CISA Adds Lanscope Endpoint Manager Zero-Day (CVE-2025-61932) to Known Exploited Vulnerabilities

CISA has added Lanscope Endpoint Manager zero-day CVE-2025-61932 to its Known Exploited Vulnerabilities (KEV) catalog, with exploitation suspected in some customer environments and notices of unauthorized external packets reaching affected systems.

The flaw stems from improper verification of the source of a communication channel, enabling remote code execution via crafted packets on the client and detection agent components, potentially allowing attackers to run arbitrary payloads, establish persistence, or pivot within a network.

All on-premises Lanscope Endpoint Manager versions 9.4.7[.]1 and earlier are affected, with patches available in versions 9.3.2.7, 9.3.3.9, 9.4.0.5, 9.4.1.5, 9.4.2.6, 9.4.3[.]8, 9.4.4[.]6, 9.4.5[.]4, 9.4.6[.]3, and 9.4.7[.]3; Motex noted that only the client needs updating. For US federal agencies, patching is mandated by 12 November 2025.

Immediate mitigation steps include upgrading to a patched version, reviewing network logs, restricting external communications, and monitoring the KEV catalogue for new entries, with SOCRadar’s XTI platform cited as a tool to track exploitation trends. According to CISA’s Known Exploited Vulnerabilities Catalog, these steps are advised to reduce exposure while organisations assess their fleets.