The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a high-severity vulnerability in Nakivo Backup & Replication to its Known Exploited Vulnerabilities (KEV) catalog, citing active exploitation. This absolute path traversal flaw, tracked as CVE-2024-48248 (CVSS score: 8.6/10), allows unauthenticated attackers to access sensitive files, including configuration files, backups, and credentials, potentially leading to further compromises. Originally reported by watchTowr in September 2024, the vulnerability was silently patched in version 11.0.0.88174 in November, but Nakivo only publicly acknowledged it in March 2025. Exploitation attempts have been observed since late February, and due to Nakivo’s extensive integration with enterprise environments and cloud services, attackers could leverage the flaw to gain broader infrastructure access. In response, CISA has mandated that all Federal Civilian Executive Branch (FCEB) agencies apply the necessary patches by April 9, 2025, under Binding Operational Directive (BOD) 22-01. Additionally, CISA has flagged two (2) other vulnerabilities. The first flaw, tracked as CVE-2025-1316, is a critical OS command injection flaw in Edimax IP cameras that has been exploited since May 2024 for Mirai botnet attacks. The second flaw, tracked as CVE-2017-12637, is a directory traversal flaw in SAP NetWeaver that has been exploited since 2017. While federal agencies are required to implement mitigations, all organizations are strongly advised to identify affected systems and apply patches immediately to prevent potential security breaches. CTIX analysts urge any administrators to ensure their vulnerable instances are patched as soon as possible to p