant security issues.

Building on the known MiFare card vulnerabilities and analyzing how data is stored on the cards, SEC Consult researchers managed to read data from the card and write data on the card, enabling them to “create money out of thin air”. A hacker can increase the card’s balance to up to $655, but the process can be repeated, SEC Consult’s Johannes Greil told SecurityWeek.

An attacker can conduct an attack using a hardware tool such as the Proxmark, which is designed for RFID security analysis, research and development. The attacker also needs to have some knowledge of the MiFare card vulnerabilities to carry out a hack, Greil explained.

SEC Consult published an advisory describing its research this week. The company has made available a detailed timeline of its interaction with KioSoft, revealing that it took the vendor well over a year to release a patch.

The security firm first contacted KioSoft in October 2023, but the vendor was unresponsive until the CERT Coordination Center at the Software Engineering Institute of Carnegie Mellon University became involved.

Advertisement. Scroll to continue reading.

SEC Consult claims to have sent many requests for a status update since October 2023, with many going unanswered. The timeline shows that the vendor has requested several extensions to the disclosure deadline, and ultimately informed the security firm that a firmware patch was released in the summer of 2025. The vendor indicated that new hardware would also be rolled out in the future.

KioSoft refused to provide version numbers of impacted and patched releases, arguing that affected customers would be privately notified, the security firm said. While KioSoft’s products are widely used, the vendor told SEC Consult that most of its solutions do not use the vulnerable MiFare card technology.

SEC Consult no longer has access to the terminals it initially conducted its research on and it could not verify the vendor’s patch.

KioSoft has not responded to SecurityWeek’s request for comment.

https://www.securityweek.com/payment-system-vendor-took-year-to-patch-infinite-card-top-up-hack-security-firm/

Cisco Patches High-Severity IOS XR Vulnerabilities

Cisco on Wednesday released patches for three vulnerabilities in IOS XR software, as part of its September 2025 security advisory bundled publication.

Tracked as CVE-2025-20248 (CVSS score of 6), the first of the bugs is a high-severity issue in the IOS XR installation process that could allow attackers to bypass image signature verification.

Successful exploitation of the flaw, Cisco explains, could lead to unsigned files being added to an ISO image, which could then be installed and activated on a device.

Because of the potential bypass of the image verification process, Cisco has raised the security impact rating of the advisory from medium to high.

The second IOS XR issue resolved this week is CVE-2025-20340 (CVSS score of 7.4), a bug in the software’s Address Resolution Protocol (ARP) implementation that could be exploited by adjacent, unauthenticated attackers to cause a denial-of-service (DoS) condition.

“This vulnerability is due to how Cisco IOS XR Software processes a high, sustained rate of ARP traffic hitting the management interface. Under certain conditions, an attacker could exploit this vulnerability by sending an excessive amount of traffic to the management interface of an affected device, overwhelming its ARP processing capabilities,” Cisco explains.

The third security defect is a medium-severity issue in IOS XR’s ACL processing feature that could allow unauthenticated, remote attackers to send traffic to a vulnerable device and bypass configured ACLs for the SSH, NetConf, and gRPC features.

Tracked as CVE-2025-20159 (CVSS score of 5.3), the flaw exists because IOS XR packet I/O infrastructure platforms for SSH, NetConf, and gRPC have not supported management interface ACLs.

Advertisement. Scroll to continue reading.

Cisco says it is not aware of any of these vulnerabilities being exploited in the wild. Users are advised to apply the available patches as soon as possible, as hackers are known to have exploited Cisco bugs.

https://www.securityweek.com/cisco-patches-high-severity-ios-xr-vulnerabilities/

High-severity vulnerability in Passwordstate credential manager. Patch now.

The maker of Passwordstate, an enterprise-grade password manager for storing companies’ most privileged credentials, is urging them to promptly install an update fixing a high-severity vulnerability that hackers can exploit to gain administrative access to their vaults.

The authentication bypass allows hackers to create a URL that accesses an emergency access page for Passwordstate. From there, an attacker could pivot to the administrative section of the password manager. A CVE identifier isn’t yet available.

Safeguarding enterprises’ most privileged credentials

Click Studios, the Australia-based maker of Passwordstate, says the credential manager is used by 29,000 customers and 370,000 security professionals. The product is designed to safeguard organizations’ most privileged and sensitive credentials. Among other things, it integrates into Active Directory, the service Windows network admins use to create, change, and modify user accounts. It can also be used for handling password resets, event auditing, and remote session logins.

On Thursday, Click Studios notified customers that it had released an update that patches two vulnerabilities.

The authentication bypass vulnerability is “associated with accessing the core Passwordstate Products’ Emergency Access page, by using a carefully crafted URL, which could allow access to the Passwordstate Administration section,” Click Studios said. The company said the severity level of the vulnerability was high.

https://arstechnica.com/security/2025/08/high-severity-vulnerability-in-passwordstate-credential-manager-patch-now/

What to know about ToolShell, the SharePoint threat under mass exploitation

Microsoft fixed the vulnerability pair—CVE-2025-49706 and CVE-2025-49704—two weeks ago as part of the company’s monthly update release. As the world learned over the weekend, the patches were incomplete, a lapse that opened organizations around the world to the new attacks.

Q: What sorts of malicious things are attackers doing with these newer ToolShell exploits?

A: According to numerous technical analyses, the attackers first infect vulnerable systems with a webshell-based backdoor that gains access to some of the most sensitive parts of a SharePoint Server. From there, the webshell extracts tokens and other credentials that allow the attackers to gain administrative privileges, even when systems are protected by multifactor authentication and single sign-on. Once inside, the attackers exfiltrate sensitive data and deploy additional backdoors that provide persistent access for future use.

For those who want more technical details, the opening volley in the attack is POST Web requests the attackers send to the ToolPane endpoint. The requests look like this:

Microsoft said these requests upload a malicious script named spinstall0.aspx, or alternatively spinstall.aspx, spinstall1.aspx, spinstall2.aspx, and so on. The script contains commands for retrieving a SharePoint server’s encrypted MachineKey configuration and returning the decrypted results to the attacker through a GET request.

Q: I maintain an on-premises SharePoint server. What should I do?

A: In short, drop whatever else you were doing and take time to carefully inspect your system. The first thing to look for is whether it has received the emergency patches Microsoft released Saturday. Install the patch immediately if it hasn’t already been done.

Patching the vulnerability is only the first step, since systems infected through the vulnerability show few or no signs of compromise. The next step is to pore through system event logs in search of indicators of compromise. These indicators can be found in numerous write-ups, including those from Microsoft and Eye Security (at the links above), the US Cybersecurity and Information Security Agency, and security firms Sentinel One, Akamai, Tenable, and Palo Alto Networks.

https://arstechnica.com/security/2025/07/what-to-know-about-toolshell-the-sharepoint-threat-under-mass-exploitation/