| Date | Source | Type | Title | Author |
|---|---|---|---|---|
| Apr 30, 2025 | CISA | Vulnerability Advisory | VA-25-120-01: Commvault Web Server unspecified vulnerability According to Commvault: "The Web Server is a component in CommCell environments that provides a RESTful interface to the software where users can perform various tasks using available APIs". A remote, authenticated attacker can exploit an unspecified vulnerability to compromise a Commvault Web Server. | CISA |
| Apr 30, 2025 | FBI | Alert | Emerging Discount Medical Insurance Scams Discount medical insurance scams involve misleading or fraudulent offers for medical insurance plans that promise reduced rates on legitimate medical insurance but do not provide any actual medical insurance coverage, resulting in millions of dollars in losses annually. | FBI |
| Apr 29, 2025 | CISA | Alert | CISA Releases Three Industrial Control Systems Advisories These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-25-119-01 Rockwell Automation ThinManager ICSA-25-119-02 Delta Electronics ISPSoft ICSA-25-105-05 Lantronix XPort (Update A) This product is provided subject to this Notification and this Privacy & Use policy. | CISA |
| Apr 29, 2025 | CISA | Vulnerability Advisory | VA-25-119-01: MSP360 Backup insecure filesystem permissions MSP360 Backup is a data backup and recovery solution. Insecure file system permission vulnerabilities in both the Windows and Linux versions allow a lower privileged user to execute commands the privileges of other users, including administrative users. An attacker could exploit these vulnerabilities to obtain user credentials, redirect the backup target to obtain the data being backed up, and execute commands with the privileges of other (possibly administrative) users. | CISA |
| Apr 29, 2025 | CISA | ICS Advisory | ICSA-25-119-01: Rockwell Automation ThinManager Successful exploitation of these vulnerabilities could allow an attacker to escalate privileges and cause a denial-of-service condition. | CISA |
| Apr 29, 2025 | CISA | ICS Advisory | ICSA-25-119-02: Delta Electronics ISPSoft Successful exploitation of these vulnerabilities could result in an attacker executing arbitrary code. | CISA |
| Apr 29, 2025 | NSA | Advisory | Info Sheet: Selecting a Protective DNS Service (April 2025 Update) Security Infrastructure Cybersecurity Information Selecting a Protective DNS Service The Domain Name System (DNS) is central to the operation of modern networks, translating human-readable domain names into machine-usable Internet Protocol (IP) addresses. DNS makes navigating to a website, sending an email, or making a secure shell connection easier, and is a key component of the Internet's resilience. | CISA, NCSC-UK, NSA |
| Apr 29, 2025 | FBI | Alert | Threat Actors Use Swatting to Target Victims Nationwide The Federal Bureau of Investigation (FBI) is aware of multiple recent swatting incidents. This Public Service Announcement (PSA) is intended to provide the public with information about what swatting is, how to take protective steps against swatting, and how | FBI |
| Apr 29, 2025 | FBI | Alert | Phishing Domains Associated with LabHost PhaaS Platform Users 29 APR 2025 The following information is being provided by the FBI, with no guarantees or warranties, for potential use at the sole discretion of recipients to protect against cyber threats. This data is provided in order to help cyber security professionals and system administrators to guard against the persistent malicious actions of cyber actors. This FLASH was coordinated with DHS/CISA. WE NEED YOUR HELP! | FBI |
| Apr 24, 2025 | CISA | ICS Advisory | ICSA-25-114-01: Schneider Electric Modicon Controllers (Update A) Schneider Electric is aware of multiple vulnerabilities in its Modicon Controller products. The [Modicon Programmable Automation controllers](https://www.se.com/ww/en/product-subcategory/3950-pac-programmable-automation-controllers/) are used for complex networked communication, display and control applications Failure to apply the mitigations or remediations provided below may risk execution of unsolicited command on the PLC which could result in a loss of availability of the controller. | CISA |
