Quick Summary
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added four actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. These include CVE-2025-68645, a PHP remote file inclusion vulnerability in Synacor Zimbra Collaboration Suite, and CVE-2025-34026, an authentication bypass in the Versa Concerto SD-WAN platform. Federal agencies must apply necessary fixes by February 12, 2026, to protect their networks against these threats.
The Securityish Brief
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) recently updated its Known Exploited Vulnerabilities (KEV) catalog by adding four security flaws that are currently being exploited in the wild. This update was announced on January 22, 2026, and highlights the urgency for organizations to address these vulnerabilities to safeguard their systems.
The vulnerabilities listed include CVE-2025-68645, which has a CVSS score of 8.8, representing a PHP remote file inclusion vulnerability in Synacor Zimbra Collaboration Suite. This flaw allows remote attackers to craft requests to the ‘/h/rest’ endpoint, enabling them to include arbitrary files without authentication. It was fixed in November 2025 with version 10.1.13.
Another critical vulnerability is CVE-2025-34026, with a CVSS score of 9.2, affecting the Versa Concerto SD-WAN orchestration platform. This authentication bypass vulnerability allows attackers to access administrative endpoints and was addressed in April 2025 with version 12.2.1 GA. Additionally, CVE-2025-31125, with a CVSS score of 5.3, is an improper access control vulnerability in Vite Vitejs that could expose arbitrary file contents through specific query parameters.
The fourth vulnerability, CVE-2025-54313, has a CVSS score of 7.5 and relates to an embedded malicious code vulnerability in eslint-config-prettier. This flaw could enable the execution of a malicious DLL known as Scavenger Loader, which is designed to deliver an information stealer. This vulnerability is part of a supply chain attack that targeted multiple npm packages.
Exploitation efforts targeting CVE-2025-68645 have been ongoing since January 14, 2026, indicating that threat actors are actively seeking to exploit these vulnerabilities. Federal Civilian Executive Branch (FCEB) agencies are mandated to implement the necessary fixes by February 12, 2026, in accordance with Binding Operational Directive (BOD) 22-01.
Understanding the Risks
These vulnerabilities pose significant risks to organizations, particularly those using the affected software. The high CVSS scores indicate that they can lead to severe security breaches, including unauthorized access and data theft. Organizations must prioritize patching these vulnerabilities to mitigate potential exploitation.
Users and organizations should remain vigilant and monitor for updates from software vendors regarding these vulnerabilities. Regularly applying security patches and updates is essential to maintaining a secure environment.
Key Takeaways
- Ensure that your organization applies the necessary patches for CVE-2025-68645 and CVE-2025-34026 before the February 12, 2026 deadline.
- Regularly check for updates from software vendors regarding vulnerabilities and security patches.
- Implement a robust monitoring system to detect any unauthorized access attempts related to these vulnerabilities.
- Educate staff about the risks associated with software vulnerabilities and the importance of timely updates.
- Review your organization’s software inventory to identify any affected systems and prioritize their remediation.
Key Terms & Concepts
- CVE: In this article, CVE refers to a list of publicly known cybersecurity vulnerabilities.
- CVSS: CVSS is a scoring system that assesses the severity of software vulnerabilities.
- PHP remote file inclusion: This is a type of vulnerability that allows an attacker to include files from a remote server.
- authentication bypass: Authentication bypass is a vulnerability that allows unauthorized access to systems or data.
- supply chain attack: A supply chain attack targets software dependencies to introduce vulnerabilities or malicious code.
Read the original article here: https://thehackernews.com/2026/01/cisa-updates-kev-catalog-with-four.html
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
