CISA Adds ASUS Embedded Malicious Code Vulnerability to KEV List Following Active Exploitation

CISA added CVE-2025-59374 — a supply-chain compromise of ASUS Live Update that delivered builds with embedded malicious code — to its Known Exploited Vulnerabilities catalog; the modified updates can trigger unintended device actions and potentially deploy malware. Because affected Live Update clients may be EoL/EoS, CISA requires federal agencies to apply mitigations or discontinue use by January 7, 2026, and urges all organizations to review, patch, or remove impacted software.