| Apr 24, 2025 | CISA | ICS Advisory | ICSA-25-114-04: Nice Linear eMerge E3 Successful exploitation of this vulnerability could allow an attacker to execute arbitrary OS commands. | CISA |
| Apr 24, 2025 | CISA | ICS Advisory | ICSA-25-114-05: Johnson Controls Software House iSTAR Configuration Utility (ICU) Tool Successful exploitation of this vulnerability may allow an attacker to execute arbitrary code. | CISA |
| Apr 24, 2025 | CISA | Alert | CISA Releases Seven Industrial Control Systems Advisories These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-25-114-01 Schneider Electric Modicon Controllers ICSA-25-114-02 ALBEDO Telecom Net.Time - PTP/NTP Clock ICSA-25-114-03 Vestel AC Charger ICSA-25-114-04 Nice Linear eMerge E3 ICSA-25-114-05 Johnson Controls Software House iSTAR Configuration Utility (ICU) Tool ICSA-25-114-06 Planet Technology Network Products ICSA-24-338-0… | CISA |
| Apr 24, 2025 | CISA | ICS Advisory | ICSA-25-114-06: Planet Technology Network Products Successful exploitation of these vulnerabilities could allow an attacker to read or manipulate device data, gain administrative privileges, or alter database entries. | CISA |
| Apr 24, 2025 | CISA | ICS Advisory | ICSA-25-114-03: Vestel AC Charger Successful exploitation of this vulnerability could allow an attacker access to sensitive information, such as credentials which could subsequently enable them to cause a denial of service or partial loss of integrity of the charger. | CISA |
| Apr 24, 2025 | CISA | ICS Advisory | ICSA-25-114-02: ALBEDO Telecom Net.Time - PTP/NTP clock Successful exploitation of this vulnerability could allow an attacker to transmit passwords over unencrypted connections, resulting in the product becoming vulnerable to interception. | CISA |
| Apr 24, 2025 | FBI | Alert | Cybercriminals Impersonating Employee Self-Service Websites to Steal Victim Information and Funds The FBI is warning the public that cyber criminals are targeting users of employee self-service websites owned by companies and government services. The cyber criminals are using search engine advertisements to impersonate legitimate websites and steal victim information and funds. | FBI |
| Apr 24, 2025 | FBI | Alert | FBI Seeking Tips about PRC Targeting of U.S. Telecommunications telecommunications companies, especially information about specific individuals behind the campaign. Investigation into these actors and their activity revealed a broad and significant cyber campaign to leverage access into these networks to target victims on a global scale. | FBI |
| Apr 23, 2025 | NSA | Advisory | Operational Technology Assurance Partnership: Smart Controller Security within National Security Systems Reference herein to any specific commercial products, process, or service by trade name, trademark, manufacturer, or otherwise, does not constitute or imply its endorsement, recommendation, or favoring by the United States Government, and this guidance shall not be used for advertising or product Cybersecurity Report Feedback: [email protected] Defense Industrial Base Inquiries and Cybersecurity Services: [email protected]. | NSA |
| Apr 22, 2025 | CISA | ICS Advisory | ICSA-25-112-02: Siemens TeleControl Server Basic TeleControl Server Basic before V3.1.2.2 contains a Improper Handling of Length Parameter Inconsistency Vulnerability that could allow an attacker to cause the application to allocate exhaustive amounts of memory and subsequently create a denial of service condition. Siemens has released a new version for TeleControl Server Basic and recommends to update to the latest version. | CISA |
| Apr 22, 2025 | CISA | ICS Advisory | ICSA-25-112-04: ABB MV Drives Multiple vulnerabilities regarding the CODESYS Runtime System from CODESYS Group have been publicly reported. CODESYS Runtime System v.3.5.15.0 is utilized in the firmware of ABB MV ACS6080 and ACS5000 drives to provide IEC 61131 programming capabilities. These vulnerabilities could lead to out-of-bound memory access. A successful exploit may result in a denial-of-service condition or arbitrary code execution. Firmware updates are available to address the vulnerabilities in products listed as affected in this advisory. | CISA |
