Cisa
The latest Cisa coverage — news, analysis, and updates from the WindowsNews.AI desk.
CISA Flags Actively Exploited Citrix NetScaler CVE-2025-7775, Demands Urgent Patch
The Cybersecurity and Infrastructure Security Agency (CISA) has added a critical Citrix NetScaler vulnerability, tracked as CVE-2025-7775, to its Known Exploited Vulnerabilities (KEV) Catalog after...
CISA Flags Zero-Day in INVT VT-Designer and HMITool: Remote Code Execution via Malicious Files
A zero-day vulnerability in INVT's VT-Designer and HMITool engineering software lets attackers run arbitrary code on industrial control system (ICS) workstations simply by tricking a user into...
Schneider Electric Issues Emergency Firmware Fix for M340 PLC DoS Flaw (CVE-2025-6625)
Schneider Electric has released firmware updates to address a high-severity denial-of-service vulnerability in its Modicon M340 programmable logic controllers and associated communication modules....
CISA Flags Urgent Patches for Exploited Citrix Session Recording and Git Flaws
The Cybersecurity and Infrastructure Security Agency (CISA) added three vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog on August 25, 2025, signaling active exploitation of flaws...
Microsoft and CISA Demand Hybrid Exchange Overhaul: October 31 Permanent Cutoff After Vulnerability Alert
Microsoft has drawn a hard line in the sand for hybrid Exchange administrators: after October 31, 2025, any on-premises server still relying on the legacy shared service principal for rich...
CISA Unveils SBOM Draft Requiring Hashes, Licenses, and Build Context—Public Comment Opens
The Cybersecurity and Infrastructure Security Agency (CISA) released a draft update to its Software Bill of Materials (SBOM) minimum elements on August 22, 2025, immediately opening a public comment...
CISA Alerts Federal Agencies and Enterprises to Apple Image I/O Zero-Day Under Active Exploit
The Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2025-43300 to its Known Exploited Vulnerabilities (KEV) Catalog on August 21, 2025, triggering a mandatory patch sprint for...
CISA's Triple Threat: Mitsubishi HVAC 9.8, Unpatched MELSEC DoS, and Fujifilm Privilege Escalation
Mitsubishi Electric’s air conditioning controllers face a critical authentication bypass with a CVSS severity score of 9.8, leading a trio of industrial control system (ICS) and medical device...
Mitsubishi Electric Confirms Unpatched DoS Flaw in MELSEC iQ-F PLCs, Recommends Network Hardening
Mitsubishi Electric has disclosed a remotely exploitable denial-of-service vulnerability in the embedded web server of its MELSEC iQ-F series programmable logic controllers, tracked under an internal...
Fujifilm Medical Viewer Flaw Allows Unauthorized Access to Patient Scans — CISA Calls for Immediate Upgrade
A severe privilege-escalation vulnerability in FUJIFILM Healthcare Americas’ Synapse Mobility medical imaging viewer could allow remote attackers to bypass role-based access controls and view...
CISA's August 19 ICS Alert: Siemens Desigo CC SAML Bypass, Tigo Hardcoded Credentials, and EG4 Inverter Firmware Risks Exposed
Four industrial control system advisories released by CISA on August 19, 2025, pack an urgent punch for critical infrastructure operators, exposing dangerous flaws across building management...
CISA Adds Actively Exploited Trend Micro Apex One Zero-Day to KEV, Mandates Rapid Patching
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2025-54948, a critical command injection vulnerability in Trend Micro’s Apex One on-premises management console, to...