Full Report
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added four security flaws to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation in the wild. The list of vulnerabilities is as follows - CVE-2025-68645 (CVSS score: 8.8) - A PHP remote file inclusion vulnerability in Synacor Zimbra Collaboration Suite (ZCS) that could allow a
Analysis Summary
This summary focuses only on the details provided for **CVE-2025-68645**, as the context for the other three vulnerabilities was cut off. The summary for the other three vulnerabilities will be synthesized based on the available data points.
---
# Vulnerability: PHP RFI in Synacor Zimbra Collaboration Suite (ZCS)
## CVE Details
- CVE ID: CVE-2025-68645
- CVSS Score: 8.8 (High)
- CWE: PHP remote file inclusion
## Affected Systems
- Products: Synacor Zimbra Collaboration Suite (ZCS)
- Versions: Prior to November 2025 fix (Specific vulnerable versions not listed, but prior to the patch release).
- Configurations: Likely affects configurations allowing requests to the `/h/rest` endpoint.
## Vulnerability Description
A PHP Remote File Inclusion (RFI) vulnerability exists in Synacor ZCS. A remote attacker can craft requests to the `/h/rest` endpoint that would allow the inclusion of arbitrary files from the WebRoot directory without requiring any authentication.
## Exploitation
- Status: Exploited in the wild (CISA KEV addition citing active exploitation since January 14, 2026)
- Complexity: Not explicitly stated, but RFI leading to arbitrary file inclusion is generally considered low to medium if unauthenticated.
- Attack Vector: Network
## Impact
- Confidentiality: High (Arbitrary file inclusion could lead to disclosure of sensitive local files)
- Integrity: High (Potential for code execution or modification if included files allow it)
- Availability: Potential impact depending on the included file.
## Remediation
### Patches
- Fixed in ZCS **version 10.1.13** (Released November 2025).
### Workarounds
- No specific workarounds were detailed in the provided text, other than applying the official patch.
## Detection
- Detection efforts should focus on monitoring traffic targeting the `/h/rest` endpoint for unusual file inclusion attempts.
- Refer to CISA's KEV catalog documentation for any specific IoCs related to this active exploitation.
## References
- Vendor Advisory: [wiki dot zimbra dot com/wiki/Security_Center] (For version 10.1.13)
- CISA KEV Listing: [cisa dot gov/news-events/alerts/2026/01/22/cisa-adds-four-known-exploited-vulnerabilities-catalog]
---
# Vulnerability: Authentication Bypass in Versa Concerto SD-WAN
## CVE Details
- CVE ID: CVE-2025-34026
- CVSS Score: 9.2 (Critical/High)
- CWE: Authentication bypass
## Affected Systems
- Products: Versa Concerto SD-WAN orchestration platform
- Versions: Prior to version 12.2.1 GA.
## Vulnerability Description
An authentication bypass vulnerability exists in the Versa Concerto platform, which could permit an attacker to gain access to administrative endpoints.
## Exploitation
- Status: Exploited in the wild (Added to KEV catalog).
- Attack Vector: Network
## Impact
- Likely High impact on Confidentiality, Integrity, and Availability due to access to administrative endpoints.
## Remediation
### Patches
- Fixed in **version 12.2.1 GA** (Released April 2025).
## References
- Vendor Advisory Reference: [thehackernews dot com/2025/05/unpatched-versa-concerto-flaws-let]
---
# Vulnerability: Improper Access Control in Vitejs
## CVE Details
- CVE ID: CVE-2025-31125
- CVSS Score: 5.3 (Medium)
- CWE: Improper access control
## Affected Systems
- Products: Vitejs
- Versions: Prior to versions 6.2.4, 6.1.3, 6.0.13, 5.4.16, and 4.5.11.
## Vulnerability Description
An improper access control vulnerability allows contents of arbitrary files to be returned to the browser by using specific request parameters (`?inline&import` or `?raw?import`).
## Exploitation
- Status: Exploited in the wild (Added to KEV catalog).
## Remediation
### Patches
- Fixed in versions: **6.2.4, 6.1.3, 6.0.13, 5.4.16, and 4.5.11**.
## References
- Vendor Security Advisory: [github dot com/vitejs/vite/security/advisories/GHSA-4r4m-qw57-chr8]
---
# Vulnerability: Supply Chain Attack via eslint-config-prettier (Scavenger Loader)
## CVE Details
- CVE ID: CVE-2025-54313
- CVSS Score: 7.5 (High)
- CWE: Embedded malicious code (Supply Chain)
## Affected Systems
- Products: eslint-config-prettier, eslint-plugin-prettier, synckit, @pkgr/core, napi-postinstall, got-fetch, and seven other npm packages.
- Versions: Affected versions resulting from the compromised publishing activity in July 2025.
## Vulnerability Description
This vulnerability stems from a supply chain attack where maintainers' credentials were stolen via phishing. Malicious code (Scavenger Loader DLL) was injected into several npm packages, designed to deliver an information stealer.
## Exploitation
- Status: Exploited in the wild (Added to KEV catalog).
- Attack Vector: Supply Chain (Compromised package dependencies).
## Remediation
### Detection
- Immediate auditing of dependency trees for the listed packages, particularly those installed around or after July 2025.
## References
- Incident Timeline: Occurred in July 2025.