| Apr 22, 2025 | CISA | ICS Advisory | ICSA-25-112-03: Schneider Electric Wiser Home Controller WHC-5918A Schneider Electric is aware of a vulnerability in its Wiser Home Controller WHC-5918A product. The Wiser Home Controller WHC-5918A, a C-Bus based home automation controller, was discontinued on December 31, 2015. Failure to apply the mitigations provided below may risk credentials being stolen, which could result in the Wiser Home Controller WHC-5918A being compromised. | CISA |
| Apr 22, 2025 | CISA | ICS Advisory | ICSA-25-112-01: Siemens TeleControl Server Basic SQL TeleControl Server Basic before V3.1.2.2 contains multiple SQL Injection vulnerabilities that could allow an attacker to read and write to the application's DB, cause denial of service and execute code in an OS shell with limited "NT AUTHORITY\NetworkService" permissions. Siemens has conducted a root-cause analysis for potential SQL injection vulnerabilities and has identified the locations in the code base where the underlying legacy design pattern has been used in. TeleControl Server Basic V3.1.2.2 has fixed all occurrences in the affected product. | CISA |
| Apr 22, 2025 | CISA | Alert | CISA Releases Five Industrial Control Systems Advisories These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-25-112-01 Siemens TeleControl Server Basic SQL ICSA-25-112-02 Siemens TeleControl Server Basic ICSA-25-112-03 Schneider Electric Wiser Home Controller WHC-5918A ICSA-25-035-04 Schneider Electric Modicon M580 PLCs, BMENOR2200H and EVLink Pro AC (Update A) This product is provided subject to this Notification and this Priva… | CISA |
| Apr 18, 2025 | FBI | Alert | FBI Warns of Scammers Impersonating the IC3 Complainants report initial contact from the scammers can vary. Some individuals received an email or a phone call, while others were approached via social media or forums. Almost all complainants indicated the scammers claimed to have recovered the victim's lost funds or offered to assist in recovering funds. | FBI |
| Apr 17, 2025 | CISA | ICS Advisory | ICSA-25-107-04: Yokogawa Recorder Products Successful exploitation of this vulnerability could allow an attacker to manipulate information on the affected products. | CISA |
| Apr 17, 2025 | CISA | ICS Advisory | ICSA-25-107-01: Schneider Electric Trio Q Licensed Data Radio Schneider Electric is aware of a vulnerability in its Trio™ Q Licensed Data Radio product. The Trio Q Licensed Data Radios product is an advanced, high-speed licensed digital data radios, providing both Ethernet and serial communications for complex and demanding applications in Point-to-Point Multipoint (Multiple Address Radio) Telemetry and remote SCADA Systems. Failure to apply the remediations or mitigations provided below may risk disclosure of information that could result in unauthorized access, loss of confidentiality, integrity, and availability of the product. | CISA |
| Apr 17, 2025 | CISA | ICS Advisory | ICSA-25-107-03: Schneider Electric ConneXium Network Manager Software Schneider Electric is aware of vulnerabilities in its ConneXium Network Manager software. The ConneXium Network Manager software provides a solution for configuring and monitoring the administrable Schneider Electric devices, including switches, routers, firewalls, ConneXium Wi-Fi devices, and products from various manufacturers. Failure to apply the mitigations below may risk sensitive data disclosure, leading privilege escalation through man-in-the-middle attacks on ConneXion Network Manager, denial of service, and remote code execution on engineering workstations. | CISA |
| Apr 17, 2025 | CISA | ICS Advisory | ICSA-25-107-02: Schneider Electric Sage Series Schneider Electric is aware of multiple vulnerabilities in its SAGE RTU products. The SAGE RTU products are hardware devices that collect utility substation information from different devices and passes it along to a SCADA software platform. Failure to apply the remediation provided below may risk total compromise of the impacted device, leading to loss of data, loss of operation, or impacts to the performance of the device. | CISA |
