CISA Adds Four Critical Vulnerabilities to KEV Catalog Due to Active Exploitation

Multi-Router Looking Glass (MRLG), a web-based tool used by network operators to run public router/BGP looking-glass services, contains a buffer overflow flaw (CWE-119) that can be triggered by remote attackers via crafted input to the network-facing service. The flaw allows arbitrary memory writes and memory corruption, potentially leading to code execution or denial of service under the privileges of the MRLG service. Organizations running reachable MRLG instances — typically ISPs, exchange points, and enterprise network teams exposing looking-glass pages — are affected. CISA added this CVE to the Known Exploited Vulnerabilities catalog on 2025-07-07, indicating confirmed in-the-wild exploitation, though no public proof-of-concept is known. EPSS currently estimates a 29% probability of exploitation within 30 days, placing it in the 98th percentile.

Do: Per the CISA KEV required action, apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable, and follow BOD 22-01 guidance for cloud services; no fixed version is specified in the available data, so check with the maintainer for the latest release. Inventory internet-facing looking-glass pages for MRLG and, where patching is not possible, restrict public access to the service or remove it from exposure.

CVE-2016-10033 is an argument/command injection flaw in the mailSend function of PHPMailer's isMail transport, affecting all PHPMailer releases before 5.2.18. When a crafted Sender (From) address containing a backslash-double-quote sequence is passed to the underlying mail command, extra arguments can be injected, allowing an unauthenticated remote attacker to execute arbitrary code on the hosting server. Because PHPMailer is one of the most widely distributed PHP mail libraries and is bundled with WordPress and Joomla, a very large population of sites and PHP applications is potentially affected, though exploitable deployments are those sending mail via the isMail transport with attacker-influenced sender addresses. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2025-07-07 and EPSS assigns a 99.7% probability of exploitation within 30 days, so active exploitation should be assumed. Ransomware association is currently listed as unknown.

Do: Upgrade PHPMailer to 5.2.18 or later everywhere it is deployed, including bundled copies inside WordPress, Joomla, and other PHP applications, and bring CMS cores current. Audit internet-facing forms, contact handlers, and API endpoints that pass user-supplied email addresses as the Sender/From value, and identify which systems send mail via the isMail transport. Federal agencies must apply vendor mitigations per CISA instructions or follow BOD 22-01 guidance for cloud services; treat exploitation as likely given the KEV listing and 99.7% EPSS.

CVE-2019-5418 is a path traversal vulnerability (CWE-22) in the Action View component of Ruby on Rails. When an application uses calls to 'render file:', a specially crafted Accept header can cause Rails to render arbitrary files on the target server, disclosing their contents to the attacker. Ruby on Rails applications (vendor: Rails) are affected, and the flaw is being actively exploited: it was added to CISA's Known Exploited Vulnerabilities catalog on 2025-07-07 and has a 98.5% EPSS probability of exploitation within 30 days (100th percentile).

Do: Apply mitigations per Rails vendor instructions immediately; organizations subject to BOD 22-01 must follow the applicable guidance for cloud services or discontinue use of the product if mitigations are unavailable. Given the KEV listing and near-certain EPSS probability, prioritize remediation of this issue over routine patch cycles. When scoping impact, review any code paths that combine 'render file:' with user-supplied Accept headers, since this is the pattern that triggers the flaw.

CVE-2019-9621 is a server-side request forgery (SSRF, CWE-918) in the ProxyServlet component of Synacor Zimbra Collaboration Suite, triggerable by an unauthenticated attacker sending crafted HTTP requests to the servlet. By making the Zimbra server issue requests of the attacker's choosing, the attacker can probe or access internal network resources from the server's position, with high confidentiality impact (CVSS 3.1: 7.5, AV:N/PR:N/C:H). Public proof-of-concept code is available, including references that pair the SSRF with an XXE flaw (e.g., a Metasploit module for Zimbra XXE-to-RCE), and Exploit-DB/PacketStorm listings cover both the SSRF and the combined injection chain. Any organization running Zimbra 8.6 before patch 13, 8.7.x before 8.7.11 patch 10, or 8.8.x before 8.8.10 patch 7 / 8.8.11 patch 3 is affected. Exploitation is confirmed in the wild: CISA added the flaw to the KEV catalog on 2025-07-07 due to active exploitation, and related reporting ties Zimbra exploitation to the Earth Lusca threat actor, whose SprySOCKS Linux backdoor has targeted government entities.

Do: Apply Synacor/Zimbra's vendor patches: 8.6.0 patch 13, 8.7.11 patch 10, 8.8.10 patch 7, or 8.8.11 patch 3 (or later) — noting 8.6/8.7 are legacy releases, so plan migration to a supported version; federal agencies must also comply with BOD 22-01. Because EPSS is very high (81%) and active exploitation is confirmed, prioritize internet-facing Zimbra servers first. Hunt for compromise by reviewing logs for unauthenticated requests to the ProxyServlet/autodiscover endpoints, unexpected outbound connections from the Zimbra host, and signs of Linux backdoors such as SprySOCKS on the mail server.

Citrix NetScaler ADC and NetScaler Gateway contain an out-of-bounds read (CWE-125) caused by insufficient input validation, which can cause the appliance to read beyond the intended memory buffer (a memory overread). The flaw is only triggerable when the appliance is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, or RDP Proxy) or as an AAA virtual server, so attackers who can reach those services can potentially induce the overread and obtain sensitive memory contents. Such disclosure could aid follow-on compromise, for example by exposing session or authentication data, and CISA notes known ransomware use. Organizations running NetScaler ADC or NetScaler Gateway in the affected Gateway/AAA configurations are exposed. The vulnerability was added to CISA's Known Exploited Vulnerabilities catalog on 2025-07-10 with known ransomware use and an EPSS of 100% (100th percentile), indicating active exploitation, while no public PoC is known and a CVSS score has not yet been assigned.

Do: Apply the fixed NetScaler ADC/Gateway builds per Citrix's security advisory (exact affected/fixed version ranges are not in the available data, so consult the bulletin); per CISA KEV, apply vendor mitigations, follow BOD 22-01 guidance for cloud services, or discontinue use if mitigations are unavailable. Inventory appliances for Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server configurations, since unconfigured/other deployments are not triggerable. After patching, terminate active and idle VPN sessions and hunt for anomalous access, given the known ransomware exploitation and the information-disclosure nature of the flaw.

Citrix NetScaler ADC and NetScaler Gateway appliances contain a memory buffer overflow (CWE-119) that can lead to unintended control flow and denial of service. The flaw is only reachable when the appliance is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, or RDP Proxy) or as an AAA virtual server, and it is network-exploitable without authentication or user interaction, though attack complexity is rated high. A successful attacker could achieve unintended control flow — with the CVSS 4.0 vector rating impact high across confidentiality, integrity, and availability — or crash the appliance, disrupting VPN access and application delivery. Any organization running NetScaler ADC or NetScaler Gateway in an affected Gateway/AAA configuration is exposed, a population that public scan data places in the tens of thousands of internet-exposed devices. The vulnerability was added to CISA's KEV catalog on 2025-06-30, confirming exploitation in the wild, with EPSS at 10.1% and no public proof-of-concept known.

Do: Apply the patched NetScaler release specified in Citrix's security bulletin for CVE-2025-6543 immediately, prioritizing appliances in Gateway or AAA configurations, per CISA KEV and BOD 22-01 requirements. Audit which virtual servers (VPN, ICA Proxy, CVPN, RDP Proxy, AAA) are in use and whether they are internet-exposed, and check appliances for signs of compromise before and after upgrading.