From the Desk of Melissa Irace, CISO
This week’s threats highlight a clear and concerning trend: attackers are targeting trusted management and security platforms, including email gateways, identity systems, virtualization infrastructure, remote support tools, and software development platforms. These systems provide broad access and high-value opportunities for attackers. The key is to detect and respond quickly, validate your defenses, and prioritize remediation of actively exploited vulnerabilities before they can be leveraged to expand access and disrupt operations.
Weekly executive summary
This week’s cyber activity reinforces a clear trend: attackers are targeting the trusted systems organizations rely on to operate and protect their business. Active exploitation of Cisco Secure Email Gateway, Cisco Identity Services Engine, VMware vCenter, ConnectWise ScreenConnect, and GitLab highlights the focus on email security, identity infrastructure, virtualization, remote support, and software development platforms.
These technologies are high-value targets because they provide broad access across the environment when compromised.
The takeaway for leaders: it’s not just about patching. Organizations must validate whether their defenses are working, monitor privileged access, and ensure critical systems can continue operating if a disruption occurs.
Melissa’s perspective
“The biggest risk right now isn’t the endpoint — it’s the trusted platforms we rely on. Security infrastructure, identity systems, virtualization, remote support, and software development tools are prime targets. Organizations should prioritize visibility and validate their defenses.”
This week’s top threats
01 · Critical
Cisco Secure Email Gateway under active exploitation
Attackers are exploiting a critical zero-day in Cisco Secure Email Gateway, allowing unauthenticated remote code execution via a crafted email. Compromise can provide root-level access to the appliance and trusted email infrastructure.
How Intuitus helps
- External Attack Surface Assessments
- Penetration Testing as a Service (PTaaS)
- Email Security Reviews
- Security Architecture Assessments
- Vulnerability Assessments
Source: BleepingComputer, “Cisco Secure Email Gateway zero-day exploited in attacks”
02 · High
VMware vCenter targeted by ransomware groups
Ransomware actors are exploiting a critical vCenter vulnerability to gain unauthorized access, deploy reverse SSH tools, and move laterally across environments. Compromise can impact multiple systems and disrupt critical operations.
How Intuitus helps
- Ransomware Readiness Assessments
- Penetration Testing as a Service (PTaaS)
- Vulnerability Assessments
- Business Continuity Planning
- MDR
Source: BleepingComputer, “CISA: Critical VMware vCenter RCE flaw now exploited by ransomware gangs”
03 · High
Cisco Identity Services Engine under active attack
Cisco ISE is being actively exploited through an authentication-bypass vulnerability, allowing attackers to access the management interface without valid credentials, potentially gaining control of network access and identity policies.
How Intuitus helps
- Identity Security Assessments
- Network Security Assessments
- Penetration Testing as a Service (PTaaS)
- Vulnerability Assessments
- MDR
Source: BleepingComputer, SecurityWeek, “Cisco warns of max severity ISE zero-day exploited in attacks”
04 · High
ConnectWise ScreenConnect being abused
A critical vulnerability in ScreenConnect is actively being exploited, allowing attackers to transfer and execute files through remote sessions. Attacks have leveraged modified clients to spread malicious scripts and payloads across environments.
How Intuitus helps
- Third-Party Risk Assessments
- Penetration Testing as a Service (PTaaS)
- Security Architecture Assessments
- Vulnerability Assessments
- MDR
Source: SecurityWeek, “ConnectWise patches ScreenConnect vulnerability exploited in worm-like attacks”
05 · Medium
GitLab supply chain risks continue to grow
Attackers are exploiting a maximum-severity GitLab flaw to access configuration files, credentials, SSH keys, and CI/CD secrets. This can lead to compromise of development pipelines and downstream production environments.
How Intuitus helps
- Application Security Assessments
- DevSecOps Reviews
- Cloud Security Assessments
- Penetration Testing as a Service (PTaaS)
- MDR
Source: Dark Reading, BleepingComputer, “Maximum Severity GitLab Flaw Puts Supply Chains at Risk”
Our approach
We don’t simply report threats. We help organizations understand their business impact, validate their defenses, and build resilience before an incident occurs. Our intelligence-driven approach transforms emerging cyber threats into practical, prioritized actions that strengthen security, improve operational resilience, and support informed executive decisions.
Five actions to take this week
- Prioritize patching. Immediately patch internet-facing and actively exploited systems.
- Review access. Audit privileged accounts and enforce Multi-Factor Authentication (MFA).
- Secure remote access. Review and monitor remote-access and third-party support tools for unauthorized activity.
- Monitor development. Check software development and cloud environments for exposed credentials or secrets.
- Prepare and respond. Validate business continuity and ransomware response plans to ensure critical services can be restored quickly.