| Apr 17, 2025 | CISA | Alert | CISA Releases Six Industrial Control Systems Advisories These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-25-107-01 Schneider Electric Trio Q Licensed Data Radio ICSA-25-107-02 Schneider Electric Sage Series ICSA-25-107-03 Schneider Electric ConneXium Network Manager ICSA-25-107-04 Yokogawa Recorder Products ICSA-24-326-04 Schneider Electric Modicon M340, MC80, and Momentum Unity M1E (Update A) ICSA-25-058-01 Schneider Electr… | CISA |
| Apr 16, 2025 | CISA | Alert | CISA Releases Guidance on Credential Risks Associated with Potential Legacy Oracle Cloud Compromise CISA is aware of public reporting regarding potential unauthorized access to a legacy Oracle cloud environment. While the scope and impact remains unconfirmed, the nature of the reported activity presents potential risk to organizations and individuals, particularly where credential material may be exposed, reused across separate, unaffiliated systems, or embedded (i.e. | CISA |
| Apr 15, 2025 | CISA | Alert | CISA Releases Nine Industrial Control Systems Advisories These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-25-105-01 Siemens Mendix Runtime ICSA-25-105-02 Siemens Industrial Edge Device Kit ICSA-25-105-03 Siemens SIMOCODE, SIMATIC, SIPLUS, SIDOOR, SIWAREX ICSA-25-105-04 Growatt Cloud Applications ICSA-25-105-05 Lantronix Xport ICSA-25-105-06 National Instruments LabVIEW ICSA-25-105-07 Delta Electronics COMMGR ICSA-25-105-08 AB… | CISA |
| Apr 15, 2025 | CISA | ICS Advisory | ICSA-25-105-08: ABB M2M Gateway ABB is aware of public reports of a vulnerabilities in product versions listed as affected in this advisory. An attacker who successfully exploited these vulnerabilities could cause the product to stop, make the product inacces-sible, take remote control of the product or insert and run arbitrary code. As part of ABB product lifecycle policy, once a product transitions to end-of-life, we discontinue maintenance, security patches, and technical support to focus on current and future technologies. | CISA |
| Apr 15, 2025 | CISA | ICS Advisory | ICSA-25-105-05: Lantronix XPort (Update A) Successful exploitation of this vulnerability could allow an attacker unauthorized access to the configuration interface and cause disruption to monitoring and operations. | CISA |
| Apr 15, 2025 | CISA | ICS Advisory | ICSA-25-105-04: Growatt Cloud Applications Successful exploitation of these vulnerabilities could allow an attacker to compromise confidentiality, achieve cross-site scripting, or code execution on affected devices. | CISA |
| Apr 15, 2025 | CISA | ICS Advisory | ICSA-25-105-06: National Instruments LabVIEW Successful exploitation of these vulnerabilities lead to the execution of arbitrary code on affected installations of LabVIEW, which could result in invalid memory writes. | CISA |
| Apr 15, 2025 | CISA | ICS Advisory | ICSA-25-105-09: Mitsubishi Electric Europe B.V. smartRTU Successful exploitation of these vulnerabilities could allow a remote unauthenticated attacker to disclose, tamper with, destroy or delete information in the product, or cause a denial-of service condition on the product. | CISA |
| Apr 15, 2025 | CISA | ICS Advisory | ICSA-25-105-07: Delta Electronics COMMGR (Update A) Successful exploitation of this vulnerability could allow for an attacker to remotely access the AS3000Simulator family in the COMMGR software and execute arbitrary code. | CISA |
| Apr 15, 2025 | CISA | ICS Advisory | ICSA-25-105-03: Siemens SIMOCODE, SIMATIC, SIPLUS, SIDOOR, SIWAREX A vulnerability exists in affected products that could allow remote attackers to affect the availability of the devices under certain conditions. The integrated ICMP services in the underlying TCP/IP stack is vulnerable to a denial of service attack through specially crafted ICMP packets. A successful attack will impact the availability of ICMP services on affected products for a limited time before it restores itself after the attack ceases. Other communication services are not affected by this vulnerability. | CISA |
