A critical zero-day vulnerability (CVE-2025-33053) in WebDAV implementations allows remote code execution. Advanced persistent threat (APT) groups have actively exploited this vulnerability in targeted campaigns against enterprise networks. The exploit uses malicious URL shortcut files combined with WebDAV server configurations to gain initial access and move laterally within compromised environments. This vulnerability is particularly effective against environments running Apache2 with WebDAV modules enabled, often lacking adequate access controls. Security researchers have observed APT groups distributing these weaponized shortcuts through phishing campaigns disguised as legitimate business documents.

A critical path equivalence vulnerability in Apache Tomcat, designated CVE-2025-24813, has been actively exploited in the wild following the public release of proof-of-concept exploit code. The vulnerability, disclosed on March 10, 2025, enables unauthenticated remote code execution under specific server configurations and affects millions of Java-based web applications worldwide. Security researchers have confirmed active exploitation attempts shortly after the vulnerability’s disclosure, with the Cybersecurity and Infrastructure Security Agency (CISA) adding it to the Known Exploited Vulnerabilities catalog on April 1, 2025.