Week of April 14, 2025: The CVE program nearly loses its contract, and Conduent reports stolen client data

What mattered to security leaders in the week of April 14, 2025? MITRE warned that its contract to run the CVE program, the shared system for naming vulnerabilities, would expire on Wednesday, April 16, until CISA exercised an option to keep it running. The same week Conduent disclosed that data exfiltrated in a January intrusion held a significant amount of personal information belonging to its clients' end users.

CISA extends MITRE's CVE contract at the last minute

In an email to CVE Board members sent on Tuesday, April 15, MITRE's Yosry Barsoum said the contracting pathway for MITRE to operate and modernize CVE and related programs such as CWE would expire on April 16, and warned that a break in service would degrade national vulnerability databases, tool vendors and incident response. CISA then said it had executed the option period on the contract on April 15 so there would be no lapse in CVE services. Teams that key patch SLAs and scanners to CVE IDs got a lesson in how thin that dependency is. (Help Net Security, CISA)

Conduent says January intrusion exposed clients' end-user data

Conduent reported in a Form 8-K under Item 1.05 that a threat actor gained access to a limited part of its environment on January 13, 2025, causing an operational disruption it resolved within days. Its investigation found the attacker exfiltrated files tied to a limited number of clients, and data-mining experts confirmed they held a significant number of individuals' personal information. Conduent said it had accrued material non-recurring expenses in the first quarter for potential notifications, and that the data had not been released publicly to its knowledge. (SEC EDGAR)

Hertz customers exposed through the Cleo file transfer attacks

Car rental company Hertz disclosed that customer data for Hertz, Dollar and Thrifty was taken by an unauthorized party that exploited zero-day vulnerabilities in the Cleo file transfer platform in October and December 2024. Hertz said it confirmed on February 10, 2025 that its data had been acquired, and published notices for customers in the US, EU, Canada, the UK and Australia. The number of affected customers was not disclosed. It is another reminder that file transfer vendors sit inside your data perimeter. (Help Net Security)

CISA issues credential guidance over a possible legacy Oracle cloud compromise

On April 16 CISA said it was aware of public reporting about potential unauthorized access to a legacy Oracle cloud environment. It stressed that scope and impact were unconfirmed, but said the reported activity posed risk where credential material might be exposed or reused across separate systems, and published guidance on reducing that risk. For customers, the practical step was rotating credentials and keys connected to that environment. (CISA)

Apple patches two zero-days used against targeted iPhone users

Apple released emergency updates for iOS, iPadOS, macOS, tvOS and visionOS fixing CVE-2025-31200, a CoreAudio memory corruption bug triggered by a crafted media file, and CVE-2025-31201, a flaw that let an attacker with read and write access bypass Pointer Authentication. Apple said both were exploited in an extremely sophisticated attack against specific targeted individuals on iOS. CISA added both to its KEV catalog on April 17. Mobile fleets need the same emergency patch path as laptops. (Help Net Security, CISA)

Windows NTLM hash leak flaw exploited in Poland and Romania

Check Point reported that CVE-2025-24054, a Windows NTLM hash disclosure vulnerability Microsoft had patched in March, was exploited from March 19, 2025 in campaigns against government and private institutions in Poland and Romania. The flaw lets an attacker capture a victim's NTLMv2 response when the machine authenticates to an attacker-run SMB server, then crack it offline or relay it. CISA added it to the KEV catalog on April 17. Restricting outbound SMB and reducing NTLM use blunt this class of attack. (Help Net Security, CISA)