Connect with us

Hi, what are you looking for?



CISA Tells US Agencies to Patch Exploited Roundcube, VMware Flaws

The US government’s cybersecurity agency adds VMware and Roundcube server flaws to its Known Exploited Vulnerabilities (KEV) catalog.

CISA staff government shutdown

The US government’s cybersecurity agency CISA on Thursday added another batch of security flaws to its Known Exploited Vulnerabilities (KEV) catalog and urged federal agencies to patch these issues as a matter of urgency.

The already exploited vulnerabilities affect users of the open-source Roundcube webmail server and VMware Aria Operations for Networks.

Exploitation of the open-source mail server Roundcube flaws has been linked to Russian state-sponsored attacks against the Ukrainian government and other high-profile entities in the country.

Threat intelligence firm Recorded Future and Ukraine’s Computer Emergency Response Team (CERT-UA) have attributed the attacks to APT28, a notorious threat actor actor believed to be linked to Russia’s GRU military spy unit.

Tracked as CVE-2020-35730, CVE-2020-12641, and CVE-2021-44026, the exploited flaws are described as cross-site scripting (XSS), remote code execution (RCE), and SQL injection bugs, respectively. Patches and mitigations have been available since at least 2021.

The VMware Aria Operations for Networks vulnerability, tracked as CVE-2023-20887 (CVSS severity score 9.8/10), is a command injection flaw that exposes unpatched systems to remote code execution exploits.

The flaw was patched in early June, but VMware updated its advisory this week to warn of in-the-wild exploitation reported by threat intelligence firm GreyNoise.

Advertisement. Scroll to continue reading.

In addition to these four issues, CISA expanded its KEV catalog with two older bugs in Mozilla Firefox (CVE-2016-9079) and Microsoft Windows’ kernel-mode driver (CVE-2016-0165).

“These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise,” CISA warned.

Per Binding Operational Directive (BOD) 22-01, federal agencies are required to identify and patch the vulnerabilities in CISA’s ‘Must Patch’ list within three weeks after they were added to the catalog. In this case, the six bugs should be addressed by July 13, 2023.

Related: Russian APT Caught Hacking Roundcube Email servers

Related: Zimbra Flaw Exploited by Russia Added to CISA ‘Must Patch’ List

Related: CISA Warns of Plex Vulnerability Linked to LastPass Hack

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join security experts as they discuss ZTNA’s untapped potential to both reduce cyber risk and empower the business.


Join Microsoft and Finite State for a webinar that will introduce a new strategy for securing the software supply chain.


Expert Insights

Related Content


Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...


A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...

Data Breaches

OpenAI has confirmed a ChatGPT data breach on the same day a security firm reported seeing the use of a component affected by an...

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...

IoT Security

A group of seven security researchers have discovered numerous vulnerabilities in vehicles from 16 car makers, including bugs that allowed them to control car...

Data Breaches

LastPass DevOp engineer's home computer hacked and implanted with keylogging malware as part of a sustained cyberattack that exfiltrated corporate data from the cloud...


Patch Tuesday: Microsoft warns vulnerability (CVE-2023-23397) could lead to exploitation before an email is viewed in the Preview Pane.


A researcher at IOActive discovered that home security systems from SimpliSafe are plagued by a vulnerability that allows tech savvy burglars to remotely disable...