BadSuccessor Vulnerability in Windows Server 2025 Allows AD User Impersonation

A critical privilege escalation issue, known as the BadSuccessor vulnerability in Windows Server 2025, poses a significant threat to Active Directory (AD) environments. This flaw exploits the newly introduced delegated Managed Service Accounts (dMSAs) feature, enabling attackers to impersonate any AD user, including domain administrators, without altering existing accounts or group memberships. Understanding the BadSuccessor …

BadSuccessor Vulnerability in Windows Server 2025 Allows AD User Impersonation Read More »

VMware vCenter Server Command Execution Vulnerability poster

Authenticated Command Execution Flaw in VMware vCenter Server (CVE-2025-41225)

A critical vulnerability in VMware vCenter Server has been disclosed by VMware. Tracked as CVE-2025-41225, the flaw allows authenticated users to execute arbitrary system commands by leveraging the alarm script feature. The issue is classified as high severity and affects multiple VMware platforms. Vulnerability Summary: The VMware vCenter Server command execution vulnerability is caused by …

Authenticated Command Execution Flaw in VMware vCenter Server (CVE-2025-41225) Read More »

FortiOS Authentication Bypass Poster

Authentication Bypass in FortiOS Affects TACACS+ Configurations

FortiOS authentication bypass vulnerabilities can expose critical infrastructure to administrative compromise. A newly disclosed flaw, CVE-2025-22252, affects multiple Fortinet products configured to use TACACS+ with ASCII authentication. The issue allows attackers to bypass login mechanisms and gain privileged access, putting entire network environments at risk. Vulnerability Summary Affected Products and Versions Fortinet confirms the following …

Authentication Bypass in FortiOS Affects TACACS+ Configurations Read More »

Windows RDP Buffer Overflow Poster poster

Windows RDP Buffer Overflow Enables Remote Code Execution

Microsoft’s May 2025 Patch Tuesday addressed two critical Windows RDP Buffer Overflow vulnerabilities, identified as CVE-2025-29966 and CVE-2025-29967. Both enable remote code execution over the network through heap memory corruption. Both flaws are classified under CWE-122: Heap-based Buffer Overflow. Affected Components The vulnerabilities exist across multiple Windows OS versions that support RDP, including client and …

Windows RDP Buffer Overflow Enables Remote Code Execution Read More »

F5 BIG-IP Command Injection via iControl REST

F5 BIG-IP Command Injection Exploit Targets iControl REST and tmsh

F5 has disclosed a high-severity F5 BIG-IP command injection vulnerability identified as CVE-2025-31644, affecting BIG-IP systems operating in Appliance mode. The flaw allows authenticated administrators to execute arbitrary system commands with root privileges. Vulnerability Summary The vulnerability stems from improper input handling in an undisclosed iControl REST API endpoint and the “save” command in TMOS …

F5 BIG-IP Command Injection Exploit Targets iControl REST and tmsh Read More »

VMware Tools File Tampering Vulnerability in VMs

VMware Tools File Tampering Vulnerability Affects Guest VMs

CVE-2025-22247 is a moderate-severity vulnerability in VMware Tools affecting versions 11.x.x and 12.x.x on Windows and Linux. It enables low-privileged users within a guest virtual machine to tamper with local files, triggering insecure file operations. macOS is not affected. Vulnerability Summary The flaw resides in the way VMware Tools handles file operations initiated from within …

VMware Tools File Tampering Vulnerability Affects Guest VMs Read More »

CVE-2025-20188 Vulnerability in Cisco IOS XE

Cisco Fixes CVE-2025-20188 vulnerability in Cisco IOS XE Allowing Root Access via JWT

Cisco has released a patch for CVE-2025-20188, a critical vulnerability (CVSS 10.0) in IOS XE Wireless Controller software. The flaw allows unauthenticated remote attackers to upload arbitrary files and execute commands with root-level privileges. The root cause is a hard-coded JSON Web Token (JWT) embedded in affected systems. Attackers can exploit this by sending crafted …

Cisco Fixes CVE-2025-20188 vulnerability in Cisco IOS XE Allowing Root Access via JWT Read More »

NorDef SLA Feature for Vulnerability Tracking

Introducing the NorDef SLA Feature for Pentest Vulnerability Tracking

When managing Pentest vulnerabilities, time is always of the essence. Effective vulnerability management is more than just identifying risks; it’s about timely remediation to protect your organization from potential threats. To achieve this, teams require clear deadlines, transparency, and accountability—something traditional penetration testing methods often lack. In response to these challenges, we are excited to …

Introducing the NorDef SLA Feature for Pentest Vulnerability Tracking Read More »

Active Directory privilege escalation vulnerability

Microsoft Patches Active Directory Privilege Escalation Vulnerability

Microsoft has patched a privilege escalation vulnerability in Active Directory Domain Services, identified as CVE-2025-29810, during the April 2025 Patch Tuesday release. Technical Overview The vulnerability is caused by improper access control in Windows Active Directory Domain Services and falls under CWE-284: Improper Access Control. An authenticated attacker with low-level privileges on a domain-joined system …

Microsoft Patches Active Directory Privilege Escalation Vulnerability Read More »

CVE-2025-23120 Veeam Backup Vulnerability

CVE-2025-23120 Veeam Backup Vulnerability Allows Remote Code Execution

A critical security vulnerability, identified as CVE-2025-23120, affects Veeam Backup & Replication versions up to 12.3.0.310. This flaw allows authenticated domain users to execute arbitrary code remotely on domain-joined backup servers. Technical Details: Affected Versions: Impacted Systems: Mitigation: The vulnerability is patched in Veeam Backup & Replication 12.3.1 (build 12.3.1.1139). Users are advised to upgrade …

CVE-2025-23120 Veeam Backup Vulnerability Allows Remote Code Execution Read More »