CISA Adds Citrix and Git Vulnerabilities to KEV Catalog
Summary
Hide β²
Show βΌ
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added three vulnerabilities affecting Citrix Session Recording and Git to the Known Exploited Vulnerabilities (KEV) catalog. The vulnerabilities are actively exploited in the wild. The flaws include improper privilege management, deserialization of untrusted data, and link following vulnerabilities. The affected products have patches available. Federal agencies must apply mitigations by September 15, 2025. The vulnerabilities are CVE-2024-8068, CVE-2024-8069, and CVE-2025-48384. The first two affect Citrix Session Recording, while the third impacts Git. The Citrix vulnerabilities allow for privilege escalation and limited remote code execution. The Git vulnerability enables arbitrary code execution. The Git flaw affects macOS and Linux systems, not Windows. The flaw in Git arises from inconsistent handling of carriage return (CR) characters in configuration files, leading to arbitrary code execution.
Timeline
-
26.08.2025 08:55 π° 2 articles
CISA Adds Citrix and Git Vulnerabilities to KEV Catalog
CISA added three vulnerabilities affecting Citrix Session Recording and Git to the KEV catalog due to active exploitation. The vulnerabilities include improper privilege management, deserialization of untrusted data, and link following flaws. Patches are available, and federal agencies must apply mitigations by September 15, 2025. The Git vulnerability CVE-2025-48384 affects macOS and Linux systems, not Windows. The flaw arises from inconsistent handling of carriage return (CR) characters in configuration files, leading to arbitrary code execution. The vulnerability can be exploited by creating malicious repositories that, when cloned, lead to remote code execution. The Git flaw affects software developers using Git on workstations and vulnerable Git versions in CI/CD build systems. The flaw was resolved in versions 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.1.
Show sources
- CISA Adds Three Exploited Vulnerabilities to KEV Catalog Affecting Citrix and Git β thehackernews.com β 26.08.2025 08:55
- Organizations Warned of Exploited Git Vulnerability β www.securityweek.com β 26.08.2025 11:08
Information Snippets
-
CVE-2024-8068 is an improper privilege management vulnerability in Citrix Session Recording, allowing privilege escalation to NetworkService Account access for authenticated users in the same Windows Active Directory domain.
First reported: 26.08.2025 08:55π° 2 sources, 2 articlesShow sources
- CISA Adds Three Exploited Vulnerabilities to KEV Catalog Affecting Citrix and Git β thehackernews.com β 26.08.2025 08:55
- Organizations Warned of Exploited Git Vulnerability β www.securityweek.com β 26.08.2025 11:08
-
CVE-2024-8069 is a deserialization of untrusted data vulnerability in Citrix Session Recording, enabling limited remote code execution with NetworkService Account privileges for authenticated users on the same intranet.
First reported: 26.08.2025 08:55π° 2 sources, 2 articlesShow sources
- CISA Adds Three Exploited Vulnerabilities to KEV Catalog Affecting Citrix and Git β thehackernews.com β 26.08.2025 08:55
- Organizations Warned of Exploited Git Vulnerability β www.securityweek.com β 26.08.2025 11:08
-
CVE-2025-48384 is a link following vulnerability in Git, arising from inconsistent handling of carriage return (CR) characters in configuration files, leading to arbitrary code execution.
First reported: 26.08.2025 08:55π° 2 sources, 2 articlesShow sources
- CISA Adds Three Exploited Vulnerabilities to KEV Catalog Affecting Citrix and Git β thehackernews.com β 26.08.2025 08:55
- Organizations Warned of Exploited Git Vulnerability β www.securityweek.com β 26.08.2025 11:08
-
Both Citrix flaws were patched in November 2024 following responsible disclosure by watchTowr Labs on July 14, 2024.
First reported: 26.08.2025 08:55π° 1 source, 1 articleShow sources
- CISA Adds Three Exploited Vulnerabilities to KEV Catalog Affecting Citrix and Git β thehackernews.com β 26.08.2025 08:55
-
CVE-2025-48384 was addressed by the Git project in July 2025, with a proof-of-concept exploit released by Datadog.
First reported: 26.08.2025 08:55π° 2 sources, 2 articlesShow sources
- CISA Adds Three Exploited Vulnerabilities to KEV Catalog Affecting Citrix and Git β thehackernews.com β 26.08.2025 08:55
- Organizations Warned of Exploited Git Vulnerability β www.securityweek.com β 26.08.2025 11:08
-
Federal Civilian Executive Branch (FCEB) agencies must apply mitigations by September 15, 2025, to secure their networks against active threats.
