Vulnerabilities

CVSS

10.0 Critical

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Risk score

100.0

Known exploited

CISA KEV

Published

2025-12-29

Status

Published

Successful exploitation of the vulnerability could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution.

Weaknesses

CWE-434

Coverage 1

threat-intel

Iran-Linked Hackers Use New Cavern C2 Framework to Target Israeli Organizations

Iranian hackers, linked to Iran's Ministry of Intelligence and Security (MOIS) and operating under the moniker Cavern Manticore, are utilizing a new, modular command-and-control (C2) framework called ‘Cavern’ to target I…

The Hacker News · Jul 6, 2026 High

CVE-2025-52691CVE-2025-68613CVE-2025-9316ISIRc2command and controldotnet

All articles mentioning it

Advisories and references

• csa.gov.sg/alerts-and-advisories/alerts/al-2025-124/
• github.com/watchtowrlabs/watchTowr-vs-SmarterMail-CVE-2025-52691?ref...
• cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-...