Threat Report 9/12/25

Critical Patches Issued for Microsoft Products 

Multiple vulnerabilities have been discovered in Microsoft products, the most severe of which could allow for remote code execution in the context of the logged-on user. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights. 

Affected Systems: 

• Many popular Microsoft products including, but not limited to, Windows, Office, and Edge 

Risk: 

• Large and medium business entities: High 

• Small business entities: Medium 

Remediation Recommendations 

• Ensure all Microsoft products have the latest version(s) installed 

• Enact the Principle of Least Privilege (limit higher-level privileges to only the users that need it) 

References 

• https://msrc.microsoft.com/update-guide/en-us
• https://msrc.microsoft.com/update-guide/releaseNote/2025-Sep

Multiple Vulnerabilities in Google Android OS
Could Allow for Remote Code Execution 

Multiple vulnerabilities have been discovered in Google Android OS, the most severe of which could allow for remote code execution. Android is an operating system developed by Google for mobile devices, including, but not limited to, smartphones, tablets, and watches. Successful exploitation of the most severe of these vulnerabilities could allow for remote code execution. Depending on the privileges associated with the exploited component, an attacker could then install programs; view, change, or delete data; or create new accounts with full rights.  

 Affected Systems: 

• Android OS patch levels prior to 2025-09-05 

Risk: 

• Large and medium business entities: High 

• Small business entities: Medium 

Remediation Recommendations 

• Ensure all devices running Android OS have the latest version(s) installed 

• Enact the Principle of Least Privilege (limit higher-level privileges to only the users that need it) 

References 

• https://source.android.com/docs/security/bulletin/2025-09-01#Google-Play-system-updates  

Multiple Vulnerabilities in Google Chrome
Could Allow for Arbitrary Code Execution 

Multiple vulnerabilities have been discovered in Google Chrome, the most severe of which could allow for arbitrary code execution. Successful exploitation of the most severe of these vulnerabilities could allow for arbitrary code execution in the context of the logged-on user. Depending on the privileges associated with the user an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights. 

Affected Systems: 

• Chrome prior to 140.0.7339.80/81 for Windows and Mac 

• Chrome prior to 140.0.7339.80 for Linux 

Risk: 

• Large and medium business entities: High 

• Small business entities: Medium 

Remediation Recommendations 

• Ensure all devices using Google Chrome have the latest version(s) installed 

• Enact the Principle of Least Privilege (limit higher-level privileges to only the users that need it) 

References 

• ​​​​ https://chromereleases.googleblog.com/2025/09/stable-channel-update-for-desktop.html 

Multiple Vulnerabilities in Adobe Products
Could Allow for Arbitrary Code Execution 

Multiple vulnerabilities have been discovered in Adobe products, the most severe of which could allow for arbitrary code execution. Successful exploitation of the most severe of these vulnerabilities could allow for arbitrary code execution in the context of the logged-on user. 

Affected Systems: 

• Acrobat DC Win - 25.001.20672 and earlier versions 

• Acrobat DCMac - 25.001.20668 and earlier versions 

• Acrobat Reader DC Win - 25.001.20672 and earlier versions 

• Acrobat Reader DC Mac - 25.001.20668 and earlier versions 

• Acrobat 2024 Win & Mac - 24.001.30254 and earlier versions 

• Acrobat 2020 Win & Mac - 20.005.30774 and earlier versions 

• Acrobat Reader 2020 Win & Mac - 20.005.30774 and earlier versions 

• Adobe After Effects 24.6.7 and earlier versions 

• Adobe After Effects 25.3 and earlier versions 

• Adobe Premiere Pro 25.3 and earlier versions 

• Adobe Premiere Pro 24.6.5 and earlier versions 

• Adobe Commerce 2.4.9-alpha2 and earlier versions 

• Adobe Commerce 2.4.8-p2 and earlier versions 

• Adobe Commerce 2.4.7-p7 and earlier versions 

• Adobe Commerce 2.4.6-p12 and earlier versions 

• Adobe Commerce 2.4.5-p14 and earlier versions 

• Adobe Commerce 2.4.4-p15 and earlier versions 

• Adobe Commerce B2B 1.5.3-alpha2 and earlier versions 

• Adobe Commerce B2B 1.5.2-p2 and earlier versions 

• Adobe Commerce B2B 1.4.2-p7 and earlier versions 

• Adobe Commerce B2B 1.3.4-p14 and earlier versions 

• Adobe Commerce B2B 1.3.3-p15 and earlier versions 

• Magento Open Source 2.4.9-alpha2 and earlier versions 

• Magento Open Source 2.4.8-p2 and earlier versions 

• Magento Open Source 2.4.7-p7 and earlier versions 

• Magento Open Source 2.4.6-p12 and earlier versions 

• Magento Open Source 2.4.5-p14 and earlier versions 

• Adobe Substance 3D Viewer 0.25.1 and earlier versions 

• AEM Cloud Service (CS) 6.5 LTS SP1 and earlier versions 

• AEM Cloud Service (CS) 6.5.23 and earlier versions 

• Adobe Dreamweaver 21.5 and earlier versions 

• Adobe Substance 3D Modeler 1.22.2 and earlier versions 

• ColdFusion 2025 Update 3 and earlier versions 

• ColdFusion 2023 Update 15 and earlier versions 

• ColdFusion 2021 Update 21 and earlier versions 

Remediation Recommendations 

• Ensure all versions of all Adobe products are updated to their latest versions
• Enact the Principle of Least Privilege (limit higher-level privileges to only the users that need it) 

Risk 

• Large and medium business entities: High 

• Small business entities: Medium 

References 

• https://helpx.adobe.com/security/Home.html 
  
• https://helpx.adobe.com/security/products/acrobat/apsb25-85.html 
  
• https://helpx.adobe.com/security/products/after_effects/apsb25-86.html 
  
• https://helpx.adobe.com/security/products/premiere_pro/apsb25-87.html 
  
• https://helpx.adobe.com/security/products/magento/apsb25-88.html 
  
• https://helpx.adobe.com/security/products/substance3d-viewer/apsb25-89.html 
  
• https://helpx.adobe.com/security/products/experience-manager/apsb25-90.html 
  
• https://helpx.adobe.com/security/products/dreamweaver/apsb25-91.html 
  
• https://helpx.adobe.com/security/products/substance3d-modeler/apsb25-92.html 
  
• https://helpx.adobe.com/security/products/coldfusion/apsb25-93.html 

ChillyHell Malware Targets mACOS 

Jamf has published a report on a strain of macOS malware dubbed "ChillyHell" that's been active since 2021. The malware was first observed by Mandiant in a 2022 campaign targeting Ukrainian government officials. Jamf notes, "Between its multiple persistence mechanisms, ability to communicate over different protocols, and modular structure, ChillyHell is extraordinarily flexible. Capabilities such as timestomping and password cracking make this sample an unusual find in the current macOS threat landscape. Notably, ChillyHell was notarized and serves as an important reminder that not all malicious code comes unsigned."