# UNC6148 Backdoors Fully-Patched SonicWall SMA 100 Series Devices with OVERSTEP Rootkit
[![Hacking SonicWall SMA 100 Series Devices](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiDteWJXj8rzKBMIKCi5ikfj2MUefFMEAniiLqXLvf7wWSWsYYusLRg1IbkCSIre2kBl1hJd3znVdgdTSOVYDFxSm2z41AS4MsJG2dBgQctj05q3OF9iFTsFqThrsrGRlCfGgYL_7jT-yEu3uVlElffovZI1KALMLH7mLIHfcYfJ92M8y3GNABN0klHWEDN/s790-rw-e365/sma.jpg "Hacking SonicWall SMA 100 Series Devices")](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiDteWJXj8rzKBMIKCi5ikfj2MUefFMEAniiLqXLvf7wWSWsYYusLRg1IbkCSIre2kBl1hJd3znVdgdTSOVYDFxSm2z41AS4MsJG2dBgQctj05q3OF9iFTsFqThrsrGRlCfGgYL_7jT-yEu3uVlElffovZI1KALMLH7mLIHfcYfJ92M8y3GNABN0klHWEDN/s790-rw-e365/sma.jpg)

A threat activity cluster has been observed targeting fully-patched [end-of-life](https://www.sonicwall.com/support/product-lifecycle-tables/Secure-Mobile-Access-100-Series/Hardware) SonicWall Secure Mobile Access (SMA) 100 series appliances as part of a campaign designed to drop a backdoor called **OVERSTEP**.

The malicious activity, dating back to at least October 2024, has been [attributed](https://cloud.google.com/blog/topics/threat-intelligence/sonicwall-secure-mobile-access-exploitation-overstep-backdoor) by the Google Threat Intelligence Group (GTIG) to a hacking crew it tracks as **UNC6148**. The number of known victims is "limited" at this stage.

The tech giant assessed with high confidence that the threat actor is "leveraging credentials and one-time password (OTP) seeds stolen during previous intrusions, allowing them to regain access even after organizations have applied security updates."

"Analysis of network traffic metadata records suggests that UNC6148 may have initially exfiltrated these credentials from the SMA appliance as early as January 2025."

The exact initial access vector used to deliver the malware is currently not known due to the steps taken by the threat actors to remove log entries. But it's believed that access may have been gained through the exploitation of known security flaws such as [CVE-2021-20035](https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0022), [CVE-2021-20038, CVE-2021-20039](https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0026), [CVE-2024-38475](https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0018), or [CVE-2025-32819](https://psirt.global.sonicwall.com/vuln-detail/snwlid-2025-0011).

Alternately, the tech giant's threat intelligence team theorized that the administrator credentials could've been obtained through information-stealing logs or acquired from credential marketplaces. However, it said it didn't find any evidence to back up this hypothesis.

[![DFIR Retainer Services](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg-X-E4jERutAGUVjhgWkMe8ShYj1nqWzq1SqeBFJikipPF-xT70YnaSLlaR3UkhNP8Q47kifLbAEGXpknthRo_lfqDawf05df5ozIbkBTrupYoGXl8axiISZxIKgHQ8GOm47oYIZ9l8PnjNrSw_NpS6YzSZzvy0bhoqKd91EG3BcIs3jONhIjeB4iXl-dY/s738-e100/zz--inside-d.png)](https://thehackernews.uk/zz--inside-d)

Upon gaining access, the threat actors have been found to establish an SSL-VPN session and spawn a reverse shell, although how this was achieved remains a mystery given that shell access should not be possible by design on these appliances. It's believed that it may have been pulled off by means of a zero-day flaw.

The reverse shell is used to run reconnaissance and file manipulation commands, not to mention export and import settings to the SMA appliance, suggesting that UNC6148 may have altered an exported settings file offline to include new rules so that their operations are not interrupted or blocked by the access gateways.

The attacks culminate in the deployment of a previously undocumented implant named OVERSTEP that's capable of modifying the appliance's boot process to maintain persistent access, as well as credential theft and concealing its own components to evade detection by patching various file system-related functions.

This is achieved by implementing a usermode rootkit through the hijacked standard library functions open and readdir, allowing it to hide the artifacts associated with the attack. The malware also hooks into the write API function to receive commands from an attacker-controlled server in the form of embedded within web requests -

*   **dobackshell**, which starts a reverse shell to the specified IP address and port
*   **dopasswords**, which creates a TAR archive of the files /tmp/temp.db, /etc/EasyAccess/var/conf/persist.db, and /etc/EasyAccess/var/cert, and save it in the location "/usr/src/EasyAccess/www/htdocs/" so that it can be downloaded via a web browser

"UNC6148 modified the legitimate RC file '/etc/rc.d/rc.fwboot' to achieve persistence for OVERSTEP," GTIG said. "The changes meant that whenever the appliance was rebooted, the OVERSTEP binary would be loaded into the running file system on the appliance."

Once the deployment step is complete, the threat actor then proceeds to clear the system logs and reboots the firewall to activate the execution of the C-based backdoor. The malware also attempts to remove the command execution traces from different log files, including httpd.log, http\_request.log, and inotify.log.

"The actor's success in hiding their tracks is largely due to OVERSTEP's capability to selectively delete log entries \[from the three log files\]," Google said. "This anti-forensic measure, combined with a lack of shell history on disk, significantly reduces visibility into the actor's secondary objectives."

Google has evaluated with medium confidence that UNC6148 may have weaponized an unknown, zero-day remote code execution vulnerability to deploy OVERSTEP on targeted SonicWall SMA appliances. Furthermore, it's suspected that the operations are carried out with the intent to facilitate data theft and extortion operations, and even ransomware deployment.

