Two developments from the past week warrant attention from UK organisations: an actively exploited flaw in a widely deployed remote access product, and a shift in how authorised push payment fraud is being socially engineered against corporate finance teams.
What happened
Remote access vulnerability under active exploitation
A critical authentication bypass — tracked here as CVE-EXAMPLE-0001 — has been reported in a remote access gateway used widely across financial services and the public sector. Exploitation requires no authentication and no user interaction. The vendor has released a fixed version; the vulnerability is reported as being exploited in the wild.
A change in payment fraud pretexting
We are seeing reporting of a variation on supplier invoice fraud in which the initial contact is a legitimate-looking calendar invitation rather than an email, placing the fraudulent request inside a channel that finance teams treat as lower risk.
Why it matters
The gateway vulnerability matters more than its severity score suggests, because the affected product sits at the network perimeter and is frequently the single control between the internet and internal systems. Where it is deployed, we assess exploitation is likely within days rather than weeks, based on the low complexity of the attack and the value of the target.
The payment fraud development matters less for its technical novelty — there is none — and more because it defeats a control most organisations rely on: staff trained to scrutinise email will not necessarily apply the same scrutiny to a meeting invitation.
Neither item requires panic. Both require someone to check something specific today.
What to do
- Today. Confirm whether the affected gateway product is deployed anywhere in your estate, including at subsidiaries and through managed service providers. Absence of evidence is not evidence of absence — check, do not assume.
- Within 48 hours. If deployed, patch to the fixed version. If patching cannot happen immediately, restrict management interface exposure and review authentication logs for the indicators in the vendor advisory.
- This week. Remind finance and accounts payable teams that payment detail changes require out-of-band verification regardless of which channel the request arrived through, and confirm the callback procedure is documented rather than assumed.
- This month. Add the scenario to your next tabletop exercise. Controls that have never been tested are assumptions, not capabilities.
Assessment confidence
We would normally state our confidence level and reasoning here — high, moderate or low — along with what would change our assessment. Being explicit about uncertainty is part of the product, not a weakness in it.
Sources
- Vendor security advisory — [link]
- NCSC guidance — [link]
- Sector fraud reporting — [link]