Week of July 7, 2025: CISA's Citrix KEV Alert and New Field CISO Appointments

Security leaders tracked CISA's July 10, 2025 addition of an actively exploited Citrix NetScaler vulnerability to its Known Exploited Vulnerabilities Catalog, alongside fourteen industrial-control-system advisories covering Siemens, Delta Electronics, Emerson, and other vendors. The week also brought leadership changes in the security industry, with AttackIQ naming a new Field CISO and Silobreaker appointing a former New York City Cyber Command CISO as its chief executive.

CISA Adds Citrix NetScaler Flaw to Known Exploited Vulnerabilities Catalog

On July 10, 2025, CISA added CVE-2025-5777, an out-of-bounds read vulnerability affecting Citrix NetScaler ADC and Gateway, to its Known Exploited Vulnerabilities Catalog, citing evidence of active exploitation. The listing triggers Binding Operational Directive 22-01 remediation deadlines for federal civilian executive branch agencies, and CISA urged all organizations running NetScaler appliances to prioritize patching given the flaw's active use in attacks. Security teams managing affected ADC and Gateway instances needed to confirm patch status following the addition. (CISA)

CISA Publishes Thirteen ICS Advisories Covering Siemens, Delta Electronics, and More

CISA released thirteen Industrial Control Systems advisories on July 10, 2025, spanning products from Siemens, Delta Electronics, Advantech, KUNBUS, and IDEC, plus a notice on the End-of-Train and Head-of-Train Remote Linking Protocol. The advisories detailed vulnerabilities and mitigations across SINEC NMS, Solid Edge, TIA Administrator, SIMATIC CN 4100, TIA Project-Server and TIA Portal, SIPROTEC 5, DTM Soft, iView, and RevPi Webstatus, among other products. CISA encouraged administrators overseeing these industrial deployments to review the technical details and apply recommended mitigations promptly. (CISA)

CISA Issues Advisory for Emerson ValveLink Products

CISA released a single Industrial Control Systems advisory on July 8, 2025, addressing Emerson ValveLink Products. The advisory outlined security issues and mitigations relevant to operators running the affected valve-management software in industrial environments. CISA encouraged users and administrators to review the technical details and apply the recommended fixes to reduce exposure in operational technology networks that rely on Emerson's ValveLink line. (CISA)

CISA Adds Four Legacy Vulnerabilities to KEV Catalog, Including PHPMailer and Rails Flaws

On July 7, 2025, CISA added four vulnerabilities to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation: a Multi-Router Looking Glass buffer overflow (CVE-2014-3931), a PHPMailer command injection flaw (CVE-2016-10033), a Ruby on Rails path traversal issue (CVE-2019-5418), and a Zimbra Collaboration Suite server-side request forgery vulnerability (CVE-2019-9621). The additions, several tied to aging software, underscored that older unpatched components remained attractive targets, prompting federal civilian agencies to meet BOD 22-01 remediation deadlines. (CISA)

AttackIQ Names Field CISO as Silobreaker Hands CEO Role to Former NYC Cyber Command Chief

Breach-and-attack-simulation firm AttackIQ appointed Pete Luban as Field Chief Information Security Officer, following his prior post as Vice President and Head of Cybersecurity and IT Risk at Dimensional Fund Advisors. In the same week's roundup, threat-intelligence company Silobreaker named Geoff Brown its new Chief Executive Officer, succeeding founder Kristofer Mansson, who moved to chairman after two decades leading the company. Brown previously served as New York City Cyber Command's head and CISO, giving him direct public-sector security leadership experience. (SecurityWeek)