What’s at Stake: Secrets, Prompt Injection, and More

LangChain Core, the core Python package powering many AI agents and workflows, is affected by a high-severity serialization injection vulnerability that carries a CVSS score of 9.3 out of 10, indicating strong potential for real-world exploitation.

At its core, the issue stems from how LangChain’s dumps() and dumpd() serialization functions handle user-controlled data structures, especially those containing an internal marker key ("lc"). When untrusted inputs are not properly escaped during serialization, they may be wrongly interpreted as legitimate internal objects during deserialization — opening the door for attackers to instantiate unsafe objects or extract secrets from environment variables.

Security researcher Yarden Porat — credited with the discovery — explained that this unsafe deserialization process can be triggered via LLM outputs, like metadata fields or additional streams from model responses, effectively turning a harmless text prompt into a potential exploit vector.

This means an attacker who can influence LLM output — for example through prompt injection — might embed harmful structures that later get processed inside serialization logic, potentially leading to:

• Secret exfiltration (e.g., API keys, environment variables),
• Unauthorized object instantiation,
• Arbitrary code execution via template engines like Jinja2, and
• Manipulation of AI agent behavior or other logic flows.

Versions Affected and Immediate Mitigation

The vulnerability affects both Python and JavaScript ecosystems of LangChain, meaning a broad swath of applications could be at risk unless updated promptly.

Affected LangChain Versions

• Python (langchain-core):
  • Versions >=1.0.0 and <1.2.5
  • Versions <0.3.81
    – Fixed in 1.2.5 and 0.3.81
• JavaScript variants (similar flaw tracked as CVE-2025-68665 with CVSS 8.6) impact:
  • @langchain/core >= 1.0.0 and <1.1.8
  • @langchain/core < 0.3.80
  • langchain >= 1.0.0 and <1.2.3
  • langchain < 0.3.37
    – All fixed in newer versions

To mitigate this risk, the LangChain team has updated how serialization is handled by introducing restrictive defaults, including:

• Allowlist controls (allowed_objects) to limit which classes can be serialized/deserialized,
• Blocking risky templates like Jinja2 by default, and
• Disabling automatic secret loading from environment variables unless explicitly allowed.

Developers are strongly urged to upgrade to the patched releases immediately, especially if their workflows include untrusted inputs, LLM streaming operations, or any dynamic serialization logic.

Why This Matters: AI and Traditional Security Collide

The LangGrinch vulnerability highlights a deeper issue at the intersection of AI development and classic security principles: LLM outputs should be treated as untrusted inputs. Unlike traditional software data flows, where strict typing and validation can be applied throughout, AI systems often produce outputs influenced by external inputs or model artifacts — making them fertile ground for injection attacks if unguarded.

In this case, fields such as additional_kwargs or response_metadata, often used to capture LLM behavior or metadata, can serve as unwitting avenues for attackers to embed harmful structures that bypass safety checks.

Industry experts warn that frameworks underpinning AI agents and automated workflows must adopt defense-in-depth strategies, including:

• Treating all AI output as potentially malicious,
• Applying strict validation and sanitization,
• Avoiding broad serialization permissions, and
• Isolating sensitive operations from LLM-driven logic. LangChain Docs

As AI continues to weave deeper into business logic and automation, these approaches become crucial to mitigating emergent risks that blur the lines between AI misbehavior and conventional security exploits.

The post AI Apps at Risk due to LangChain Vulnerability appeared first on CyberHood Sentinel.

Widespread Attacks Deploying Diverse Malware
According to a new analysis by Huntress, adversaries exploiting React2Shell are not limiting themselves to simple payloads. In a series of intrusions detected as of early December 2025, attackers dropped XMRig cryptocurrency miners alongside a range of malicious tools, including:

PeerBlight: a Linux backdoor capable of persistence and stealthy command execution.

CowTunnel: a reverse proxy tunnel that can bypass firewall restrictions by initiating outbound connections to attacker-controlled infrastructure.

ZinFoq: a Go-based post-exploitation implant supporting interactive shell operations, file management, and network pivoting.

