Volexity says UTA0576 used a zero-day chain to get unauthenticated root on a fully patched Ivanti Connect Secure 22.8R2.4 VPN. Ivanti's Integrity Checker Tool does not flag it, so the check for lateral movement from the VPN device falls to forensics.
Perspective Coverage
10 publishers
- Builder
- Builder 15%
- Operator
- Operator 70%
- Investor
- Investor 15%
Reality
- Evidence78
- Adoption
- Not scored
- Hype gap+8
- Incentives40
- Confidence78
buildOne report1 publisher Exploited NetScaler flaw runs commands without a login on every ADC and Gateway deployment
Citrix shipped one NetScaler ADC and Gateway release that fixes eight flaws, two of them rated CVSS v4 9.5 and already exploited. Teams running their own appliances on older 13.1 or 14.1 builds should treat the upgrade as an emergency change.
Reality
- Evidence55
- Adoption70
- Hype gap+5
- Incentives
- Not scored
- Confidence55
buildConfirmed3 publishers Citrix confirmed attackers are exploiting two CVSS 9.5 pre-auth RCE flaws in NetScaler ADC and Gateway, one of them present in default configurations. Self-managed appliances need the fixed build, installed after evidence is saved, since an upgrade can erase signs of intrusion.
Perspective Coverage
3 publishers
- Builder
- Builder 22%
- Operator
- Operator 65%
- Investor
- Investor 13%
Reality
- Evidence76
- Adoption68
- Hype gap+5
- Incentives35
- Confidence74
Citrix has fixed two NetScaler ADC and Gateway flaws, each rated 9.5 out of 10, that attackers were exploiting before any patch existed. CISA wants owners to look for signs of compromise first because the update can erase the evidence, so the upgrade comes second.
Reality
- Evidence72
- Adoption
- Not scored
- Hype gap+5
- Incentives
- Not scored
- Confidence70
buildConfirmed2 publishers CrowdSec's final analysis puts the entry point in a former employee's development environment, hit by the TanStack npm malware in May. Its own organisation audit logs did not keep the clone events, so GitHub Support supplied them.
Publishers:dev.to · thearabianpost.com Reality
- Evidence62
- Adoption32
- Hype gap−8
- Incentives72
- Confidence58
buildOne report1 publisher Cisco's remediation path for a suspect virtual email gateway starts with a new VM
For virtual appliances where exploitation is suspected, Cisco's advisory lists five actions before the box can be trusted again, one of which is installing fixed software. Owners of physical appliances are told to call TAC.
Publishers:cisco.com
Reality
- Evidence66
- Adoption
- Not scored
- Hype gap+6
- Incentives70
- Confidence62
Sakura declared containment on a 583-account rental-server breach on August 17. On August 19 it said the attacker had also been in the sales-management system holding member records.
Perspective Coverage
3 publishers
- Builder
- Builder 20%
- Operator
- Operator 55%
- Investor
- Investor 25%
Reality
- Evidence82
- Adoption62
- Hype gap+16
- Incentives68
- Confidence74