| Apr 15, 2025 | CISA | ICS Advisory | ICSA-25-105-01: Siemens Mendix Runtime Mendix Runtime allows for entity enumeration due to distinguishable responses in certain client actions. This could allow an unauthenticated remote attacker to list all valid entities and attribute names of a Mendix Runtime-based application. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends countermeasures for products where fixes are not, or not yet available. | CISA |
| Apr 15, 2025 | CISA | ICS Advisory | ICSA-25-105-02: Siemens Industrial Edge Device Kit Users of Industrial Edge Devices are advised to consult the respective Security Advisories for their devices (for Siemens Industrial Edge devices see Additional Information). Industrial Edge Device Kit contains a weak authentication vulnerability that could facilitate an unauthenticated remote attacker to circumvent authentication and impersonate a legitimate user. Industrial Edge Device Builders integrate Industrial Edge Device Kit into their offerings within the open Industrial Edge ecosystem. See further details about affected Industrial Edge Devices in the Additional Information section. | CISA |
| Apr 14, 2025 | CISA | Vulnerability Advisory | VA-25-104-01: SicommNet multiple vulnerabilities SicommNet BASEC is an online eProcurement solution used by governments and other entities. Multiple vulnerabilities have been found in BASEC. These vulnerabilities allow a remote, unauthenticated attacker to gain administrative privileges, read user passwords, and obtain credentials. The attacker could take complete control of BASEC and all of the user data stored in BASEC. | CISA |
| Apr 11, 2025 | CISA | Alert | Fortinet Releases Advisory on New Post-Exploitation Technique for Known Vulnerabilities Fortinet is aware of a threat actor creating a malicious file from previously exploited Fortinet vulnerabilities (CVE-2024-21762, CVE-2023-27997, and CVE-2022-42475) within FortiGate products. This malicious file could enable read-only access to files on the device's file system, which may include configurations. | CISA |
| Apr 11, 2025 | CERT-EU | Advisory | 2025-017: Critical Vulnerabilitites in Microsoft Products It is recommended updating as soon as possible, prioritising critical devices and public facing This advisory describes some notable vulnerabilities addressed by the April 2025 Patch Tuesday. The vulnerability CVE-2025-29824, with a CVSS score of 7.8, is a user-after-free vulnerability in the Windows Common Log File System (CLFS) that can be exploited by attackers to elevate their privileges to SYSTEM on previously compromised Windows machines. | CERT-EU |
| Apr 10, 2025 | CISA | ICS Medical Advisory | ICSMA-25-100-01: INFINITT Healthcare INFINITT PACS Successful exploitation of these vulnerabilities could allow an attacker to upload malicious files and access unauthorized system resources, resulting in arbitrary code execution or information disclosure. | CISA |
| Apr 10, 2025 | CISA | ICS Advisory | ICSA-25-100-09: ABB Arctic Wireless Gateways ABB is aware of public reports of the vulnerabilities in the product versions listed as affected in this advisory. An attacker who successfully exploited modem module vulnerabilities could run arbitrary code in the wireless modem module of the product. This could lead to denial of service or tampering with unencrypted traffic. An attacker who successfully exploited the OpenSSH vulnerability could run arbitrary code in the product with privileged user permissions. This could cause the product to stop, make the product inaccessible, or the attacker could take control of the product. | CISA |
| Apr 10, 2025 | CISA | ICS Advisory | ICSA-25-100-08: Subnet Solutions PowerSYSTEM Center Successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition. | CISA |
| Apr 10, 2025 | CISA | ICS Advisory | ICSA-25-100-07: Rockwell Automation Arena Successful exploitation of these vulnerabilities could disclose information to an attacker or allow execution of arbitrary code on the system. | CISA |
| Apr 10, 2025 | CISA | ICS Advisory | ICSA-25-100-04: Siemens Industrial Edge Devices Siemens Industrial Edge Devices contain a weak authentication vulnerability that could facilitate an unauthenticated remote attacker to circumvent authentication and impersonate a legitimate user. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available. | CISA |
