Critical Lanscope Endpoint Manager Bug Exploited in Ongoing Cyberattacks, CISA Confirms

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a critical vulnerability in Motex Lanscope Endpoint Manager to its Known Exploited Vulnerabilities catalogue, with the flaw tracked as CVE-2025-61932 and a CVSS v4 score of 9.3. The weakness affects on‑premises versions of Lanscope Endpoint Manager, specifically the Client program and Detection Agent, and could allow attackers to execute arbitrary code by sending specially crafted packets, according to CISA.

It impacts versions up to 9.4.7.1, and is addressed in versions 9.3.2.7, 9.3.3.9, 9.4.0.5, 9.4.1.5, 9.4.2.6, 9.4.3[.]8, 9.4.4[.]6, 9.4.5[.]4, 9.4.6[.]3, and 9.4.7[.]3. JVN notes that Motex has confirmed an unnamed customer "received a malicious packet suspected to target this vulnerability," and officials say it is not yet known who is behind the real‑world exploitation or the scale of the activity.

In light of active exploitation, agencies in the Federal Civilian Executive Branch are advised to remediate CVE-2025-61932 by 12 November 2025 to help safeguard their networks, according to the advisory.