Skip to content
OriginalSign in
Image: BleepingComputer

BleepingComputer

CISA warns of actively exploited Git code execution flaw

Part of the CISA story · since 26 Aug 2025

Quiet for 59 weekslast report 8 Sep36 articles8 outlets
26 Aug · GBHackers first26 Mar6 Jun17 AugNowThis article3rd of 36
  • Tue 26 Aug, 08:05 UTC. GBHackers, first report. CISA Issues Alert on Citrix Flaws Actively Exploited by Hackers.
  • Tue 26 Aug, 09:19 UTC. The Hacker News, its first report on the story. CISA Adds Three Exploited Vulnerabilities to KEV Catalog Affecting Citrix and Git.
  • Tue 26 Aug, 19:15 UTC. BleepingComputer, its first report on the story. CISA warns of actively exploited Git code execution flaw. This article, 3rd of 36.
  • Tue 26 Aug, 19:27 UTC. SecurityWeek, its first report on the story. Just a moment....
  • Tue 26 Aug, 19:27 UTC. Security Affairs, its first report on the story. U.S. CISA adds Citrix Session Recording, and Git flaws to its Known Exploited Vulnerabilities catalog.
  • Tue 26 Aug, 19:28 UTC. SecurityOnline, its first report on the story. CISA Adds Citrix and Git Flaws to Known Exploited Vulnerabilities Catalog.
  • Tue 26 Aug, 19:29 UTC. GBHackers. CISA Alerts on Git Arbitrary File Write Flaw Actively Exploited.
  • Wed 27 Aug, 09:45 UTC. GBHackers. CISA Issues New ICS Advisories on Critical Vulnerabilities and Exploits.
  • Wed 27 Aug, 12:00 UTC. SecurityWeek. Citrix Patches Exploited NetScaler Zero-Day.
  • Wed 27 Aug, 18:09 UTC. BleepingComputer. Over 28,000 Citrix devices vulnerable to new exploited RCE flaw.
  • Wed 27 Aug, 19:41 UTC. Security Affairs. U.S. CISA adds Citrix NetScaler flaw to its Known Exploited Vulnerabilities catalog.
  • Thu 28 Aug, 06:15 UTC. SecurityOnline. An Espionage System: NSA, CISA, & Partners Expose Chinese APT Groups.
  • Thu 28 Aug, 08:16 UTC. GBHackers. CISA Issues Alert on Citrix NetScaler 0-Day RCE Exploited in the Wild.
  • Thu 28 Aug, 08:16 UTC. GBHackers. CISA Releases Guide to Hunt and Mitigate Chinese State-Sponsored Threats.
  • Thu 28 Aug, 17:00 UTC. Dark Reading, its first report on the story. CISA's New SBOM Guidelines Get Mixed Reviews.
  • Thu 28 Aug, 21:10 UTC. Dark Reading. CISA, FBI, NSA Warn of Chinese 'Global Espionage System'.
  • Fri 29 Aug, 12:30 UTC. DataBreaches, its first report on the story. CISA steps in to help Nevada state government recover from cyberattack.
  • Wed 3 Sep, 01:00 UTC. SecurityOnline. CISA Warns of Critical Flaw in SunPower Solar Inverters (CVE-2025-9696, CVSS 9.6).
  • Wed 3 Sep, 01:01 UTC. SecurityOnline. CISA Flags Two Actively Exploited Vulnerabilities: TP-Link Router Reset Flaw and WhatsApp Zero-Day Chain.
  • Wed 3 Sep, 07:16 UTC. The Hacker News. CISA Adds TP-Link and WhatsApp Flaws to KEV Catalog Amid Active Exploitation.
  • Wed 3 Sep, 09:16 UTC. GBHackers. CISA Alerts on Critical SunPower Vulnerability Allowing Full Device Takeover.
  • Wed 3 Sep, 13:31 UTC. GBHackers. CISA Alerts on TP-Link Authentication Flaw Under Active Exploitation.
  • Wed 3 Sep, 13:31 UTC. Security Affairs. U.S. CISA adds WhatsApp, and TP-link flaws to its Known Exploited Vulnerabilities catalog.
  • Wed 3 Sep, 20:01 UTC. SecurityWeek. US Cybersecurity Agency Flags Wi-Fi Range Extender Vulnerability Under Active Attack.
  • Thu 4 Sep, 02:30 UTC. SecurityOnline. CISA Warns: Actively Exploited TP-Link Router Flaws Added to KEV Catalog.
  • Thu 4 Sep, 08:45 UTC. Security Affairs. U.S. CISA adds TP-Link Archer C7(EU) and TL-WR841N flaws to its Known Exploited Vulnerabilities catalog.
  • Thu 4 Sep, 12:15 UTC. The Hacker News. CISA Flags TP-Link Router Flaws CVE-2023-50224 and CVE-2025-9377 as Actively Exploited.
  • Thu 4 Sep, 20:47 UTC. BleepingComputer. New TP-Link zero-day surfaces as CISA warns other flaws are exploited.
  • Fri 5 Sep, 03:00 UTC. SecurityOnline. CISA Adds Three New Vulnerabilities to Catalog, Urges Immediate Patching.
  • Fri 5 Sep, 11:01 UTC. GBHackers. CISA Issues Alert on Android 0-Day Use-After-Free Vulnerability Under Active Exploitation.
  • Fri 5 Sep, 11:45 UTC. GBHackers. CISA Warns: TP-Link Vulnerabilities Under Active Exploitation.
  • Fri 5 Sep, 12:15 UTC. Security Affairs. U.S. CISA adds Sitecore, Android, and Linux flaws to its Known Exploited Vulnerabilities catalog.
  • Fri 5 Sep, 17:16 UTC. The Hacker News. CISA Orders Immediate Patch of Critical Sitecore Vulnerability Under Active Exploitation.
  • Sun 7 Sep, 11:35 UTC. DataBreaches. CISA orders federal agencies to patch Sitecore zero-day following hacking reports.
  • Mon 8 Sep, 06:15 UTC. GBHackers. CISA Alerts on WhatsApp 0-Day Vulnerability Actively Exploited in Attacks.
  • Mon 8 Sep, 10:35 UTC. DataBreaches. CISA Delays Cyber Incident Reporting Rule for Critical Infrastructure.

