Overview
Commvault has issued security advisories highlighting four vulnerabilities impacting both Windows and Linux platforms. Security researchers have demonstrated that these flaws can be chained together by a remote, unauthenticated attacker to achieve remote code execution on a Commvault server.
- CVE-2025-57788: Unauthorised API access vulnerability (CVSSv4 6.9)
- CVE-2025-57789: Weakness in the initial administrator login process (CVSSv4 5.3)
- CVE-2025-57790: Path traversal issue (CVSSv4 8.7)
- CVE-2025-57791: Argument injection flaw in CommServe (CVSSv4 6.9)
Citrix has released a critical security advisory concerning three vulnerabilities in NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway). NetScaler serves as a multifunctional solution providing load balancing, web application firewall (WAF), VPN gateway, and SSL offloading for web apps.
- CVE-2025-7775: Memory buffer operations restriction flaw (CVSSv4 9.2). Exploitation enables unauthenticated remote code execution on NetScaler appliances. This vulnerability is currently being actively exploited.
- CVE-2025-7776: Another memory buffer operations restriction issue (CVSSv4 8.8). Successful attacks could allow an unauthenticated, remote adversary to disrupt services, cause abnormal system behaviour, or trigger denial-of-service conditions.
- CVE-2025-8424: Improper access control weakness (CVSSv4 8.7). Attackers may use this to gain unauthorised access to the NetScaler management interface, potentially resulting in full device compromise.
Git received a security update in July to resolve a high-severity vulnerability that permits arbitrary code execution (CVE-2025-48384). The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added this flaw to its Known Exploited Vulnerabilities (KEV) Catalog
- CVE-2025-48384: Arbitrary code execution through broken configuration quoting (CVSSv3 8.1)
Docker has disclosed a critical vulnerability in Docker Desktop that could allow attackers to escape containers, mount the host file system, and escalate their privileges to those of an administrator. The issue affects both Windows and macOS versions of the application.
- CVE-2025-9074: Container escape vulnerability (CVSSv4 score: 9.3). Exploitation allows a malicious container to access Docker’s internal HTTP API without authentication, create privileged containers, and mount the host file system, potentially granting full access to the host system.
Recommended Action
Organisations are encouraged to review the appropriate security advisory pages and apply the updates:
Commvault – Cloud Security Advisories
Citrix – Security Bulletin
Git – Security Advisories
Docker – Advisory
If you have any concerns, or have been affected by a cyber-related issue, report it to us by submitting a Cyber Concerns Online Reporting Form.