A marked escalation in the abuse of ConnectWise ScreenConnect installers since March 2025, with U.S.-based businesses bearing the brunt of these incursions. Adversaries are now deploying lightweight ClickOnce runner installers—devoid of embedded configurations—to evade static detection, fetching malicious components at runtime. Post-installation, attackers automate the rapid deployment of two distinct remote access trojans (RATs): the […]
A critical vulnerability in SAP S/4HANA is being actively exploited in the wild, allowing attackers with low-level user access to gain complete control over affected systems.
The vulnerability, tracked as CVE-2025-42957, carries a CVSS score of 9.9 out of 10, signaling a severe and imminent threat to organizations running all releases of S/4HANA, both on-premise and in private clouds.
The flaw was discovered by researchers at SecurityBridge Threat Research Labs, who have now verified that malicious actors are already using it.
SAP released a patch on August 11, 2025, and experts are urging all customers to apply the security updates immediately.
SAP S/4HANA Vulnerability Actively Exploited
Successful exploitation of this ABAP code injection vulnerability grants an attacker full administrative privileges. This allows them to access the underlying operating system and gain complete control over all data within the SAP system.
The consequences are dire and can include the theft of sensitive business information, financial fraud, espionage, or the deployment of ransomware.
An attacker could delete or insert data directly into the database, create new administrator accounts with SAP_ALL privileges, download password hashes, and modify core business processes with minimal effort.
What makes CVE-2025-42957 particularly dangerous is its low attack complexity. An attacker only needs access to a low-privileged user account, which could be obtained through phishing or other common methods.
From there, they can exploit the flaw over the network without any user interaction, escalating their privileges to achieve a full system compromise.
SecurityBridge, which responsibly disclosed the vulnerability to SAP on June 27, 2025, warns that unpatched systems are exposed to immediate risk.
Because SAP’s ABAP code is open, reverse engineering the patch to create a working exploit is a relatively simple task for skilled attackers.
Mitigations
Security experts have issued clear guidance for organizations to protect themselves:
Patch Immediately: Apply SAP’s August 2025 security updates, specifically SAP Notes 3627998 and 3633838, without delay.
Review Access: Restrict access to the S_DMIS authorization object and consider implementing SAP UCON to limit RFC usage.
Monitor System Logs: Actively watch for suspicious RFC calls, the creation of new high-privilege users, or unexpected changes to ABAP code.
Harden Defenses: Ensure robust system segmentation, regular backups, and SAP-specific security monitoring solutions are in place to detect and respond to attacks.
Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant Updates.
Attack Surface Management (ASM) is a proactive cybersecurity discipline that helps organizations identify, analyze, and remediate all of their internet-facing assets and potential vulnerabilities. It goes beyond traditional vulnerability scanning to find and continuously monitor unknown or unmanaged assets, such as rogue cloud instances, misconfigured APIs, and shadow IT, that attackers use as entry points. […]
A critical security flaw in SAP S/4HANA, tracked as CVE-2025-42957, is being actively exploited by attackers, according to research from SecurityBridge. The vulnerability, which carries a CVSS score of 9.9 out of 10, allows a low-privileged user to execute code injection and gain full control of an SAP system. Organizations running SAP S/4HANA on-premise or […]
The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent warning regarding critical vulnerabilities in popular TP-Link router models that are currently being actively exploited by cybercriminals. These security flaws affect widely-used home and small business networking devices, putting millions of users at risk. Critical Vulnerabilities Identified Two severe vulnerabilities have been added to […]
A new security exploit has been discovered that lets attackers slip malicious code into widely used desktop applications including Signal, 1Password, Slack, and Google Chrome by evading built-in code integrity checks. The vulnerability, tracked as Electron CVE-2025-55305, affects nearly every app built on the Chromium engine when they use Electron, a popular framework for making […]
A critical security vulnerability impacting SAP S/4HANA, an Enterprise Resource Planning (ERP) software, has come under active exploitation in the wild.
The command injection vulnerability, tracked as CVE-2025-42957 (CVSS score: 9.9), was fixed by SAP as part of its monthly updates last month.
“SAP S/4HANA allows an attacker with user privileges to exploit a vulnerability in the function module
CISA has issued an urgent alert regarding a zero-day vulnerability in the Android operating system that is being actively exploited in real-world attacks.
The vulnerability, identified as CVE-2025-48543, is a high-severity issue that could allow attackers to gain elevated control over affected devices.