[![CIS Build Kits](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi_HDUlvbnYoGKWPtfjTL83IuUQ73P6igcLnrsVdRjU2sVKjgD6kcX1QX3psmxbKnQ-GfeZ5xCNgnJF64an1ZS4C9mxkNAfVoSaNVMTGdlCMv4nchoUdLGCDbdB6BQWiRScizTQjINO1DArRQdcgzs5CbapyRNjTVLX_RBZ4eS9Kg3iB7UkazuU0e5YlPLZ/s728-e100/sem-d.png)](https://thehackernews.uk/endpoint-protect-d)

This connection stems from the fact that one of the organizations that was targeted by UNC6148 was posted on the data leak site operated by World Leaks, an extortion gang run by individuals previously associated with the Hunters International ransomware scheme. It's worth noting that Hunters International recently [shuttered](https://thehackernews.com/2025/07/weekly-recap-chrome-0-day-ivanti.html#:~:text=Hunters%20International%20Shuts%20Down%20https://www.truesec.com/hub/blog/web-shell-on-a-sonicwall-sma) its criminal enterprise.

According to Google, UNC6148 exhibits tactical overlaps with prior exploitation of SonicWall SMA devices observed in July 2023 that involved an unknown threat actor deploying a web shell, a hiding mechanism, and a way to ensure persistence across firmware upgrades, per [Truesec](https://www.truesec.com/hub/blog/web-shell-on-a-sonicwall-sma).

The exploitation activity was subsequently [linked](https://dfir.ch/posts/microsocks_sonicwall/) by security researcher Stephan Berger to the deployment of the Abyss ransomware.

The findings once again highlight how threat actors are increasingly focusing on edge network systems that aren't usually covered by common security tools like Endpoint Detection and Response (EDR) or antivirus software and slip into target networks unnoticed.

"Organizations should acquire disk images for forensic analysis to avoid interference from the rootkit anti-forensic capabilities. Organizations may need to engage with SonicWall to capture disk images from physical appliances," Google said.

When reached for comment on the findings, SonicWall told The Hacker News that it has been "working closely" with GTIG throughout the whole process, and that it plans to accelerate the end-of-support date for the SMA 100 series. It also said it intends to support existing SMA 100 deployments with firmware updates throughout the remaining lifecycle.

"In response to the evolving threat landscape – and in alignment with our commitment to transparency and customer protection – SonicWall will accelerate the end-of-support date for the SMA 100 series," the company said. "The SMA 100 has already reached end-of-sale status, as reflected in our Product Lifecycle Table, and this update aligns with our long-term strategy and industry direction."

"SonicWall has been actively guiding customers toward more modern, secure solutions such as our Cloud Secure Edge service and the SMA 1000 series. These platforms are built on advanced technology stacks and offer stronger security, greater scalability, and an improved user experience – better suited for today's distributed and cloud-connected environments. This mirrors broader industry trends, where leading vendors like Cisco and Palo Alto Networks have moved customers from legacy hardware to cloud-native architectures."

_(The story was updated after publication to include a response from SonicWall.)_

Found this article interesting? Follow us on [Google News](https://news.google.com/publications/CAAqLQgKIidDQklTRndnTWFoTUtFWFJvWldoaFkydGxjbTVsZDNNdVkyOXRLQUFQAQ), [Twitter](https://twitter.com/thehackersnews) and [LinkedIn](https://www.linkedin.com/company/thehackernews/) to read more exclusive content we post.


Suricata 8.0.2 and 7.0.13 released - including multiple vulnerabilities

# Suricata 8.0.2 and 7.0.13 released! - Suricata
We are pleased to announce the releases of Suricata 8.0.2 and 7.0.13.

These are security releases, fixing a number of important issues.

Get the releases here:

8.0.2: [https://www.openinfosecfoundation.org/download/suricata-8.0.2.tar.gz](https://www.openinfosecfoundation.org/download/suricata-8.0.2.tar.gz)

7.0.13: [https://www.openinfosecfoundation.org/download/suricata-7.0.13.tar.gz](https://www.openinfosecfoundation.org/download/suricata-7.0.13.tar.gz)

[](https://forum.suricata.io/t/suricata-8-0-2-and-7-0-13-released/6100#p-18099-notable-changes-1)Notable Changes
----------------------------------------------------------------------------------------------------------------

Suricata-update has been updated to version 1.3.7. This version is bundled with the releases.

Various security, performance, accuracy, and stability issues have been fixed.

8.0.2 tickets: [https://redmine.openinfosecfoundation.org/versions/225](https://redmine.openinfosecfoundation.org/versions/225)

7.0.13 tickets: [https://redmine.openinfosecfoundation.org/versions/224](https://redmine.openinfosecfoundation.org/versions/224)

### [](https://forum.suricata.io/t/suricata-8-0-2-and-7-0-13-released/6100#p-18099-cve-ids-addressed-2)CVE IDs Addressed:

*   CVE-2025-64344: HIGH (7.0.x and 8.0.x)
*   CVE-2025-64333: HIGH (7.0.x and 8.0.x)
*   CVE-2025-64332: HIGH (7.0.x and 8.0.x)
*   CVE-2025-64331: HIGH (7.0.x and 8.0.x)
*   CVE-2025-64330: HIGH (7.0.x and 8.0.x)
*   CVE-2025-64335: HIGH (8.0.x only)
*   CVE-2025-64334: HIGH (8.0.x only)

Suricata Security Advisories: [https://github.com/OISF/suricata/security/advisories](https://github.com/OISF/suricata/security/advisories)

