U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds OracSKYSEA Client View, Rapid7 Velociraptor, Microsoft Windows, and IGEL OS flaws to its Known Exploited Vulnerabilities catalog.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added OracSKYSEA Client View, Rapid7 Velociraptor, Microsoft Windows, and IGEL OS flaws to its Known Exploited Vulnerabilities (KEV) catalog.
Below are the descriptions for these flaws:
- CVE-2016-7836 SKYSEA Client View Improper Authentication Vulnerability
- CVE-2025-6264 Rapid7 Velociraptor Incorrect Default Permissions Vulnerability
- CVE-2025-24990 Microsoft Windows Untrusted Pointer Dereference Vulnerability
- CVE-2025-47827 IGEL OS Use of a Key Past its Expiration Date Vulnerability
- CVE-2025-59230 Microsoft Windows Improper Access Control Vulnerability
The vulnerability CVE-2016-7836 in SKYSEA Client View (≤ v11.221.03) allows remote code execution due to improper authentication handling in TCP connections with the management console.
Velociraptor lets endpoints expose VQL “Artifacts” that often run with elevated privileges. The Admin.Client.UpdateClientConfig artifact failed to require the higher EXECVE permission, so any user with COLLECT_CLIENT (typically the Investigator role) could collect and invoke it to modify client configuration. The CVE-2025-6264 flaw enables arbitrary command execution and potential endpoint takeover; however, the exploitation requires prior ability to collect artifacts from the target.
The two actively exploited Windows zero-days added the KeV catalog are CVE-2025-24990 in the Agere Modem Driver and CVE-2025-59230 in RasMan. Both flaws allow privilege escalation. Microsoft plans to remove the vulnerable driver instead of patching it.
The last issue added to the catalog, tracked CVE-2025-47827, is a Secure Boot bypass that affects IGEL OS versions before 11, publicly disclosed June 2025 by Zack Didcott. Exploitation lets an attacker deploy a kernel-level rootkit to compromise IGEL OS and virtual desktops, potentially capturing credentials and tampering sessions. The flaw is not remote: it typically requires physical access, enabling “evil-maid” style attacks.
According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.
Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.
CISA orders federal agencies to fix the vulnerabilities by November 4, 2025.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, CISA)
