✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 4309 to 4320 of 5296
2024 Salesloft-Drift Supply Chain Breach: AWS Credential Exposure and Cloud Security Lessons
In early 2024, a sophisticated supply chain attack targeted the Salesloft and Drift integration, leading to the compromise of AWS credentials and unauthorized access to cloud environments. Threat actors exploited weaknesses in the integration pipeline, leveraging exposed secrets to move laterally and access sensitive customer data before the breach became public. Red Canary detected anomalous cloud activity tied to this attack, providing early detection prior to broad public awareness and response, thereby helping to mitigate further impact. This incident is significant as it demonstrates the growing frequency and sophistication of supply chain attacks within SaaS and cloud services, especially those exploiting secret leaks and third-party application integrations. The breach highlights the need for heightened vigilance, identity and credential protection, and advanced threat detection capabilities in the cloud ecosystem.
7 months ago
Kill Chain
AVEVA 2025: XSS Vulnerability in Application Server IDE Threatens Industrial Security
In November 2025, AVEVA disclosed a critical security vulnerability (CVE-2025-8386) in its Application Server IDE, exposing numerous organizations in the critical manufacturing sector worldwide. The flaw, classified as an Improper Neutralization of Script-Related HTML Tags (CWE-80), allows authenticated users with elevated permissions to tamper with application help files and persistently inject cross-site scripting (XSS) payloads. If exploited during configuration-time operations, malicious code can trigger upon subsequent access by other users, resulting in horizontal or vertical privilege escalation. While only affective at config-time and not impacting runtime components, the risk is heightened due to widespread industrial deployments. This incident underscores persistent challenges in securing industrial software, as XSS and privilege escalation vulnerabilities remain a significant vector for lateral attacker movement. The AVEVA disclosure demonstrates the urgency for robust privilege auditing and regular patching, especially as attackers increasingly target industrial environments for both espionage and disruption.
7 months ago
Kill Chain
Rockwell Automation 2025 ICS Vulnerabilities: Studio 5000 Path Traversal & SSRF Risks
In November 2025, Rockwell Automation disclosed critical vulnerabilities affecting its Studio 5000 Simulation Interface used across chemical and manufacturing sectors. The issues—Improper Limitation of a Pathname to a Restricted Directory (CVE-2025-11696) and Server-Side Request Forgery (CVE-2025-11697)—allowed local attackers to execute arbitrary scripts with administrator privileges and capture NTLM hashes via outbound SMB requests. The vulnerabilities impacted versions 2.02 and earlier, and, if exploited, could grant attackers lateral movement or privileged control within industrial environments, threatening operational integrity and sensitive data. These vulnerabilities highlight ongoing threats to industrial control systems (ICS) and the continued focus of adversaries on exploiting misconfigurations and overlooked APIs. With increasing regulatory pressure for critical infrastructure resilience and the evolution of ICS-specific ransomware and supply chain attacks, such vulnerabilities remain a potent risk requiring constant attention and timely remediation.
7 months ago
Kill Chain
CISA Flags 18 Critical ICS Vulnerabilities Across Major Vendors
In November 2025, the Cybersecurity and Infrastructure Security Agency (CISA) released 18 advisories highlighting critical vulnerabilities across a wide spectrum of Industrial Control Systems (ICS) products from vendors such as Mitsubishi Electric, AVEVA, Rockwell Automation, Siemens, and others. These advisories detailed security gaps including unencrypted communications, insufficient segmentation, lack of policy enforcement, and exploitable firmware flaws. Although no specific exploitation campaigns were publicly confirmed at the time, the breadth and technical depth of the advisories underscore the ICS sector’s wide attack surface and the urgent need for robust controls and timely patching to prevent downtime, data loss, or operational safety issues. This disclosure is especially relevant given the escalating sophistication of threat actors targeting operational technology and the convergence of IT/OT networks. The incident reflects a steady increase in supply chain exposures and nation-state attention on industrial sectors, amplifying risk to critical infrastructure worldwide.