[](https://forum.suricata.io/t/suricata-8-0-2-and-7-0-13-released/6100#p-18099-oisf-signing-key-updated-3)OISF Signing key updated
----------------------------------------------------------------------------------------------------------------------------------

The OISF signing key has been recently updated to have a later expiration date. It is the same key as before, but users will need to refresh it:

```
gpg --receive-keys 2BA9C98CCDF1E93A
```

It can also be downloaded from:

[https://www.openinfosecfoundation.org/downloads/OISF.pub](https://www.openinfosecfoundation.org/downloads/OISF.pub)

[](https://forum.suricata.io/t/suricata-8-0-2-and-7-0-13-released/6100#p-18099-special-thanks-4)Special Thanks
--------------------------------------------------------------------------------------------------------------

Adam Kiripolsky, Alain Térieur, Amir Boussejra, Andreas Dolp, Andy Awad, Bai Liang, Cheng Longfei, Fupeng Zhao, Heng Li, Jamie Lavigne, Jesse Lepich, Jules Lumbergh, Marko Jahnke, [Outreachy](https://www.outreachy.org/), [OSS-Fuzz](https://github.com/google/oss-fuzz), [Coverity](https://scan.coverity.com/).

[](https://forum.suricata.io/t/suricata-8-0-2-and-7-0-13-released/6100#p-18099-join-us-for-suricon-2025-5)Join us for SuriCon 2025!!
------------------------------------------------------------------------------------------------------------------------------------

This year’s Suricata Community Conference is happening this month in Montreal, Canada, from November 19 to 21.

SuriCon is a great place to present exciting work or research done with Suricata. Come share it with us! Check the agenda, we always have great talks ![:smiley:](https://emoji.discourse-cdn.com/twitter/smiley.png?v=15) [https://suricon.net/agenda-montreal/](https://suricon.net/agenda-montreal/)

This year, we have three 2-day training sessions to choose from, including a brand-new Threat Hunting class, and a Rule Writing training. Some rooms are getting full, don’t miss your spot! [https://suricon.net/trainings/](https://suricon.net/trainings/)

Check everything SuriCon and get book room deals at [https://suricon.net/](https://suricon.net/) .

**About Suricata**
------------------

[Suricata](https://suricata.io/) is a high-performance Network Threat Detection, IDS, IPS, and Network Security Monitoring engine. Open-source and owned by a community-run non-profit foundation, the Open Information Security Foundation ([OISF](https://oisf.net/)). Suricata is developed by OISF, its supporting vendors, and the community.

———————————————

Originally posted by Victor Julien to the Suricata forum: [https://forum.suricata.io/t/suricata-8-0-2-and-7-0-13-released](https://forum.suricata.io/t/suricata-8-0-2-and-7-0-13-released)


Uhale digital frames with Android operating system have several critical vulnerabilities

> Experts have found that many of the digital frame models analyzed download malicious payloads from Chinese servers immediately after ignition. At startup, devices check for an update of the Uhale app, install the update to version 4.2.0 and restart. After restarting, the updated app starts downloading and running the malware.
>
> The downloaded JAR/DEX file is saved in the Uhale application directory and run at each subsequent system start. It is not yet clear why version 4.2.0 of the application became malicious (whether this was done intentionally by the developers themselves or whether the ZEASN upgrade infrastructure was compromised).
>
> The malware detected has been linked to the Vo1d botnet, which has millions of devices, as well as the Mzmess family of malware. This connection is confirmed by packet prefixes, string names, endpoints, malware distribution process, and a range of artifacts.
>
> In addition to the automatic download of the malware (which did not occur on all the frames analyzed), the researchers also discovered numerous vulnerabilities. In their report, Quokka's specialists detailed 17 problems, 11 of which have already received CVE identifiers.

The most serious are:

* CVE-2025-58392 and CVE-2025-58397 – An insecure implementation of TrustManager allows a MitM attack to inject counterfeit encrypted responses, eventually leading to remote code execution with root privileges;
* CVE-2025-58388 – During an application update, raw file names are passed directly to shell commands, allowing command injection and remote installation of arbitrary APKs;
* CVE-2025-58394 – All the camera frames tested were shipped with disabled SELinux, default root access and AOSP public test keys, which means they were completely compromised from the first moment;
* CVE-2025-58396 – A pre-installed application launches a file server on the TCP 17802 port, which accepts file uploads without authentication. As a result, any host on the local network gets the ability to write or delete arbitrary files on your device;
* CVE-2025-58390 – WebView in the app ignores SSL/TLS errors and allows mixed content, allowing attackers to inject or intercept data viewed on the device, opening the door to phishing and content spoofing.


### React2Shell (CVE-2025-55182)

#### What?

A 10.0 critical severity vulnerablility affecting server-side use of React.js, tracked as [CVE-2025-55182](https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components) in React.js and [CVE-2025-66478](https://github.com/vercel/next.js/security/advisories/GHSA-9qr9-h5gf-34mp) specifically for the Next.js framework.

This vulnerability was responsibly disclosed by myself, [Lachlan Davidson](https://github.com/lachlan2k) on 29 November 2025 PT to the Meta team. Initial disclosure and patch release was performed by React and Vercel on 3 December 2025 PT.

#### Update: Proof-of-Concepts

A real public PoC began circulating after around 30 hours from initial disclosure, I've now shared my [PoCs](https://github.com/lachlan2k/React2Shell-CVE-2025-55182-original-poc) several hours later. Full writeup in due course :)

#### Update: A note on scanners (4 December 20:55 UTC)

We've seen some great scanners from the likes of Assetnote, which are very effective at detecting unpatched Next.js instances that use Server Components.

