Week of March 17, 2025: GitHub Actions Supply-Chain Compromise and New CISO Appointments

Security leaders faced a fast-moving GitHub Actions supply-chain compromise and five new Known Exploited Vulnerabilities Catalog entries from CISA, including flaws in Fortinet FortiOS/FortiProxy and SAP NetWeaver, during the week of March 17, 2025. The week also brought new chief information security officer appointments at the Congressional Budget Office, Life360, and Forcepoint, alongside a dozen ICS advisories and a federal court order affecting CISA's probationary workforce.

CISA Adds Fortinet and GitHub Action Flaws to KEV Catalog

On March 18, 2025, CISA added two vulnerabilities to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation: an authentication bypass affecting Fortinet FortiOS and FortiProxy, and an embedded malicious code flaw in the tj-actions/changed-files GitHub Action. The listing required federal civilian agencies to remediate the flaws under Binding Operational Directive 22-01, and CISA urged all organizations to prioritize patching given the frequency with which these vulnerability types are used as attack vectors by malicious cyber actors. (CISA)

Compromised GitHub Action Exposed Secrets Across CI/CD Pipelines

CISA warned that the widely used tj-actions/changed-files GitHub Action, tracked as CVE-2025-30066, was compromised, with the issue patched in version 46.0.1. The compromise exposed secrets such as access keys, GitHub personal access tokens, npm tokens, and private RSA keys, and was linked to an earlier compromise of the reviewdog/action-setup@v1 action, tracked as CVE-2025-30154. CISA urged organizations to audit repositories that ran affected versions between March 11 and March 15, 2025, and to rotate any exposed credentials immediately. (CISA)

KEV Catalog Grows With SAP, NAKIVO, and Edimax Camera Flaws

CISA added three more vulnerabilities to its Known Exploited Vulnerabilities Catalog on March 19, 2025, citing evidence of active exploitation: a command injection flaw in Edimax IC-7100 IP cameras, a path traversal vulnerability in NAKIVO Backup and Replication, and a directory traversal vulnerability in SAP NetWeaver dating back to 2017. The additions triggered remediation deadlines for federal civilian agencies under Binding Operational Directive 22-01 and renewed attention on patching older, still-exploited enterprise software. (CISA)

CISA Publishes Seven ICS Advisories Covering Schneider, Rockwell, Mitsubishi

On March 18, 2025, CISA issued seven Industrial Control Systems advisories covering products from Schneider Electric, Rockwell Automation, and Mitsubishi Electric, including the EcoStruxure Power Automation System, the ASCO 5310/5350 Remote Annunciator, and Rockwell Automation Lifecycle Services running on VMware. The advisories detailed current security issues and exploits affecting ICS environments and provided mitigation guidance for asset owners operating the affected equipment across critical infrastructure sectors. (CISA)

Five More ICS Advisories Target Schneider, Siemens, SMA Equipment

CISA released five additional Industrial Control Systems advisories on March 20, 2025, addressing products from Schneider Electric, Siemens, SMA Solar Technology, and Santesoft, including the EcoStruxure platform, Enerlin'X IFE and eIFE devices, Simcenter Femap software, the Sunny Portal, and the Sante DICOM Viewer Pro. The advisories outlined vulnerabilities and recommended mitigations for operators running the affected industrial and medical imaging software. (CISA)

CISO Moves: Congressional Budget Office, Life360, Forcepoint Name New Security Chiefs

During the week of March 17, 2025, several organizations announced new chief information security officers. Tabitha Craig, who previously held leadership roles at the Department of Defense and the Department of Housing and Urban Development, was named CISO of the Congressional Budget Office. Life360 appointed former Amazon security leader Vari Bindra, Forcepoint named Guy Shamilov, formerly of Varonis and Tata Consultancy Services, and Archipelo appointed Paul Calatayud, previously Global CSO at Palo Alto Networks, as its CISO and Chief Strategy Officer. (SecurityWeek)

Court Order Prompts CISA to Reinstate Probationary Employees

CISA announced on March 18, 2025 that it was working to reinstate employees whose terminations fell within a federal court's Temporary Restraining Order issued in Maryland, et al v. United States Department of Agriculture, et al. The agency directed affected former employees to contact its human resources office regarding reinstatement, reflecting broader litigation over probationary terminations across federal agencies that touched CISA's cybersecurity workforce during the week. (CISA)