Original release date: September 7, 2021 | Last revised: September 8, 2021

Zoho has released a security update on a vulnerability (CVE-2021-40539) affecting ManageEngine ADSelfService Plus builds 6113 and below. CVE-2021-40539 has been detected in exploits in the wild. A remote attacker could exploit this vulnerability to take control of an affected system. ManageEngine ADSelfService Plus is a self-service password management and single sign-on solution for Active Directory and cloud apps. Additionally, CISA strongly urges organizations ensure ADSelfService Plus is not directly accessible from the internet.

CISA encourages users and administrators to review the Zoho advisory for more information and to update to ADSelfService Plus build 6114.

Original release date: September 3, 2021

CISA has released a new CISA Insights, Risk Considerations for Managed Service Provider Customers (MSPs), which provides Managed Service Provider (MSP) customers a framework for reducing risk.

This framework is designed for government and private sector organizations of all sizes, and it suggests considerations for IT management planning, best practices, and tools for reducing overall risk. This resource divides guidance across these areas: (1) senior executives and boards of directors (strategic decision-making); (2) procurement professionals (operational decision-making); and (3) network administrators, systems administrators, and front-line cybersecurity staff (tactical decision-making).

Read CISA’s latest blog, visit: CISA.gov/blog/2021/09/02/going-beyond-assessing-security-practices-it- service-providers.

To view this CISA Insights, please visit: CISA.gov/publication/risk-considerations-msp-customers. For additional supply chain risk management information or resources, visit CISA.gov/ict-supply-chain-library.

Original release date: September 2, 2021

Cisco has released security updates to address a critical vulnerability affecting Cisco Enterprise Network Function Virtualization Infrastructure Software (NFVIS) Release 4.5.1. A remote attacker could exploit this vulnerability to take control of an affected system. For updates addressing lower severity vulnerabilities, see the Cisco Security Advisories page.

CISA encourages users and administrators to review Cisco advisory cisco-sa-nfvis-g2DMVVh and apply the necessary update.

Original release date: August 31, 2021

Today, the Federal Bureau of Investigation (FBI) and CISA released a Joint Cybersecurity Advisory (CSA) to urge organizations to ensure they protect themselves against ransomware attacks during holidays and weekends—when offices are normally closed.

Although FBI and CISA do not currently have any specific threat reporting indicating a cyberattack will occur over the upcoming Labor Day holiday, malicious cyber actors have launched serious ransomware attacks during other holidays and weekends in 2021. The Joint CSA identifies both immediate and longer term actions organizations can take to protect against the rise in ransomware, including:

• Making an offline backup of your data.
• Avoiding clicking on suspicious links.
• Securing and monitoring Remote Desktop Protocol endpoints.
• Updating OS and software.
• Using strong passwords.
• Using multi-factor authentication.

CISA and the FBI encourage users to examine their current cybersecurity posture and implement the recommended mitigations in the Joint CSA to manage the risk posed by all cyber threats, including ransomware.