However, there's another nuance that we'd like to highlight: The day-0 protections from some providers are actually runtime-level, and not just WAF rules. So many customers with theoretically vulnerable versions are, to our knowledge, still protected.

We're aware of many submissions to Bug Bounty programs, etc. based on these scanner outputs, many of which may be false positives. Unfortuantely, at this point in time, we cannot share any methods to concretely identify with certainity if you are vulnerable. So when in doubt: patch!

#### Update: A note on invalid PoCs (4 December 03:25 UTC)

We have seen a rapid trend of "Proof of Concepts" spreading which are not genuine PoCs.

Anything that requires the developer to have explicitly exposed dangerous functionality to the client is not a valid PoC. Common examples we've seen in supposed "PoCs" are vm#runInThisContext, child\_process#exec, and fs#writeFile.

This would only be exploitable if you had consciously chosen to let clients invoke these, which would be dangerous no matter what. The genuine vulnerability does not have this constraint. In Next.js, the list of server functions is managed for you, and does not contain these.

Many of these "PoCs" have been referenced in publications, and even some vulnerability aggregators. We are concerned that these may lead to false negatives when evaluating if a service is vulnerable, or lead to unpreparedness if or when a genuine PoC surfaces.

### Am I affected?

Refer to vendor advisories from [React](https://github.com/facebook/react/security/advisories/GHSA-fv66-9v8q-g76r) and [Next.js](https://github.com/vercel/next.js/security/advisories/GHSA-9qr9-h5gf-34mp).

### What happened to CVE-2025-66478?

This CVE was (technically correctly) marked as a duplicate of CVE-2025-55182.

The decision to publish a second CVE for Next.js was made due to these exceptional circumstsances: Next.js does not include React as a traditional dependency - instead, they bundle it "vendored". So, if you're using Next.js, many dependency tools do not automatically recognise it as vulnerable.

### Aditional React vulnerabilities (CVE-2025-55183, CVE-2025-55184, CVE-2025-67779)

Denial of Service - High Severity: CVE-2025-55184 and CVE-2025-67779 (CVSS 7.5)

(CVE-2025-55184 was incompletely fixed, leading to the
full fixes being tracked under CVE-2025-67779.)

"Security researchers have discovered that a malicious
HTTP request can be crafted and sent to any Server
Functions endpoint that, when deserialized by React,
can cause an infinite loop that hangs the server
process and consumes CPU. Even if your app does not
implement any React Server Function endpoints it may
still be vulnerable if your app supports React Server
Components.

This creates a vulnerability vector where an attacker
may be able to deny users from accessing the product,
and potentially have a  performance impact on the
server environment."

Source Code Exposure - Medium Severity: CVE-2025-55183 (CVSS 5.3)


Security content of iOS 26.2 and iPadOS 26.2

# About the security content of iOS 26.2 and iPadOS 26.2 - Apple Support
For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the [Apple security releases](https://support.apple.com/en-us/100100) page.

Apple security documents reference vulnerabilities by [CVE-ID](https://www.cve.org/About/Overview) when possible.

For more information about security, see the [Apple Product Security](https://support.apple.com/en-us/102549) page.

Released December 12, 2025

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: An app may be able to access sensitive payment tokens

Description: A permissions issue was addressed with additional restrictions.

CVE-2025-46288: floeki, Zhongcheng Li from IES Red Team of ByteDance

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: Processing a file may lead to memory corruption

Description: The issue was addressed with improved bounds checks.

CVE-2025-43539: Michael Reeves (@IntegralPilot)

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: An attacker may be able to spoof their FaceTime caller ID

Description: An inconsistent user interface issue was addressed with improved state management.

CVE-2025-46287: an anonymous researcher, Riley Walz

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: Multiple issues in curl

Description: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at [cve.org](https://www.cve.org/).

CVE-2024-7264

CVE-2025-9086

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: Password fields may be unintentionally revealed when remotely controlling a device over FaceTime

Description: This issue was addressed with improved state management.

CVE-2025-43542: Yiğit Ocak

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: An app may be able to inappropriately access files through the spellcheck API

Description: A logic issue was addressed with improved checks.

CVE-2025-43518: Noah Gregory (wts.dev)

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: Processing malicious data may lead to unexpected app termination

Description: A memory corruption issue was addressed with improved bounds checking.

CVE-2025-43532: Andrew Calvano and Lucas Pinheiro of Meta Product Security

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: An app may be able to identify what other apps a user has installed

Description: A permissions issue was addressed with additional restrictions.

CVE-2025-46279: Duy Trần (@khanhduytran0)

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: An app may be able to gain root privileges

Description: An integer overflow was addressed by adopting 64-bit timestamps.

CVE-2025-46285: Kaitao Xie and Xiaolong Bai of Alibaba Group

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: Processing a file may lead to memory corruption

Description: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at [cve.org](https://www.cve.org/).

CVE-2025-5918

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: An app may be able to access user-sensitive data

Description: A logging issue was addressed with improved data redaction.

CVE-2025-43475: Rosyna Keller of Totally Not Malicious Software

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: An app may be able to access sensitive user data

Description: An information disclosure issue was addressed with improved privacy controls.

CVE-2025-46276: Rosyna Keller of Totally Not Malicious Software

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: A malicious HID device may cause an unexpected process crash

Description: Multiple memory corruption issues were addressed with improved input validation.

CVE-2025-43533: Google Threat Analysis Group

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: Photos in the Hidden Photos Album may be viewed without authentication

Description: A configuration issue was addressed with additional restrictions.

