Skip to main content

CISA issues alert on Ashlar-Vellum vulnerabilities in multiple products

Source Decision Insights Threat Desk Published November 25, 2025 Companies 1
Human View Machine View

302nd article in the last 90 days, one of 409 articles referencing Cybersecurity and Infrastructure Security Agency (CISA). Previous coverage: CISA issues seven advisories on industrial control systems vulnerabilities (Nov 2025).

Companies mentioned

Best suited for

Persona
Security Operations Leader
Decision stage
Which to buy
Adoption curve
Early Majority
Industry
Information Technology / Software & Services / Software / Design & Creative Software

Our classification, not the publisher's statement. Best suited for, not only for.

Ashlar-Vellum has identified vulnerabilities involving out-of-bounds write and heap-based buffer overflow in its Cobalt, Xenon, Argon, Lithium, and Cobalt Share products, posing risks of information disclosure and arbitrary code execution.

The issues correspond to CVEs CVE-2025-65084 and CVE-2025-65085, impacting versions 12.6.1204.207 and earlier of the stated software. The vulnerabilities affect core components in each product, with exploitation triggered by user interactions involving these versions. Both vulnerabilities have a Common Vulnerability Scoring System (CVSS) v3.1 base score of 7.8 and a CVSS v4 base score of 8.4, reflecting the detailed assessment vectors provided in the advisory.

Exploiting these vulnerabilities could enable unauthorized disclosure of information or the execution of arbitrary code within the affected environments.

Ashlar-Vellum recommends upgrading to version 12.6.1204.208 or newer across all affected products to address the vulnerabilities. Defensive measures include configuring control system networks to limit exposure, employing firewall protections, and using secure remote access methods such as VPNs, acknowledging the importance of updated Virtual Private Network (VPN) solutions.

Organizations are advised to conduct thorough impact and risk assessments before deploying mitigation strategies. Additional resources on industrial control system security and defense-in-depth approaches are available for reference. Observed suspicious activities should be reported through established channels for further analysis and correlation.

Blog post, originally published by CISA at cisa.gov.

Mentions

Structured data (JSON-LD)

The schema.org markup this page publishes for search engines and AI agents, exactly as they read it.

[
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#website",
    "@type": "WebSite",
    "name": "Decision Insights",
    "potentialAction": {
      "@type": "SearchAction",
      "target": {
        "@type": "EntryPoint",
        "urlTemplate": "https://decisioninsights.ai/search/?q={search_term_string}&submit=1"
      }
    },
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    },
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#organization",
    "@type": "Organization",
    "contactPoint": {
      "@type": "ContactPoint",
      "contactType": "customer support",
      "email": "[email protected]"
    },
    "description": "Decision Insights is a Registry of technology companies, open source projects, and industry terms, built for people and for AI agents that need sourced, structured information.",
    "logo": {
      "@type": "ImageObject",
      "url": "https://wiretap-cdn-assets.nyc3.cdn.digitaloceanspaces.com/decision-insights/[email protected]"
    },
    "name": "Decision Insights",
    "parentOrganization": {
      "@type": "Organization",
      "name": "Wiretap Labs",
      "sameAs": [
        "https://www.linkedin.com/company/wiretap-labs",
        "https://www.crunchbase.com/organization/wiretap-labs"
      ],
      "url": "https://wiretaplabs.com"
    },
    "publishingPrinciples": "https://decisioninsights.ai/standards/",
    "sameAs": [
      "https://www.linkedin.com/company/decisioninsights"
    ],
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@type": "BreadcrumbList",
    "itemListElement": [
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai",
        "name": "Decision Insights",
        "position": 1
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/records/",
        "name": "Records",
        "position": 2
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/cisa-issues-alert-on-ashlar-vellum-vulnerabilities-in-multiple-products/",
        "name": "CISA issues alert on Ashlar-Vellum vulnerabilities in multiple products",
        "position": 3
      }
    ]
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/cisa-issues-alert-on-ashlar-vellum-vulnerabilities-in-multiple-products/#blogposting",
    "@type": "BlogPosting",
    "about": {
      "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/#organization",
      "@type": "Organization",
      "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/",
      "name": "Cybersecurity and Infrastructure Security Agency (CISA)"
    },
    "audience": [
      {
        "@type": "Audience",
        "additionalType": "Persona",
        "audienceType": "Security Operations Leader"
      },
      {
        "@type": "Audience",
        "additionalType": "Adoption curve",
        "audienceType": "Early Majority"
      },
      {
        "@type": "Audience",
        "additionalType": "Industry",
        "audienceType": "Information Technology / Software & Services / Software / Design & Creative Software"
      }
    ],
    "author": {
      "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
      "@type": "Person",
      "name": "Decision Insights Threat Desk",
      "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
    },
    "dateModified": "2026-08-23T13:01:33-06:00",
    "datePublished": "2025-11-25T13:16:45-07:00",
    "description": "Ashlar-Vellum addresses out-of-bounds write and buffer overflow vulnerabilities in versions 12.6.1204.207 and earlier with updated releases.",
    "headline": "CISA issues alert on Ashlar-Vellum vulnerabilities in multiple products",
    "isBasedOn": {
      "@type": "CreativeWork",
      "author": {
        "@type": "Person",
        "name": "CISA"
      },
      "sourceOrganization": {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/",
        "name": "Department of Homeland Security"
      },
      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-329-01"
    },
    "keywords": [
      "Common Vulnerability Scoring System",
      "Virtual Private Network",
      "Vulnerabilities"
    ],
    "mainEntityOfPage": {
      "@id": "https://decisioninsights.ai/cisa-issues-alert-on-ashlar-vellum-vulnerabilities-in-multiple-products/",
      "@type": "WebPage",
      "sdDatePublished": "2026-08-23",
      "sdPublisher": {
        "@id": "https://decisioninsights.ai/#organization"
      }
    },
    "mentions": [
      {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/",
        "name": "Cybersecurity and Infrastructure Security Agency (CISA)"
      }
    ],
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    }
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
    "@type": "Person",
    "description": "CISA advisories, vendor security bulletins, and CVE disclosures, summarized into sourced briefs. Produced under our Standards & Methodology.",
    "name": "Decision Insights Threat Desk",
    "sameAs": [
      "https://www.linkedin.com/showcase/decisioninsights/"
    ],
    "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
  }
]

Is this your company? Get structured data for your own pages