7 months ago
Kill Chain
Critical Authorization Flaw Exposes Rockwell Automation Verve Asset Manager (2025)
In November 2025, Rockwell Automation disclosed a critical vulnerability (CVE-2025-11862) in multiple versions of its Verve Asset Manager platform, widely used in industrial control system cybersecurity. The flaw, present from versions 1.33 up to 1.41.3, arises from an incorrect authorization configuration that allows unauthorized read-only users to perform privileged API operations, such as reading, updating, and deleting user accounts. The vulnerability, which is remotely exploitable with low attack complexity, exposes critical manufacturing environments to potential data breaches or sabotage until properly patched. Rockwell addressed the issue in version 1.41.4 and subsequent releases, urging all customers to update immediately. This incident underscores the growing risk baseline facing operational technology (OT) and ICS environments as attackers increasingly target authorization misconfigurations and API exposures. Regulatory pressure and rising sophistication in adversary tactics make strong access controls and rapid patch management more essential than ever for organizations managing critical infrastructure.
7 months ago
Kill Chain
2025 Rockwell FactoryTalk Policy Manager DoS Vulnerability Exposes Critical Manufacturing
In November 2025, Rockwell Automation disclosed a critical vulnerability (CVE-2024-22019) affecting versions 6.51.00 and earlier of its FactoryTalk Policy Manager, a tool widely deployed in industrial and manufacturing environments for policy enforcement and network segmentation. The flaw—tied to improper resource shutdown or release in the Node.js HTTP server—enables remote attackers to send specially crafted chunked HTTP requests that exhaust CPU and network resources, resulting in denial-of-service (DoS) conditions. While no active exploitation was reported as of publication, the vulnerability posed operational risks to OT systems globally, especially in critical manufacturing sectors. The incident underscores the risks posed by third-party software dependencies in industrial control system environments, especially as attackers target resource exhaustion vectors that bypass conventional safeguards. The disclosure highlights the increasing urgency for proactive vulnerability management and defense-in-depth strategies, given the essential role of OT in critical infrastructure.
7 months ago
Kill Chain
Brightpick ICS Flaws Expose Critical Automation Functions and Credentials Globally
In November 2025, vulnerabilities were discovered in Brightpick AI's Mission Control and Internal Logic Control, software used for warehouse automation globally. Security researcher Souvik Kandar disclosed that all product versions lacked authentication for critical functions and exposed sensitive credentials via unencrypted channels, including WebSocket traffic accessible without prior authentication. If exploited, attackers could manipulate robot controls or intercept sensitive information, posing operational and confidentiality risks to organizations in sectors such as manufacturing, healthcare, and logistics. Brightpick AI had not issued a response or patch at the time of the initial disclosure. This incident stands out due to its impact on operational technology and industrial control systems, highlighting the widespread risk of exposed critical functions and hardcoded credentials in automation platforms. With growing connectivity in ICS environments, such vulnerabilities reflect an urgent need for organizations to bolster segmentation, credential management, and network security controls.
7 months ago
Kill Chain
2025 Siemens Spectrum Power 4 Flaws: Privilege Escalation in Critical ICS
In November 2025, Siemens disclosed a set of severe vulnerabilities impacting its Spectrum Power 4 platform, a widely deployed solution in the global energy sector. Discovered by researchers at Limes Security and reported through Siemens ProductCERT, these issues include incorrect use of privileged APIs, flawed privilege assignment, and insecure permissions, collectively enabling remote and local attackers to execute arbitrary code with administrative privileges or extract sensitive credentials. While there are currently no reports of active exploitation, the vulnerabilities expose critical infrastructure operators to the risk of operational disruption and data compromise. This incident highlights persistent threats due to weak privilege controls and insecure configurations in industrial control systems (ICS), which are increasingly targeted by sophisticated actors. With the energy sector classified as critical infrastructure, such exposures have regulatory, safety, and reputational consequences, driving renewed urgency for timely patch management and robust network segmentation.
