Authoritative signal

Known exploited

The current CISA KEV catalog, bound to the active generation and ordered by catalog date and CASCA priority.

As known Jul 19, 2026, 5:00 AM UTCgen-56ccdaf9

KEV JSON is authoritativeCatalog absence remains unknown; CSV is serialization-only and never an independent vote.1,647 catalog members · showing 201–250

201

CVE-2025-61932CISA KEV

Motex LANSCOPE Endpoint Manager Improper Verification of Source of a Communication Channel Vulnerability

Motex LANSCOPE Endpoint Manager contains an improper verification of source of a communication channel vulnerability allowing an attacker to execute arbitrary code by sending specially crafted packets.

MotexLANSCOPE Endpoint Manager

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added: 2025-10-22
Due: 2025-11-12
Priority interval: 66.5–82.8
Coverage: 85%

↗

202

CVE-2025-2747CISA KEV

Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel Vulnerability

Kentico Xperience CMS contains an authentication bypass using an alternate path or channel vulnerability that could allow an attacker to control administrative objects.

KenticoXperience CMS

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added: 2025-10-20
Due: 2025-11-10
Priority interval: 83.7–98.7
Coverage: 85%

↗

203

CVE-2025-2746CISA KEV

Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel Vulnerability

Kentico Xperience CMS contains an authentication bypass using an alternate path or channel vulnerability that could allow an attacker to control administrative objects.

KenticoXperience CMS

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added: 2025-10-20
Due: 2025-11-10
Priority interval: 79.8–94.8
Coverage: 85%

↗

204

CVE-2025-61884CISA KEVKnown ransomware

Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability

Oracle E-Business Suite contains a server-side request forgery (SSRF) vulnerability in the Runtime component of Oracle Configurator. This vulnerability is remotely exploitable without authentication.

OracleE-Business Suite

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added: 2025-10-20
Due: 2025-11-10
Priority interval: 78.5–93.5
Coverage: 85%

↗

205

CVE-2025-33073CISA KEV

Microsoft Windows SMB Client Improper Access Control Vulnerability

Microsoft Windows SMB Client contains an improper access control vulnerability that could allow for privilege escalation. An attacker could execute a specially crafted malicious script to coerce the victim machine to connect back to the attack system using SMB and authenticate.

MicrosoftWindows

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added: 2025-10-20
Due: 2025-11-10
Priority interval: 78.1–93.1
Coverage: 85%

↗

206

CVE-2022-48503CISA KEV

Apple Multiple Products Unspecified Vulnerability

Apple macOS, iOS, tvOS, Safari, and watchOS contain an unspecified vulnerability in JavaScriptCore that when processing web content may lead to arbitrary code execution. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.

AppleMultiple Products

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added: 2025-10-20
Due: 2025-11-10
Priority interval: 65.6–80.6
Coverage: 85%

↗

207

CVE-2025-54253CISA KEV

Adobe Experience Manager Forms Code Execution Vulnerability

Adobe Experience Manager Forms in JEE contains an unspecified vulnerability that allows for arbitrary code execution.

AdobeExperience Manager (AEM) Forms

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added: 2025-10-15
Due: 2025-11-05
Priority interval: 83.7–98.7
Coverage: 85%

↗

208

CVE-2016-7836CISA KEVConflicting evidence

SKYSEA Client View Improper Authentication Vulnerability

SKYSEA Client View contains an improper authentication vulnerability that allows remote code execution via a flaw in processing authentication on the TCP connection with the management console program.

SKYSEAClient View

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added: 2025-10-14
Due: 2025-11-04
Priority interval: 73.3–88.8
Coverage: 73%

↗

209

CVE-2025-24990CISA KEV

Microsoft Windows Untrusted Pointer Dereference Vulnerability

Microsoft Windows Agere Modem Driver contains an untrusted pointer dereference vulnerability that allows for privilege escalation. An attacker who successfully exploited this vulnerability could gain administrator privileges.

MicrosoftWindows

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added: 2025-10-14
Due: 2025-11-04
Priority interval: 64.4–79.4
Coverage: 85%

↗

210

CVE-2025-59230CISA KEV

Microsoft Windows Improper Access Control Vulnerability

Microsoft Windows contains an improper access control vulnerability in Windows Remote Access Connection Manager which could allow an authorized attacker to elevate privileges locally.

