Week of April 28, 2025: M&S Ransomware Attack and SAP NetWeaver Zero-Day Hit CISA's KEV List

Security leaders tracked Marks & Spencer's ongoing ransomware disruption alongside a rapid succession of CISA Known Exploited Vulnerabilities additions covering SAP NetWeaver, Commvault, Broadcom Brocade, Apache HTTP Server, and SonicWall. Researchers also published findings on 2024 zero-day exploitation trends and a new class of Apple AirPlay vulnerabilities, giving CISOs several fresh patching and incident-response priorities to weigh.

Marks & Spencer Ransomware Attack Disrupted Online Retail Operations

British retailer Marks & Spencer continued recovering from a ransomware attack that multiple outlets linked to the Scattered Spider group deploying DragonForce encryptor software. The company notified the London Stock Exchange and customers on April 22, 2025, after attackers encrypted VMware ESXi virtual machines. Online orders remained suspended, contactless payments and gift card redemption were disrupted, and the customer reward scheme was paused. M&S engaged external cyber security experts and reported the incident to UK data protection authorities and the National Cyber Security Centre. (Help Net Security)

CISA Adds Actively Exploited SAP NetWeaver Flaw to KEV Catalog

CISA added CVE-2025-31324, an unrestricted file upload vulnerability affecting SAP NetWeaver, to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. The addition triggered Binding Operational Directive 22-01 remediation deadlines for federal civilian executive branch agencies. CISA urged all organizations, not just federal agencies, to prioritize patching the flaw given its demonstrated use by attackers in the field. (CISA)

CISA Flags Three More Actively Exploited Vulnerabilities

CISA added three vulnerabilities to its Known Exploited Vulnerabilities Catalog: a code injection flaw in Broadcom Brocade Fabric OS (CVE-2025-1976), a stack-based buffer overflow in Qualitia Active! Mail (CVE-2025-42599), and an unspecified vulnerability in the Commvault Web Server (CVE-2025-3928). The agency said these vulnerability types are frequent attack vectors and pose significant risks to the federal enterprise, and it required federal civilian agencies to remediate them under Binding Operational Directive 22-01. (CISA)

Apache HTTP Server and SonicWall Flaws Added to KEV List

CISA added two further vulnerabilities to its Known Exploited Vulnerabilities Catalog: an improper escaping of output vulnerability in Apache HTTP Server (CVE-2024-38475) and an OS command injection vulnerability in SonicWall SMA100 appliances (CVE-2023-44221). Both were confirmed as actively exploited, triggering remediation deadlines for federal civilian executive branch agencies under Binding Operational Directive 22-01, with CISA urging broader organizations to prioritize patching. (CISA)

CISA Publishes Industrial Control Systems Advisories for Rockwell, Delta Electronics

CISA released three Industrial Control Systems advisories covering Rockwell Automation ThinManager, Delta Electronics ISPSoft, and an updated advisory for Lantronix XPort. The advisories detailed current security issues, vulnerabilities, and exploits affecting ICS products used across critical infrastructure sectors. CISA encouraged users and administrators to review the advisories for technical details and mitigation steps to reduce exposure to industrial control system attacks. (CISA)

Google Reports 44% of 2024 Zero-Days Hit Enterprise Products

Google Threat Intelligence Group reported that attackers exploited 75 zero-day vulnerabilities in 2024, with 33 vulnerabilities, or 44%, affecting enterprise solutions, up from 37% in 2023. Researchers found that security and networking products accounted for over 60% of enterprise zero-day exploitation, with Microsoft, Google, and Ivanti among the most frequently targeted vendors. The findings highlighted continued state-sponsored and financially motivated targeting of firewalls, VPNs, and managed file transfer products. (Help Net Security)

AirBorne Flaws in Apple AirPlay Protocol Enabled Device Compromise

Researchers at Oligo Security disclosed a set of vulnerabilities dubbed "AirBorne" affecting Apple's AirPlay protocol, AirPlay software development kits, and the CarPlay Communication Plug-in, which could let attackers compromise AirPlay-enabled devices from Apple and third-party vendors. The flaws allowed remote code execution, credential extraction, and denial-of-service conditions under certain preconditions. Apple had been patching the issues across macOS, iOS, watchOS, tvOS, and related SDKs since the start of the year, while researchers urged organizations to update devices and restrict AirPlay network communication. (Help Net Security)