status_reason: confirmed

notes: Affected: Omnissa / Omnissa Workspace ONE UEM | Description: Omnissa Workspace ONE UEM contains a Secondary Context Path Traversal Vulnerability. A malicious actor may be able to gain access to sensitive information by sending crafted GET requests (read-only) to restricted API endpoints | Origin source: CERT-PL | Notes: https://moje.cert.pl/komunikaty/2025/29/aktywnie-wykorzystywana-krytyczna-podatnosc-w-narzedziu-omnissa-workspace-one-uem-airwatch-mdm/

source: enisa-cnw-kev

catalog: ENISA / EU CSIRTs Network (CNW) KEV CSV

product: Omnissa Workspace ONE UEM

originSource: CERT-PL

vendorProject: Omnissa


notes: Affected: Citrix / Citrix ADC and Citrix Gateway | Origin source: cnw

product: Citrix ADC and Citrix Gateway

originSource: cnw

vendorProject: Citrix


notes: Affected: Red Hat / JBoss Application Server | Description: some management interfaces remain accessible and lack effective access control mechanisms | Origin source: CERT Italia | Notes: https://www.acn.gov.it/portale/w/distribuzione-di-payload-malevoli-tramite-vulnerabilita-note

product: JBoss Application Server

originSource: CERT Italia

vendorProject: Red Hat


notes: Affected: Red Hat / JBoss Application Server | Description: this management interface allows administrative operations to be performed without adequate access controls allowing a remote attacker to interact with the system in an unauthorized manner | Origin source: CERT Italia | Notes: https://www.acn.gov.it/portale/w/distribuzione-di-payload-malevoli-tramite-vulnerabilita-note


notes: Affected: Apache / Commons Collections library | Description: the system accepts serialized objects without verifying their origin or reliability allowing an attacker to send specially crafted payloads that are then deserialized and executed | Origin source: CERT Italia | Notes: https://www.acn.gov.it/portale/w/distribuzione-di-payload-malevoli-tramite-vulnerabilita-note

product: Commons Collections library

vendorProject: Apache


notes: Affected: Red Hat / JBoss Application Server | Description: the servlet exposes an endpoint that allows you to invoke Java Management Extensions (JMX) operations without any authentication or access control | Origin source: CERT Italia | Notes: https://www.acn.gov.it/portale/w/distribuzione-di-payload-malevoli-tramite-vulnerabilita-note


notes: Affected: Fortinet / FortiOS/FortiProxy | Description: authentication bypass using an alternate path or channel vulnerability | Exploitation type: ransomware | CWEs: CWE-288 | Origin source: cnw

product: FortiOS/FortiProxy

vendorProject: Fortinet

exploitationType: ransomware


notes: Affected: Apache / ActiveMQ | Exploitation type: ransomware | Origin source: cnw

product: ActiveMQ


notes: Affected: F5 / BIG-IP | Exploitation type: ransomware | Origin source: cnw

product: BIG-IP


notes: Affected: Microsoft / Netlogon (ZeroLogon) | Exploitation type: ransomware | Origin source: cnw

product: Netlogon (ZeroLogon)

vendorProject: Microsoft


notes: Affected: Fortinet / FortiClientEMS | Exploitation type: ransomware | Origin source: cnw

product: FortiClientEMS


notes: Affected: Atlassian / Confluence Server and Data Server | Exploitation type: ransomware | Origin source: cnw

product: Confluence Server and Data Server

vendorProject: Atlassian


notes: Affected: Fortinet / FortiOS and FortiProxy | Exploitation type: ransomware | Origin source: cnw

product: FortiOS and FortiProxy


notes: Affected: Microsoft / Windows (SMBv1 - EternalBlue) | Exploitation type: ransomware | Origin source: cnw

product: Windows (SMBv1 - EternalBlue)


notes: Affected: Citrix / Citrix ADC and Citrix Gateway | Exploitation type: ransomware | Origin source: cnw


notes: Affected: Microsoft / Windows BITS26 | Exploitation type: ransomware | Origin source: cnw

product: Windows BITS26


notes: Affected: Ivanti / CSA (Cloud Services Appliance) | Origin source: cnw

product: CSA (Cloud Services Appliance)

vendorProject: Ivanti