Week of July 18, 2022: Confluence Zero-Day Alert and Oracle's 349-Bug Patch Update

Security leaders tracked an actively exploited flaw in Atlassian's Questions for Confluence App, a 349-vulnerability Oracle Critical Patch Update, and freshly released indicators of compromise from Ukrainian networks shared by U.S. Cyber Command. CISA also updated guidance on continued Log4Shell exploitation in VMware Horizon, warned of six vulnerabilities in the MiCODUS MV720 GPS tracker, and logged routine patch releases from Apple and Cisco.

Atlassian Flags Actively Exploited Confluence Questions App Flaw

Atlassian published a security advisory for CVE-2022-26138, a vulnerability in its Questions for Confluence App that could let an attacker obtain sensitive information. The company's July 20, 2022 advisory stated the flaw was likely to be exploited in the wild, prompting CISA to urge immediate patching. Security teams running Confluence add-ons used the disclosure to prioritize emergency updates during the week, given the active-exploitation warning tied directly to the vulnerable component. (CISA)

Cisco Issues Security Updates Across Multiple Products

Cisco released security updates addressing vulnerabilities across several product lines, with CISA noting some flaws could let a remote attacker take control of an affected system. The advisory, last revised July 22, 2022, pointed users toward Cisco's own advisories page for additional lower-severity fixes. CISOs tracking Cisco infrastructure used the release to schedule patching for affected network and security appliances before attackers could weaponize the disclosed issues. (CISA)

Apple Patches Multiple Products Against Takeover Flaws

Apple shipped security updates for multiple products during the week, addressing vulnerabilities that attackers could exploit to take control of affected systems, according to CISA's July 22, 2022 alert. The agency encouraged administrators to review Apple's releases and apply them without delay. For CISOs managing fleets of Apple devices, the update cycle represented a necessary action item amid a week otherwise dominated by actively exploited third-party software flaws. (CISA)

US Cyber Command Shares Malware Indicators From Ukrainian Networks

U.S. Cyber Command's Cyber National Mission Force, working with Ukraine's Security Service, released indicators of compromise for malware observed on Ukrainian networks, CISA said in a July 21, 2022 alert. The disclosure accompanied a related CISA malware analysis report on a remote access tool with command-and-control capabilities. For CISOs tracking state-aligned threat activity tied to the Ukraine conflict, the IOC release offered concrete detection signatures to feed into monitoring tools. (CISA)

Oracle's July Critical Patch Update Covers 349 Flaws

Oracle issued its Critical Patch Update for July 2022, addressing 349 vulnerabilities spread across its product portfolio, CISA reported on July 21, 2022. Some of the flaws could let a remote attacker take control of an affected system. The scale of the release made it one of the heavier patch cycles of the year, requiring security teams to triage which Oracle databases, middleware, and applications needed urgent remediation first. (CISA)

CISA Warns of Six Flaws in MiCODUS MV720 GPS Tracker

CISA released an Industrial Controls Systems Advisory detailing six vulnerabilities in the MiCODUS MV720 GPS tracker, published July 19, 2022. The agency said successful exploitation could let a remote actor gain control of the tracker, potentially affecting a vehicle's fuel supply, vehicle control, or enabling locational surveillance of vehicles using the device. Fleet operators and connected-vehicle security teams treated the advisory as a reminder to inventory and assess embedded IoT tracking hardware. (CISA)

CISA Refreshes Log4Shell Advisory for VMware Horizon Systems

CISA updated its joint advisory with U.S. Coast Guard Cyber Command on continued exploitation of Log4Shell in VMware Horizon systems, adding new indicators of compromise on July 18, 2022. The agency advised that any affected VMware Horizon or Unified Access Gateway system without promptly applied updates or workarounds should be treated as compromised. The refreshed guidance underscored that Log4Shell-related exposure in VMware environments remained an active risk months after initial disclosure. (CISA)