Critical CVEs and ransomware chaining expose enterprise attack paths

At a glance

What this is: This weekly report tracks active exploitation of critical CVEs and ransomware tradecraft, with Oracle E-Business Suite, Redis, GoAnywhere MFT, Unity, and SonicWall all appearing in the same threat window.

Why it matters: For IAM, PAM, and NHI teams, the report matters because several attack paths hinge on authentication bypass, credential harvesting, standing access, and post-compromise privilege use.

By the numbers:

• Seven major incidents dominated the threat landscape in the week of October 7-13, 2025.
• 570+ potentially vulnerable Oracle E-Business Suite instances were identified by the Shadowserver Foundation.

👉 Read FireCompass's weekly report on new hacking techniques and critical CVEs

Context

The central problem is not just that critical vulnerabilities exist, but that exploit chains are increasingly short, automated, and operationally mature. Once attackers can move from initial access to code execution, persistence, and exfiltration within one incident window, traditional patch cadence and quarterly exposure reviews no longer match the pace of risk. For identity and access teams, that speed matters because authentication bypass, credential theft, and privileged tool abuse are often the bridge from vulnerability to business impact.

This report is primarily a threat synthesis, not a vendor product analysis. It is useful because it shows how CVEs, exposed credentials, and ransomware operations are converging into a single attack economy. That convergence is typical of current enterprise risk, especially where internet-facing systems, privileged service accounts, and remote management tooling are not tightly governed.

Key questions

Q: What breaks when an internet-facing access broker is vulnerable to pre-auth RCE?

A: The trust boundary breaks first. An attacker can run code before authentication, which means the device that is supposed to control access becomes the initial foothold. From there, persistence, management-plane abuse, and lateral movement become realistic because the attacker is operating inside the broker itself, not outside it.

Q: Why do credentials and privilege matter so much in ransomware incidents?

A: Ransomware operators usually need administrative access to disable security tools, stop services, move laterally, and encrypt at scale. Stolen credentials often matter more than the initial malware sample because they give the attacker control over timing and scope. IAM and PAM controls therefore directly shape whether an intrusion becomes a widespread outage.

Q: How can security teams tell whether exploit activity has become an identity incident?

A: Look for account creation, privilege changes, anomalous administrative tools, directory reconnaissance, or sudden credential rotation needs on the affected host. If those signals appear, the exploit has likely moved into identity territory. Teams should treat those indicators as a containment trigger, not a secondary investigation detail.

Q: Should organisations prioritise patching or identity hardening first after active exploitation is detected?

A: They should do both, but identity hardening often limits the fastest spread while patching addresses the root entry point. If the exploit path already includes SSO, tokens, or privileged credentials, revocation and containment can reduce impact before the patch cycle completes.

Technical breakdown

Oracle E-Business Suite RCE: how the exploit chain bypasses trust controls

CVE-2025-61882 combines server-side request forgery, CRLF injection, authentication bypass, and unsafe XSLT processing to reach remote code execution in Oracle E-Business Suite. The path matters because each stage weakens a different trust boundary: request validation, session validation, and template execution. Once the attacker can upload a malicious XSLT template through the XML Publisher flow, code runs when the template is previewed. That makes the vulnerability especially dangerous in systems where application features are exposed to untrusted input.

Practical implication: segment internet-facing ERP components and treat template-processing paths as high-risk execution surfaces.

Redis RediShell and why authenticated access is enough

RediShell is a use-after-free flaw in Redis Lua scripting that allows an authenticated user to escape the sandbox and execute code on the host. The important technical point is that authentication alone does not equal safety when the runtime itself becomes the escalation mechanism. If an attacker can trigger vulnerable Lua behavior, they can move from application-level access to host compromise, then establish persistence or reverse shells. This is a classic example of why service authentication and runtime hardening must be evaluated together.

Practical implication: restrict Lua scripting exposure, enforce Redis authentication, and monitor for anomalous script execution.