Researchers observed automated exploitation tooling that indiscriminately scanned both Windows and Linux endpoints, indicating that attackers have weaponized the flaw at scale. These automated tools probe for vulnerable instances, deploy scripts, and fetch additional payloads from command-and-control (C2) servers once access is obtained.

Critical Vulnerability and Rapid Exploitation
React2Shell is an unauthenticated RCE vulnerability affecting React Server Components (RSC), a core part of the React 19 ecosystem and related frameworks such as Next.js. The root cause lies in unsafe deserialization of specially crafted HTTP requests destined for server functions — a flaw that allows remote attackers to execute arbitrary code without authentication. The vulnerability carries a CVSS severity score of 10.0, the highest possible.

Since its public disclosure in early December 2025, React2Shell has been one of the most rapidly weaponized vulnerabilities seen in recent years. Threat intelligence from Amazon Web Services noted that China-linked state-aligned groups, including Earth Lamia and Jackpot Panda, began exploiting the flaw within hours of disclosure, scanning the internet en masse for vulnerable systems.

Notably, a number of victim organizations remain unpatched despite widespread warnings. Researchers from Wiz reported that around half of publicly exposed vulnerable instances have yet to be updated, providing a broad attack surface for adversaries.

Nation-State Actors and Sophisticated Payloads
In addition to commodity malware, indicators point to nation-state involvement in targeted exploitation campaigns. Security firms have linked React2Shell attacks to North Korean threat actors deploying a sophisticated Remote Access Trojan known as EtherRAT. This malware implements multiple Linux persistence techniques and has been associated with additional malicious activity characteristic of North Korean operations.

Beyond EtherRAT, telemetry from multiple security vendors has revealed over a dozen distinct intrusion clusters, ranging from simple cryptomining deployments to advanced backdoors and proxy frameworks. These clusters reflect both opportunistic scanning and deliberate, targeted campaigns affecting industries from construction and entertainment to higher education and government.

Expert Analysis and Mitigation Urgency
Security experts emphasize that React2Shell is a “patch-now” vulnerability. Christiaan Beek, senior director of threat intelligence at Rapid7, characterized the situation as requiring immediate action: “This is a patch-now situation, because exploitation is happening simultaneously across the entire threat landscape.”

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2025-55182 to its Known Exploited Vulnerabilities (KEV) catalog, underscoring the ongoing active exploitation and the critical need for organizations to remediate affected systems urgently.

From a defensive standpoint, organizations are advised to:

• Audit and update all React Server Component and related frameworks to patched versions as released by maintainers.
• Deploy Web Application Firewall (WAF) rules to block known exploit patterns during remediation.
• Monitor logs for signs of exploitation, such as malformed RSC payloads or unexpected outbound connections.
• Analyze systems for post-exploit indicators, including unauthorized backdoors or proxy tunnels

A Vulnerability With a Long Tail
React2Shell has quickly transitioned from an obscure vulnerability to a highly exploited threat affecting enterprises worldwide. Its broad impact on modern web infrastructure, coupled with active exploitation by both low-skill and sophisticated threat actors, highlights the critical importance of rapid patching and vigilant monitoring.

As the cybersecurity community continues to uncover new malware tied to this flaw, defenders are urged not only to remediate immediately but to consider long-term improvements to software supply chain security and dependency management — issues that increasingly underpin modern cyber risk.

The post React2Shell Exploits Surge as Critical React Server Component Flaw Fuels Crypto Miners and New Linux Malware Outbreak appeared first on CyberHood Sentinel.

What’s Going On

Security firm Wordfence reports that the CVE-2025-6389 vulnerability affects all Sneeit versions up to, and including, 8.3 — a plugin used by more than 1,700 active WordPress installations.

The flaw resides in the plugin’s sneeit_articles_pagination_callback() function, which improperly passes unsanitized user input into PHP’s call_user_func(). This oversight enables unauthenticated attackers to execute arbitrary PHP functions — such as wp_insert_user() — to create backdoor administrator accounts, upload malicious PHP files, or otherwise hijack the site.