CVE-2025-43428: an anonymous researcher, Michael Schmutzer of Technische Hochschule Ingolstadt

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: An app may be able to access a user’s Safari history

Description: A logging issue was addressed with improved data redaction.

CVE-2025-46277: Kirin (@Pwnrin)

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: An app may be able to access sensitive user data

Description: A logging issue was addressed with improved data redaction.

CVE-2025-43538: Iván Savransky

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: An app may be able to access user-sensitive data

Description: This issue was addressed with additional entitlement checks.

CVE-2025-46292: Rosyna Keller of Totally Not Malicious Software

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash

Description: A type confusion issue was addressed with improved state handling.

WebKit Bugzilla: 301257

CVE-2025-43541: Hossein Lotfi (@hosselot) of Trend Micro Zero Day Initiative

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: Processing maliciously crafted web content may lead to an unexpected process crash

Description: A use-after-free issue was addressed with improved memory management.

WebKit Bugzilla: 301726

CVE-2025-43536: Nan Wang (@eternalsakura13)

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: Processing maliciously crafted web content may lead to an unexpected process crash

Description: The issue was addressed with improved memory handling.

WebKit Bugzilla: 300774

WebKit Bugzilla: 301338

CVE-2025-43535: Google Big Sleep, Nan Wang (@eternalsakura13)

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: Processing maliciously crafted web content may lead to an unexpected process crash

Description: A buffer overflow issue was addressed with improved memory handling.

WebKit Bugzilla: 301371

CVE-2025-43501: Hossein Lotfi (@hosselot) of Trend Micro Zero Day Initiative

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: Processing maliciously crafted web content may lead to an unexpected process crash

Description: A race condition was addressed with improved state handling.

WebKit Bugzilla: 301940

CVE-2025-43531: Phil Pizlo of Epic Games

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26. CVE-2025-14174 was also issued in response to this report.

Description: A use-after-free issue was addressed with improved memory management.

WebKit Bugzilla: 302502

CVE-2025-43529: Google Threat Analysis Group

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: Processing maliciously crafted web content may lead to memory corruption. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26. CVE-2025-43529 was also issued in response to this report.

Description: A memory corruption issue was addressed with improved validation.

WebKit Bugzilla: 303614

CVE-2025-14174: Apple and Google Threat Analysis Group

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later

Impact: Processing maliciously crafted web content may lead to an unexpected process crash

Description: A use-after-free issue was addressed with improved memory management.

WebKit Bugzilla: 300926

CVE-2025-43511: 이동하 (Lee Dong Ha of BoB 14th)

We would like to acknowledge an anonymous researcher for their assistance.

We would like to acknowledge Mickey Jin (@patch1t) for their assistance.

We would like to acknowledge Golden Helm Securities for their assistance.

We would like to acknowledge Mochammad Nosa Shandy Prastyo for their assistance.

We would like to acknowledge Richard Hyunho Im (@richeeta) at Route Zero Security (routezero.security) for their assistance.

We would like to acknowledge Geva Nurgandi Syahputra (gevakun) for their assistance.

Information about products not manufactured by Apple, or independent websites not controlled or tested by Apple, is provided without recommendation or endorsement. Apple assumes no responsibility with regard to the selection, performance, or use of third-party websites or products. Apple makes no representations regarding third-party website accuracy or reliability. [Contact the vendor](https://support.apple.com/103190) for additional information.

Published Date: December 12, 2025


CVE-2025-66516: Apache Tika core, Apache Tika parsers, Apache Tika PDF parser module: Update to CVE-2025-54988 to expand scope of artifacts affected

Ref: [https://seclists.org/oss-sec/2025/q4/238](https://seclists.org/oss-sec/2025/q4/238)

Severity: critical

Affected versions:

- Apache Tika core (org.apache.tika:tika-core) 1.13 through 3.2.1
- Apache Tika parsers (org.apache.tika:tika-parsers) 1.13 before 2.0.0
- Apache Tika PDF parser module
(org.apache.tika:tika-parser-pdf-module) 2.0.0 through 3.2.1

Description:

Critical XXE in Apache Tika tika-core (1.13-3.2.1), tika-pdf-module
(2.0.0-3.2.1) and tika-parsers (1.13-1.28.5) modules on all platforms
allows an attacker to carry out XML External Entity injection via a
crafted XFA file inside of a PDF.

This CVE covers the same vulnerability as in CVE-2025-54988. However,
this CVE expands the scope of affected packages in two ways.

First, while the entrypoint for the vulnerability was the
tika-parser-pdf-module as reported in CVE-2025-54988, the
vulnerability and its fix were in tika-core. Users who upgraded the
tika-parser-pdf-module but did not upgrade tika-core to >= 3.2.2 would
still be vulnerable.

Second, the original report failed to mention that in the 1.x Tika
releases, the PDFParser was in the "org.apache.tika:tika-parsers"
module.

References: Ref: [https://seclists.org/oss-sec/2025/q4/238](https://seclists.org/oss-sec/2025/q4/238)


# Reports About Cyberattacks Against Cisco Secure Email Gateway And Cisco Secure Email and Web Manager
Reports About Cyberattacks Against Cisco Secure Email Gateway And Cisco Secure Email and Web Manager
----------------------------------------------------------------------------------------------------

Critical

CVE-2025-20393

CWE-20

[Download CSAF](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sma-attack-N9bf4/csaf/cisco-sa-sma-attack-N9bf4.json)

[Email](mailto:?Subject=Cisco%20Security%20Advisory%20cisco-sa-sma-attack-N9bf4&Body=https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sma-attack-N9bf4)

Summary

-----------

*   On December 10, Cisco became aware of a new cyberattack campaign targeting a limited subset of appliances with certain ports open to the internet that are running Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Email and Web Manager. This attack allows the threat actors to execute arbitrary commands with _root_ privileges on the underlying operating system of an affected appliance. The ongoing investigation has revealed evidence of a persistence mechanism planted by the threat actors to maintain a degree of control over compromised appliances.