| Apr 10, 2025 | CISA | ICS Advisory | ICSA-25-100-03: Siemens Solid Edge Solid Edge is affected by an out of bounds write vulnerability that could be triggered when the application is parsing X_T data or a specially crafted file in X_T format. If a user is tricked to open a malicious file with the affected applications, an attacker could leverage the vulnerability to perform remote code execution in the context of the current process. Siemens has released new versions for the affected products and recommends to update to the latest versions. | CISA |
| Apr 10, 2025 | CISA | ICS Advisory | ICSA-25-100-02: Siemens SIDIS Prime SIDIS Prime before V4.0.700 is affected by multiple vulnerabilities in the components OpenSSL, SQLite, Boost C++ Libraries and several Microsoft components as described below. Siemens has released a new version of SIDIS Prime and recommends to update to the latest version. | CISA |
| Apr 10, 2025 | CISA | ICS Advisory | ICSA-25-100-01: Siemens License Server (SLS) Siemens License Server before V4.3 contains various vulnerabilities that could allow a low-privileged local user to escalate privileges or perform arbitrary code execution. Siemens has released a new version for Siemens License Server (SLS) and recommends to update to the latest version. | CISA |
| Apr 10, 2025 | CISA | ICS Advisory | ICSA-25-100-05: Siemens Insights Hub Private Cloud Insights Hub Private Cloud is affected by multiple vulnerabilities in Ingress NGINX Controller for Kubernetes. These vulnerabilities could lead to arbitrary code execution in the context of the ingress-nginx controller, or disclosure of Secrets accessible to the controller, or denial of service condition. Siemens has released a new version for Insights Hub Private Cloud and recommends to update to the latest version. | CISA |
| Apr 10, 2025 | CISA | ICS Advisory | ICSA-25-100-06: Siemens SENTRON 7KT PAC1260 Data Manager SENTRON 7KT PAC1260 Data Manager is affected by multiple vulnerabilities as listed below. Software fixes can no longer be provided for The SENTRON 7KT PAC1260 Data Manager. This advisory documents the known open vulnerabilities. To fix the vulnerabilities, Siemens recommends to replace the device by the new SENTRON 7KT PAC1261 Data Manager and update it to the latest available firmware version. | CISA |
| Apr 10, 2025 | CISA | Alert | CISA Releases Ten Industrial Control Systems Advisories These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-25-100-01 Siemens License Server ICSA-25-100-02 Siemens SIDIS Prime ICSA-25-100-03 Siemens Solid Edge ICSA-25-100-04 Siemens Industrial Edge Devices ICSA-25-100-05 Siemens Insights Hub Private Cloud ICSA-25-100-06 Siemens SENTRON 7KT PAC1260 Data Manager ICSA-25-100-07 Rockwell Automation Arena ICSA-25-100-08 Subnet Solut… | CISA |
| Apr 9, 2025 | NSA | Alert | BADBAZAAR and MOONSHINE: Spyware Targeting Uyghur, Taiwanese, and Tibetan Groups and Civil Society Actors This advisory includes two case studies detailing techniques used by malicious cyber actors using spyware known as BADBAZAAR and MOONSHINE to target data on mobile devices including smartphones that could be of interest to the Chinese state. | ASD/ACSC, CCCS, FBI, NCSC-NZ, NCSC-UK, NSA |
| Apr 9, 2025 | JPCERT/CC | Alert | Microsoft Releases April 2025 Security Updates Microsoft has released April 2025 Security Updates to address the vulnerabilities in their products. Remote attackers leveraging these vulnerabilities may be able to execute arbitrary code. According to Microsoft, among the vulnerabilities, the following vulnerability have been confirmed to be exploited in the wild. | JPCERT/CC |
| Apr 9, 2025 | NSA | Advisory | CSA: BADBAZAAR and MOONSHINE: Technical analysis and mitigations BADBAZAAR and MOONSHINE: Technical With support from the UK Cyber League, this advisory has been jointly produced by the National Cyber Security Centre (NCSC UK) and international partners: > The Australian Cyber Security Centre, part of the Australian Signals > The Canadian Centre for Cyber Security, part of the Communications > The German Federal Intelligence Service > The German Federal Office for the Protection of the Constitution > The New Z… | ASD/ACSC, CCCS, FBI, NCSC-NZ, NCSC-UK, NSA |
