CISA Expands Vulnerabilities Catalog: Fortinet and GitHub Security Risks

CISA has recently expanded its Known Exploited Vulnerabilities Catalog with two new entries that underscore the persistent threat posed by actively exploited vulnerabilities. While the vulnerabilities detailed in this update may not target Microsoft Windows directly, the implications resonate broadly across IT environments—especially for those managing mixed system environments where Windows and non‑Windows platforms coexist.

Overview of the Catalog Update​

The Cybersecurity and Infrastructure Security Agency (CISA) announced the addition of two exploiting vulnerabilities based on reliable evidence of active misuse. The update includes:
• CVE-2025-24472: A vulnerability in Fortinet’s FortiOS and FortiProxy systems that potentially allows attackers to bypass authentication protocols.
• CVE-2025-30066: A flaw in the tj‑actions/changed‑files GitHub Action where embedded malicious code could be introduced.
These vulnerabilities have been incorporated into the Known Exploited Vulnerabilities Catalog—a dynamic list aimed at helping organizations identify and prioritize remediation for vulnerabilities actively being exploited by cybercriminals. The underlying objective is to reduce risk and enhance the overall resilience of federal networks as mandated by Binding Operational Directive (BOD) 22‑01.

Understanding the Vulnerabilities​

Fortinet FortiOS and FortiProxy (CVE-2025-24472)​

Fortinet products are widely deployed in various network environments, including those that interface with Windows networks. The identified authentication bypass vulnerability affects FortiOS and FortiProxy systems, which serve as critical components in securing network perimeters. With such appliances defending corporate infrastructure, any lapse in security could have cascading effects, potentially compromising the security posture of connected systems—even those running Windows.
Key takeaways for IT administrators:
• Authentication bypass vulnerabilities can allow unauthorized access, undermining security controls.
• Mixed environments (where networks share resources between Fortinet devices and Windows servers) may be at higher risk if vulnerabilities remain unmitigated.
• It is essential to review vendor advisories and apply patches or configuration changes as soon as possible.

GitHub Action Vulnerability (CVE-2025-30066)​

GitHub, a platform that many development teams—often integrated with Windows-based environments—rely on, is not immune to security flaws. The second entry in the catalog highlights a vulnerability in the tj‑actions/changed‑files GitHub Action. This vulnerability involves the potential for malicious actors to insert compromised code into automation pipelines. Considering that modern software development practices on Windows frequently employ GitHub Actions for continuous integration and continuous delivery (CI/CD), this vulnerability could facilitate an attacker’s effort to embed harmful code into otherwise trusted build processes.
Critical points to note:
• Embedded malicious code in CI/CD pipelines may lead to compromised software distribution.
• Developers and DevOps teams should audit their GitHub Actions workflows and monitor for any unusual changes.
• Timely updates and adherence to secure coding practices are essential in mitigating these threats.

Broader Implications for Enterprise Environments​

Although BOD 22‑01 explicitly targets the Federal Civilian Executive Branch (FCEB) agencies, the underlying message is universal: organizations of all sizes should move quickly to remediate known vulnerabilities that are actively exploited. Here’s why this update matters even for those primarily operating within Windows environments:
• Mixed IT environments are the norm. Even if your primary operating system is Windows, your network functions alongside routers, firewalls, and other appliances that might run on alternative platforms. A breach in one area can serve as an entry point to others.
• The update serves as a reminder that cybersecurity is a shared responsibility. Cybercriminals frequently exploit vulnerabilities across system boundaries using lateral movement techniques.
• The inclusion of a GitHub Action vulnerability reinforces the need for robust DevOps security practices. Developers working on Windows often use integrated development environments (IDEs) and repositories that link with GitHub, making it crucial to apply security patches promptly to protect source code and automation processes.
The evolving landscape of cybersecurity attacks requires that organizations not only focus on protecting operating systems like Windows but also invest in network hardware and cloud-based platforms that collectively contribute to overall security.

Security Best Practices and Mitigation Strategies​

With the ongoing pressure of active exploitation, following rigorous security practices can safeguard organizations from widespread breaches:

1. Comprehensive Patch Management
   • Establish a robust patch management system that continuously monitors for vendor updates and critical security advisories.
   • Ensure that all system components—ranging from Windows servers to network appliances such as Fortinet products—are up-to-date with the latest patches and security configurations.
2. Vulnerability Scanning & Automation
   • Implement automated vulnerability scanning tools across your network. These tools can help identify known exploits and highlight systems that might be exposed to threats like the ones outlined in the CISA update.
   • Consider using continuous integration security checks to scan GitHub Actions workflows for signs of tampering.
3. Network Segmentation & Access Controls
   • Adopt a layered defense model. Isolating network segments can prevent a compromised system from becoming an entry point to the entire network.
   • Strengthen access controls, ensuring that vulnerabilities which allow authentication bypasses do not become doorways for attackers.
4. Developer Vigilance
   • For those engaged in software development, regularly review and audit automation scripts and GitHub Actions workflows for unusual modifications or potential injected code.
   • Deploy security tools that can detect anomalous behavior in code repositories to catch issues before they escalate.
5. Incident Response Planning
   • Prepare and periodically update an incident response plan that addresses potential breaches resulting from both software and hardware vulnerabilities.
   • Simulate breach scenarios to train IT teams and ensure a swift, coordinated response in case of an attack.

Adopting these best practices not only aligns with federal mandates like BOD 22‑01 but also fortifies the defensive posture of any organization, regardless of the primary operating system in use.

Real-World Impact and the Way Forward​

Cybersecurity is far from static—in its very fabric, it demands continuous evolution and adaptation. The recent CISA update provides a wake-up call, emphasizing that vulnerabilities are not isolated incidents but components of a larger, interconnected threat landscape. While Windows users might initially question, "Why should I care about vulnerabilities in Fortinet or GitHub Actions?" the answer lies in the principle that cybersecurity weaknesses in one area can quickly proliferate across an entire network.
Consider a scenario where a misconfigured network appliance serves as an unintentional bridge to an otherwise secure Windows domain. Or imagine a developer unwittingly integrating compromised code from a vulnerable GitHub Action, leading to a larger breach during a critical software deployment. These examples illustrate that the security of IT infrastructure is only as strong as its weakest link.
As organizations strive to safeguard digital assets, adopting a proactive approach towards vulnerability management becomes crucial. The CISA catalog is a dynamic tool that aids in this endeavor, providing clear guidance on which vulnerabilities are currently exploited, and, by extension, where immediate remediation can prevent catastrophic breaches.

Concluding Thoughts​

The addition of CVE-2025-24472 and CVE-2025-30066 to CISA’s Known Exploited Vulnerabilities Catalog highlights an ever-present truth in cybersecurity: staying on the cutting edge of threat intelligence is non-negotiable. For WindowsForum readers, this update—though not Windows-specific—serves as an important reminder that effective security is a mosaic composed of many layers and components.
By embracing proactive patch management, rigorous vulnerability scanning, and a culture of security within development teams, organizations can mitigate risks long before they translate into significant breaches. Whether you’re managing a corporate network full of Windows machines or working in a hybrid environment, now is the time to review, update, and reinforce your cybersecurity strategies.
In the rapidly evolving digital battlefield, a single overlooked vulnerability can ripple into widespread operational disruptions. So ask yourself: Is your organization keeping pace with the latest security advisories? The answer may well determine the difference between resilience and vulnerability in today’s cyber-driven world.

---

Source: CISA CISA Adds Two Known Exploited Vulnerabilities to Catalog | CISA