Cybersecurity Threats: Four Vulnerabilities Added to CISA's Known Exploited Vulnerabilities (KEV) Catalog

In a significant move to safeguard digital security, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has updated its Known Exploited Vulnerabilities (KEV) catalog, adding four software vulnerabilities that are currently being actively exploited. This development underscores the urgent need for organizations worldwide, including those in North East India, to prioritize cybersecurity measures.

Vulnerabilities and Their Implications

The newly added vulnerabilities and their implications are as follows:

• CVE-2025-68645 (CVSS score: 8.8)

  This is an APHP remote file inclusion vulnerability in Synacor Zimbra Collaboration Suite (ZCS). It allows a remote attacker to craft malicious requests and include arbitrary files from the WebRoot directory, bypassing authentication. The vulnerability was fixed in November 2025, but its exploitation has been ongoing since January 14, 2026.

• CVE-2025-34026 (CVSS score: 9.2)

  This is an authentication bypass vulnerability in the Versa Concerto SD-WAN orchestration platform. It allows an attacker to access administrative endpoints, potentially leading to unauthorized access and system compromise. The vulnerability was fixed in April 2025.

• CVE-2025-31125 (CVSS score: 5.3)

  This is an improper access control vulnerability in Vite Vitejs. It could allow contents of arbitrary files to be returned to the browser, potentially leading to information disclosure. The vulnerability was fixed in March 2025.

• CVE-2025-54313 (CVSS score: 7.5)

  This is an embedded malicious code vulnerability in eslint-config-prettier. It could allow for the execution of a malicious DLL called Scavenger Loader, designed to deliver an information stealer. This vulnerability is part of a supply chain attack that targeted eslint-config-prettier and six other npm packages.

Relevance to North East India and Broader Indian Context

While these vulnerabilities were discovered and fixed by the respective software developers, their continued exploitation underscores the need for organizations worldwide, including in North East India, to stay vigilant and update their systems promptly. Cybersecurity threats are not confined to any geographical region, and it is crucial for organizations to prioritize cybersecurity measures to protect their digital assets.

Future Implications and Recommendations

In response to the addition of these vulnerabilities to the KEV catalog, Federal Civilian Executive Branch (FCEB) agencies in the U.S. are required to apply the necessary fixes by February 12, 2026. Organizations in North East India and elsewhere should follow suit, ensuring their networks are secure against active threats.

Regular updates, prompt patching, and employee training on cybersecurity best practices are essential to mitigate the risks posed by known exploited vulnerabilities. By prioritizing cybersecurity, organizations can safeguard their digital assets and protect themselves against potential cyberattacks.