| Apr 4, 2025 | CISA | Alert | CISA Adds One Vulnerability to the KEV Catalog Reducing the Significant Risk of Known Exploited Vulnerabilities The impact of cybersecurity intrusions that leverage vulnerabilities in information technology and operational technology products threaten the public sector, the private sector, and ultimately the American people’s security and privacy. In 2020, industry partners identified a total of 18,358 new cybersecurity vulnerabilities, or Common Vulnerabilities and Exposures (CVEs). | CISA |
| Apr 4, 2025 | CISA | Alert | Ivanti Releases Security Updates for Connect Secure, Policy Secure & ZTA Gateways Vulnerability (CVE-2025-22457) A cyber threat actor could exploit CVE-2025-22457 to take control of an affected system. CISA has added CVE-2025-22457 to its Known Exploited Vulnerabilities Catalog . See the following resources for more guidance: April Security Update | Ivanti Suspected China-Nexus Threat Actor Actively Exploiting Critical Ivanti Connect Secure Vulnerability (CVE-2025-22457) | Google Cloud Blog Conduct threat hunting actions: Run an external Integrity Checker T… | CISA |
| Apr 3, 2025 | FBI | Alert | Fast Flux: A National Security Threat Malicious cyber actors, including cybercriminals and nation-state actors, use fast flux to obfuscate the locations of malicious servers by rapidly changing Domain Name System (DNS) records. Additionally, they can create resilient, highly available command and control (C2) infrastructure, concealing their subsequent malicious operations. | ASD/ACSC, CCCS, CISA, FBI, NCSC-NZ, NSA |
| Apr 3, 2025 | NCSC | Guidance | New feature: View and manage Early Warning findings in MyNCSC Early Warning alerts and the CSV attachment will continue to be sent via email, but now this same data, and more, can be viewed within the MyNCSC platform. View Early Warning findings alongside other findings you may already receive See other IP addresses in your portfolio affected by the same finding See a summary of key dates and actions affecting each Early Warning finding, including when it was found, what action was taken and by whom Find gu… | NCSC-UK |
| Apr 3, 2025 | CERT-EU | Advisory | 2025-016: Critical Vulnerability in Ivanti Products The vulnerability has been fixed in the February 2025 release and was initially identified as a product bug. CERT-EU recommends upgrading to a supported and fixed version of Ivanti products as soon as possible. | CERT-EU |
| Apr 3, 2025 | CERT-EU | Advisory | 2025-015: Critical vulnerability in CrushFTP It is recommended updating affected server as soon as possible [1,2]. Proof of concepts are available, and the vulnerability is being exploited in the wild. | CERT-EU |
| Apr 3, 2025 | CERT-EU | Advisory | 2025-014: Critical Vulnerability in Apache Tomcat It is recommended updating the affected assets to a fixed version of Apache Tomcat. ThevulnerabilityCVE-2025-24813,withaCVSSscoreof9.8,liesintheApacheTomcat’spartial PUT feature. | CERT-EU |
| Apr 3, 2025 | CISA | ICS Advisory | ICSA-25-093-04: ABB Low Voltage DC Drives and Power Controllers CODESYS RTS CODESYS group published several vulnerabilities regarding the CODESYS Runtime System, which is included in the firmware of ABB LV DC drives and power controllers. It is used to implement a selection of features and to provide IEC 611131-3 programming capabilities. These vulnerabilities include memory corruption issues that could lead to out-of-bound memory access. Subsequently, a successful exploit could allow attackers to trigger a denial-of-service condition or execute arbitrary code over the fieldbus interfaces. | CISA |
| Apr 3, 2025 | CISA | ICS Advisory | ICSA-25-093-03: ABB ACS880 Drives Containing CODESYS RTS Multiple vulnerabilities regarding the CODESYS Runtime System from CODESYS Group have been publicly reported. CODESYS Runtime System is utilized in the firmware of ABB ACS880 drives to provide IEC 61131-3 programming capabilities. These vulnerabilities could lead to out-of-bound memory access. Successful exploit may result in a denial-of-service condition or arbitrary code execution. Firmware updates are available that mitigate the publicly reported vulnerabilities of the product versions listed as affected in this advisory. | CISA |
