U.S. CISA adds MRLG, PHPMailer, Rails Ruby on Rails, and Synacor Zimbra Collaboration Suite flaws to its Known Exploited Vulnerabilities catalog

Multi-Router Looking Glass (MRLG), a web-based tool used by network operators to run public router/BGP looking-glass services, contains a buffer overflow flaw (CWE-119) that can be triggered by remote attackers via crafted input to the network-facing service. The flaw allows arbitrary memory writes and memory corruption, potentially leading to code execution or denial of service under the privileges of the MRLG service. Organizations running reachable MRLG instances — typically ISPs, exchange points, and enterprise network teams exposing looking-glass pages — are affected. CISA added this CVE to the Known Exploited Vulnerabilities catalog on 2025-07-07, indicating confirmed in-the-wild exploitation, though no public proof-of-concept is known. EPSS currently estimates a 29% probability of exploitation within 30 days, placing it in the 98th percentile.

Do: Per the CISA KEV required action, apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable, and follow BOD 22-01 guidance for cloud services; no fixed version is specified in the available data, so check with the maintainer for the latest release. Inventory internet-facing looking-glass pages for MRLG and, where patching is not possible, restrict public access to the service or remove it from exposure.

CVE-2016-10033 is an argument/command injection flaw in the mailSend function of PHPMailer's isMail transport, affecting all PHPMailer releases before 5.2.18. When a crafted Sender (From) address containing a backslash-double-quote sequence is passed to the underlying mail command, extra arguments can be injected, allowing an unauthenticated remote attacker to execute arbitrary code on the hosting server. Because PHPMailer is one of the most widely distributed PHP mail libraries and is bundled with WordPress and Joomla, a very large population of sites and PHP applications is potentially affected, though exploitable deployments are those sending mail via the isMail transport with attacker-influenced sender addresses. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2025-07-07 and EPSS assigns a 99.7% probability of exploitation within 30 days, so active exploitation should be assumed. Ransomware association is currently listed as unknown.

Do: Upgrade PHPMailer to 5.2.18 or later everywhere it is deployed, including bundled copies inside WordPress, Joomla, and other PHP applications, and bring CMS cores current. Audit internet-facing forms, contact handlers, and API endpoints that pass user-supplied email addresses as the Sender/From value, and identify which systems send mail via the isMail transport. Federal agencies must apply vendor mitigations per CISA instructions or follow BOD 22-01 guidance for cloud services; treat exploitation as likely given the KEV listing and 99.7% EPSS.

CVE-2019-5418 is a path traversal vulnerability (CWE-22) in the Action View component of Ruby on Rails. When an application uses calls to 'render file:', a specially crafted Accept header can cause Rails to render arbitrary files on the target server, disclosing their contents to the attacker. Ruby on Rails applications (vendor: Rails) are affected, and the flaw is being actively exploited: it was added to CISA's Known Exploited Vulnerabilities catalog on 2025-07-07 and has a 98.5% EPSS probability of exploitation within 30 days (100th percentile).

Do: Apply mitigations per Rails vendor instructions immediately; organizations subject to BOD 22-01 must follow the applicable guidance for cloud services or discontinue use of the product if mitigations are unavailable. Given the KEV listing and near-certain EPSS probability, prioritize remediation of this issue over routine patch cycles. When scoping impact, review any code paths that combine 'render file:' with user-supplied Accept headers, since this is the pattern that triggers the flaw.

CVE-2019-9621 is a server-side request forgery (SSRF, CWE-918) in the ProxyServlet component of Synacor Zimbra Collaboration Suite, triggerable by an unauthenticated attacker sending crafted HTTP requests to the servlet. By making the Zimbra server issue requests of the attacker's choosing, the attacker can probe or access internal network resources from the server's position, with high confidentiality impact (CVSS 3.1: 7.5, AV:N/PR:N/C:H). Public proof-of-concept code is available, including references that pair the SSRF with an XXE flaw (e.g., a Metasploit module for Zimbra XXE-to-RCE), and Exploit-DB/PacketStorm listings cover both the SSRF and the combined injection chain. Any organization running Zimbra 8.6 before patch 13, 8.7.x before 8.7.11 patch 10, or 8.8.x before 8.8.10 patch 7 / 8.8.11 patch 3 is affected. Exploitation is confirmed in the wild: CISA added the flaw to the KEV catalog on 2025-07-07 due to active exploitation, and related reporting ties Zimbra exploitation to the Earth Lusca threat actor, whose SprySOCKS Linux backdoor has targeted government entities.

Do: Apply Synacor/Zimbra's vendor patches: 8.6.0 patch 13, 8.7.11 patch 10, 8.8.10 patch 7, or 8.8.11 patch 3 (or later) — noting 8.6/8.7 are legacy releases, so plan migration to a supported version; federal agencies must also comply with BOD 22-01. Because EPSS is very high (81%) and active exploitation is confirmed, prioritize internet-facing Zimbra servers first. Hunt for compromise by reviewing logs for unauthenticated requests to the ProxyServlet/autodiscover endpoints, unexpected outbound connections from the Zimbra host, and signs of Linux backdoors such as SprySOCKS on the mail server.