Week of November 10, 2025: FortiWeb Exploits and Updated Akira Ransomware Guidance

Security leaders watching the week of November 10, 2025 saw CISA confirm active exploitation of chained FortiWeb vulnerabilities, publish an updated Akira ransomware advisory with the FBI and international partners, and push fresh Cisco ASA and Firepower patch-compliance guidance alongside 18 industrial control system advisories. The same week brought a round of Known Exploited Vulnerabilities Catalog additions covering WatchGuard, Gladinet, Microsoft, and Samsung products, plus a new CISO appointment at financial software provider Finastra.

CISA Flags Chained FortiWeb Flaws Enabling Remote Code Execution

CISA published an advisory on November 14, 2025 warning that threat actors were exploiting two Fortinet FortiWeb vulnerabilities, CVE-2025-64446 and CVE-2025-58034, which could be chained to achieve unauthenticated remote code execution against the web application firewall. CVE-2025-64446 allowed an unauthenticated actor to execute administrative commands through crafted HTTP or HTTPS requests, while CVE-2025-58034 let an authenticated attacker run unauthorized code via HTTP requests or CLI commands. Fortinet issued patched versions across the FortiWeb 7.0 through 8.0 branches, and CISA added CVE-2025-64446 to its Known Exploited Vulnerabilities Catalog that same day. (CISA)

CISA Adds WatchGuard, Gladinet, and Microsoft Flaws to KEV Catalog

On November 12, 2025, CISA added three vulnerabilities to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation: CVE-2025-9242, an out-of-bounds write flaw in WatchGuard Firebox; CVE-2025-12480, an improper access control vulnerability in Gladinet Triofox; and CVE-2025-62215, a race condition vulnerability in Microsoft Windows. CISA reiterated that Binding Operational Directive 22-01 requires federal civilian agencies to remediate catalog entries by their due dates, and it urged all organizations to prioritize patching these actively exploited products as part of routine vulnerability management. (CISA)

Samsung Mobile Flaw Joins CISA's Exploited Vulnerabilities List

On November 10, 2025, CISA added CVE-2025-21042, an out-of-bounds write vulnerability affecting Samsung mobile devices, to its Known Exploited Vulnerabilities Catalog after confirming evidence of active exploitation. The addition triggered Binding Operational Directive 22-01 remediation timelines for federal civilian executive branch agencies running affected Samsung devices. CISA again encouraged all organizations, not just federal agencies, to treat catalog entries as priority patches within their vulnerability management programs, noting that such flaws remain a frequent vector for malicious cyber actors targeting mobile endpoints. (CISA)

CISA, FBI Update Akira Ransomware Guidance With New Variant Details

CISA, the FBI, the Department of Defense Cyber Crime Center, the Department of Health and Human Services, and international partners released an updated #StopRansomware advisory on November 13, 2025 covering new tactics used by the Akira ransomware group. The update detailed a new Akira_v2 variant offering faster encryption, continued exploitation of edge devices and backup servers for initial access, and use of tools including Anydesk, Ngrok, and SystemBC malware. CISA's Nick Andersen said "the threat of ransomware from groups like Akira is real," urging organizations to apply patches and enforce multifactor authentication for remote access services. (CISA)

CISA Pushes Cisco ASA and Firepower Patch Verification After Compliance Gaps

On November 12, 2025, CISA released Implementation Guidance for Emergency Directive 25-03, addressing Cisco Adaptive Security Appliance and Firepower device vulnerabilities CVE-2025-20333 and CVE-2025-20362 originally identified in a September 25 emergency directive. CISA said it had found multiple organizations that believed they had applied required updates but had not reached the minimum software version, and it directed federal agencies to verify patch compliance and use its RayDetect scanner to examine ASA core dumps for signs of RayInitiator compromise. The agency warned that threat actors continued to target unpatched devices. (CISA)

CISA Issues 18 Industrial Control Systems Advisories in One Day

On November 13, 2025, CISA released 18 Industrial Control Systems advisories covering products from Mitsubishi Electric, AVEVA, Rockwell Automation, Siemens, General Industrial Controls, Brightpick, and Festo. The advisories spanned systems including Mitsubishi Electric's MELSEC iQ-F Series, AVEVA's Application Server IDE and Edge platforms, several Rockwell Automation FactoryTalk and Studio 5000 products, and multiple Siemens product lines such as SICAM, Spectrum Power 4, LOGO! 8, Solid Edge, COMOS, and Altair Grid Engine. CISA encouraged asset owners and administrators to review the advisories for technical details and mitigations relevant to their operational technology environments. (CISA)

Finastra Names Matthew McCormack as Chief Information Security Officer

Financial services software provider Finastra announced during the week of November 10, 2025 that it had appointed Matthew McCormack as its new Chief Information Security Officer alongside Ali Khan as Chief Data Officer and Sanjay Jain as Chief Information Officer. According to the announcement, McCormack would lead Finastra's security strategy and frameworks as the company reshaped its senior technology leadership team. The appointment placed cybersecurity oversight alongside newly created data and information-technology executive roles at the banking-software provider. (SecurityWeek)