Federal Agencies Told to Act Quickly to Turn Back Cyberthreat

WASHINGTON — The entity charged with protecting federal agencies from bad cyber actors issued a rare emergency directive Thursday, warning they should quickly take steps to protect themselves from vulnerabilities found in VMware.

VMware is a cloud computing and virtualization technology company headquartered in Palo Alto, California. It is primarily known for creating a platform for the virtualization of IT infrastructure as an alternative to having dedicated hosts.

According to the Cybersecurity and Infrastructure Security Agency, vulnerabilities found in five of the company’s products: VMware Workspace ONE Access (Access), VMware Identity Manager (vIDM), VMware vRealize Automation (vRA), VMware Cloud Foundation, and vRealize Suite Lifecycle Manager (vRSLCM) have placed federal networks and systems at immediate risk of a cyber intrusion.

It goes on to say the problem is a vulnerability that permits attackers to gain deep access into computer systems without the need to authenticate. 

“These vulnerabilities pose an unacceptable risk to federal network security,” said CISA Director Jen Easterly in a written statement. 

“CISA has issued this Emergency Directive to ensure that federal civilian agencies take urgent action to protect their networks. We also strongly urge every organization — large and small — to follow the federal government’s lead and take similar steps to safeguard their networks.”

The federal civilian executive branch agencies to whom the warning applies include every executive branch department — Energy, Commerce, Homeland Security, Treasury, Transportation, etc. — as well as “smaller” agencies like the board of governors of the Federal Reserve, the Federal Trade Commission, the National Transportation Safety Board, the Environmental Protection Agency and the Nuclear Regulatory Commission.

Even the Peace Corps could be vulnerable to the threat.

On its website CISA said VMware first discovered new vulnerabilities in early April and released an update to address the problem.

Unfortunately, the agency said, “threat actors were able to reverse engineer the update and begin exploitation of impacted VMware products that remained unpatched within 48 hours of the update’s release.”

Earlier today, VMware released an update for two new vulnerabilities. 

“Based on the above, CISA expects threat actors to quickly develop a capability to exploit these newly released vulnerabilities in the same impacted VMware products,” the agency said. “Exploiting the above vulnerabilities permits attackers to trigger a server-side template injection that may result in remote code execution; escalate privileges to ‘root’; and obtain administrative access without the need to authenticate.

“CISA has determined that these vulnerabilities pose an unacceptable risk … and require emergency action,” the agency said.

Dan can be reached at [email protected] and @DanMcCue