Active Exploitation of Critical Infrastructure Management RCE Flaws

Multiple maximum-severity vulnerabilities in enterprise infrastructure management products are being actively exploited, enabling unauthenticated remote code execution as root and creating high-impact initial access paths into data center and security operations environments. Reported exploitation includes mass, automated scanning and rapid weaponization following public disclosure and PoC availability, increasing the likelihood of opportunistic compromise, follow-on payload delivery, and lateral movement in affected networks.

Fortinet FortiSIEM is reported as under active attack via CVE-2024-23108, an unauthenticated command-injection issue in the phMonitor component (noted as listening on TCP 8014) that can yield full system compromise. Separately, Cisco Secure Email Gateway / Secure Email and Web Manager is reported as exploited via CVE-2024-20353 (CVSS 10.0), with activity attributed to China-linked UAT-9686 leveraging the Spam Quarantine interface to gain root execution and deploy custom malware for persistence and evasion. In parallel, Check Point-linked reporting describes RondoDox botnet-driven exploitation of HPE OneView CVE-2025-37164 at scale (tens of thousands of attempts observed), consistent with an “exploit-shotgun” approach used to build botnets for DDoS, cryptomining, and secondary payload delivery; the surge coincided with the flaw’s addition to CISA’s known-exploited list.