Vulnerability Management
The latest Vulnerability Management coverage — news, analysis, and updates from the WindowsNews.AI desk.
CISA Adds Actively Exploited Trend Micro Apex One Zero-Day to KEV, Mandates Rapid Patching
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2025-54948, a critical command injection vulnerability in Trend Micro’s Apex One on-premises management console, to...
Siemens RTLS Backup Script Vulnerability Allows Full SYSTEM Takeover
A single flawed backup script in Siemens' industrial location tracking software can hand an attacker full SYSTEM-level control of the underlying Windows server. That is the sobering reality of...
CISA Flags 9.3 CVSS Score as Azure RTOS Bugs Expose Rockwell Micro800 PLCs to Remote Code Execution
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) republished an urgent advisory on August 14, 2025, warning that multiple high-severity vulnerabilities in Rockwell Automation's...
Rockwell Automation Patches FactoryTalk Action Manager Vulnerability That Broadcasts API Tokens
Rockwell Automation has confirmed a high-severity information disclosure vulnerability in its FactoryTalk Action Manager software that broadcasts reusable API tokens over local WebSocket channels,...
CISA Sounds Alarm on FactoryTalk Linx Flaw: A Single Env Variable Can Hand Over Full OT Driver Control
Industrial operators running Rockwell Automation’s FactoryTalk Linx have been handed a high‑priority patch order this week. A vulnerability resurfaced by CISA on August 14, 2025, allows any...
CISA Warns: Rockwell ArmorBlock 5000 Flaws Allow Remote Session Hijack, Score Hits 8.8
Two high-severity vulnerabilities in Rockwell Automation’s ArmorBlock 5000 I/O modules allow attackers to hijack web management sessions without credentials, CISA warned on August 14, 2025. The...
Siemens Urges Immediate Patch for SIMATIC RTLS Locating Manager as Two New Flaws Threaten Industrial Operations
Siemens has released an urgent security advisory detailing two newly tracked vulnerabilities in its SIMATIC RTLS Locating Manager, the Windows-based server component that processes ultra-wideband tag...
Microsoft’s August Patches Slam Shut 107+ Holes, Including Public Kerberos Flaw and Critical GDI+ RCE
On August 12, 2025, Microsoft’s monthly Patch Tuesday arrived with a payload heavy enough to keep IT admins working through the night. The security slate covers at least 107 distinct...
Microsoft Patches Publicly Disclosed ‘BadSuccessor’ Kerberos Zero-Day and Exchange Hybrid Cloud Threat in August 2025 Update
Microsoft’s August 2025 security update patches a publicly disclosed Kerberos privilege escalation flaw and a dangerous Exchange hybrid vulnerability that could let attackers hop from on-premises...
CISA, NSA, FBI Release Guidance for OT Asset Inventories to Fortify Critical Infrastructure
On August 13, 2025, the Cybersecurity and Infrastructure Security Agency (CISA) joined forces with the National Security Agency (NSA), the Federal Bureau of Investigation (FBI), the Environmental...
CISA Orders Patching of 2007 Excel Bug, 2013 IE Flaw, and 2025 WinRAR Zero-Day
On August 12, the Cybersecurity and Infrastructure Security Agency (CISA) added three vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog—two of them first disclosed during the...
Microsoft Patches CVE-2025-49736: Android Edge UI Spoofing Bug Allows Credential Theft
Microsoft has released a patch for a UI spoofing vulnerability in its Edge browser for Android, tracked as CVE-2025-49736. The flaw, which Microsoft classifies as allowing an unauthenticated attacker...