You're listening to the CyberWire Network, powered by N2K.

This is a SISO Cybersecurity Alert.

ID number Alpha Alpha-22 TAC 138 Bravo.

Original release date, May 18, 2022, last revised, May 18th, 2022.

Last revised, May 19th, 2022.

CISA is releasing the Cybersecurity Advisory to warn organizations that malicious cyber actors are exploiting C. V. E. 2022- 22954 and C. V.E. 2022. 2960 separately and in combination. These vulnerabilities affect versions

of VMware products. Successful exploitation permits malicious actors to trigger a

server-side template injection that may result in remote

code execution or escalation of privileges to root-level access.

VMware released updates for both vulnerabilities on April 6th, 2022.

Malicious cyber actors were able to reverse engineer the updates to develop an

exploit within 48 hours and began exploiting vulnerabilities in unpatched

devices.

Based on this activity, CISA... exploiting vulnerabilities in unpatched devices.

Based on this activity, CISA expects cyber actors to quickly develop exploits for the new

VMware vulnerability C. V.E. 2022-22972 and 22973.

In response, CISA has released Emergency Directive 2-03, which requires emergency action from

federal civilian executive branch agencies to immediately implement updates or remove the affected software from their network.

This directive and resources remediation actions can be found in the show notes.

CISA has received information, including indicators of compromise,

about observed exploitation already underway at multiple large organizations

from trusted third parties.

...