Tenable Blog

Zoho releases a patch for a critical remote code execution flaw in ManageEngine one day after the vulnerability was publicly disclosed.

Update 03/09/2020: Updated the Analysis section to include information on reports of active exploitation of this vulnerability.

Last week, thousands of security-minded professionals descended on downtown San Francisco for the annual RSA Conference. Monday, February 24, featured a Public Sector Day event, which kicked off the big week with a distinct government security focus. The 400-plus crowd of federal/state/local government officials, security specialists and other interested attendees were treated to a number of informative and instructive keynotes, breakout sessions, and panel presentations. Here are the highlights. 

Vulnerability assessments are one of the best methods to take the pulse of your organization’s network security.

Consider for a moment the lifecycle of a vulnerability – of any size – in the security of the network infrastructure that your organization relies upon. If discovered by malicious online actors, they may choose to exploit it. They can implement everything from dedicated denials of service, which stun your organization's activities, to rootkits that allow more subtle, gradually destructive access. 

Attackers are probing for vulnerable Microsoft Exchange Servers, as details surrounding a severe flaw were recently made public.

Update 02/27/2020: The proof-of-concept section has been updated to reflect the availability of several exploit scripts, including those that can be used to automate exploitation.

Several proof-of-concept exploit scripts for recently patched flaw in Apache Tomcat are now available.