According to The U.S. Cybersecurity & Infrastructure Security Agency (CISA), hackers are exploiting an arbitrary code execution flaw in the Git distributed version control system, which has been added to the KEV catalogue with a patch deadline for federal agencies of 15 September.

The vulnerability, tracked as CVE-2025-48384, stems from Git’s mishandling of carriage return characters in configuration files, causing a submodule path resolution mismatch that enables remote code execution when users clone repositories containing crafted submodules. Git discovered the issue on 8 July 2025 and has released fixes across multiple versions: 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.1.

If updating is not possible, the guidance includes avoiding recursive submodule clones from untrusted sources, disabling Git hooks globally via core[.]hooksPath, or enforcing only audited submodules. The article also notes that, alongside the Git flaw, CISA added two Citrix Session Recording vulnerabilities (CVE-2024-8068 and CVE-2024-8069) to the KEV catalogue, both with medium severity and fixes reported by the vendor in November 2024, with the same patch deadline of 15 September.

How the story developed

All 36 articles
Quiet for 59 weekslast report 8 Sep36 articles8 outlets

36 articles from 8 outlets since 26 Aug. Quiet since 8 Sep. This was the 3rd report, 11 hours after the first.

Now26 Aug27302468101223 OctFirst reportGBHackers · 26 Aug, 08:05Picked up againafter 5 days quiet
  • Tue 26 Aug, 08:05 UTC. GBHackers, first report. CISA Issues Alert on Citrix Flaws Actively Exploited by Hackers.
  • Tue 26 Aug, 09:19 UTC. The Hacker News, its first report on the story. CISA Adds Three Exploited Vulnerabilities to KEV Catalog Affecting Citrix and Git.
  • Tue 26 Aug, 19:15 UTC. BleepingComputer, its first report on the story. CISA warns of actively exploited Git code execution flaw. This article, 3rd of 36.
  • Tue 26 Aug, 19:27 UTC. SecurityWeek, its first report on the story. Just a moment....
  • Tue 26 Aug, 19:27 UTC. Security Affairs, its first report on the story. U.S. CISA adds Citrix Session Recording, and Git flaws to its Known Exploited Vulnerabilities catalog.
  • Tue 26 Aug, 19:28 UTC. SecurityOnline, its first report on the story. CISA Adds Citrix and Git Flaws to Known Exploited Vulnerabilities Catalog.
  • Tue 26 Aug, 19:29 UTC. GBHackers. CISA Alerts on Git Arbitrary File Write Flaw Actively Exploited.
  • Wed 27 Aug, 09:45 UTC. GBHackers. CISA Issues New ICS Advisories on Critical Vulnerabilities and Exploits.
  • Wed 27 Aug, 12:00 UTC. SecurityWeek. Citrix Patches Exploited NetScaler Zero-Day.
  • Wed 27 Aug, 18:09 UTC. BleepingComputer. Over 28,000 Citrix devices vulnerable to new exploited RCE flaw.
  • Wed 27 Aug, 19:41 UTC. Security Affairs. U.S. CISA adds Citrix NetScaler flaw to its Known Exploited Vulnerabilities catalog.
  • Thu 28 Aug, 06:15 UTC. SecurityOnline. An Espionage System: NSA, CISA, & Partners Expose Chinese APT Groups.
  • Thu 28 Aug, 08:16 UTC. GBHackers. CISA Issues Alert on Citrix NetScaler 0-Day RCE Exploited in the Wild.
  • Thu 28 Aug, 08:16 UTC. GBHackers. CISA Releases Guide to Hunt and Mitigate Chinese State-Sponsored Threats.
  • Thu 28 Aug, 17:00 UTC. Dark Reading, its first report on the story. CISA's New SBOM Guidelines Get Mixed Reviews.
  • Thu 28 Aug, 21:10 UTC. Dark Reading. CISA, FBI, NSA Warn of Chinese 'Global Espionage System'.
  • Fri 29 Aug, 12:30 UTC. DataBreaches, its first report on the story. CISA steps in to help Nevada state government recover from cyberattack.
  • Wed 3 Sep, 01:00 UTC. SecurityOnline. CISA Warns of Critical Flaw in SunPower Solar Inverters (CVE-2025-9696, CVSS 9.6).
  • Wed 3 Sep, 01:01 UTC. SecurityOnline. CISA Flags Two Actively Exploited Vulnerabilities: TP-Link Router Reset Flaw and WhatsApp Zero-Day Chain.