Less than 24 hours after public disclosure on November 24, 2025, Wordfence had already blocked over 131,000 exploit attempts — 15,381 of those in a single day.

Attackers have been observed sending specially crafted HTTP requests to typical WordPress endpoints (e.g., /wp-admin/admin-ajax.php), creating malicious admin users such as “arudikadis” and uploading webshells like “tijtewmg.php” to maintain persistent backdoor access.

Compromised sites reportedly store malicious PHP shells — often named “xL.php,” “Canonical.php,” “.a.php,” or “simple.php” — granting attackers full control over the server: directory scanning, file read/write/delete, ZIP extraction, and more.

Why It Matters

RCE vulnerabilities like CVE-2025-6389 are especially dangerous because they give attackers server-level control — meaning they can deface websites, steal or leak data, send spam, or even pivot deeper into hosting infrastructures. In the case of Sneeit, malicious actors can operate without any user credentials, making automated wide-scale attacks trivial.

Moreover, Sneeit is commonly bundled within WordPress themes — which increases the likelihood that some site owners may be unaware of the underlying plugin and therefore miss critical updates.

What to Do: Immediate Actions & Mitigations

• Update Immediately: Site owners must upgrade to Sneeit version 8.4 or later, the patched release (rolled out on August 5, 2025).
• Audit & Hard-Harden: Review user accounts for unknown administrators, inspect file systems for suspicious PHP files (especially in upload or plugin directories), and check web-server logs and access patterns.
• Temporarily Disable Sneeit: If updating is not immediately feasible, consider disabling or removing the Sneeit plugin until patching is possible.
• Use Web Application Firewalls (WAFs): Deploy WAF rules to block untrusted POST requests, unusual calls to admin-ajax.php, or attempts to drop PHP files.

Security researchers and site administrators alike are also advising stronger supply-chain hygiene — especially avoiding themes bundled with outdated or rarely maintained plugins, and staying alert with vulnerability advisories

Broader Context: WordPress & Plugin Risk Landscape

This incident adds to a growing list of severe plugin-related vulnerabilities rocking the WordPress ecosystem. As attackers increasingly mechanize their reconnaissance and exploitation processes, a single unpatched plugin can jeopardize an entire website — or even a hosting server — overnight.

According to security tracking services, the Sneeit flaw is not unique. Flaws caused by improper input validation, dangerous PHP function execution, or weak plugin maintenance have repeatedly surfaced in 2025 — making plugin management and timely patching among the most critical tasks for any WordPress administrator

The post Sneeit WordPress RCE Under Active Attack by Hackers appeared first on CyberHood Sentinel.

What Happened: Zero-Day Exploitation Drives Urgent Patch

Oracle’s security advisory reveals that CVE-2025-61882, rated CVSS 9.8, is a remotely exploitable flaw in the Oracle E-Business Suite that could allow an unauthenticated attacker (i.e. someone without credentials) to execute code on the Oracle Concurrent Processing component via HTTP access.

The urgency of the patch was driven by real-world exploitation: Cl0p has been observed leveraging this vulnerability in targeted data theft operations. Oracle’s Chief Security Officer, Rob Duhart, stated that the company released additional updates after discovering other potential attack vectors during their investigation.

Indicators of compromise linked to the attack include specific IP addresses (e.g. 200.107.207.26 and 185.181.60.11), and artifacts like exploit scripts and ZIP archives circulating under names such as

Background & Broader Context

This development comes amid a broader campaign by Cl0p targeting Oracle E-Business Suite users. In August 2025, security firm Mandiant reported that multiple vulnerabilities—some already patched in Oracle’s July update and at least one that would later become CVE-2025-61882—had been used to steal large volumes of data across multiple victims.

Charles Carmakal, CTO at Mandiant (now part of Google Cloud), warned that “irrespective of when the patch is applied, organizations should examine whether they were already compromised.” This warning is significant: even if organizations quickly apply Oracle’s fix, attackers may already have gained a foothold through earlier exploitation.

