🚨 CISA Alert: Two Critical Adobe and Oracle Vulnerabilities Are Being Actively Exploited!

Raluca Gheorghita February 25, 2025

Cybersecurity is once again under pressure as the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two critical vulnerabilities in Adobe ColdFusion and Oracle Agile Product Lifecycle Management (PLM) to its Known Exploited Vulnerabilities (KEV) list. These vulnerabilities allow attackers to execute remote code and compromise affected systems.

🚨 Which Vulnerabilities Are Being Exploited?

CISA has identified two actively exploited vulnerabilities, one of which has a critical CVSS score of 9.8:

🔴 CVE-2017-3066 (CVSS Score: 9.8) – A deserialization vulnerability in Adobe ColdFusion, caused by an issue in the Apache BlazeDS library. This flaw allows attackers to execute arbitrary code on the affected system.

📌 Fix: Adobe addressed this issue in April 2017, but unpatched systems remain at risk.

🔴 CVE-2024-20953 (CVSS Score: 8.8) – A deserialization vulnerability in Oracle Agile PLM, which can be exploited by a low-privileged attacker via HTTP to compromise the system.

📌 Fix: Oracle released a patch in January 2024, but organizations must ensure they have applied it.

⚠️ Why Are These Vulnerabilities Dangerous?

Deserialization vulnerabilities are highly dangerous as they allow attackers to inject and execute malicious code on vulnerable servers. Once exploited, they can facilitate data theft, unauthorized access, and even ransomware deployment.

🛡️ How Can You Protect Yourself?

If you are using Adobe ColdFusion or Oracle Agile PLM, immediate action is essential! CISA has mandated federal agencies to patch these issues by March 17, 2025.

📌 Essential Security Steps:
✅ Apply the official patches provided by Adobe and Oracle – attackers specifically target unpatched systems!
✅ Monitor network traffic and suspicious activities on affected servers.
✅ Use WAF (Web Application Firewall) protections to block exploitation attempts.
✅ Review access control policies and restrict unnecessary external connections.
✅ Segment your IT infrastructure to minimize the impact of a potential breach.

🔐 Hack & Fix: Advanced Protection Against Exploited Vulnerabilities

Cybercriminals are always one step ahead, and software vulnerabilities are actively being exploited right now. However, you can prevent an attack before it's too late. Hack & Fix provides advanced security testing, vulnerability identification, and proactive protection against exploits.

💻 How Can Hack & Fix Secure Your Business?

🔹 External Network Pentest – Identifies vulnerabilities in your external network before hackers do.
🔹 Internal Network Pentest – Simulates internal attacks to uncover weaknesses in your IT infrastructure.
🔹 Web Application & API Pentest – Protects your data and customers by securing web applications and APIs.
🔹 Vulnerability Scan & Assessment – Detects and fixes vulnerabilities before they can be exploited.
🔹 Red Team Exercise – Tests your organization's ability to defend against real-world cyber threats.
🔹 Phishing & Social Engineering – Trains your employees to recognize and avoid phishing attacks.
🔹 Android & iOS Application Pentest – Ensures mobile apps are secure for end users.
🔹 OSINT & Threat Hunting – Identifies and neutralizes hidden threats within your digital environment.
🔹 Cloud Security Assessment – Strengthens your cloud infrastructure against cyberattacks.

🔎 Conclusion: A New Wave of Exploits?

The fact that these older vulnerabilities are still being exploited proves that security patches are not being implemented quickly enough in many organizations. Hackers take advantage of this to infiltrate networks and gain unauthorized access.

📢 Now is the time to act! If you use Adobe ColdFusion or Oracle Agile PLM, apply the latest patches immediately.

💬 How often do you apply security updates in your organization? Do you think these attacks will become even more frequent? Let us know in the comments!