Tuesday, November 25, 2025 Archive

Archived Security Snapshot

Critical vulnerabilities, curated daily for security professionals

Archived Security Brief

Tuesday's vulnerability landscape marks a return to critical vulnerability activity with 3 critical CVEs (first critical disclosures after a 3-day absence) alongside a 147% surge in high-priority vulnerabilities from Monday's 19 to 47 CVEs. Six actively exploited CISA KEV vulnerabilities require immediate remediation across Samsung Mobile, Gladinet Triofox, Microsoft Windows, WatchGuard Firebox, Google Chromium, and Oracle Fusion Middleware systems. The disclosure environment features maximum severity CVSS 9.8-9.9 vulnerabilities affecting MILLENSYS Vision Tools (unauthenticated credential exposure), Fluent Bit log processing (command injection), and Desktop Security System (directory traversal), representing a significant Tuesday escalation in attack surface risk.

  • Critical CVE count increased from 0 to 3 vulnerabilities, marking the return of maximum severity disclosures after a 3-day streak of zero critical CVEs
  • High-priority vulnerabilities surged 147% from 19 to 47 CVEs, representing the highest Tuesday mid-week disclosure volume this month
  • Six actively exploited CISA KEV vulnerabilities maintain steady federal priority remediation requirements, unchanged from Monday's count
  • CVE-2025-63958 (CVSS 9.8) exposes plaintext database credentials and file share paths in MILLENSYS Vision Tools via unauthenticated access to /MILLENSYS/settings endpoint
  • CVE-2025-25736 (CVSS 9.1) allows command injection in Fluent Bit log processing plugins (in_http, in_splunk, in_elasticsearch) through unsanitized log data
  • CVE-2025-38064 (CVSS 9.9) enables directory traversal attacks in Desktop Security System Application Server, allowing arbitrary file system access
  • Tuesday disclosure pattern shows vendors resuming critical vulnerability publication after Monday's moderated weekend recovery activity

Immediate action: IMMEDIATE TUESDAY RESPONSE: Security teams must prioritize the three critical vulnerabilities disclosed today, starting with CVE-2025-63958 (MILLENSYS Vision Tools), which exposes plaintext database credentials through an unauthenticated configuration endpoint accessible at /MILLENSYS/settings. Organizations running MILLENSYS Vision Tools Workspace 6.5.0.2585 should immediately implement Web Application Firewall rules to block external access to this endpoint, rotate all exposed database credentials, and apply vendor patches. CVE-2025-25736 (Fluent Bit) requires immediate mitigation for organizations using Fluent Bit log processing in production environments, as threat actors can inject malicious commands through log data processed by in_http, in_splunk, and in_elasticsearch plugins. Deploy input validation filters and update to patched Fluent Bit versions urgently. CVE-2025-38064 (Desktop Security System) demands directory traversal protection through application server configuration hardening and access control verification. The six CISA KEV vulnerabilities require continued priority remediation to meet federal compliance deadlines, with Samsung Mobile, Microsoft Windows, and Google Chromium V8 vulnerabilities enabling privilege escalation and code execution attacks across consumer and enterprise devices. Organizations should leverage Tuesday maintenance windows to address the 147% surge in high-priority CVEs, focusing first on the 15 CVEs enhanced with Gemini AI analyst comments (indicated by the analysis badge) that provide detailed exploitation scenarios and compensating controls. For vulnerabilities lacking vendor patches, implement network segmentation to isolate affected systems, deploy Web Application Firewalls with command injection and directory traversal detection rules, enable enhanced logging to detect exploitation attempts, and restrict administrative access to trusted IP addresses only.

How to read this brief

CVSS score (e.g. 9.1) — severity from 0–10. Red marks critical (9+), orange high (7–8.9).

Exploitability — how hard the flaw is to attack, read from the CVSS vector:

  • Network / Adjacent / Local / Physical — how close an attacker must get. Network means reachable over the internet.
  • No / Low / High privileges — the access they need first. No privileges means no login required.
  • No interaction / User interaction — whether a victim has to do something (open a file, click a link). No interaction means fully automatable.

The lower the bar on all three, the easier to exploit at scale — “Network · No privileges · No interaction” is the worst case: hit from anywhere, no credentials, no victim action.

Actively exploited — confirmed under attack in the wild (CISA’s Known Exploited Vulnerabilities catalog). Prioritize these regardless of score.

EPSS · Nth percentile — FIRST.org’s estimated chance a flaw is exploited within 30 days. We flag it only in the top 10% — a statistical signal it’s unusually likely to be targeted, separate from whether attacks are confirmed.

💡 Tip: Swipe CVE cards left to ⭐ star, right to ❌ remove

Section Navigation