    Cisco strongly recommends that customers follow the guidance provided in the [Recommendations](#Recommendations) section of this advisory to assess exposure and mitigate risks.

    Cisco Talos discussed these attacks in the blog post [UAT-9686 actively targets Cisco Secure Email Gateway and Secure Email and Web Manager](https://blog.talosintelligence.com/uat-9686/).

    This advisory is available at the following link:
    [https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sma-attack-N9bf4](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sma-attack-N9bf4)

Affected Products

---------------------

*   Cisco continues to investigate this attack campaign. As the investigation progresses, Cisco will update this advisory as appropriate as more information becomes available.

    This attack campaign affects Cisco Secure Email Gateway, both physical and virtual, and Cisco Secure Email and Web Manager appliances, both physical and virtual, when both of the following conditions are met:

    *   The appliance is configured with the **Spam Quarantine** feature.
    *   The **Spam Quarantine** feature is exposed to and reachable from the internet.

    The Spam Quarantine feature is not enabled by default. Deployment guides for these products do not require this port to be directly exposed to the Internet.

    **Note**: All releases of Cisco AsyncOS Software are affected by this attack campaign.

    **Determine Whether Spam Quarantine Is Enabled on a Cisco Secure Email Gateway Appliance**

    To determine whether the Spam Quarantine feature is configured and enabled on an appliance, connect to the web management interface and navigate to the following menu: **Network** > **IP Interfaces >** \[**Select the Interface on which Spam Quarantine is configured**\]**.** If the checkbox next to Spam Quarantine is checked, the feature is enabled.

    **Determine Whether Spam Quarantine Is Enabled on a Cisco Secure Email and Web Manager Appliance**

    To determine whether the Spam Quarantine feature is configured and enabled on an appliance, connect to the web management interface and navigate to the following menu: **Management Appliance >** **Network** > **IP Interfaces >** \[**Select the interface on which Spam Quarantine is configured**\]. If the checkbox next to Spam Quarantine is checked, the feature is enabled.

    Only products listed in the [Vulnerable Products](#vp) section of this advisory are known to be affected by this attack campaign.

    Cisco has confirmed that all devices that are part of Cisco Secure Email Cloud are not affected.

    Cisco is not aware of any exploitation activity against Cisco Secure Web.

Indicators of Compromise

----------------------------

*   As part of the attack campaign described in this advisory, the threat actor planted a persistent covert channel that was used to remotely access the compromised appliance.

    Customers who wish to explicitly verify whether an appliance has been compromised can open a [Cisco Technical Assistance Center (TAC)](https://www.cisco.com/c/en/us/support/index.html) case. To expedite our investigation into the potential compromise, please ensure that remote access is enabled on the affected appliances. For more guidance, see this [tech note](https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/117873-faq-esa-00.html).

    In any case, Cisco strongly recommends following the guidance listed in the [Recommendations](#Recommendations) section of this advisory.

Workarounds

---------------

*   There are no workarounds identified that directly mitigate the risk concerning this attack campaign, but administrators can view and follow the guidance provided in the [Recommendations](#Recommendations) section of this advisory.

Recommendations

-------------------

*   If an appliance has been identified as having the web management interface or the Spam Quarantine port exposed to and reachable from the internet, Cisco strongly recommends following a multi-step process to restore the appliance to a secure configuration, when possible. For additional information, see **Useful Resources** at the end of this section.

    If restoring the appliance is not possible, Cisco recommends contacting [TAC](https://www.cisco.com/c/en/us/support/index.html) to check whether the appliance has been compromised. In case of confirmed compromise, rebuilding the appliances is, currently, the only viable option to eradicate the threat actors persistence mechanism from the appliance.

    In addition, Cisco strongly recommends restricting access to the appliance and implementing robust access control mechanisms to ensure that ports are not exposed to unsecured networks.

    **General Recommendations For Hardening**

    *   Prevent access from the internet to the appliance. If internet access to the appliance is required, restrict appliance access to only known, trusted hosts on ports/protocols that are included in the user guides.
    *   Protect Cisco Secure Email Gateway and Cisco Secure Email and Web Manager appliances behind a filtering device such as a firewall, and filter traffic to/from the appliances while only allowing known, trusted hosts to send traffic to the appliances. Using a two-layer firewall can provide flexibility in network planning so that end users do not connect directly to the outer DMZ. See the Deployment sections of the User Guides for [Cisco Secure Email Gateway](https://www.cisco.com/c/en/us/td/docs/security/esa/esa16-0-3/user_guide/b_ESA_Admin_Guide_16-0-3/b_ESA_Admin_Guide_12_1_chapter_010.html#con_1287954) and [Cisco Secure Email and Web Manager](https://www.cisco.com/c/en/us/td/docs/security/security_management/sma/sma16-0-2/user_guide/b_sma_admin_guide_16_0_2/b_NGSMA_Admin_Guide_chapter_01.html#con_1257754).
    *   For Cisco Secure Email Gateway, separate mail and management functionality onto separate network interfaces. This reduces the chance of unauthorized users accessing the internal Management Network. For more information, see the device user guides.
    *   Regularly monitor web log traffic for any unexpected traffic to/from appliances. Logging should be sent to an external server, if possible, and kept for a long enough duration so that post-event investigations can be performed with sufficient log data.
    *   Disable HTTP for the main administrator portal.
    *   Disable any network services that are not required, including HTTP and FTP. For more information about specific service functionality, see the Cisco Secure Email Gateway and Cisco Secure Email and Web Manager user guides.
    *   Upgrade the appliance to the latest version of Cisco AsyncOS Software.
    *   Use a strong form of end-user authentication to the appliances, such as SAML or Lightweight Directory Access Protocol (LDAP). For more secure methods of authentication, see [Authentication Options for End Users Accessing Spam Management Features](https://www.cisco.com/c/en/us/td/docs/security/security_management/sma/sma16-0-2/user_guide/b_sma_admin_guide_16_0_2/b_NGSMA_Admin_Guide_chapter_0101.html?bookSearch=true#con_1623537).
    *   Change the default administrator password to a more secure variant. Restrict access to the administrator account by creating user accounts based on necessary access requirements. In addition, create operator accounts for all administrators.
    *   Using SSL/TLS, obtain an SSL certificate from a certificate authority (CA) or create a self-signed certificate.