7 months ago
Kill Chain
Mitsubishi Electric 2025: Denial-of-Service Vulnerability Impacts Industrial Control Systems
In November 2025, a denial-of-service (DoS) vulnerability (CVE-2025-10259) impacting Mitsubishi Electric MELSEC iQ-F Series programmable logic controllers was publicly disclosed. Researchers from Zhongguancun Laboratory and Tsinghua University identified that improper validation in the TCP communication module allowed remote attackers to send specially crafted TCP packets, causing affected devices to disconnect and become temporarily unresponsive. The vulnerability (CVSS 5.3) requires no authentication and can be exploited remotely, posing a notable risk to industrial control systems in the critical manufacturing sector worldwide. This incident highlights persistent cybersecurity weaknesses in industrial IoT and critical infrastructure devices, which attackers increasingly target to disrupt operations. As regulatory expectations and threat actor sophistication rise, even moderate-severity flaws in ICS environments must be prioritized and mitigated decisively.
7 months ago
Kill Chain
Rockwell Automation FactoryTalk DataMosaix: 2025 ICS Cloud Vulnerabilities Expose Industrial Risk
In November 2025, Rockwell Automation disclosed two critical vulnerabilities in its FactoryTalk DataMosaix Private Cloud platform, widely used across critical manufacturing sectors. The flaws include a weak authentication mechanism (CVE-2025-11084) that enables attackers to bypass MFA and gain unauthorized access, and a persistent cross-site scripting bug (CVE-2025-11085) that could facilitate account takeover, credential theft, or redirecting users to malicious sites. Rockwell and CISA jointly warned that attackers could exploit these remotely and potentially take control of sensitive ICS data or operations globally, demanding urgent updates. These vulnerabilities underscore rising risks tied to identity-driven attacks and web-based threats targeting industrial control environments. With Ransomware-as-a-Service and supply chain attacks escalating, organizations in critical sectors face mounting pressure to implement multi-layered controls and update legacy authentication practices.
7 months ago
Kill Chain
Siemens Solid Edge 2025: Improper Certificate Validation Exposes Critical Manufacturing to MITM Attacks
In November 2025, Siemens disclosed a critical vulnerability in its Solid Edge SE2025 product, identified as CVE-2025-40744. This software flaw, stemming from improper certificate validation in the License Service endpoint, allows unauthenticated remote attackers to perform man-in-the-middle (MITM) attacks by intercepting or manipulating encrypted traffic. The issue, rated 8.7 (CVSS v4), affects all versions of Solid Edge SE2025 prior to V225.0 Update 11, putting global critical manufacturing environments at risk of credential interception and data exposure. This incident reflects increasing attacker focus on exploiting certificate validation weaknesses in supply chain and industrial environments. With industrial control systems often at the core of large enterprises' operations, such vulnerabilities demand swift patching and ongoing vigilance in authentication and encrypted traffic controls.
7 months ago
Kill Chain
AVEVA Edge 2025: Cryptographic Weakness Leaves Critical Manufacturing at Risk
In November 2025, AVEVA disclosed a critical vulnerability (CVE-2025-9317) in its Edge HMI/SCADA software (versions 2023 R2 and prior), stemming from the use of a broken or risky cryptographic algorithm. The flaw allows local attackers with read access to Edge project or cache files to reverse engineer both application-native and Active Directory passwords via brute-force techniques. This security gap exposes organizations using AVEVA Edge in the critical manufacturing sector to unauthorized credential recovery, potentially impacting operational technology environments on a global scale. The incident highlights increased scrutiny of industrial control software security, especially against a backdrop of escalating supply chain and OT attacks. Regulatory and compliance pressures are intensifying, and organizations are urged to prioritize cryptographic hygiene, proactive patching, and strict access controls to mitigate insider and lateral threat risks.
7 months ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Attackers Learned to Use AI. Now They Built Tools to Destroy It.
Living-off-the-Agent: How AI Tool Misuse Became the Insider Threat Nobody Provisioned
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