First reported: 26.08.2025 08:55π° 2 sources, 2 articlesShow sources
- CISA Adds Three Exploited Vulnerabilities to KEV Catalog Affecting Citrix and Git β thehackernews.com β 26.08.2025 08:55
- Organizations Warned of Exploited Git Vulnerability β www.securityweek.com β 26.08.2025 11:08
Similar Happenings
CVE-2025-5086 in DELMIA Apriso Exploited in the Wild
A critical deserialization vulnerability (CVE-2025-5086) in Dassault Systèmes DELMIA Apriso Manufacturing Operations Management (MOM) software is being actively exploited. The flaw, with a CVSS score of 9.0, affects versions from Release 2020 through Release 2025. The vulnerability allows for remote code execution, and exploitation attempts have been observed originating from an IP address in Mexico. The attacks involve sending a malicious HTTP request with a Base64-encoded payload. The payload decodes to a Windows executable identified as "Trojan.MSIL.Zapchast.gen," a spyware capable of capturing user activities and sending collected information to attackers. DELMIA Apriso is used in production processes for digitalizing and monitoring, including scheduling production, quality management, resource allocation, warehouse management, and integration between production equipment and business applications. The flaw impacts critical industries such as automotive, aerospace, electronics, high-tech, and industrial machinery. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the vulnerability to the Known Exploited Vulnerabilities (KEV) catalog and is advising federal agencies to apply necessary updates by October 2, 2025.
Akira Ransomware Exploits SonicWall SSL VPN Flaws and Misconfigurations
The Akira ransomware group has been actively exploiting vulnerabilities and misconfigurations in SonicWall SSL VPN devices to gain initial access to networks. This campaign has seen increased activity since late July 2025, targeting organizations globally, including those in Australia. The attacks leverage a year-old flaw (CVE-2024-40766) and misconfigured LDAP settings to bypass access controls and facilitate ransomware deployment. The threat actors use a combination of brute-forcing credentials, exploiting default configurations, and leveraging the Virtual Office Portal to configure multi-factor authentication (MFA) with valid accounts. These tactics allow them to bypass security measures and gain unauthorized access to networks. SonicWall has confirmed that recent SSLVPN activity is related to CVE-2024-40766, not a zero-day vulnerability. The affected firewall versions include specific models of Gen 5, Gen 6, and Gen 7 devices. Organizations are advised to update to firmware version 7.3.0 or later, rotate passwords, enforce MFA, mitigate the SSLVPN Default Groups risk, and restrict Virtual Office Portal access to trusted/internal networks to mitigate risks.
Cursor AI editor autoruns malicious code in repositories
A flaw in the Cursor AI editor allows malicious code in repositories to autorun on developer devices. This vulnerability can lead to malware execution, environment hijacking, and credential theft. The issue arises from Cursor disabling the Workspace Trust feature from VS Code, which prevents automatic task execution without explicit user consent. The flaw affects one million users who generate over a billion lines of code daily. The Cursor team has decided not to fix the issue, citing the need to maintain AI and other features. They recommend users enable Workspace Trust manually or use basic text editors for unknown projects. The flaw is part of a broader trend of prompt injections and jailbreaks affecting AI-powered coding tools.
Critical SessionReaper vulnerability patched in Adobe Commerce and Magento Open Source
Adobe has patched a critical vulnerability (CVE-2025-54236) in its Commerce and Magento Open Source platforms, dubbed SessionReaper. This flaw, with a CVSS score of 9.1, could allow unauthenticated attackers to take control of customer accounts via the Commerce REST API. The patch was released on September 9, 2025, following an emergency notification to selected customers on September 4, 2025. Adobe Commerce on Cloud customers were already protected by a WAF rule deployed as an interim measure. The vulnerability is considered one of the most severe in the platform's history, with potential for widespread exploitation. Administrators are advised to apply the patch immediately, as it disables certain internal Magento functionalities that may affect custom or external code. The affected versions include Adobe Commerce 2.4.9-alpha2 and earlier, 2.4.8-p2 and earlier, 2.4.7-p7 and earlier, 2.4.6-p12 and earlier, 2.4.5-p14 and earlier, and 2.4.4-p15 and earlier. The affected versions also include Adobe Commerce B2B 1.5.3-alpha2 and earlier, 1.5.2-p2 and earlier, 1.4.2-p7 and earlier, 1.3.4-p14 and earlier, and 1.3.3-p15 and earlier. The affected versions include Magento Open Source 2.4.9-alpha2 and earlier, 2.4.8-p2 and earlier, 2.4.7-p7 and earlier, 2.4.6-p12 and earlier, and 2.4.5-p14 and earlier. The Custom Attributes Serializable module versions 0.1.0 to 0.4.0 are also affected.
Critical SAP NetWeaver Command Execution Vulnerabilities Patched
SAP has patched three critical vulnerabilities in NetWeaver, its middleware for business applications. The most severe flaw, CVE-2025-42944, allows unauthenticated attackers to execute arbitrary OS commands via insecure deserialization. Two other critical issues, CVE-2025-42922 and CVE-2025-42958, enable authenticated users to upload arbitrary files and unauthorized users to access administrative functions. These vulnerabilities affect SAP's ERP, CRM, SRM, and SCM applications, widely used in large enterprise networks. The patches come amid ongoing exploitation of another critical SAP vulnerability, CVE-2025-42957, which affects S/4HANA, Business One, and NetWeaver products. SAP released 21 new and four updated security notes on September 2025 patch day, including updates for NetWeaver AS ABAP and other SAP products. SAP has also released a patch for a high-severity missing input validation bug in SAP S/4HANA (CVE-2025-42916, CVSS score: 8.1).