CISA Updates KEV Catalog with Four Actively Exploited Software Vulnerabilities

CVE-2025-31125 is an improper access control flaw (CWE-284/CWE-200) in the Vite JavaScript frontend tooling's dev server, where HTTP requests using the '?inline&import' or '?raw?import' query parameters can read the contents of files the dev server should not serve, bypassing its file-access restrictions (server.fs.deny). An unauthenticated remote attacker (CVSS:3.1 AV:N/AC:L/PR:N/UI:N) triggers it by sending crafted requests with these query parameters to a running Vite dev server. The attacker gains read access to arbitrary files on the machine running the dev server, such as source code and .env files containing secrets, with high confidentiality impact and no integrity or availability impact. Only applications that explicitly expose the Vite dev server to the network via the --host flag or the server.host option are affected; production builds are not impacted. The flaw is being actively exploited: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-01-22 (ransomware association unknown), and EPSS assigns a 58.5% probability of exploitation within 30 days (99th percentile).

Do: Upgrade Vite to 6.2.4, 6.1.3, 6.0.13, 5.4.16, or 4.5.11 depending on your release line. Until patched, do not expose the dev server to untrusted networks (remove --host/server.host or bind to localhost behind an access-controlled proxy), and review access logs for requests using ?inline&import or ?raw?import that retrieved sensitive files such as .env. As a KEV entry added 2026-01-22, U.S. federal agencies must apply vendor mitigations per BOD 22-01 or discontinue use if mitigations are unavailable.

Versa Concerto, Versa Networks' SD-WAN orchestration and management platform, contains an authentication-bypass flaw (CWE-288) in its Traefik reverse proxy configuration that allows unauthenticated remote attackers to reach administrative endpoints that should require login. The flaw is network-reachable with no privileges or user interaction required, and the internal Actuator endpoint is also reachable, letting attackers pull heap dumps and trace logs that may contain sensitive information. Public research (Project Discovery) demonstrates the bypass can be chained toward remote code execution, and separate Versa Concerto flaws reported publicly have been shown to allow Docker escapes and compromise of the underlying host. Known-affected versions are Concerto 12.1.2 through 12.2.0, with additional versions possibly vulnerable, so any organization running a vulnerable Concerto instance — particularly one exposed to the internet — is at risk. The flaw is confirmed to be exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-01-22, and EPSS assigns an ~82% probability of exploitation within 30 days (100th percentile).

Do: Upgrade Concerto to the fixed release per Versa Networks' security advisory — the known-affected range is 12.1.2 through 12.2.0, but because additional versions may be vulnerable, confirm the patched version with the vendor; U.S. federal agencies must apply these mitigations or discontinue use of the product under BOD 22-01. In the meantime, restrict internet exposure of Concerto portals and its administrative/Actuator endpoints, and review trace logs and any evidence of heap-dump access for signs of unauthenticated administrative requests.

CVE-2025-54313 is a supply chain compromise (CWE-506) of the widely used npm package eslint-config-prettier, in which versions 8.10.1, 9.1.1, 10.1.6, and 10.1.7 contained embedded malicious code, reportedly injected after the maintainer's npm account was hijacked via a phishing campaign. The malicious code triggers automatically: installing any of these versions executes a bundled install.js file that launches the node-gyp.dll malware on Windows systems. An attacker gains code execution with the privileges of the installing user or CI job, carrying high integrity impact per the CVSS score (ability to tamper with code, build outputs, and credentials); public write-ups describe the campaign as dropping malware via hijacked npm linter packages. Affected parties are developers, build/CI pipelines, and downstream projects that installed the compromised versions; CISA identifies the affected product as Prettier's eslint-config-prettier, with related npm packages (eslint-plugin-prettier, synckit, pkgr/core, got-fetch, napi-postinstall, homarr) listed as associated products. The flaw is being actively exploited: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-01-22, and EPSS estimates a 4.3% probability of exploitation in the next 30 days (91st percentile).

Do: Stop using the compromised versions (8.10.1, 9.1.1, 10.1.6, 10.1.7): reinstall a clean release and verify lockfiles and caches do not resolve to the malicious versions. Check any Windows developer machine or CI runner that installed them for a malicious node-gyp.dll payload and rotate credentials and tokens from those environments. Federal agencies must follow the KEV required action: apply vendor mitigations or BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Synacor Zimbra Collaboration Suite (ZCS) contains a PHP remote file inclusion (RFI) flaw (CWE-98) reachable through its /h/rest endpoint. By sending crafted requests to /h/rest, a remote attacker can influence the application's internal request dispatching and cause the server to include arbitrary files from the WebRoot directory, potentially exposing sensitive file content or executing attacker-influenced file content reachable there. An attacker who abuses this flaw may gain information disclosure or further compromise of the ZCS server; the available data does not specify authentication requirements or confirm full remote code execution. Any organization running Zimbra Collaboration Suite, especially internet-facing ZCS email and collaboration servers, is potentially affected, though specific affected version ranges were not provided in the available data. The flaw was added to CISA's Known Exploited Vulnerabilities (KEV) catalog on 2026-01-22, indicating confirmed exploitation in the wild, and EPSS assigns a 49.4% probability of exploitation within 30 days (99th percentile); no public proof-of-concept is known.

Do: Apply the patched ZCS release per Synacor's/Zimbra's advisory (specific patched versions were not provided in the available data) and follow CISA KEV required actions, including applicable BOD 22-01 guidance for federal agencies. Review access logs for crafted or anomalous requests to /h/rest and restrict internet exposure of ZCS endpoints until the patch is deployed. Ransomware association is unknown, so treat exploitation activity as potentially preparatory to broader compromise.