Week of October 10, 2022: Patch Tuesday Exploits and Multibillion-Dollar Security M&A

Security leaders faced a crowded Patch Tuesday and confirmed in-the-wild exploitation of critical bugs in FortiOS, Windows, and Zimbra Collaboration, while CISA published twenty-five industrial control systems advisories and added another flaw to its Known Exploited Vulnerabilities Catalog. The week also brought two multibillion-dollar acquisitions in the identity and security-awareness markets, as Thoma Bravo agreed to buy ForgeRock and Vista Equity Partners moved to take KnowBe4 private, alongside a new CEO taking the helm at RSA Conference.

CISA Added New Vulnerability to Known Exploited Vulnerabilities Catalog

On October 11, 2022, CISA added one additional vulnerability to its Known Exploited Vulnerabilities Catalog after determining it showed evidence of active exploitation. The catalog, established under Binding Operational Directive 22-01, requires federal civilian agencies to remediate listed flaws by set deadlines, and CISA urged all organizations to prioritize the same fixes as part of routine vulnerability management. The single addition kept pressure on defenders already juggling multiple October patches across vendor ecosystems. (CISA)

Microsoft's October Patch Tuesday Fixed 85 Flaws, Including an Actively Exploited Windows Bug

Microsoft's October 2022 security release addressed 85 CVE-numbered vulnerabilities, among them CVE-2022-41033, an elevation-of-privilege flaw in the Windows COM+ Event System Service that researchers confirmed was already being exploited. The batch also included a maximum-severity flaw affecting Azure Arc-enabled Kubernetes clusters, critical SharePoint remote-code-execution issues, and fixes for legacy PPTP VPN components. Two Exchange Server zero-days tracked as ProxyNotShell remained unpatched, leaving administrators to rely on Microsoft's interim mitigation guidance while awaiting a full fix. (Help Net Security)

Fortinet Confirmed Active Exploitation of Critical FortiOS Auth-Bypass Flaw

Fortinet confirmed that CVE-2022-40684, a critical authentication-bypass vulnerability affecting FortiOS, FortiProxy, and FortiSwitchManager administrative interfaces, had been exploited in the wild after earlier privately warning customers to patch or mitigate it. The company urged administrators to check devices for a specific indicator of compromise and to upgrade to fixed firmware versions or restrict access to management interfaces. Security researchers reverse-engineered the patch within days, and follow-up reporting through the week described mounting exploitation attempts against exposed FortiGate devices. (Help Net Security)

Attackers Exploited Unpatched Zimbra Collaboration RCE Bug

A still-unpatched remote-code-execution vulnerability in Zimbra Collaboration, tracked as CVE-2022-41352, was found being actively exploited through Zimbra's Amavis antivirus engine, which uses the vulnerable cpio method to scan inbound email. Synacor, the company behind Zimbra, advised administrators to install an alternative pax package and restart servers as a workaround while a permanent patch remained unscheduled. The flaw marked the sixth Zimbra vulnerability exploited by attackers during the year, according to reporting that referenced a CISA alert on the pattern. (Help Net Security)

CISA Published 25 Industrial Control Systems Advisories in a Single Release

CISA released twenty-five Industrial Control Systems advisories on October 13, 2022, covering products from Siemens, Hitachi Energy, and Mitsubishi Electric across sectors including building automation, energy management, and manufacturing controllers. The advisories detailed vulnerabilities and mitigations spanning device families such as SIMATIC, SCALANCE, LOGO!, Desigo, and SICAM, along with updates to previously issued advisories affecting Interniche stack implementations and OPC UA-enabled products. The volume underscored the continuing exposure of operational-technology environments to newly disclosed and legacy flaws. (CISA)

Thoma Bravo Agreed to Acquire Identity Vendor ForgeRock for $2.3 Billion

ForgeRock entered a definitive agreement to be acquired by private equity firm Thoma Bravo in an all-cash deal valued at approximately $2.3 billion, or $23.25 per share, representing roughly a 53 percent premium over ForgeRock's closing price the prior trading day. The transaction, unanimously approved by ForgeRock's board, was expected to close in the first half of 2023 pending shareholder and regulatory approval, after which ForgeRock's identity and access management platform would become privately held rather than publicly traded. (Help Net Security)

Vista Equity Partners Agreed to Take KnowBe4 Private for $4.6 Billion

Security-awareness training vendor KnowBe4 entered a definitive agreement to be acquired by Vista Equity Partners in an all-cash transaction valued at approximately $4.6 billion on an equity-value basis, with stockholders set to receive $24.90 per share. Founder and CEO Stu Sjouwerman described the deal as the next phase of the company's growth. The transaction, unanimously approved by KnowBe4's board and Special Committee, was expected to close in the first half of 2023 subject to stockholder and regulatory approval. (Help Net Security)

Kylie Wright-Ford Began as New CEO of RSA Conference

Kylie Wright-Ford took over as CEO of RSA Conference LLC, bringing prior leadership experience from organizations including World 50 and GLG focused on building professional communities. In a published interview conducted that week, Wright-Ford discussed her priorities for the role, the biggest challenges facing the cybersecurity industry, and where she saw opportunities for RSA Conference to grow as a gathering point for security leaders. The appointment placed new leadership atop one of the industry's most closely watched annual events. (Help Net Security)