  • Wed 3 Sep, 07:16 UTC. The Hacker News. CISA Adds TP-Link and WhatsApp Flaws to KEV Catalog Amid Active Exploitation.
  • Wed 3 Sep, 09:16 UTC. GBHackers. CISA Alerts on Critical SunPower Vulnerability Allowing Full Device Takeover.
  • Wed 3 Sep, 13:31 UTC. GBHackers. CISA Alerts on TP-Link Authentication Flaw Under Active Exploitation.
  • Wed 3 Sep, 13:31 UTC. Security Affairs. U.S. CISA adds WhatsApp, and TP-link flaws to its Known Exploited Vulnerabilities catalog.
  • Wed 3 Sep, 20:01 UTC. SecurityWeek. US Cybersecurity Agency Flags Wi-Fi Range Extender Vulnerability Under Active Attack.
  • Thu 4 Sep, 02:30 UTC. SecurityOnline. CISA Warns: Actively Exploited TP-Link Router Flaws Added to KEV Catalog.
  • Thu 4 Sep, 08:45 UTC. Security Affairs. U.S. CISA adds TP-Link Archer C7(EU) and TL-WR841N flaws to its Known Exploited Vulnerabilities catalog.
  • Thu 4 Sep, 12:15 UTC. The Hacker News. CISA Flags TP-Link Router Flaws CVE-2023-50224 and CVE-2025-9377 as Actively Exploited.
  • Thu 4 Sep, 20:47 UTC. BleepingComputer. New TP-Link zero-day surfaces as CISA warns other flaws are exploited.
  • Fri 5 Sep, 03:00 UTC. SecurityOnline. CISA Adds Three New Vulnerabilities to Catalog, Urges Immediate Patching.
  • Fri 5 Sep, 11:01 UTC. GBHackers. CISA Issues Alert on Android 0-Day Use-After-Free Vulnerability Under Active Exploitation.
  • Fri 5 Sep, 11:45 UTC. GBHackers. CISA Warns: TP-Link Vulnerabilities Under Active Exploitation.
  • Fri 5 Sep, 12:15 UTC. Security Affairs. U.S. CISA adds Sitecore, Android, and Linux flaws to its Known Exploited Vulnerabilities catalog.
  • Fri 5 Sep, 17:16 UTC. The Hacker News. CISA Orders Immediate Patch of Critical Sitecore Vulnerability Under Active Exploitation.
  • Sun 7 Sep, 11:35 UTC. DataBreaches. CISA orders federal agencies to patch Sitecore zero-day following hacking reports.
  • Mon 8 Sep, 06:15 UTC. GBHackers. CISA Alerts on WhatsApp 0-Day Vulnerability Actively Exploited in Attacks.
  • Mon 8 Sep, 10:35 UTC. DataBreaches. CISA Delays Cyber Incident Reporting Rule for Critical Infrastructure.
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 36 articles as a list
  1. Tue 26 AugDay 07
    1. CISA Issues Alert on Citrix Flaws Actively Exploited by Hackers08:05 · GBHackers · First report
    2. CISA Adds Three Exploited Vulnerabilities to KEV Catalog Affecting Citrix and Git09:19 · The Hacker News
    3. CISA warns of actively exploited Git code execution flaw19:15 · BleepingComputer · This article, 3rd of 36
    Show 4 more from 26 Aug
    1. Just a moment...19:27 · SecurityWeek
    2. U.S. CISA adds Citrix Session Recording, and Git flaws to its Known Exploited Vulnerabilities catalog19:27 · Security Affairs
    3. CISA Adds Citrix and Git Flaws to Known Exploited Vulnerabilities Catalog19:28 · SecurityOnline
    4. CISA Alerts on Git Arbitrary File Write Flaw Actively Exploited19:29 · GBHackers
  2. Wed 27 AugDay 14
    1. CISA Issues New ICS Advisories on Critical Vulnerabilities and Exploits09:45 · GBHackers
    2. Citrix Patches Exploited NetScaler Zero-Day12:00 · SecurityWeek
    3. Over 28,000 Citrix devices vulnerable to new exploited RCE flaw18:09 · BleepingComputer
    4. U.S. CISA adds Citrix NetScaler flaw to its Known Exploited Vulnerabilities catalog19:41 · Security Affairs
  3. Thu 28 AugDay 25
    1. An Espionage System: NSA, CISA, & Partners Expose Chinese APT Groups06:15 · SecurityOnline
    2. CISA Issues Alert on Citrix NetScaler 0-Day RCE Exploited in the Wild08:16 · GBHackers
    3. CISA Releases Guide to Hunt and Mitigate Chinese State-Sponsored Threats08:16 · GBHackers
    Show 2 more from 28 Aug
    1. CISA's New SBOM Guidelines Get Mixed Reviews17:00 · Dark Reading
    2. CISA, FBI, NSA Warn of Chinese 'Global Espionage System'21:10 · Dark Reading
  4. Fri 29 AugDay 31
    1. CISA steps in to help Nevada state government recover from cyberattack12:30 · DataBreaches