GoAnywhere MFT post-exploitation: how attackers turn one flaw into full control

The GoAnywhere incident shows the common post-exploitation sequence after command injection: initial access, persistence through RMM tools, discovery, lateral movement, command and control, exfiltration, and finally ransomware deployment. Each stage uses legitimate administrative or remote support tooling to blend in with normal operations. That makes the boundary between vulnerability management and identity governance very thin, because once privileged access is established, attackers often reuse trusted channels rather than noisy malware. The technical lesson is that compromise of an MFT system can become an enterprise-wide trust event.

Practical implication: watch MFT and remote-management logs for tool installation, tunnel creation, and unusual RDP activity.

Threat narrative

Attacker objective: The objective is to convert a public-facing foothold into durable enterprise access, then monetise it through theft, extortion, or ransomware.

1. Entry occurred through exploitation of exposed zero-day flaws or credential weaknesses in internet-facing systems, including Oracle E-Business Suite, GoAnywhere MFT, and SonicWall VPNs.
2. Escalation followed when attackers used authentication bypasses, sandbox escapes, stolen credentials, or privileged remote tools to gain broader host and network access.
3. Impact came from persistence, lateral movement, exfiltration, and in some cases ransomware deployment, turning single-system compromise into enterprise-wide disruption.

Breaches seen in the wild

• Gladinet Hard-Coded Keys RCE Exploitation — Actively exploited hard-coded keys in Gladinet CentreStack and Triofox enable remote code execution.
• Cisco Active Directory credentials breach — Kraken ransomware group leaked Cisco Active Directory credentials.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Exploit speed is now a governance variable, not just an operational one. The report shows attackers moving from flaw discovery to active exploitation fast enough that traditional patch calendars can lose the race. In NHI terms, this is the same problem seen with exposed secrets and standing credentials, where access survives long enough to be abused before controls react. Practitioners should treat time-to-exploit as a control input, not a post-incident metric.

Standing trust in internet-facing systems remains the core failure mode. Oracle EBS, Redis, and GoAnywhere each show a different version of the same governance gap: externally reachable services are still trusted too much once they authenticate, deserialize, or process templates. That assumption collapses when a runtime or application feature becomes the exploit path. NIST CSF and NIST SP 800-53 both point to tighter access, monitoring, and integrity controls, but the field problem is less about framework absence and more about uneven enforcement.

Service accounts and remote-management tooling are the hidden bridge from vulnerability to ransomware. Once attackers establish a foothold, they often pivot through RMM agents, RDP, tunnels, and other legitimate mechanisms that look operationally normal. That creates a familiar NHI pattern: over-privileged non-human access extends the blast radius of an initial compromise. The practitioner conclusion is that remote tooling must be governed as privileged identity, not as just another endpoint utility.

Attack-chain consolidation is making breach response more identity-centric. The week’s incidents show a shift from isolated vulnerability events to multi-stage campaigns that blend exploitation, credential abuse, and post-exploitation reuse. That aligns with MITRE ATT&CK tactics across initial access, credential access, lateral movement, and impact, and it reinforces why identity telemetry must sit inside broader detection programmes. Teams should assume that every exposed service can become an identity problem within minutes.

Named concept: exploit-to-ransomware compression. This report captures how a single exposed service can move from entry point to extortion platform in one short operational sequence. The shorter that sequence becomes, the less value there is in siloed vulnerability, identity, and SOC workflows. Practitioners need integrated exposure reduction, privileged access control, and detection around the same asset set.

From our research:

• 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, according to The State of Non-Human Identity Security.
• Lack of credential rotation is cited as the top cause of NHI-related attacks by 45% of organisations, followed by inadequate monitoring and logging at 37% and over-privileged accounts at 37%.
• The broader control gap is visible in the 52 NHI Breaches Report, which shows how unattended machine access turns into repeatable incident patterns.