    **Useful Resources**

    The following resources can help restore an affected appliance to a secure state. Some of the documents are related to a specific product, but the procedures are mostly interchangeable. If customers have specific questions about a procedure, contact [TAC.](https://www.cisco.com/c/en/us/support/index.html)

    To download replacement Virtual Appliances, visit the relevant Cisco Software Download page:

    *   [Cisco Secure Email Gateway](https://software.cisco.com/download/home/284900944/type/282975113/release/16.0.1?i=!pp)
    *   [Cisco Secure Email and Web Manager](https://software.cisco.com/download/home/286283259/type/286283388/release/16.0.2?i=!pp)

    For information about exporting reporting data from an appliance, see [Working with Reports.](https://www.cisco.com/c/en/us/td/docs/security/security_management/sma/sma16-0/user_guide/b_sma_admin_guide_16_0/b_NGSMA_Admin_Guide_chapter_010.html)

    For information about how to purge messages in the quarantine, see [Spam Quarantine.](https://www.cisco.com/c/en/us/td/docs/security/security_management/sma/sma16-0/user_guide/b_sma_admin_guide_16_0/b_NGSMA_Admin_Guide_chapter_0101.html)

    For additional information, see [Centralizing Policy, Virus, and Outbreak Quarantines.](https://www.cisco.com/c/en/us/td/docs/security/esa/esa16-0/user_guide/b_ESA_Admin_Guide_16-0/b_ESA_Admin_Guide_12_1_chapter_0101011.html#con_1158787)

Exploitation and Public Announcements

-----------------------------------------

*   In December 2025, the Cisco Product Security Incident Response Team (PSIRT) became aware of potentially malicious activity that targets Cisco Secure Email Gateway and Cisco Secure Email and Web Manager appliances.

Source

----------

*   This attack campaign was initially found during the resolution of a Cisco TAC support case.

Cisco Security Vulnerability Policy

---------------------------------------

*   To learn about Cisco security vulnerability disclosure policies and publications, see the [Security Vulnerability Policy](http://www.cisco.com/web/about/security/psirt/security_vulnerability_policy.html). This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco.

*   [Subscribe](https://www.cisco.com/c/en/us/support/web/tools/cns/notifications.html)

Related to This Advisory

----------------------------

URL

-------

*   [https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sma-attack-N9bf4](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sma-attack-N9bf4)

Revision History

--------------------

*
|Version|Description            |Section|Status |Date       |
|-------|-----------------------|-------|-------|-----------|
|1.0    |Initial public release.|-      |Interim|2025-DEC-17|

    Show Less

* * *

Legal Disclaimer

--------------------

*   ### SOFTWARE DOWNLOADS AND TECHNICAL SUPPORT

    The [Cisco Support and Downloads](https://www.cisco.com/c/en/us/support/index.html) page on Cisco.com provides information about licensing and downloads. This page can also display customer device support coverage for customers who use the My Devices tool. Please note that customers may download only software that was procured from Cisco directly or through a Cisco authorized reseller or partner and for which the license is still valid.

    Customers who purchase directly from Cisco but do not hold a Cisco service contract and customers who make purchases through third-party vendors but are unsuccessful in obtaining fixed software through their point of sale should obtain upgrades by contacting the [Cisco Technical Assistance Center (TAC)](https://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.html). Customers should have the product serial number available and be prepared to provide the URL of this advisory as evidence of entitlement to a free upgrade.

    When [considering software upgrades](https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html#fixes), customers are advised to regularly consult [the advisories](https://www.cisco.com/go/psirt) for the relevant Cisco products to determine exposure and a complete upgrade solution. In all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the [Cisco Technical Assistance Center (TAC)](https://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.html) or their contracted maintenance providers.

    ### LEGAL DISCLAIMER DETAILS

    CISCO DOES NOT MAKE ANY EXPRESS OR IMPLIED GUARANTEES OR WARRANTIES OF ANY KIND, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. WITHOUT LIMITING THE GENERALITY OF THE FOREGOING, CISCO DOES NOT GUARANTEE THE ACCURACY OR COMPLETENESS OF THIS INFORMATION. THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.

    Copies or summaries of the information contained in this Security Advisory may lack important information or contain factual errors. Customers are advised to visit the [Cisco Security Advisories](https://www.cisco.com/go/psirt) page for the most recent version of this Security Advisory. The Cisco Product Security Incident Response Team (PSIRT) assesses only the affected and fixed release information that is documented in this advisory. See the [Cisco Security Vulnerability Policy](https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html#fixes) for more information.

