Serial number:AV25-821
Date:December 9, 2025
Updated:December 16, 2025

On December 9, 2025, Fortinet published security advisories to address vulnerabilities in multiple products including two critical vulnerabilities (CVE-2025-59718, CVE-2025-59719):

• FortiOS 7.6 – versions prior to 7.6.4
• FortiOS 7.4 – versions prior to 7.4.9
• FortiOS 7.2 – versions prior to 7.2.12
• FortiOS 7.0 – versions prior to 7.0.18
• FortiProxy 7.6 – versions prior to 7.6.4
• FortiProxy 7.4 – versions prior to 7.4.11
• FortiProxy 7.2 – versions prior to 7.2.15
• FortiProxy 7.0 – versions prior to 7.0.22
• FortiSwitchManager 7.2 – versions prior to 7.2.7
• FortiSwitchManager 7.0 – versions prior to 7.0.6
• FortiWeb 8.0 – versions prior to 8.0.1
• FortiWeb 7.6 – versions prior to 7.6.5
• FortiWeb 7.4 – versions prior to 7.4.10

The FortiCloud SSO Login Authentication feature must be enabled on the affected products for these vulnerabilities to be exploited.

Update 1

On December 16, 2025, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2025-59718 to their Known Exploited Vulnerabilities (KEV) Database.

Open-source reporting indicates that CVE-2025-59718 is being exploited.

The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates.

• Multiple Fortinet Products' FortiCloud SSO Login Authentication Bypass
• Fortinet PSIRT Advisories
• CISA KEV : CVE-2025-59718

Serial number:AV25-841
Date:December 16, 2025

Between December 8 and 14, 2025, Red Hat published security advisories to address vulnerabilities in multiple products. Included were updates to address vulnerabilities in the Linux kernel for the following products:

• Red Hat Enterprise Linux – multiple versions and platforms
• Red Hat CodeReady Linux Builder – multiple versions and platforms
• Red Hat Enterprise Linux Server – multiple versions and platforms

The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.

• Red Hat Security Updates - RHSA-2025:22997
• Red Hat Security Updates - RHSA-2025:22995
• Red Hat Security Updates - RHSA-2025:23009
• Red Hat Security Updates - RHSA-2025:22854
• Red Hat Security Advisories

Serial number:AV25-840
Date:December 15, 2025

On December 11, 2025, ConnectWise published a security advisory to address a vulnerability in the following product:

• ConnectWise ScreenConnect – versions prior to 25.8

The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.

• ScreenConnect 25.8 Security Patch
• ConnectWise - Latest Advisories

Serial number:AV25-839
Date:December 15, 2025

Between December 8 and 14, 2025, VMware published security advisories to address vulnerabilities in multiple Tanzu products.

• VMware Tanzu RabbitMQ on Kubernetes – versions prior to 4.1.6
• VMware Tanzu RabbitMQ on Kubernetes – versions prior to 4.2.1

The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.

• Product Release Advisory - VMware Tanzu RabbitMQ on Kubernetes 4.1.6
• Product Release Advisory - VMware Tanzu RabbitMQ on Kubernetes 4.2.1
• Security Advisories – Tanzu

Serial number:AV25–838
Date:December 15, 2025

Between December 8 and 14, 2025, CISA published ICS advisories to address vulnerabilities in the following products:

• AzeoTech DAQFactory – release 20.7 (Build 2555) and prior
• Festo Software LX Appliance – versions prior to June 2023
• Grassroots DICOM (GDCM) – versions 3.0.24 and prior
• Grassroots Simple TK – versions 2.5.2 and prior
• Grassroots medlnria – versions 4.0 and prior
• Johnson Controls iSTAR – multiple models and versions
• Multiple India-based CCTV Cameras – D-Link DCS-F5614-L1, Sparsh Securitech and Securus
• OpenPLC_V3 – versions prior to pull request #310
• Siemens Advanced Licensing (SALT) Toolkit – multiple models and versions
• Siemens Building X - Security Manager Edge Controller (ACC-AP) – all versions
• Siemens Energy Services – all versions with G5DFR
• Siemens Gridscale X Prepay – versions prior to 4.2.1
• Siemens IAM Client – multiple models and versions
• Siemens SINEMA Remote Connect Server – versions prior to V3.2 SP4
• U-Boot – versions prior to 2017.11 on multiple Qualcomm chips
• Varex Imaging Panoramic Dental Imaging Software – versions prior to 6.6.1.490

The Cyber Centre encourages users and administrators to review the provided web link, perform the suggested mitigations and apply the necessary updates if available.

• CISA ICS Advisories

Serial number:AV25-837
Date: December 15, 2025

On December 12, 2025, Apple published a security update to address vulnerabilities in the following products:

• iOS – versions prior to 26.2
• iPadOS – versions prior to 26.2
• iOS – versions prior to 18.7.3
• iPadOS – versions prior to 18.7.3
• macOS Tahoe – versions prior to 26.2
• macOS Sequoia – versions prior to 15.7.3
• macOS Sonoma – versions prior to 14.8.3
• tvOS – versions prior to 26.2
• watchOS – versions prior to 26.2
• visionOS – versions prior to 26.2
• Safari – versions prior to 26.2

Apple is aware that CVE-2025-14174 and CVE-2025-43529 are being exploited.

On December 12, 2025, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2025-14174 to their Known Exploited Vulnerabilities (KEV) Database. CISA added CVE-2025-43529 to the KEV on December 15, 2025.

The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates.

• Apple Security Updates
• Known Exploited Vulnerabilities Catalog | CISA