Week of August 4, 2025: Emergency Exchange Directive and SharePoint ToolShell Report

Security leaders faced an emergency scramble after CISA ordered federal agencies to lock down hybrid Microsoft Exchange deployments against CVE-2025-53786 and published malware analysis on the SharePoint ToolShell exploit chain. The same week brought new CISO appointments at New Charter Technologies, Noma Security, and Infoblox, Senate confirmation of Sean Cairncross as National Cyber Director, and CISA's addition of three actively exploited D-Link vulnerabilities to its KEV Catalog.

CISA Orders Federal Agencies to Fix Hybrid Exchange Flaw

On August 7, 2025, CISA issued Emergency Directive 25-02, ordering federal civilian agencies running hybrid Microsoft Exchange deployments to apply mitigations for CVE-2025-53786 by 9:00 AM EDT on August 11, 2025. The directive addressed a post-authentication flaw that could let an attacker with administrative access to an on-premises Exchange server escalate privileges into an organization's connected cloud environment. CISA said it was not aware of active exploitation but urged every organization operating hybrid Exchange, not only federal agencies, to apply Microsoft's guidance promptly given the scale of potential identity and domain compromise. (CISA)

CISA Details Mitigation Steps for Exchange Hybrid Vulnerability

CISA published an alert on CVE-2025-53786, a high-severity vulnerability in Microsoft Exchange hybrid deployments that could let an attacker with administrative access to an on-premises server escalate privileges and compromise an organization's Exchange Online identity integrity. The agency recommended organizations inventory all Exchange servers, apply Microsoft's April 2025 Exchange Server Hotfix Updates, deploy a dedicated Exchange hybrid app, and run the Microsoft Exchange Health Checker. CISA also recommended disconnecting internet-facing Exchange Server or SharePoint Server instances that had reached end-of-life, naming SharePoint Server 2013 as an example no longer supported. (CISA)

CISA Publishes Malware Analysis on SharePoint ToolShell Exploit Chain

CISA released a Malware Analysis Report on files tied to Microsoft SharePoint vulnerabilities CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, and CVE-2025-53771, which threat actors chained together in an exploit chain known as ToolShell to gain unauthorized access to on-premises SharePoint servers. CISA analyzed six files, including two DLLs, a cryptographic key stealer, and three web shells capable of stealing cryptographic keys and exfiltrating data via Base64-encoded PowerShell commands. CISA had already added CVE-2025-49704 and CVE-2025-49706 to its Known Exploited Vulnerabilities Catalog on July 22, 2025, and CVE-2025-53770 on July 20, 2025. (CISA)

CISA Adds Three D-Link Flaws to Known Exploited Vulnerabilities Catalog

On August 5, 2025, CISA added three vulnerabilities affecting D-Link devices to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation: CVE-2020-25078 and CVE-2020-25079, both affecting D-Link DCS-2530L and DCS-2670L cameras, and CVE-2022-40799, a download of code without integrity check vulnerability in the D-Link DNR-322L. Binding Operational Directive 22-01 required Federal Civilian Executive Branch agencies to remediate the flaws by CISA's specified due date, and the agency urged all organizations to prioritize remediation of catalog vulnerabilities as part of standard vulnerability management. (CISA)

CISA Issues Ten ICS Advisories Across Manufacturing and Building Systems

CISA released ten Industrial Control Systems advisories on August 7, 2025, covering products from Delta Electronics, Johnson Controls, Burk Technology, Rockwell Automation, Packet Power, Dreame Technology, EG4 Electronics, Yealink, Instantel, and Mitsubishi Electric/ICONICS. The advisories detailed current vulnerabilities and exploits affecting operational technology equipment used across manufacturing, energy, and building-management environments, and CISA encouraged asset owners and administrators to review the technical mitigations for each affected product line. (CISA)

CISO Moves and Cyber Director Confirmation Mark the Week

SecurityWeek's industry-moves roundup for the week of August 4, 2025, recorded a cluster of security-leadership changes: New Charter Technologies named Ryan Davis, formerly a business-unit CISO at IBM, as its Chief Information Security Officer; Noma Security appointed Diana Kelley, previously CISO at Protect AI, as its CISO; and Infoblox added former Google Cloud, Goldman Sachs, and Deutsche Bank security executive Phil Venables to its board. Separately, the US Senate confirmed Sean Cairncross as National Cyber Director, more than five months after his nomination, making him the administration's principal cybersecurity policy adviser. (SecurityWeek)