CISA Warns SaaS Attacks Surge
- Threat actors accessed Commvault’s Microsoft 365 app secrets in Azure.
- Unauthorized access affected customers' M365 environments via stolen credentials.
- Exploitation linked to zero-day CVE-2025-3928 in Commvault Web Server.
- Attackers use advanced techniques targeting SaaS providers’ cloud misconfigurations.
- Incident highlights risks from default cloud permissions and flawed app security.