Kaseya Labs:

Actionable Threat
Research & Analysis

Cisco has published a critical vulnerability (CVE-2025-20265) with the highest severity score (CVSS 10.0) for its Secure Firewall Management Center (FMC) product. The vulnerability, a Radius Remote Code Execution Vulnerability, enables an unauthenticated attacker to remotely inject arbitrary code, typically shell commands, that are executed at with high level privileges. The flaw is present in […]

Zoom, one of the most widely adopted collaboration and web meeting tools, has published a critical vulnerability (CVE-2025-49457) for its Windows Client. The vulnerability, an Untrusted Search Path (CWE-426), may allow an unauthenticated user to conduct an escalation of privilege via network access on versions lower than 6.3.10. The flaw was discovered by Zoom’s Offensive […]

A WinRAR vulnerability published (CVE-2025-8088) which allows attackers to execute arbitrary code by crafting malicious archive files. This vulnerability actively being exploited in the wild and was discovered by Anton Cherepanov, Peter Košinár, and Peter Strýček from ESET. WinRaR does NOT have auto-update patching capabilities, meaning interaction by users or IT is required to remediate this […]

*Update August 6th 10PM EDT – SonicWall has posted these events are not connected to a zero-day vulnerability. Instead, there is a significant correlation with threat activity related to CVE-2024-40766, which was previously disclosed and documented in SonicWall’s public advisory SNWLID-2024-0015.  SonicWall customers should review their recommendations at: https://www.sonicwall.com/support/notices/gen-7-and-newer-sonicwall-firewalls-sslvpn-recent-threat-activity/250804095336430 The new recommendations include: Kaseya Detections Both […]

*Updated July 31, 2025 with additional Details and IOCs A series of new and previously patched vulnerabilities, discovered by Eye Security, have been widely exploited in Microsoft’s SharePoint On-Premises Server software (cloud SharePoint instances are not impacted).  Dubbed “ToolShell”, threat actors can exploit the vulnerability to execute code remotely over the network – essentially giving […]

CISA has announced that an older version of PaperCut NG/MF print management software is under active exploitation and has added it to the CISA Known Exploited Vulnerabilities (KEV) Catalog.  Attackers can leverage the vulnerability to: “potentially enable an attacker to alter security settings or execute arbitrary code”.  This vulnerability was disclosed and patched in 2023 […]

A Remote Access Trojan (RAT) is a type of malware that allows an attacker to gain full access to a system as if they were physically present on the keyboard. As antivirus and antimalware have improved at detecting malicious applications, bad actors have increasingly turned to using legitimate remote control tools as RATs. Legitimate remote […]