The pattern reflects a familiar tactic in advanced persistent threats (APTs) and ransomware groups: exploit a chain of known and zero-day vulnerabilities to gain access, then move laterally or exfiltrate sensitive data. In this case, Cl0p appears to have orchestrated a “high-volume email campaign” using compromised accounts to further their reach.

Expert Insights & Recommended Actions

Although Oracle did not include independent external commentary in its advisory, experts like those at Mandiant have publicly weighed in. The takeaway: applying the patch is necessary but not sufficient. Organizations should:

• Investigate past compromise indicators: Look into system logs, network traffic, and known IoCs to check for evidence of prior data exfiltration or backdoors.
• Implement segmentation and access controls: Limit the exposure of Oracle EBS components, especially the Concurrent Processing interface, to only trusted networks and systems.
• Monitor for anomalous behavior: Use threat-detection tools and continuous monitoring to detect unexpected outbound connections or privilege escalations.
• Stay current on updates: In this case, Oracle’s emergency patch was issued as soon as additional vectors were identified.

By combining patching with proactive hunting and defensive architecture, security teams can reduce their exposure to both zero-day and future threats.

Conclusion

Oracle’s emergency patch for CVE-2025-61882 underscores the speed with which modern cyber adversaries strike—and the critical need for equally rapid defensive responses. While the patch addresses the immediate flaw exploited by Cl0p, the campaign’s already-completed data thefts mean that affected organizations must review evidence of past compromise. In short: patch fast, but investigate thoroughly.

The post Oracle Patches Critical Flaw Exploited by Cl0p in Data Theft Campaign appeared first on CyberHood Sentinel.

With a CVSS score of 7.8, the vulnerability stems from an “improper ownership management” issue in the OverlayFS subsystem of the Linux kernel. It allows attackers to escalate privileges by tricking the system into spawning SUID binaries — executables that run with elevated privileges, specifically root

How the Exploit Works

OverlayFS facilitates union mounting of disparate directories, allowing the kernel to manage file systems in layers. According to CISA:

“Linux kernel contains an improper ownership management vulnerability … in how a user copies a capable file from a nosuid mount into another mount.”

Security firm Datadog illustrated the mechanism back in May 2023. The exploit enables an unprivileged user to:

1. Copy a capable file (with setuid bits) from the lower layer (nosuid-disabled).
2. Move it into an upper layer, bypassing proper ownership checks.
3. Execute it from a directory like /tmp, where the file appears to be owned by root.
4. Achieve local root access, compromising the system

In simple terms, the attacker “smuggles” a privileged binary into a writable location, then runs it to take over the host .

Historical Context: Related Vulnerabilities

OverlayFS has been the source of similar exploits in the past. In mid-2023, Wiz, a cloud security firm, disclosed two related flaws—GameOver(lay)—affecting Ubuntu and enabling analogous privilege elevation techniques (CVE‑2023‑32629 and CVE‑2023‑2640). These exploits, too, manipulated OverlayFS to create unauthorized SUID executables for root privilege escalation.

Who Is at Risk?

While any Linux system using OverlayFS could be vulnerable, those employing user namespaces and container technologies (like Docker, Kubernetes, or certain chroot environments) are particularly at risk. As noted by both Datadog and Wiz, the flaw is “trivial to exploit”, meaning even users with minimal privileges can leverage it to gain full system control

CISA’s Urgent Advisory for Federal Agencies

CISA has mandated that all Federal Civilian Executive Branch (FCEB) agencies must:

• Apply the official Linux kernel patch for CVE‑2023‑0386.
• Comply by July 8, 2025, to mitigate active threats

This directive underscores the severity of the issue. Federal systems are frequently targeted by sophisticated attackers; delaying patching increases exposure to compromise.

Mitigation Steps for All Users

Even outside U.S. federal systems, any Linux environment using OverlayFS should act immediately:

1. Update your Linux kernel to a version patched in early 2023.
2. Verify patched OverlayFS behavior via official kernel changelogs or vendor advisories.
3. Restrict untrusted user namespaces, especially in environments like Docker or Kubernetes where users may have container-level access.
4. Audit systems for suspicious SUID binaries located in common writeable directories like /tmp.
5. Use least privilege principles — ensure only essential users/groups have access to OverlayFS mounts and user namespaces.

