Threat advisories

Top Middle East Cyber Threats – July 15th, 2025

By helpag

At Help AG, our Managed Security Services (MSS) team offers 24x7x365 monitoring of complex IT security infrastructures to some of the largest enterprises in the region. As a result, we have our eyes keenly fixed on the cybersecurity threat landscape and are among the first in the region to learn and act upon new threats.

Citrix Mitigates Security Flaws Across NetScaler and VDA Products

Citrix has issued 6 security fixes: 2 Critical, 3 High, and 1 Medium severity.

The medium vulnerability (CVE-2025-4365) allows arbitrary file reads in NetScaler Console and SDX (SVM).

High-severity flaws (CVE-2025-6759, CVE-2025-0320) enable local privilege escalation to SYSTEM on Windows VDA and Secure Access Client. Another (CVE-2025-5349) affects access control on the NetScaler Management Interface.

The critical issues (CVE-2025-6543, CVE-2025-5777) involve memory overflow and overread risks, potentially leading to Denial-of-Service (DoS) or remote code execution in NetScaler ADC and Gateway.

RECOMMENDATIONS

Ensure all systems are patched and updated.

Microsoft Releases Fixes Targeting Edge Security Vulnerabilities

Microsoft has released 3 medium-severity security fixes for Microsoft Edge (Chromium-based), addressing the following vulnerabilities:

CVE-2025-47963: A spoofing vulnerability in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. No associated CWE has been assigned.

CVE-2025-47182: Due to improper input validation, an authorized local attacker can bypass a security feature in Microsoft Edge (Chromium-based).

CVE-2025-47964: Another spoofing vulnerability affecting Microsoft Edge (Chromium-based).

Fortinet Discloses Buffer Overflow Vulnerability in FortiOS

Fortinet has disclosed a heap-based buffer overflow vulnerability in the cw_stad daemon of FortiOS, tracked as CVE-2025-24477 and classified under CWE-122.This vulnerability may allow an authenticated attacker to execute arbitrary code or commands by sending specially crafted requests.

While the flaw has been assigned a CVSS v3 score of 4.0 (Medium severity), the possibility of privilege escalation introduces a significant risk for affected systems.

The issue impacts specific versions of FortiOS.

FortiOS 7.6 – upgrade to 7.6.3 or later

FortiOS 7.4 – upgrade to 7.4.8 or later

FortiOS 7.2 – upgrade to 7.2.12 or later

FortiOS 7.0 and 6.4 – not affected

Organizations using impacted FortiOS versions are strongly urged to apply the appropriate updates to mitigate the risk of exploitation.

RECOMMENDATIONS

Ensure all systems are patched and updated.

Splunk Releases Security Patches Addressing Multiple Vulnerabilities

Splunk has released 8 security patches: 7 medium and 1 low severity. Affected versions include Splunk Enterprise below 9.4.3 and Splunk Cloud Platform subversions.

Notable vulnerabilities include:

DoS and CSRF exploits targeting path traversal and cluster manipulation (CVE-2025-20320, 20322, 20321)
Privilege misuse allowing alert suppression and disabling of scheduled searches (CVE-2025-20300, 20323)
Remote code execution via unsanitized scripted inputs (CVE-2025-20319)
Unauthorized config changes through API misuse (CVE-2025-20324)
Exposure of splunk.secret key in debug logging (CVE-2025-20325)

RECOMMENDATIONS

Ensure all systems are patched and updated.

Google Chrome Releases Fixes for Critical Cookie Encryption Vulnerabilities

Google Chrome has released 3 security fixes, addressing 2 critical and 1 high-severity vulnerabilities related to the AppBound cookie encryption mechanism.

CVE-2025-34091 (High): A padding oracle vulnerability in AppBound encryption allows local attackers to exploit verbose decryption errors in Windows Event Logs, enabling recovery of encrypted cookie keys and low-privileged cookie theft.

CVE-2025-34090 (Critical): A security bypass due to improper validation of Component Object Model (COM) server paths allows attackers to hijack Class Identifier (CLSID) registration. This causes Google Chrome to fall back to legacy encryption protocols, exposing cookies to malware running in the user’s context.

CVE-2025-34092 (Critical): A cookie encryption bypass arises from weak path validation. Attackers can impersonate Chrome using path spoofing to retrieve protected cookie keys.

References

https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694729
https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694820
https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694724
https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694788
https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX693420

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-47963
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-47182
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-47964

https://fortiguard.fortinet.com/psirt/FG-IR-25-026

https://advisory.splunk.com/advisories/SVD-2025-0703
https://advisory.splunk.com/advisories/SVD-2025-0708
https://advisory.splunk.com/advisories/SVD-2025-0706
https://advisory.splunk.com/advisories/SVD-2025-0702
https://advisory.splunk.com/advisories/SVD-2025-0705
https://advisory.splunk.com/advisories/SVD-2025-0707
https://advisory.splunk.com/advisories/SVD-2025-0709
https://advisory.splunk.com/advisories/SVD-2025-0704

https://vulncheck.com/advisories/google-chrome-appbound-cookie-encryption
https://www.cyberark.com/resources/threat-research-blog/c4-bomb-blowing-up-chromes-appbound-cookie-encryption