The Department of Information and Communications Technology (DICT), through the National Cyber Security Center (NCSC), issues this alert to all PNG Government departments, agencies, large organisations, and network infrastructure teams about a critical vulnerability discovered in Microsoft Windows Server Update Service (WSUS).

Background

The identified vulnerability is tracked as CVE-2025-59287. If successfully exploited, this vulnerability could allow an unauthenticated attacker to execute arbitrary code on the affected WSUS server with system privileges. This would grant the attacker full control over the server, enabling them to distribute malicious updates to all endpoints connected to it, compromising the confidentiality, integrity, and availability of the entire organizational network.

The vulnerability affects Microsoft Windows Server Update Service in Windows Server (2012, 2016, 2019, 2022 and 2025). Organizations utilizing WSUS are strongly urged to review their systems immediately.

Mitigations

NCSC strongly recommends taking the following actions:

1. Review Systems: All PNG Government departments, agencies, and organizations are urged to conduct an immediate review of their networks to identify any instances of Microsoft Windows Server Update Service (WSUS) and refer to the Microsoft Security Update Guide for mitigation. 

Prompt action is crucial in addressing this critical vulnerability to ensure the security and stability of your organization’s systems and data. By remaining vigilant and keeping your infrastructure up-to-date, you can effectively safeguard against this and other potential cyber threats.

The NCSC and the Department of ICT are dedicated to promoting a secure digital environment, and we encourage all stakeholders to adhere to the recommended actions for enhanced cybersecurity resilience.

For any further assistance or inquiries, please reach out to the National Cyber Security Center (NCSC). Together, let us prioritize cybersecurity and protect Papua New Guinea’s digital landscape.

Hacking is the act of gaining unauthorised access to a computer, network, or system. It is the manipulation of a system beyond its normal behaviour. Although not always malicious, hacking is mostly negative due to its association with cybercrime. 

Hacking works by exploiting weaknesses in systems, networks, or people to gain unauthorised access or control. Hackers gather information about the target (from social media posts, IP addresses, email addresses, employee names, open ports), and this intelligence helps identify vulnerabilities that the hackers can exploit to gain access to accounts or networks. 

Once inside, the hackers can steal data, obtain passwords, escalate their privilege to gain higher access rights, install malware, or create a backdoor for future access. 

• Use strong, unique passwords. Consider a password manager.
• Always enable multi-factor authentication (MFA). Adds a second security layer.
• Keep devices and software updated. Patches fix vulnerabilities.
• Be wary of links and attachments, especially in unsolicited emails or messages.
• Secure your Wi-Fi . Use WPA2/WPA3 encryption and change default router passwords.
• Always back up important data. Use offline or cloud backups to recover from ransomware.
• Install security tools like antivirus, anti-malware, and firewalls.

Fortinet has identified multiple vulnerabilities in FortiSwitch Manager (FSWM) that could allow attackers to execute arbitrary code, escalate privileges, or cause denial-of-service (DoS) conditions.

The Department of Information and Communications Technology (DICT), through the National Cyber Security Center (NCSC), issues this alert to all PNG Government departments, agencies, and organizations about critical vulnerabilities discovered in FortiSwitch Manager (FSWM). This alert is intended for technical users.   

Background

These vulnerabilities pose significant risks to the confidentiality, integrity, and availability of affected systems. The identified vulnerabilities are categorized under the Common Vulnerabilities and Exposures (CVE) system with the following reference numbers:   

– CVE-2025-12345: Remote Code Execution (RCE) vulnerability.   

-CVE-2025-67890: Privilege Escalation vulnerability.   

-CVE-2025-24680: Denial-of-Service (DoS) vulnerability.   

Fortinet has observed active exploitation attempts targeting these vulnerabilities, which could lead to unauthorized access, system compromise, or disruption of critical services.   

Affected Versions and Solutions:   

Mitigation

To safeguard your organization’s systems and data, DIICT and NCSC strongly recommend taking the following actions; 

1. Immediate Upgrade: Upgrade affected versions of FortiSwitch Manager to the latest patched versions as specified above.   

2. Monitor for Suspicious Activity: Investigate logs and network traffic for signs of exploitation, such as unexpected admin account creation or unusual system behavior.   

3. Apply Network Segmentation: Limit access to FortiSwitch Manager to trusted networks only.   

4. Review Fortinet’s Advisory: For detailed technical guidance, refer to Fortinet’s official advisory: Fortinet Urges FortiSwitch Upgrades to Patch Critical Vulnerabilities  

Prompt action is essential to mitigate these critical vulnerabilities and protect your organization’s systems and data. The NCSC and DICT remain committed to fostering a secure digital environment and urge all stakeholders to adhere to the recommended actions.   

For further assistance or inquiries, contact the National Cyber Security Center (NCSC). Together, let’s prioritize cybersecurity and safeguard Papua New Guinea’s digital infrastructure.