MicrosoftWindows

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added: 2025-10-14
Due: 2025-11-04
Priority interval: 62.8–77.8
Coverage: 85%

↗

211

CVE-2025-47827CISA KEV

IGEL OS Use of a Key Past its Expiration Date Vulnerability

IGEL OS contains a use of a key past its expiration date vulnerability that allows for Secure Boot bypass. The igel-flash-driver module improperly verifies a cryptographic signature. Ultimately, a crafted root filesystem can be mounted from an unverified SquashFS image.

IGELIGEL OS

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added: 2025-10-14
Due: 2025-11-04
Priority interval: 55.4–70.4
Coverage: 85%

↗

212

CVE-2021-43798CISA KEVConflicting evidence

Grafana Path Traversal Vulnerability

Grafana contains a path traversal vulnerability that could allow access to local files.

Grafana LabsGrafana

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added: 2025-10-09
Due: 2025-10-30
Priority interval: 71.4–92.6
Coverage: 73%

↗

213

CVE-2025-27915CISA KEV

Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability

Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability that exists in the Classic Web Client due to insufficient sanitization of HTML content in ICS files. When a user views an e-mail message containing a malicious ICS entry, its embedded JavaScript executes via an ontoggle event inside a tag. This allows an attacker to run arbitrary JavaScript within the victim's session, potentially leading to unauthorized actions such as setting e-mail filters to redirect messages to an attacker-controlled address. As a result, an attacker can perform unauthorized actions on the victim's account, including e-mail redirection and data exfiltration.

SynacorZimbra Collaboration Suite (ZCS)

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added: 2025-10-07
Due: 2025-10-28
Priority interval: 57.7–72.7
Coverage: 85%

↗

214

CVE-2025-61882CISA KEVKnown ransomware

Oracle E-Business Suite Unspecified Vulnerability

Oracle E-Business Suite contains an unspecified vulnerability in the BI Publisher Integration component. The vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Concurrent Processing. Successful attacks can result in takeover of Oracle Concurrent Processing.

OracleE-Business Suite

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added: 2025-10-06
Due: 2025-10-27
Priority interval: 84.5–99.5
Coverage: 85%

↗

215

CVE-2010-3962CISA KEVConflicting evidence

Microsoft Internet Explorer Uninitialized Memory Corruption Vulnerability

Microsoft Internet Explorer contains an uninitialized memory corruption vulnerability that could allow for remote code execution. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.

MicrosoftInternet Explorer

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added: 2025-10-06
Due: 2025-10-27
Priority interval: 79.9–97.9
Coverage: 73%

↗

216

CVE-2010-3765CISA KEVConflicting evidence

Mozilla Multiple Products Remote Code Execution Vulnerability

Mozilla Firefox, SeaMonkey, and Thunderbird contain an unspecified vulnerability when JavaScript is enabled. This allows remote attackers to execute arbitrary code via vectors related to nsCSSFrameConstructor::ContentAppended, the appendChild method, incorrect index tracking, and the creation of multiple frames, which triggers memory corruption.

MozillaMultiple Products

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added: 2025-10-06
Due: 2025-10-27
Priority interval: 81.5–97.8
Coverage: 73%

↗

217

CVE-2011-3402CISA KEV

Microsoft Windows Remote Code Execution Vulnerability

Microsoft Windows Kernel contains an unspecified vulnerability in the TrueType font parsing engine in win32k.sys in the kernel-mode drivers that allows remote attackers to execute arbitrary code via crafted font data in a Word document or web page.

MicrosoftWindows

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added: 2025-10-06
Due: 2025-10-27
Priority interval: 79.7–95.9
Coverage: 85%

↗

218

CVE-2013-3918CISA KEV

Microsoft Windows Out-of-Bounds Write Vulnerability

Microsoft Windows contains an out-of-bounds write vulnerability in the InformationCardSigninHelper Class ActiveX control, icardie.dll. An attacker could exploit the vulnerability by constructing a specially crafted webpage. When a user views the webpage, the vulnerability could allow remote code execution. An attacker who successfully exploited this vulnerability could gain the same user rights as the current user. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.

MicrosoftWindows

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added: 2025-10-06
Due: 2025-10-27
Priority interval: 79.2–95.4
Coverage: 85%

↗

219

CVE-2021-22555CISA KEVConflicting evidence

Linux Kernel Heap Out-of-Bounds Write Vulnerability

Linux Kernel contains a heap out-of-bounds write vulnerability that could allow an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name space.