Failing to patch risks full system compromise with local exploits, data theft, or deployment of further malicious tools.

Why This Matters

CVE‑2023‑0386 exemplifies a stealthy yet potent vulnerability: it doesn’t need network access, only local execution rights, which are easier for attackers to obtain. OverlayFS is widely used; thus, the exploit’s attack surface is extensive. The ease of attack and potential for total system takeover make it a high-priority issue.

Furthermore, Container-driven infrastructure means enterprise and cloud systems are not exempt. Misconfigurations or oversights can allow attackers to escalate from isolated containers to full host compromise.

Final Takeaway

CVE‑2023‑0386 is a tangible, actively exploited vulnerability that demands immediate attention. Whether you’re a federal agency, enterprise, or small business, taking prompt action is essential:

• Patch your Linux kernel now to versions addressing CVE‑2023‑0386.
• Enforce overlay namespace restrictions to limit exposure.
• Audit and monitor for unauthorized SUID file creations.

Ignoring this advisory could leave critical systems open to root-level breaches via a mechanic that’s straightforward to exploit. Stay proactive, secure your infrastructure, and keep OverlayFS-managed environments under scrutiny.

The post CISA Flags Active Exploitation of Linux Kernel Privilege Escalation Bug appeared first on CyberHood Sentinel.

Vulnerability Details

CVE-2025-5419 is characterized as an out-of-bounds read and write issue within the V8 engine. Exploitation of this vulnerability could allow a remote attacker to corrupt the heap memory via a crafted HTML page, potentially leading to arbitrary code execution. Google’s Threat Analysis Group (TAG) researchers, Clement Lecigne and Benoît Sevens, discovered and reported the flaw on May 27, 2025. A fix was promptly implemented the following day through a configuration change to the Stable version of Chrome across all platforms.

As per Google’s advisory, “Google is aware that an exploit for CVE-2025-5419 exists in the wild.” However, specific details regarding the nature of the attacks or the threat actors involved have not been disclosed to prevent further exploitation

Recommended Actions

Users are strongly advised to update their Chrome browsers to the latest versions to mitigate potential risks:

• Windows and macOS: Version 137.0.7151.68 or 137.0.7151.69
• Linux: Version 137.0.7151.68

Additionally, users of Chromium-based browsers such as Microsoft Edge, Brave, Opera, and Vivaldi should apply the respective updates as they become available.

Context and Precedence

This marks the second actively exploited zero-day vulnerability in Chrome addressed by Google in 2025. Earlier this year, CVE-2025-2783 was patched after being weaponized in attacks targeting organizations in Russia.

The swift identification and remediation of CVE-2025-5419 underscore the importance of timely updates and vigilance in cybersecurity practices.

The post Google Issues Emergency Patch for Actively Exploited Chrome Zero-Day Vulnerability appeared first on CyberHood Sentinel.

Details of the Vulnerabilities

• CVE-2025-4918: This vulnerability involves an out-of-bounds access issue when resolving JavaScript Promise objects. Exploitation could permit attackers to perform unauthorized read or write operations in memory.
• CVE-2025-4919: This flaw pertains to an out-of-bounds access vulnerability during the optimization of linear sums in JavaScript. Attackers could manipulate array index sizes to achieve unauthorized memory access.

Successful exploitation of either vulnerability could lead to memory corruption, potentially enabling attackers to execute arbitrary code or access confidential information.

Affected Firefox Versions

The vulnerabilities impact the following Firefox versions:

• All versions prior to Firefox 138.0.4 (including Firefox for Android)
• All versions of Firefox Extended Support Release (ESR) before 128.10.1
• All versions of Firefox ESR before 115.23.1

Users are strongly advised to update to the latest versions to mitigate potential risks.

Discovery and Recognition

The vulnerabilities were discovered by security researchers during the Pwn2Own Berlin event:

• CVE-2025-4918 was reported by Edouard Bochin and Tao Yan from Palo Alto Networks.
• CVE-2025-4919 was reported by Manfred Paul.

