erroneo.us
Search all guides⌘K

Digest · Tuesday

Security digest: January 13, 2026

1 editorial brief, 1 known exploited (cisa kev) addition and 4 critical advisories.

All digests · RSS · Markdown

Take stock

  • Act now: FortiOS CVE-2025-25249 and CVE-2025-61624 Now Exploited. Owners of FortiGate firewalls and FortiSwitchManager, FortiProxy or FortiPAM appliances below the fixed builds, starting with any device that has the fabric service or CAPWAP (UDP 5246-5249) reachable from untrusted networks.
  • Do you run any of these? Microsoft Windows. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-02-03.
  • npm: 2 critical advisories (@orval/mcp, opencode-ai). Check with npm audit (or: npm ls <package>).
  • RubyGems: 1 critical advisory (openc3). Check with bundle audit check --update.
  • NuGet: 1 critical advisory (UmbracoForms). Check with dotnet list package --vulnerable --include-transitive.
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Act now

· Vulnerability · CVE-2025-25249, CVE-2025-61624

FortiOS CVE-2025-25249 and CVE-2025-61624 Now Exploited

If you run FortiGates, get to FortiOS 7.4.10+ or 7.6.5+ now and hunt for implants: one bug gives unauthenticated attackers code execution over CAPWAP and is being exploited at scale, and the other turns stolen admin logins into root implants.

Must act: Owners of FortiGate firewalls and FortiSwitchManager, FortiProxy or FortiPAM appliances below the fixed builds, starting with any device that has the fabric service or CAPWAP (UDP 5246-5249) reachable from untrusted networks.

Can relax: FortiSASE customers (Fortinet patched the service itself), devices already on FortiOS 7.4.10+ or 7.6.5+ that show no signs of compromise, and teams with no Fortinet equipment.

  1. Inventory every FortiGate, FortiSwitchManager, FortiProxy and FortiPAM with its version (get system status).
  2. Upgrade FortiOS to 7.4.10+ or 7.6.5+, which covers both CVEs; move 7.2, 7.0 and 6.4 units to a fixed branch.
  3. Until patched, remove the fabric service from internet-facing interfaces and block UDP 5246-5249 from untrusted networks with a local-in policy.

Read the brief →

Known exploited (CISA KEV) 1

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

CVEProduct and flawCISA due
CVE-2026-20805Microsoft Windows
Microsoft Windows Information Disclosure Vulnerability		2026-02-03

Critical advisories by ecosystem 4

GitHub-reviewed advisories rated critical, published this day (Pacific time).

npm 2

Check: npm audit (or: npm ls <package>)

NuGet 1

Check: dotnet list package --vulnerable --include-transitive

RubyGems 1

Check: bundle audit check --update