What this signals

Exploit speed will force exposure management to become more adaptive. When active exploitation can begin within the same reporting cycle as disclosure, teams need remediation workflows that prioritise reachability, exploitability, and privilege impact over raw CVE volume. That is where identity governance intersects with vulnerability management: a vulnerable asset with privileged back-end access behaves like a high-risk identity node, not just a patch item.

Service accounts, remote tools, and API-connected systems need the same scrutiny as human admin access. The report’s attack chains show how legitimate operational channels become attacker infrastructure after compromise. For identity programmes, that means the control conversation has to move from static entitlements to lifecycle visibility, reviewability, and containment around non-human access paths.

Attack-chain consolidation is a warning sign for programme design. As ransomware crews combine exploitation, identity abuse, and post-exploitation tooling, siloed security ownership becomes a liability. Teams that separate vulnerability response, IAM, PAM, and SOC workflows will keep missing the handoff points where incidents actually expand.

For practitioners

• Harden internet-facing enterprise applications Review ERP, MFT, and VPN platforms for pre-authentication execution paths, template processing, and deserialisation exposure. Prioritise network segmentation around systems that can bridge user traffic to privileged back-end functions.
• Treat remote-management tools as privileged access Inventory RMM agents, tunnelling tools, and remote desktop pathways on critical servers, then define who is allowed to install or invoke them. Alert on unexpected RMM deployment, Cloudflare tunnels, and mstsc.exe usage from non-admin contexts.
• Compress patching around exploit-confirmed CVEs Move from generic patch backlog to exploit-confirmed remediation windows for internet-facing assets. Pair emergency patching with threat hunting for suspicious XML Publisher activity, anomalous Lua execution, and forged license responses.
• Map identity controls to post-exploitation stages Use privileged access reviews to identify where standing credentials, service accounts, and application tokens could support lateral movement after a breach. Tie these reviews to logging and containment controls that watch for reverse shells, new persistence, and unauthorised admin activity.

Key takeaways

• This report shows how quickly critical vulnerabilities can turn into full intrusion paths when public services, remote tools, and privileged access overlap.
• The scale matters: Oracle EBS exposure, broad Redis reach, and active ransomware chaining show that patching alone is no longer enough.
• Containment improves when teams treat vulnerable platforms as identity and privilege problems, not only as software defects.

Key terms

• Exploit Chain: A sequence of vulnerabilities or malicious steps that work together to move from initial exposure to full compromise. In practice, one weakness may not be enough on its own, but chained weaknesses let attackers bypass normal protections and reach code execution, data theft, or device control.
• Authentication bypass: An authentication bypass is a flaw that lets a requester reach protected functionality without completing the intended identity check. In practice, it turns the application’s login boundary into a broken assumption, so any exposure path in front of that application becomes materially more important.
• Post-exploitation Tooling: Post-exploitation tooling is the legitimate or dual-use software attackers deploy after first access to extend control, evade detection, or move laterally. Examples include remote management agents, tunnelling tools, and administrative utilities that can blend with normal operations.
• Standing Privilege: Standing privilege is access that remains active even when no immediate task requires it. For NHI programmes, it is a common failure mode because long-lived credentials and persistent roles create unnecessary exposure. Reducing standing privilege usually means tighter expiry, on-demand access, and clearer review of who or what still needs access.

What's in the full article

FireCompass's full report covers the operational detail this post intentionally leaves for the source:

• Step-by-step exploit breakdowns for Oracle E-Business Suite, Redis, GoAnywhere MFT, Unity, and SonicWall.
• Indicator examples for hunting suspicious XML Publisher activity, Lua abuse, RMM deployment, and tunnel creation.
• Incident-by-incident timelines showing how exploitation progressed into persistence, lateral movement, and ransomware.
• Threat-actor context and tool usage details that help SOC teams build detections and triage priorities.

👉 FireCompass's full report covers exploit chains, exposure counts, and response details across the week’s incidents.

Deepen your knowledge

The NHI Foundation Level course covers NHI governance, machine identity security, and secrets management as part of the industry's only accredited NHI security programme. It helps security practitioners connect identity control to broader exposure and privilege decisions.