Each researcher received a $50,000 reward for their findings, highlighting the importance of collaborative efforts in identifying and addressing security flaws.

Mozilla’s Response

In response to the discoveries, Mozilla promptly released patches to address the vulnerabilities. The organization emphasized that, although the exploits did not break out of the browser’s sandbox environment, users should update their browsers immediately to ensure optimal security.

Implications for Users

While the immediate impact of these vulnerabilities was contained, the incident underscores the importance of regular software updates and vigilance against potential threats. Web browsers remain a primary target for cyberattacks, and staying current with security patches is crucial for protection.

Recommendations

To safeguard against similar vulnerabilities:

• Update Regularly: Ensure your browser and all software are up-to-date with the latest security patches.
• Enable Automatic Updates: Allow your browser to update automatically to receive timely security fixes.
• Be Cautious with Links: Avoid clicking on suspicious links or visiting untrusted websites.
• Use Security Software: Employ reputable antivirus and anti-malware solutions to provide an additional layer of defense.

Conclusion

Mozilla’s swift action in patching these critical vulnerabilities demonstrates the effectiveness of coordinated efforts between security researchers and software developers. Users are encouraged to remain proactive in maintaining their cybersecurity hygiene to protect against emerging threats.

The post Mozilla Addresses Critical Zero-Day Flaws in Firefox appeared first on CyberHood Sentinel.

CVE-2025-4632: What You Need to Know

• Vulnerability ID: CVE-2025-4632
• CVSS Score: 9.8 (Critical)
• Affected Product: Samsung MagicINFO 9 Server (versions before 21.1052.0)
• Exploitation Type: Unauthenticated remote arbitrary file write
• Patch Bypass Of: CVE-2024-7399

This vulnerability stems from improper validation of file paths, which allows attackers to carry out path traversal attacks. By crafting malicious file paths, threat actors can write arbitrary files to the server with system-level privileges, paving the way for full server compromise.

Active Exploitation in the Wild

The flaw was actively exploited in the wild, as per cybersecurity firm Huntress, who observed attackers using it to:

• Drop malicious files like srvany.exe and services.exe
• Run reconnaissance commands such as whoami and query user
• Deploy the Mirai botnet, a notorious malware used for large-scale DDoS attacks

The exploit chain was triggered after a proof-of-concept (PoC) was publicly released by SSD Disclosure on April 30, 2025.

A Patch Bypass Resurfaces

CVE-2025-4632 is particularly dangerous because it acts as a patch bypass for CVE-2024-7399, previously believed to be mitigated. This allowed attackers to once again target vulnerable MagicINFO servers, emphasizing the importance of defense-in-depth and continuous patch validation.

Mitigation and Patch Guidance

Samsung has addressed the vulnerability in MagicINFO 9 Server version 21.1052.0. Users on older versions should follow this two-step upgrade path:

1. Upgrade to version 21.1050.0
2. Then proceed to 21.1052.0

Jamie Levy, Director of Adversary Tactics at Huntress, confirmed:

“We have verified that MagicINFO 9 21.1052.0 does mitigate the original issue raised in CVE-2025-4632.”

Recommendations

Organizations using MagicINFO should:

• Immediately apply the latest patch
• Audit systems for unauthorized changes or signs of compromise
• Implement WAF, EDR, and network segmentation to mitigate future exposure

Final Thoughts

With the rapid release of PoC code and proven active exploitation, CVE-2025-4632 serves as a stark reminder of how quickly attackers can capitalize on software flaws. Samsung MagicINFO users must act now to secure their systems against future compromise and botnet recruitment.

The post Samsung Patches CVE-2025-4632 Flaw Exploited by Mirai Botnet in MagicINFO 9 Server appeared first on CyberHood Sentinel.

The targeted endpoint, /developmentserver/metadatauploader, belongs to the Visual Composer component of SAP NetWeaver. The vulnerability enables remote code execution (RCE) by allowing threat actors to upload web shells without authentication.