Feedback

------------

*   Leave additional feedback


Privilege boundary violation vulnerability is identified affecting multiple Radiometer Products

A "Privilege boundary violation" vulnerability is identified affecting multiple Radiometer Products. Exploitation of this vulnerability gives a user with physical access to the analyzer, the possibility to gain unauthorized access to functionalities outside the restricted environment. The vulnerability is due to weakness in the design of access control implementation in application software.

Other related CVE's are CVE-2025-14096 and CVE-2025-14097.

Affected customers have been informed about this vulnerability.

This CVE is being published to provide transparency.

**Required configuration for Exposure**

Physical access to the analyzer is needed.

**Temporary work Around**                                                                                Only authorized people can physically access the analyzer.

**Permanent solution**
Local Radiometer representatives will contact all affected customers to discuss a permanent solution.

**Exploit Status**                                                                                Researchers have provided working proof-of-concept. Radiometer is not aware of any publicly available exploit at the time of publication.


gpg.fail - multiple vulnerabilities in GnuPG

# gpg.fail
"in the hurry of leaving i forgot the sites src at home, sorry, had to rewrite the whole thing. expect a nicer site by tomorrow. im patching as we speak."
\- reaper (<- to blame)

1.  [Multiple Plaintext Attack on Detached PGP Signatures in GnuPG](https://gpg.fail/detached)
2.  [GnuPG Accepts Path Separators and Path Traversals in Literal Data "Filename" Field](https://gpg.fail/filename)
3.  [Cleartext Signature Plaintext Truncated for Hash Calculation](https://gpg.fail/formfeed)
4.  [Encrypted message malleability checks are incorrectly enforced causing plaintext recovery attacks](https://gpg.fail/malleability)
5.  [Memory Corruption in ASCII-Armor Parsing](https://gpg.fail/memcpy)
6.  [Trusted comment injection (minisign)](https://gpg.fail/minisign)
7.  [Cleartext Signature Forgery in the NotDashEscaped header implementation in GnuPG](https://gpg.fail/notdash)
8.  [OpenPGP Cleartext Signature Framework Susceptible to Format Confusion](https://gpg.fail/notsoclear)
9.  [GnuPG Output Fails To Distinguish Signature Verification Success From Message Content](https://gpg.fail/noverify)
10.  [Cleartext Signature Forgery in GnuPG](https://gpg.fail/nullbyte)
11.  [Radix64 Line-Truncation Enabling Polyglot Attacks](https://gpg.fail/polyglot)
12.  [GnuPG may downgrade digest algorithm to SHA1 during key signature checking](https://gpg.fail/sha1)
13.  [GnuPG Trust Packet Parsing Enables Adding Arbitrary Subkeys](https://gpg.fail/trust)
14.  [Trusted comment Injection (minisign)](https://gpg.fail/trustcomment)

Video https://media.ccc.de/v/39c3-to-sign-or-not-to-sign-practical-vulnerabilities-i/oembed


#  CRITICAL SECURITY BULLETIN: Trend Micro Apex Central (on-premise) January 2026 Multiple Vulnerabilities

### Affected Version(s)

|Product                   |Affected Version(s)       |Platform |Language(s) |
|--------------------------|--------------------------|---------|------------|
|Apex Central (on-premise) |Versions below Build 7190 |Windows  |English     |

###
Solution

Trend Micro has released the following solutions to address the issue:

These are the minimum recommended version(s) of the patches and/or builds required to address the issue. Trend Micro highly encourages customers to obtain the latest version of the product if there is a newer one available than the one listed in this bulletin.

Customers are encouraged to visit Trend Micro’s [Download Center](http://downloadcenter.trendmicro.com/) to obtain prerequisite software (such as Service Packs) before applying any of the solutions above.

###
Vulnerability Details

**CVE-2025-69258**: **LoadLibraryEX Remote Code Execution (RCE) Vulnerability**
_CVSSv3.1: 9.8: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H_

A LoadLibraryEX vulnerability in Trend Micro Apex Central could allow an unauthenticated remote attacker to load an attacker-controlled DLL into a key executable, leading to execution of attacker-supplied code under the context of SYSTEM on affected installations.

**CVE-2025-69259**:  **Message Unchecked NULL Return Value Denial of Service (DoS) Vulnerability**
_CVSSv3.1: 7.5: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H_

A message unchecked NULL return value vulnerability in Trend Micro Apex Central could allow a remote attacker to create a denial-of-service condition on affected installations.

_Please note: authentication is not required in order to exploit this vulnerability._

**CVE-2025-69260**:  **Message Out-of-bounds Read Denial of Service (DoS) Vulnerability**
_CVSSv3.1: 7.5: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H_

A message out-of-bounds read vulnerability in Trend Micro Apex Central could allow a remote attacker to create a denial-of-service condition on affected installations.

_Please note: authentication is not required in order to exploit this vulnerability._

###
Mitigating Factors

Exploiting these type of vulnerabilities generally require that an attacker has access (physical or remote) to a vulnerable machine. In addition to timely application of patches and updated solutions, customers are also advised to review remote access to critical systems and ensure policies and perimeter security is up-to-date.

However, even though an exploit may require several specific conditions to be met, Trend Micro strongly encourages customers to update to the latest builds as soon as possible.

###
Acknowledgement

Trend Micro would like to thank the following individuals/organizations for responsibly disclosing these issues and working with Trend Micro to help protect our customers:

*   [Tenable](https://www.tenable.com/)


Vulnerabilities in various SAP products

Vulnerabilities in various SAP products.