  5. Quiet for 5 days

    Wed 3 SepDay 87
    1. CISA Warns of Critical Flaw in SunPower Solar Inverters (CVE-2025-9696, CVSS 9.6)01:00 · SecurityOnline · Picked up again
    2. CISA Flags Two Actively Exploited Vulnerabilities: TP-Link Router Reset Flaw and WhatsApp Zero-Day Chain01:01 · SecurityOnline
    3. CISA Adds TP-Link and WhatsApp Flaws to KEV Catalog Amid Active Exploitation07:16 · The Hacker News
    Show 4 more from 3 Sep
    1. CISA Alerts on Critical SunPower Vulnerability Allowing Full Device Takeover09:16 · GBHackers
    2. CISA Alerts on TP-Link Authentication Flaw Under Active Exploitation13:31 · GBHackers
    3. U.S. CISA adds WhatsApp, and TP-link flaws to its Known Exploited Vulnerabilities catalog13:31 · Security Affairs
    4. US Cybersecurity Agency Flags Wi-Fi Range Extender Vulnerability Under Active Attack20:01 · SecurityWeek
  6. Thu 4 SepDay 94
    1. CISA Warns: Actively Exploited TP-Link Router Flaws Added to KEV Catalog02:30 · SecurityOnline
    2. U.S. CISA adds TP-Link Archer C7(EU) and TL-WR841N flaws to its Known Exploited Vulnerabilities catalog08:45 · Security Affairs
    3. CISA Flags TP-Link Router Flaws CVE-2023-50224 and CVE-2025-9377 as Actively Exploited12:15 · The Hacker News
    4. New TP-Link zero-day surfaces as CISA warns other flaws are exploited20:47 · BleepingComputer
  7. Fri 5 SepDay 105
    1. CISA Adds Three New Vulnerabilities to Catalog, Urges Immediate Patching03:00 · SecurityOnline
    2. CISA Issues Alert on Android 0-Day Use-After-Free Vulnerability Under Active Exploitation11:01 · GBHackers
    3. CISA Warns: TP-Link Vulnerabilities Under Active Exploitation11:45 · GBHackers
    Show 2 more from 5 Sep
    1. U.S. CISA adds Sitecore, Android, and Linux flaws to its Known Exploited Vulnerabilities catalog12:15 · Security Affairs
    2. CISA Orders Immediate Patch of Critical Sitecore Vulnerability Under Active Exploitation17:16 · The Hacker News

  8. Quiet for 2 days

    Sun 7 SepDay 121
    1. CISA orders federal agencies to patch Sitecore zero-day following hacking reports11:35 · DataBreaches
  9. Mon 8 SepDay 132
    1. CISA Alerts on WhatsApp 0-Day Vulnerability Actively Exploited in Attacks06:15 · GBHackers
    2. CISA Delays Cyber Incident Reporting Rule for Critical Infrastructure10:35 · DataBreaches

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in