Exploitation Targets Critical Infrastructure Worldwide

Cybersecurity researchers from EclecticIQ have uncovered widespread exploitation of the flaw by Chinese threat groups across multiple industries. At least 581 SAP NetWeaver systems have been compromised, with over 800 additional systems identified as potential future targets.

Sectors Impacted:

• UK-based natural gas and waste management firms
• Medical equipment manufacturers
• Oil and gas exploration companies in the U.S.
• Government ministries in Saudi Arabia

The discovery was made through attacker-exposed infrastructure that included detailed logs of compromised environments and targeted domains.

Threat Actors and Their Toolkits

EclecticIQ attributed the campaign to multiple China-linked APT groups including:

• UNC5221: Deployed custom malware like KrustyLoader to deliver payloads such as Sliver.
• UNC5174: Installed SNOWLIGHT loaders to fetch backdoors like GOREVERSE and VShell.
• CL-STA-0048: Attempted to establish reverse shells from infected SAP environments.
• Chaya_004: Delivered SuperShell, a Go-based reverse shell tool, to compromised systems.

These actors employed advanced tactics including custom malware, remote access trojans (RATs), and fileless persistence mechanisms.

SAP Releases Security Patch

In response to active exploitation, SAP issued Security Note 3604119 on May 13, 2025, patching CVE-2025-31324. The update also addresses a related deserialization issue tracked as CVE-2025-42999.

SAP Urges Immediate Action:

• Apply the latest patches from SAP immediately.
• Scan for compromise indicators using open-source tools from Mandiant and Onapsis.
• Monitor for suspicious activity, especially unauthorized file uploads and outbound connections to suspicious IP addresses.

Urgency for Enterprise Defenders

Given the critical severity of the flaw and ongoing exploitation, CVE-2025-31324 poses an immediate threat to global enterprise infrastructure. Unpatched SAP systems represent a high-value target for state-sponsored cyber actors seeking to disrupt essential services and steal sensitive data.

Security professionals are urged to prioritize SAP security assessments, update threat detection rules, and strengthen monitoring of external access to development endpoints.

Conclusion

The exploitation of SAP CVE-2025-31324 by China-linked APTs highlights the urgent need for robust patch management and proactive threat detection in enterprise environments. With attackers actively targeting critical infrastructure, immediate remediation and enhanced visibility are key to mitigating risk.

The post Critical SAP Vulnerability CVE-2025-31324 Exploited in Ongoing Cyberattacks appeared first on CyberHood Sentinel.

Vulnerability Details​

The flaw, identified as CVE-2025-34028, is a path traversal vulnerability with a maximum CVSS score of 10.0. It affects Commvault’s Command Center versions 11.38.0 through 11.38.19. The vulnerability allows unauthenticated remote attackers to upload specially crafted ZIP files, which, when decompressed by the server, can lead to remote code execution.

Cybersecurity firm watchTowr Labs discovered the issue, pinpointing the “deployWebpackage.do” endpoint as the source. This endpoint can be exploited to trigger a pre-authenticated Server-Side Request Forgery (SSRF), resulting in code execution when a malicious .JSP file is included in the ZIP archive. ​

Commvault has addressed the vulnerability in versions 11.38.20 and 11.38.25. Users are urged to update to these versions promptly.

CISA’s Response and Recommendations​

In light of the active exploitation, CISA has mandated that all Federal Civilian Executive Branch (FCEB) agencies apply the necessary patches by May 23, 2025. The agency also advises all organizations using affected versions to follow vendor instructions, apply mitigations, or discontinue use if patches are unavailable.

Impact and Mitigation​

Commvault reported that a small number of customers have been affected, but there has been no unauthorized access to backup data. For those unable to update immediately, isolating the Command Center from external network access is recommended.

This incident marks the second time a Commvault vulnerability has been exploited in real-world attacks, following CVE-2025-3928, which allowed remote, authenticated attackers to create and execute web shells. ​

Organizations are encouraged to review their systems for potential exposure and take immediate action to mitigate risks associated with this vulnerability.

The post Critical Commvault Vulnerability Actively Exploited, Added to CISA’s KEV Catalog​ appeared first on CyberHood Sentinel.