CISA Sounds Alarm on Critical Sudo Flaw Actively Exploited in Linux and Unix Systems

Adminer, a popular single-file PHP database management tool, contains a server-side request forgery vulnerability (CWE-918) in versions 4.0.0 through before 4.7.9 when the deployment bundles all database drivers, such as the standard adminer.php file. An unauthenticated remote attacker can influence the database server address that Adminer connects to, causing the server-side PHP process to issue requests to attacker-chosen internal or external hosts and ports. This can be used to enumerate internal services and, as with other recently exploited SSRF flaws (e.g., the Pandoc attacks against AWS IMDS), to steal cloud instance metadata credentials. Anyone running an affected version, whether standalone or via the Debian adminer package, is exposed. The flaw has an EPSS of 90.5% and was added to CISA's Known Exploited Vulnerabilities catalog on 2025-09-29, confirming active exploitation in the wild.

Do: Upgrade Adminer to version 4.7.9 or later; on Debian, install the current security update for the adminer package. If upgrading is not immediately possible, restrict access to adminer.php (IP allowlisting, authentication, or removing it from the web root) and review logs for connections from the web server to internal services or cloud metadata endpoints such as 169.254.169.254. As a KEV entry, US federal agencies must apply the required mitigations or discontinue use per BOD 22-01 guidance.

CVE-2025-10035 is a critical (CVSS 9.8) deserialization-of-untrusted-data flaw (CWE-502) in the License Servlet of Fortra GoAnywhere Managed File Transfer (MFT). It is triggered when the servlet processes a license response carrying a validly forged signature, causing it to deserialize an arbitrary attacker-controlled object; the CVSS vector indicates the attack is network-based and requires no privileges or user interaction. Successful exploitation can lead to command injection (CWE-77), effectively giving an attacker command execution on the MFT server and access to the files and credentials that flow through it. Any organization running GoAnywhere MFT, which is commonly deployed as a central file-transfer hub, is affected, although specific affected/fixed version ranges are not provided in the available data. Exploitation is confirmed in the wild: the flaw was added to CISA's KEV catalog on 2025-09-29 with known ransomware use, Microsoft attributes attacks to the Storm-1175 ransomware affiliate (Medusa, now reportedly replaced by StormEncryptor), and EPSS assigns a 99.8% probability of exploitation within 30 days.

Do: Apply mitigations or patches per Fortra's vendor instructions immediately, as this is a KEV entry carrying BOD 22-01 requirements for federal agencies (patch or discontinue use if mitigations are unavailable). Because a ransomware affiliate (Storm-1175, using Medusa/StormEncryptor) is actively exploiting it, hunt for compromise: review License Servlet traffic and logs for forged license responses, check for unexpected processes or new accounts, and look for signs of lateral movement. Until patched, restrict or remove internet exposure of GoAnywhere MFT admin and license interfaces.

Cisco IOS and IOS XE contain a stack-based buffer overflow (CWE-121) in the Simple Network Management Protocol (SNMP) subsystem. An attacker who can reach the device's SNMP service can send crafted SNMP requests: with a low-privileged SNMP account the attacker can crash the device and force a reload (denial of service), while with a high-privileged SNMP account the attacker can execute arbitrary code as root and take full control of the device. Any organization running Cisco IOS or IOS XE on routers, switches, or controllers is potentially affected, especially where SNMP is enabled or reachable from untrusted networks. The vulnerability was added to CISA's Known Exploited Vulnerabilities catalog on 2025-09-29, confirming exploitation in the wild, and EPSS assigns it a 39.4% probability of exploitation within 30 days (99th percentile). CVSS scoring is not yet available and no public proof-of-concept is known, but defenders should treat the flaw as actively exploited.

Do: Upgrade IOS and IOS XE devices to fixed software releases as specified in Cisco's security advisory; given the KEV listing, federal agencies should follow BOD 22-01 timelines or apply vendor-directed mitigations. As interim mitigation, restrict SNMP access to trusted management hosts using ACLs (and management VRFs where supported), disable SNMP on devices that do not need it, and audit existing SNMP community strings and SNMPv3 users to identify accounts with high privilege levels, which expose the root code-execution path.

Sudo before 1.9.17p1 mishandles the --chroot option: when sudo runs chrooted, it loads /etc/nsswitch.conf from the user-controlled chroot directory rather than the trusted system copy. A local user who can invoke sudo with --chroot can plant a crafted nsswitch.conf (and the NSS libraries it references) in that directory, causing sudo to load untrusted functionality as root. Successful exploitation grants full root privileges on the host, and any Linux deployment running an unpatched sudo is affected, including Ubuntu, Debian, Red Hat Enterprise Linux, SUSE and openSUSE products per the CPE data. The vulnerability is confirmed exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2025-09-29 (ransomware association not yet reported), and EPSS assigns a high 59.4% probability of exploitation within 30 days. Public proof-of-concept references are already available from the researchers who disclosed the flaw.

Do: Upgrade Sudo to 1.9.17p1 or later, or apply your distribution's updated sudo packages (Ubuntu, Debian, Red Hat Enterprise Linux, SUSE and openSUSE have issued patches); the same update also fixes the related local privilege escalation CVE-2025-32462. Until patched, remove or restrict the -R/--chroot option in sudoers policies and identify local users permitted to run sudo with chroot, and audit installed sudo versions across servers and container images. Federal agencies must satisfy the CISA KEV required action, including applicable BOD 22-01 guidance for cloud services.

CVE-2025-59689 is a command injection flaw (CWE-77) in Libraesva Email Security Gateway versions 4.5 through 5.5.x before 5.5.7. It is triggered when the gateway processes a crafted compressed email attachment; per the CVSS vector, no privileges are required but user interaction is involved, and the injection lets an attacker run arbitrary commands with impact that extends beyond the affected component (scope change). Any organization running an affected Libraesva ESG release is in scope, with email security gateways typically sitting in the mail flow and handling untrusted inbound attachments. The flaw is being actively exploited, with public reports attributing exploitation to state-sponsored actors, and CISA added it to the Known Exploited Vulnerabilities catalog on 2025-09-29.

Do: Upgrade to the fixed release for your deployed line: 5.5.7, 5.4.8, 5.2.31, 5.1.20, or 5.0.31. Because the flaw is actively exploited, including by nation-state actors, review gateway logs and compressed-attachment handling for signs of compromise after patching; organizations subject to BOD 22-01 must apply vendor mitigations or discontinue use of the product.