Week of August 15, 2022: CISA's Zimbra Alert and Apple's Zero-Day Fixes

The week of August 15, 2022 centered on active exploitation of Zimbra Collaboration Suite flagged by CISA and MS-ISAC, two Apple zero-days patched across iOS, iPadOS and macOS, and a fresh batch of CISA Known Exploited Vulnerabilities additions that security teams needed to triage. Disclosures at DigitalOcean, Signal, and Amazon Ring, alongside a first-of-its-kind Cyber Command deployment to Croatia, rounded out a week that kept both patch management and third-party risk squarely on CISO agendas.

CISA and MS-ISAC Warn of Active Zimbra Collaboration Suite Exploitation

CISA and the Multi-State Information Sharing and Analysis Center published a joint advisory on August 16, 2022, warning that threat actors were actively exploiting multiple vulnerabilities in Zimbra Collaboration Suite, a cloud-hosted email and collaboration platform used across government and private-sector networks. The advisory pointed administrators to a companion technical report detailing the exploited CVEs and urged organizations to patch immediately, since attackers could steal email credentials and gain persistent access to unpatched instances. For CISOs running Zimbra, the guidance underscored the value of timely patching and detection of indicators of compromise. (CISA)

CISA Adds Seven Actively Exploited Vulnerabilities to KEV Catalog

On August 18, 2022, CISA added seven vulnerabilities to its Known Exploited Vulnerabilities Catalog after confirming evidence of active exploitation. Under Binding Operational Directive 22-01, federal civilian agencies must remediate catalog entries by CISA's specified deadlines, and the agency urged all organizations to prioritize these fixes as part of routine vulnerability management. The addition reinforced a steady cadence of KEV updates throughout August 2022, giving security teams a fresh set of exploited flaws to track and patch across their environments before attackers could take advantage of unpatched systems. (CISA)

Cisco Patches Privilege Escalation Flaw in Secure Web Appliance

CISA issued an alert on August 18, 2022, flagging security updates from Cisco for its Secure Web Appliance product line. The updates addressed vulnerabilities that a remote attacker could exploit to take control of an affected system, including a privilege escalation flaw highlighted in Cisco's own advisory. CISA pointed administrators toward Cisco's advisory pages for both the higher-severity fix and companion updates addressing lower-severity issues, recommending prompt patching for any organization running the appliance to filter web traffic at the perimeter. (CISA)

DigitalOcean Discloses Customer Exposure From Mailchimp Compromise

DigitalOcean disclosed on August 15, 2022, that a compromise of its Mailchimp account, tied to a broader Mailchimp incident targeting crypto and blockchain customers, had exposed some customer email addresses. The company said its security team discovered the breach after transactional emails stopped arriving and a customer reported an unauthorized password reset. Some reset attempts succeeded, though multi-factor authentication blocked at least one account takeover. DigitalOcean ended its use of Mailchimp, warned customers about possible follow-on phishing, and said it was reviewing default two-factor authentication for all accounts. (Help Net Security)

Ring App Vulnerability Could Have Exposed Camera Recordings

Researchers at Checkmarx disclosed on August 18, 2022, a vulnerability in the Android version of Amazon's Ring app that could have let a malicious app on the same device hijack an authentication token and hardware ID to reach a victim's Ring account through internal APIs. That access could have exposed personal details and stored recordings, including geolocation and address data, and researchers showed how bulk recordings could be analyzed with computer-vision tools. Amazon fixed the flaw in version .51 of the app and said no customer information had been found exposed. (Help Net Security)

U.S. Cyber Command Deploys Hunt Forward Team to Croatia

U.S. Cyber Command disclosed on August 19, 2022, that its Cyber National Mission Force had sent a team of defensive cyber operators to Croatia for the first time, hunting for malicious activity alongside the Croatian Security and Intelligence Agency's Cyber Security Centre on partner networks of national significance. The mission, part of the command's broader hunt-forward program that had by then covered 18 countries and more than 50 foreign networks, was framed as strengthening both allied defenses and U.S. insight into adversary tradecraft threatening shared infrastructure. (Help Net Security)