Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

LevelBlue Labs is tracking a severe vulnerability in Windows Server Update Services (WSUS), CVE-2025-59287, that allows attackers to remotely execute code without authentication and is being exploited by threat actors to compromise vulnerable Windows Server users.

Welcome to The researcher’s desk – a content series where the Detectify security research team conducts a technical autopsy on vulnerabilities that are particularly interesting, complex, or persistent. The goal here is not to report the latest research (for which you can refer to the Detectify release log); it is to take a closer look at certain vulnerabilities, regardless of their disclosure date, that still offer critical lessons.

A critical zero-day, CVE-2025-64446, path-traversal vulnerability in Fortinet FortiWeb, the company’s Web Application Firewall (WAF), is being actively exploited in the wild to create unauthorized administrator accounts on exposed systems. This flaw allows unauthenticated attackers to gain complete administrator access to affected devices.

On November 13, 2025, open source reporting began detailing active exploitation of a silently patched Fortinet FortiWeb vulnerability. The flaw is a path traversal issue in the FortiWeb web application firewall (WAF) that allows an unauthenticated threat actor to create new administrative users on exposed devices. The following day, November 14, Fortinet officially addressed the vulnerability in an advisory, tracking it as CVE‑2025‑64446.

AI has collapsed the vulnerability exploit lifecycle. Adversaries now discover, weaponize, and exploit exposures across hybrid environments in minutes — chaining together misconfigurations, unpatched systems, and stolen credentials to gain rapid access and move laterally across environments. For defenders, the speed of the adversary changes everything.

Picture this: a critical vulnerability hits your dependency tree. Security flags it as high-priority, but the development team pushes back because the upgrade breaks three integration tests. Sound familiar? You’re not alone. It’s the same story for countless organizations, and it potentially costs your team countless hours of development time and revenue lost.

The Django Software Foundation has rolled out important security fixes addressing two serious vulnerabilities that could let attackers manipulate databases and disrupt application availability. The vulnerabilities such as CVE-2025-64459 (SQL Injection) and CVE-2025-64458 (Denial of Service), were found in commonly used functions of the Django web framework. These vulnerabilities affect how Django processes queries and handles redirects, especially when user-supplied input is not properly validated.

We’re proud to share that Nucleus Security has been named a Challenger in the inaugural 2025 Gartner Magic Quadrant for Exposure Assessment Platforms (EAPs) — recognized for our completeness of vision and ability to execute. This marks a significant milestone not only for Nucleus, but for the evolution of our entire industry. For the first time, Gartner has formally recognized Exposure Assessment Platforms as a distinct category.