Cyber

What changed

Wazuh Server has been identified with a deserialization of untrusted data vulnerability that poses significant risks. This flaw exists in versions 4.4.0 to 4.9.1, enabling remote code execution if exploited.

• The vulnerability arises from unsafe deserialization of JSON parameters in DistributedAPI.
• Attackers can inject unsanitized data, leading to arbitrary code execution.
• This issue can be triggered by anyone with API access, including compromised servers.

Who is affected

Organizations utilizing Wazuh Server versions between 4.4.0 and 4.9.1 are at risk. This includes various sectors relying on threat detection and response capabilities.

• Wazuh Server users across multiple industries.
• Organizations with compromised dashboards or servers in their Wazuh clusters.
• Any entity using the affected versions without proper security measures.

What to do

Immediate action is required to mitigate the risks associated with this vulnerability. Users should prioritize updating to the latest version of Wazuh Server to ensure protection against potential exploits.

• Upgrade Wazuh Server to version 4.9.1 or later to eliminate the vulnerability.
• Review API access controls to limit exposure to potential attackers.
• Monitor for any suspicious activity that may indicate exploitation attempts.

What changed

A critical vulnerability, identified as CVE-2025-0282, has been discovered in Ivanti's Connect Secure, Policy Secure, and Neurons for Zero Trust Access (ZTA) gateways. This stack-based buffer overflow flaw allows unauthenticated attackers to execute arbitrary code, potentially leading to severe security breaches.

The vulnerability is categorized as a zero-day, meaning it is currently unpatched and poses an immediate risk to affected systems.

Who is affected

Organizations utilizing Ivanti's security solutions are at risk, particularly those relying on the following products:

The vulnerability impacts a wide range of users, including enterprises that have deployed these Ivanti products for secure access and policy enforcement.

• Ivanti Connect Secure (ICS)
• Ivanti Policy Secure (IPS)
• Neurons for Zero Trust Access (ZTA) gateways
• Any organization using these products for network security

What to do

Security teams should prioritize assessing their environments for the presence of Ivanti products and implement immediate measures to mitigate potential exploitation of this vulnerability.

It is crucial to monitor official channels for updates from Ivanti regarding patches or workarounds.

• Conduct an inventory of Ivanti products in use.
• Implement network segmentation to limit exposure.
• Monitor for unusual activity that may indicate exploitation attempts.
• Stay updated with advisories from Ivanti and relevant cybersecurity authorities.