Loading story…
Rapid7 submitted a Metasploit module for Ivanti Connect Secure that targets the chained vulnerabilities CVE-2023-46805 and CVE-2024-21887, a combination widely associated with remote code execution on exposed appliances. The pull request indicates offensive security tooling has been updated to support exploitation of the authentication bypass and command injection chain, lowering the barrier for defenders and attackers alike to reproduce the issue in testing or live environments.
A separate GitHub reference shows ProjectDiscovery adding a Nuclei template for CVE-2025-4665, identified as a SQL injection flaw in the WordPress CFDB7 plugin. While the available material does not include exploitation details or patch guidance, both references show public security tooling rapidly incorporating newly disclosed vulnerabilities, increasing the urgency for organizations to identify exposed Ivanti gateways and vulnerable WordPress installations and apply mitigations or updates.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
A pull request was published in the nuclei-templates repository to add a template for CVE-2025-4665, identified in the content as a SQL injection vulnerability affecting the WordPress CFDB7 plugin. No patch, exploitation, or victim details are provided in the reference.
A pull request was opened in the Metasploit Framework repository for an exploit module targeting Ivanti Connect Secure vulnerabilities CVE-2023-46805 and CVE-2024-21887. This indicates public exploit tooling development for the chained flaws.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CISA added multiple vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog**, including a critical **SolarWinds Web Help Desk (WHD)** security protection bypass tracked as `CVE-2025-40536` (CVSS 9.8). The issue stems from flawed CSRF-check logic that relies on a whitelist of query parameters, which can be bypassed with crafted URI parameters to reach restricted functionality without authentication; SolarWinds patched the flaw in *WHD 2026.1*. CISA set an accelerated remediation deadline for U.S. Federal Civilian Executive Branch agencies, and Microsoft separately reported an active campaign targeting SolarWinds WHD but did not confirm whether `CVE-2025-40536` was the specific vulnerability exploited. Rapid7 reported that **Metasploit added exploit module support for SolarWinds WHD vulnerabilities `CVE-2025-40536` and `CVE-2025-40551`**, enabling post-exploitation sessions running as `NT AUTHORITY\SYSTEM` when successful. This increases operational risk for unpatched environments by lowering the barrier to exploitation and reinforces the urgency of applying SolarWinds’ available fixes and validating exposure of WHD instances, particularly those reachable from untrusted networks.
Jun 29, 2026
ProjectDiscovery contributors submitted new **Nuclei** detection templates for two high-impact vulnerabilities: `CVE-2025-27364`, a remote code execution flaw affecting **MITRE Caldera**, and `CVE-2025-22457`, a stack-based buffer overflow affecting **Ivanti Connect Secure**, **Policy Secure**, and **ZTA Gateways**. The Caldera submission adds a community template for identifying exposure to the RCE issue, while the Ivanti submission adds version-based detection logic tied to product web portal pages. The Ivanti flaw was described as a **CVSS 9.0** vulnerability in `X-Forwarded-For` header processing and was reported as **actively exploited in the wild** by China-nexus threat actors, with references to **Mandiant**, **Google TAG**, and inclusion in **CISA's Known Exploited Vulnerabilities** catalog. The proposed Ivanti template checks for versions earlier than `22.7R2.6`, giving defenders a way to quickly identify potentially exposed appliances, while the Caldera template expands scanning coverage for organizations using the adversary emulation platform.
Jun 29, 2026
China-nexus threat actors exploited remote code execution flaws in **Ivanti Connect Secure** VPN appliances to breach multiple organizations, according to TeamT5. The reporting links intrusions to abuse of Ivanti vulnerabilities including `CVE-2025-22457`, and follows earlier attention on `CVE-2025-0282`, a pre-authentication RCE tied to a TLS stack overflow in the product's IFT component. The activity shows continued attacker focus on internet-facing Ivanti gateways as an initial access path into enterprise environments. Public exploit development accompanied the disclosures, with GitHub repositories publishing proof-of-concept code and scanner tooling for both `CVE-2025-22457` and `CVE-2025-0282`. The availability of PoCs lowers the barrier for follow-on exploitation and increases pressure on defenders to patch exposed Ivanti Connect Secure systems, hunt for signs of compromise on VPN appliances, and review access originating from those devices into internal networks.
Jul 11, 2026