Table of Contents

Cyberthreat Analysis

• Salesforce Discloses Unauthorized Access to Customer Data Via Compromised Gainsight-Published Applications
• Akira Ransomware's SonicWall Campaign Creates Enterprise M&A Risk
• FortiWeb Authentication Bypass Vulnerability Exploited in the Wild

Industry News

#NMFTACyber On Demand

Salesforce Discloses Unauthorized Access to Customer Data Via Compromised Gainsight-Published Applications

On November 19, 2025, Salesforce announced an investigation into unusual activity involving applications published by Gainsight, a company that provides customer success software integrated with Salesforce. In their advisory, Salesforce indicated that they had notified affected customers directly, and that an investigation is ongoing. Salesforce has not yet provided details about the full scope of the malicious activity. 

According to Salesforce, there is no evidence that this issue resulted from a vulnerability in the Salesforce platform itself. Instead, the source of the malicious activity is believed to be tied to Gainsight-published applications that are installed and managed by customers directly. In response, Salesforce revoked all active access and refresh tokens linked to these applications and temporarily removed them from the company’s AppExchange marketplace. 

On November 20, 2025, Gainsight acknowledged on their status page that there had been connection failures for the Gainsight SFDC Connector in relation to this incident but has not provided any additional details at this time.

Akira Ransomware's SonicWall Campaign Creates Enterprise M&A Risk

The “Akira” ransomware group has been weaponizing vulnerabilities in SonicWall secure sockets layer (SSL) virtual private network (VPN) devices, revealing an overlooked threat for larger enterprises navigating mergers and acquisitions (M&A). These devices, widely used by small- and medium-sized businesses due to their affordability and ease of use, have become launchpads for Akira’s fast-spreading attacks.  

ReliaQuest analyzed a series of Akira attacks between June and October 2025 that targeted SonicWall SSL VPN devices to uncover a troubling trend. In every incident, Akira operators gained a foothold in larger, acquiring enterprises by compromising SonicWall devices inherited from smaller, acquired business during M&A. In these cases, the acquiring enterprises were unaware that these devices existed in their new environments, leaving critical vulnerabilities exposed. 

This isn’t just the usual story of hidden technologies slipping through the cracks during M&A. These attacks were part of a deliberate and targeted campaign against SonicWall devices, which are rare in larger organizations but common in smaller ones. Standard M&A due diligence is not enough. Security teams must proactively secure inherited technologies, prioritizing early visibility into new environments, like remote access tools, to address risky configurations and outdated credentials before attackers exploit them.

FortiWeb Authentication Bypass Vulnerability Exploited in the Wild

A relative path traversal vulnerability in Fortinet FortiWeb may allow an attacker to execute administrative commands on the system via crafted Hypertext Transfer Protocol (HTTP) or Hypertext Transfer Protocol Secure (HTTPS) requests. The vulnerability exists due to a flaw in the validation checks in the HTTP requests used to authenticate application programming interface (API) callers. By supplying a handcrafted HTTP_CGIINFO header, an attacker can impersonate any user, including the built-in admin, and inherit their full privileges. Fortinet has observed this to be exploited in the wild. Fortinet recommends disabling HTTP or HTTPS for internet facing interfaces until an upgrade can be performed. If the HTTP/HTTPS Management interface is internally accessible only as per best practice, the risk is significantly reduced.

Refer a Colleague

Would you like others at your company to be added to the NMFTA Headline Newsletter email distribution list? Send them this link or fill out the form for them on their behalf below!