In this week's Security Advisory:
Fortinet has released multiple advisories detailing eighteen new vulnerabilities affecting various products, eight of which are high severity. Some of the high-severity vulnerabilities include an XSS flaw, remote code execution, privilege escalation, and sensitive data exposure. The medium-severity vulnerabilities can lead to the following as well; code execution, command execution, arbitrary file writing, and bypassing web firewall protections. Fortinet stated that most of these vulnerabilities were found internally and have not seen any evidence of exploitation in the wild.
Affected Versions
More Reading/Information
Microsoft announced patches for fifty-seven vulnerabilities, including six zero-day vulnerabilities, all of which are being exploited in the wild. The vulnerabilities in total can lead to remote code execution, privilege escalation, denial of service, spoofing, and feature bypasses. It is essential to make these vulnerabilities a priority to patch.
Affected Versions
More Reading/Information
Apple released a patch for CVE-2025-24201 this week. This zero-day vulnerability affects the WebKit web browser engine component. This allows a threat actor to craft malicious web content such that it can break out of the Web Content sandbox. This vulnerability has been exploited against users with earlier iOS versions.
Affected Versions
More Reading/Information
Google Chrome announced patches with an updated browser version, which has addressed fourteen new vulnerabilities. Successful exploitation of these can lead to code execution.
Adobe has released patches for thirty-five vulnerabilities in different products. Multiple vulnerabilities were flagged as critical, and it was warned that successful exploitation could lead to arbitrary code execution and memory leaks.
Zoom released patches for five new vulnerabilities. Three of these can be exploited by an authenticated attacker to escalate privilege via network access.
More Reading/Information
Please review your environment to ensure the above-mentioned issues are patched in a timely manner. It is security best practice to regularly update and/or patch software to the latest versions. The vulnerabilities above highlight the security benefits of limiting deployed software to "vendor-supported versions" only. This dramatically increases the likelihood that new vulnerabilities have a patch issued for them. Likewise, Cybersafe strongly encourages maintaining an inventory of current software in your environment, which helps ensure and inform your patch and vulnerability management program.