Week of July 29, 2024: VMware ESXi KEV Addition and Azure DDoS Outage

Security leaders watched CISA add an actively exploited VMware ESXi authentication bypass to its Known Exploited Vulnerabilities Catalog, DigiCert force a mass TLS certificate revocation, and a DDoS attack knock Azure and Microsoft 365 services offline for hours. The week also brought fresh SEC disclosures from Meta Materials and Cencora on cyber incidents, Apple's rollout of security updates across its product line, and CISA's naming of its first Chief Artificial Intelligence Officer.

CISA Adds Actively Exploited VMware ESXi Flaw to KEV Catalog

On July 30, 2024, CISA added CVE-2024-37085, an authentication bypass vulnerability affecting VMware ESXi, to its Known Exploited Vulnerabilities Catalog after confirming active exploitation. The flaw let attackers who had compromised Active Directory domain credentials gain full administrative control over ESXi hypervisors by creating or renaming a group called "ESX Admins." Ransomware operators tracked under names including Storm-0506 and Octo Tempest used the bug to encrypt virtual machines en masse. Federal civilian agencies were required to remediate the vulnerability under Binding Operational Directive 22-01. (CISA)

CISA Flags ServiceNow and Acronis Bugs as Actively Exploited

On July 29, 2024, CISA added three vulnerabilities to its Known Exploited Vulnerabilities Catalog: CVE-2024-4879 and CVE-2024-5217, both affecting ServiceNow's Now Platform, and CVE-2023-45249, an insecure default password flaw in Acronis Cyber Infrastructure. The ServiceNow issues stemmed from improper input validation and an incomplete list of disallowed inputs, while the Acronis flaw allowed remote attackers to bypass authentication on unpatched servers. Federal civilian agencies were directed to remediate the vulnerabilities under Binding Operational Directive 22-01 given evidence of ongoing exploitation. (CISA)

DigiCert Forced Mass TLS Certificate Revocation Over DCV Compliance Gap

On July 30, 2024, DigiCert began revoking a subset of TLS certificates after identifying a non-compliance issue with domain control verification, warning that websites and services relying on them could face temporary disruption. CISA urged affected customers to check their DigiCert accounts and reissue or rekey certificates before the deadline, which was later extended to 3:30 p.m. EDT on July 31, 2024. The incident forced security teams at many organizations to scramble on short notice to avoid outages tied to certificate validity. (CISA)

Apple Patches Safari, iOS, macOS and More Against Exploitable Flaws

On July 30, 2024, Apple released security updates spanning Safari 17.6, iOS and iPadOS 17.6 and 16.7.9, macOS Sonoma 14.6, Ventura 13.6.8 and Monterey 12.7.6, watchOS 10.6, tvOS 17.6, and visionOS 1.3. CISA said a cyber threat actor could exploit some of the addressed vulnerabilities to take control of an affected system and encouraged users and administrators to apply the updates promptly across the full range of impacted Apple products and platforms. (CISA)

CISA Names Lisa Einstein as Its First Chief AI Officer

On August 1, 2024, CISA announced Lisa Einstein as its first Chief Artificial Intelligence Officer, a new role meant to institutionalize how the agency governs its own AI use and supports critical infrastructure owners adopting AI safely. Einstein had led CISA's AI efforts since 2023 as Senior Advisor for AI and had served since 2022 as Executive Director of the CISA Cybersecurity Advisory Committee. CISA Director Jen Easterly said the position would help build AI expertise into the agency's work. (CISA)

Meta Materials Discloses IT Disruption Tied to Website Deactivation

Meta Materials disclosed in a Form 8-K that on July 25, 2024 its website, email, and related IT systems were significantly disrupted and taken offline. The company said a former executive officer deliberately deactivated and cancelled the renewal of its website, cutting off email communications with customers and investors until systems were reactivated on July 29, 2024. Meta Materials said it had not determined whether the incident would materially affect its financial condition and continued investigating unauthorized access to sensitive data. (SEC EDGAR)

Cencora Updates SEC Filing on Scope of February Data Exfiltration

Cencora filed an amended Form 8-K on July 31, 2024 updating its earlier disclosure of a February 2024 data exfiltration incident, stating its investigation had identified additional exfiltrated data beyond what was first reported. The company said the newly reviewed data included personal and protected health information, most of it tied to a subsidiary providing patient support services, and that it had issued required notifications to affected parties and regulators. Cencora said it did not believe the incident was reasonably likely to materially affect its financial results. (SEC EDGAR)

DDoS Attack and Defense Error Knock Azure and Microsoft 365 Offline

Microsoft confirmed that a distributed denial-of-service attack beginning July 30, 2024 made Azure App Services, the Azure portal, and several Microsoft 365 and Purview services temporarily inaccessible for a subset of customers between roughly 11:45 and 19:43 UTC. An unexpected traffic spike overwhelmed Azure Front Door and Azure CDN components, and Microsoft said the impact was amplified by an error in its DDoS defense implementation. The company promised a detailed post-incident review of the outage, which echoed a 2023 attack attributed to the group Microsoft tracks as Storm-1359. (Help Net Security)