| Apr 3, 2025 | CISA | ICS Advisory | ICSA-25-093-02: Hitachi Energy TRMTracker Hitachi Energy is aware of the multiple vulnerabilities that affect the TRMTracker product versions listed in this document. An attacker successfully exploiting these vulnerabilities can cause confidentiality and integrity impacts. Please refer to the Recommended Immediate Actions for information about the mitigation/remediation. | CISA |
| Apr 3, 2025 | CISA | ICS Advisory | ICSA-25-093-05: B&R APROL Updates are available that resolve privately reported vulnerabilities in the product versions listed as affected in this advisory. An attacker who successfully exploits these vulnerabilities could elevate privileges or gather sensitive information. | CISA |
| Apr 3, 2025 | CISA | ICS Advisory | ICSA-25-093-01: Hitachi Energy RTU500 Series (Update B) Hitachi Energy is aware of the vulnerabilities, CVE-2024-10037, CVE-2024-11499, CVE-2024-12169, and CVE-2025-1445 in the RTU500 Web server component, the IEC 60870-5-104 controlled station implementation and IEC 61850 implementation, that affects the RTU500 versions that are listed below. An attacker successfully exploiting these vulnerabilities could trigger a restart of a RTU500 CMU. Please refer to the Recom-mended Immediate Actions for information about the available mitigation/remediation strategies. | CISA |
| Apr 3, 2025 | CISA | Advisory | Fast Flux: A National Security Threat The Protective Domain Name System (DNS) Resolver service allows the Cybersecurity and Infrastructure Security Agency (CISA) to detect and prevent cyberattacks and threats targeting federal civilian executive branch (FCEB) agency networks. Protective DNS also offers a range of capabilities to safeguard assets that may otherwise be challenging to protect such as cloud, mobile, and nomadic devices. | ASD/ACSC, CCCS, CISA, FBI, NCSC-NZ, NSA |
| Apr 3, 2025 | CISA | Alert | NSA, CISA, FBI, and International Partners Release Cybersecurity Advisory on “Fast Flux,” a National Security Threat Today, CISA—in partnership with the National Security Agency (NSA), Federal Bureau of Investigation (FBI), Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC), Canadian Centre for Cyber Security (CCCS), and New Zealand’s National Cyber Security Centre (NCSC-NZ)—released joint Cybersecurity Advisory Fast Flux: A National Security Threat (PDF, 841 KB). | ASD/ACSC, CCCS, CISA, FBI, NCSC-NZ, NSA |
| Apr 3, 2025 | CISA | Alert | CISA Releases Five Industrial Control Systems Advisories These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-25-093-01 Hitachi Energy RTU500 Series ICSA-25-093-02 Hitachi Energy TRMTracker ICSA-25-093-03 ABB ACS880 Drives Containing CODESYS RTS ICSA-25-093-04 ABB Low Voltage DC Drives and Power Controllers CODESYS RTS This product is provided subject to this Notification and this Privacy & Use policy. | CISA |
| Apr 2, 2025 | FBI | Alert | Criminal Actors Steal U.S. Taxpayer Identity to File False Tax Returns and Claim Refunds The IRS recommends establishing an Identity Protection Personal Identification Number (IP PIN), a six-digit number assigned to taxpayers to help prevent the misuse of a taxpayers' Social Security number on fraudulent federal income tax returns. Enrollment in the IP PIN program starts by establishing an online account at irs.gov . | FBI |
| Apr 1, 2025 | CISA | ICS Advisory | ICSA-25-091-01: Rockwell Automation Lifecycle Services with Veeam Backup and Replication Successful exploitation of this vulnerability could allow an attacker with administrative privileges to execute code on the target system. | CISA |
| Apr 1, 2025 | CISA | Alert | CISA Releases Two Industrial Control Systems Advisories These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-25-091-01 Rockwell Automation Lifecycle Services with Veeam Backup and Replication ICSA-24-331-04 Hitachi Energy MicroSCADA Pro/X SYS600 (Update A) This product is provided subject to this Notification and this Privacy & Use policy. | CISA |