Week of December 22, 2025: WatchGuard Firewall Attacks, ServiceNow's $7.75B Armis Deal

Security leaders watched CISA add a new exploited vulnerability to its KEV catalog, WatchGuard warn that more than 115,000 internet-facing Firebox firewalls were under active attack, and Romania's national water utility confirm a BitLocker-based ransomware incident that locked roughly 1,000 systems. The same week brought a $7.75 billion security acquisition as ServiceNow agreed to buy Armis, while Nissan disclosed that a breach of a Red Hat-managed GitLab instance had exposed data on 21,000 customers.

CISA Adds Digiever DVR Flaw to KEV Catalog

CISA added CVE-2023-52163, a missing authorization vulnerability in Digiever DS-2105 Pro devices, to its Known Exploited Vulnerabilities Catalog on December 22, 2025, citing evidence of active exploitation. The addition triggers Binding Operational Directive 22-01 remediation requirements for federal civilian agencies. CISA urged all organizations, not just federal agencies, to prioritize patching the flaw as part of ongoing vulnerability management practices, given it is a frequent attack vector for malicious cyber actors. (CISA)

WatchGuard Firebox Firewalls Face Active Exploitation

More than 115,000 internet-facing WatchGuard Firebox firewalls were found vulnerable to CVE-2025-14733, a remote code execution flaw in the Fireware OS IKED process that WatchGuard disclosed on December 18 and that CISA added to its KEV catalog with a December 26 remediation deadline for federal agencies. The unauthenticated flaw could let attackers execute arbitrary code during VPN negotiations, and WatchGuard urged customers to upgrade to patched Fireware OS versions and check for indicators of compromise. (Help Net Security)

CISA Issues ICS Advisory for Mitsubishi Electric Air Conditioning Systems

CISA released an updated Industrial Control Systems advisory on December 23, 2025, covering Mitsubishi Electric Air Conditioning Systems under advisory ICSA-25-177-01 (Update B). The advisory provides technical details and mitigations for vulnerabilities affecting the vendor's building-control products. CISA encouraged users and administrators managing these systems to review the advisory and apply the recommended mitigations to reduce exposure to the identified ICS vulnerabilities. (CISA)

NIST and CISA Open Comment Period on Token Protection Guidance

NIST and CISA released a draft Interagency Report, IR 8597, on December 22, 2025, offering implementation guidance for protecting identity tokens and assertions from forgery, theft, and misuse in cloud environments. The report responds to a directive on strengthening cybersecurity and addresses recent incidents at major cloud service providers tied to stolen or forged tokens. Public comments are open through January 30, 2026, with federal agencies and cloud service providers as the primary intended audience. (CISA)

ServiceNow to Acquire Armis for $7.75 Billion

ServiceNow entered a definitive agreement on December 24, 2025, to acquire cyber-asset exposure management vendor Armis for approximately $7.75 billion in cash, funded through cash on hand and debt. The deal is intended to expand ServiceNow's security workflow offerings and combine Armis's real-time asset discovery across IT, OT, and IoT devices with ServiceNow's automated remediation capabilities. The transaction is expected to close in the second half of 2026, pending regulatory approval, after which Armis's team will join ServiceNow. (Help Net Security)

Nissan Discloses Impact From Red Hat GitLab Breach

Nissan disclosed on December 23, 2025, that personal information belonging to 21,000 customers of its Nissan Fukuoka Sales unit was exposed in a breach of a self-managed GitLab instance used by Red Hat Consulting. The exposed data included names, addresses, phone numbers, partial email addresses, and sales-related information, though no credit card data was taken. Red Hat notified Nissan of the incident on October 3, and Nissan said it has reported the breach to relevant authorities and notified affected individuals. (SecurityWeek)

Romanian Water Agency Hit by BitLocker Ransomware

Romania's national water management agency disclosed on December 22, 2025, that a ransomware attack using the legitimate Windows tool BitLocker left staff locked out of approximately 1,000 computer systems, including workstations and servers. Romania's National Directorate of Cyber Security said hydrotechnical infrastructure such as dams and flood defenses remained unaffected, though email servers were disrupted and staff had to rely on telephone and radio communications. Attackers issued a ransom note demanding contact within seven days. (The Record)