While CISA didn't share any additional details regarding these ongoing attacks, it did add the two vulnerabilities to its Known Exploited Vulnerabilities Catalog, giving Federal Civilian Executive Branch (FCEB) agencies three weeks to patch their systems by August 12 as mandated by the November 2021 Binding Operational Directive (BOD) 22-01. CISA has warned that attackers are actively exploiting two security vulnerabilities in the SysAid IT service management (ITSM) software to hijack administrator accounts. SysAid has over 5,000 customers and more than 10 million users across 140 countries worldwide, serving a diverse range of clients, from small businesses to Fortune 500 enterprises, including high-profile companies such as Xerox, IKEA, Coca-Cola, Honda, Michelin, and Motorola. One month later, watchTowr Labs also published proof-of-concept code, showing that the SysAid vulnerabilities are trivial to exploit and allow attackers to retrieve local files containing sensitive information. However, the FIN11 financially motivated cybercrime group exploited a SysAid vulnerability (CVE-2023-47246) in 2023 to deploy Clop ransomware on compromised servers in zero-day attacks. Although BOD 22-01 primarily targets U.S. federal agencies, the cybersecurity agency encourages all organizations, including private companies, to prioritize patching the two actively exploited flaws as soon as possible. "These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise," CISA warned.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Wed, 23 Jul 2025 13:35:06 +0000