CVE-2025-47729 on CISA KEV

The TeleMessage archiving backend through 2025-05-05 holds cleartext copies of messages from TM SGNL (aka Archive Signal) app users, which is different functionality than described in the TeleMessage "End-to-End encryption from the mobile phone through to the corporate archi

01What CISA says about this vulnerability

The TeleMessage archiving backend through 2025-05-05 holds cleartext copies of messages from TM SGNL (aka Archive Signal) app users, which is different functionality than described in the TeleMessage "End-to-End encryption from the mobile phone through to the corporate archive" documentation, as exploited in the wild in May 2025.

02Required action — verbatim from CISA

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

03Notes & references

• news.ycombinator.com — https://news.ycombinator.com/item?id=43909220
• arstechnica.com — https://arstechnica.com/security/2025/05/signal-clone-used-by-trump-official-sto…
• www.theregister.com — https://www.theregister.com/2025/05/05/telemessage_investigating/

04SARA's analyst layer — why this matters

This vulnerability is currently on the CISA KEV list, which CISA only adds CVEs to when there is reliable evidence of active exploitation in the wild. For federal civilian agencies, BOD 22-01 requires remediation by the due date above. For everyone else, KEV is the strongest "patch immediately" signal you can get from public threat intel.

05Affected products (summary)

Vendor	Product	Versions
TeleMessage	archiving backend	0

06Detection

Open the Sigma generator with a pre-filled prompt for this CVE to draft a starting detection:

Open in Sigma generator →