Week of November 17, 2025: Logitech Breach, Cloudflare Outage, CISA KEV Additions

Security leaders faced a convergence of incidents during the week of November 17, 2025, as Logitech confirmed a data breach tied to a zero-day exploit, a Cloudflare configuration change knocked major internet services offline, and Salesforce investigated a Gainsight-linked token compromise. CISA also added three vulnerabilities, affecting Fortinet FortiWeb, Google Chrome and Oracle Fusion Middleware, to its Known Exploited Vulnerabilities Catalog and published new guidance addressing bulletproof hosting providers and industrial control system flaws.

Logitech Confirms Data Breach Tied to Third-Party Zero-Day

Logitech confirmed in a Form 8-K filing with the US Securities and Exchange Commission that an unauthorized third party accessed its internal IT system through a zero-day vulnerability in a third-party software platform. The company stated the exfiltrated data likely included limited information about employees, consumers, customers and suppliers, but said it does not believe sensitive personal information such as national ID numbers or credit card information was housed in the affected system. Logitech said costs tied to the incident would likely be covered in part or in full by its cybersecurity insurance policy. The Cl0p extortion gang listed Logitech among its dark web victims. (Help Net Security)

Cloudflare Outage Disrupts Major Internet Services

A previously undisclosed issue crippled Cloudflare's network on November 18, 2025, rendering many of the internet's most used sites and services temporarily inaccessible, including X, OpenAI, AWS, Spotify and Visa, according to Down Detector tracking. Cloudflare confirmed the incident affected its Sites and Services offerings, including Access, Bot Management, CDN/Cache, Dashboard, Firewall, Network, WARP and Workers. The company said it identified the issue and implemented a fix, though some customers continued experiencing trouble logging into the dashboard. Cloudflare's CEO later said the outage, the company's worst since 2019, stemmed from a change to a database system's permissions rather than a cyberattack. (Help Net Security)

CISA Adds Exploited Fortinet FortiWeb Flaw to KEV Catalog

CISA added a Fortinet FortiWeb OS command injection flaw, CVE-2025-58034, to its Known Exploited Vulnerabilities Catalog on November 18, 2025, citing evidence of active exploitation. The agency recommended a remediation timeframe of one week given ongoing exploitation activity tied to a related FortiWeb path traversal vulnerability. Fortinet's Product Security Incident Response Team separately confirmed exploitation of CVE-2025-58034 in the wild, noting the flaw lets authenticated attackers execute unauthorized code through crafted HTTP requests or CLI commands. Affected FortiWeb versions span 7.0.0 through 8.0.1, with Fortinet urging upgrades to patched releases for remediation. (CISA)

CISA Adds Exploited Chrome V8 Flaw to KEV Catalog

CISA added a Google Chromium V8 type confusion vulnerability, CVE-2025-13223, to its Known Exploited Vulnerabilities Catalog on November 19, 2025, based on evidence of active exploitation. Google had separately shipped an emergency fix for the flaw after its Threat Analysis Group flagged in-the-wild attacks exploiting heap corruption through a specially crafted HTML page. The vulnerability, along with a second V8 type confusion flaw, CVE-2025-13224, was fixed in Chrome version 142.0.7444.175/.176 across Windows, macOS and Linux. CISA's addition set a remediation deadline for federal civilian agencies under Binding Operational Directive 22-01. (CISA)

CISA and Partners Release Bulletproof Hosting Defense Guide

CISA, with the NSA, the Department of Defense Cyber Crime Center, the FBI and international partners, released the guide Bulletproof Defense: Mitigating Risks from Bulletproof Hosting Providers on November 19, 2025. Developed through the Joint Ransomware Task Force, the guide outlines steps for internet service providers and network defenders to curate malicious resource lists, apply traffic filters, and share threat intelligence to counter bulletproof hosting infrastructure used for ransomware, phishing, malware delivery and denial-of-service attacks. CISA said the providers pose an imminent and significant risk to the resilience of critical systems and services. (CISA)

CISA Issues Six Industrial Control Systems Advisories

CISA released six Industrial Control Systems advisories on November 20, 2025, covering products from Automated Logic, ICAM365, Opto 22, Festo and Emerson. The advisories addressed the Automated Logic WebCTRL Premium Server, ICAM365 CCTV cameras, Opto 22 GRV-EPIC and GRV-RIO controllers, Festo's MSE6-C2M/D2M/E2M and Didactic product lines, and Emerson's Appleton UPSMON-PRO systems. CISA encouraged operators across these vendor environments to review the advisories for technical details and mitigations, reflecting continued attention to vulnerabilities affecting building automation, surveillance and industrial power equipment. (CISA)

Salesforce Probes Gainsight-Linked Token Compromise

Salesforce confirmed it identified unusual activity involving Gainsight-published applications connected to its platform, which may have enabled unauthorized access to certain customers' Salesforce data through the app's connection. Salesforce revoked active access and refresh tokens tied to Gainsight-published applications and temporarily removed them from AppExchange while the investigation continued, stating there was no indication the issue stemmed from a Salesforce platform vulnerability. Google Threat Intelligence Group linked the activity to the same threat actors behind the earlier Salesloft Drift compromise, advising organizations using Gainsight integrations to review connected third-party applications and rotate credentials. (Help Net Security)

CISA Adds Exploited Oracle Fusion Middleware Flaw to KEV Catalog

CISA added an Oracle Fusion Middleware missing authentication vulnerability, CVE-2025-61757, to its Known Exploited Vulnerabilities Catalog on November 21, 2025, based on evidence of active exploitation. The flaw affects a critical function within Fusion Middleware deployments and falls into a vulnerability class CISA described as a frequent attack vector for malicious cyber actors. Federal civilian agencies were required to remediate the flaw under Binding Operational Directive 22-01, and CISA urged all organizations to prioritize patching as part of routine vulnerability management practice. (CISA)