A critical zero-day vulnerability in SonicWall SMA1000 appliances is being actively exploited in targeted attacks. This analysis explains the attack flow, affected environments, and the urgent defensive steps organizations must take to secure their networks.
Microsoft’s November update fixes an exploited Windows Kernel zero-day (CVE-2025-62215) and a critical zero-click GDI+ RCE (CVE-2025-60724). Therefore, prioritize domain controllers, management servers, upload-handling services, and developer workstations using WSLg. Then complete fleet rollout and validate Kerberos delegation settings to blunt identity abuse.
The recently disclosed flaw in LANSCOPE Endpoint Manager (CVE-2025-61932) enables unauthenticated attackers to send malicious packets, execute arbitrary code and compromise systems. Organisations must patch affected versions, apply network controls and monitor for unusual traffic to avoid full network takeover.
Researchers discovered a zero-day in Zimbra webmail where malicious JavaScript injected into .ICS calendar files executes within session context — allowing attackers to steal emails, credentials, and forward mail.