On Thursday, September 4, 2025, CISA added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, signaling a confirmed and ongoing threat to users.
The vulnerability is described as a use-after-free vulnerability within the Android Runtime (ART), the core component responsible for executing applications on Android devices.
A malicious actor can exploit this type of memory corruption bug to bypass the robust security confines of the Chrome browser sandbox, resulting in local privilege escalation.
Android 0-Day Use-After-Free Vulnerability
A successful exploit would effectively grant an attacker higher-level permissions on the device, transforming a low-privilege compromise into a significant system-wide breach. This could enable them to install persistent malware, access sensitive user data, or take further control of the compromised device.
According to the information released by CISA, the specific threat actors or the nature of the campaigns leveraging this exploit, such as its use in ransomware attacks, are currently unknown.
However, the inclusion in the KEV catalog confirms that security researchers have observed active exploitation in the wild, meaning attackers were using the flaw before a patch was publicly available.
In response to the active threat, CISA has issued a binding operational directive to all Federal Civilian Executive Branch (FCEB) agencies. These agencies are required to apply the necessary mitigations as instructed by the vendor by a deadline of September 25, 2025.
If patches are not available, agencies are instructed to discontinue the use of the product to prevent potential compromise.
Google has addressed the vulnerability in its September 2025 Android Security Bulletin, released on September 1. CISA’s advisory urges all organizations, as well as individual Android users, to prioritize installing this security update as soon as it is made available by their device manufacturer.
Given the severity of a privilege escalation flaw, all Android users are strongly encouraged to check for and apply the latest system updates immediately. To do so, users can typically navigate to Settings > System > System update.
Prompt patching remains the most critical defense against vulnerabilities that are being actively used in cyberattacks.
Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant Updates.
The Cybersecurity and Infrastructure Security Agency (CISA) has issued a high-priority alert for a newly discovered zero-day vulnerability in the Android Runtime component. This “use-after-free” flaw could allow attackers to escape the Chrome sandbox and elevate privileges on an affected device. CISA warns that the vulnerability is under active exploitation and urges organizations and users […]
A critical, zero-click vulnerability that allows attackers to hijack online accounts by exploiting how web applications handle international email addresses.
The flaw, rooted in a technical discrepancy known as a “canonicalization mismatch,” affects password reset and “magic link” login systems, which are foundational to modern web security.
According to NullSecurityX, the attack requires no interaction from the victim, making it exceptionally dangerous. An attacker can gain full control of an account simply by requesting a password reset using a specially crafted email address that appears identical to the victim’s.
This method bypasses the need for phishing or tricking the user into clicking a malicious link.
The vulnerability stems from the interplay between Unicode, which allows for characters from various languages in domain names (Internationalized Domain Names or IDN), and Punycode, the system that converts these characters into the standard ASCII format used by internet infrastructure.
0-Click Vulnerability Using Punycode
Attackers can register a domain using Unicode characters that are visually indistinguishable from standard letters, such as a Cyrillic ‘o’ instead of a Latin ‘o’.
According to a technical analysis of the vulnerability, the attack unfolds when a web application’s backend processes a password reset request.
For example, an attacker might request a password reset for “victim@gmail.com” but submit the address using a “full-width” ‘m’ (gｍail.com).
The application’s front-end or validation logic may fail to distinguish between the legitimate address and the visually confusable one, approving the request.
However, when the email system sends the reset link, it correctly routes it to the attacker-controlled Punycode version of the domain (e.g., xn--...). The attacker then receives the privileged link and takes over the account, while the legitimate user remains completely unaware.
This “0-click” nature is what makes the threat so severe. The compromise is not a result of user error but a fundamental flaw in how different layers of an application, from the user interface and validation rules to the database and mail servers, handle email addresses.
Each component may interpret the Unicode and Punycode versions differently, creating a gap that attackers can exploit, NullSecurityX said.
“The result is that two addresses that look the same to humans can be handled as different strings by the mail transport,” the research paper states.
Since email often serves as the ultimate “trust anchor” for recovering access to countless other online services, a compromise can have a cascading effect.
Experts are urging developers to immediately review and fortify their authentication systems. Mitigation requires implementing consistent normalization of email addresses across all system components, using robust validation libraries that understand Unicode confusables, and ensuring that database lookups are not susceptible to these visual tricks.
This silent but potent threat highlights the need for a deeper, code-level understanding of how seemingly simple data like an email address is processed and trusted.
Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant Updates.