LinuxKernel

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added: 2025-10-06
Due: 2025-10-27
Priority interval: 69.2–93.5
Coverage: 73%

↗

220

CVE-2021-43226CISA KEVConflicting evidence

Microsoft Windows Privilege Escalation Vulnerability

Microsoft Windows Common Log File System Driver contains a privilege escalation vulnerability that could allow a local, privileged attacker to bypass certain security mechanisms.

MicrosoftWindows

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added: 2025-10-06
Due: 2025-10-27
Priority interval: 55.0–78.0
Coverage: 73%

↗

221

CVE-2014-6278CISA KEVConflicting evidence

GNU Bash OS Command Injection Vulnerability

GNU Bash contains an OS command injection vulnerability which allows remote attackers to execute arbitrary commands via a crafted environment.

GNUGNU Bash

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added: 2025-10-02
Due: 2025-10-23
Priority interval: 82.0–100.0
Coverage: 73%

↗

222

CVE-2017-1000353CISA KEVConflicting evidence

Jenkins Remote Code Execution Vulnerability

Jenkins contains a remote code execution vulnerability. This vulnerability that could allowed attackers to transfer a serialized Java SignedObject object to the remoting-based Jenkins CLI, that would be deserialized using a new ObjectInputStream, bypassing the existing blocklist-based protection mechanism.

JenkinsJenkins

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added: 2025-10-02
Due: 2025-10-23
Priority interval: 78.7–99.5
Coverage: 73%

↗

223

CVE-2025-4008CISA KEV

Smartbedded Meteobridge Command Injection Vulnerability

Smartbedded Meteobridge contains a command injection vulnerability that could allow remote unauthenticated attackers to gain arbitrary command execution with elevated privileges (root) on affected devices.

SmartbeddedMeteobridge

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added: 2025-10-02
Due: 2025-10-23
Priority interval: 81.2–96.5
Coverage: 85%

↗

224

CVE-2015-7755CISA KEVConflicting evidence

Juniper ScreenOS Improper Authentication Vulnerability

Juniper ScreenOS contains an improper authentication vulnerability that could allow unauthorized remote administrative access to the device.

JuniperScreenOS

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added: 2025-10-02
Due: 2025-10-23
Priority interval: 80.2–95.7
Coverage: 73%

↗

225

CVE-2025-21043CISA KEVConflicting evidence

Samsung Mobile Devices Out-of-Bounds Write Vulnerability

Samsung mobile devices contain an out-of-bounds write vulnerability in libimagecodec.quram.so which allows remote attackers to execute arbitrary code.

SamsungMobile Devices

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added: 2025-10-02
Due: 2025-10-23
Priority interval: 64.4–81.9
Coverage: 73%

↗

226

CVE-2025-10035CISA KEVKnown ransomware

Fortra GoAnywhere MFT Deserialization of Untrusted Data Vulnerability

Fortra GoAnywhere MFT contains a deserialization of untrusted data vulnerability allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection.

FortraGoAnywhere MFT

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added: 2025-09-29
Due: 2025-10-20
Priority interval: 84.5–100.0
Coverage: 85%

↗

227

CVE-2025-32463CISA KEVConflicting evidence

Sudo Inclusion of Functionality from Untrusted Control Sphere Vulnerability

Sudo contains an inclusion of functionality from untrusted control sphere vulnerability. This vulnerability could allow local attacker to leverage sudo’s -R (--chroot) option to run arbitrary commands as root, even if they are not listed in the sudoers file.

SudoSudo

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added: 2025-09-29
Due: 2025-10-20
Priority interval: 73.3–92.0
Coverage: 73%

↗

228

CVE-2021-21311CISA KEVConflicting evidence

Adminer Server-Side Request Forgery Vulnerability

Adminer contains a server-side request forgery vulnerability that, when exploited, allows a remote attacker to obtain potentially sensitive information.

AdminerAdminer

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added: 2025-09-29
Due: 2025-10-20
Priority interval: 75.0–92.0
Coverage: 73%

↗

229

CVE-2025-20352CISA KEV

Cisco IOS and IOS XE Software SNMP Denial of Service and Remote Code Execution Vulnerability

Cisco IOS and IOS XE contains a stack-based buffer overflow vulnerability in the Simple Network Management Protocol (SNMP) subsystem that could allow for denial of service or remote code execution. A successful exploit could allow a low-privileged attacker to cause the affected system to reload, resulting in a DoS condition, or allow a high-privileged attacker to execute arbitrary code as the root user and obtain full control of the affected system.

CiscoIOS and IOS XE

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added: 2025-09-29
Due: 2025-10-20
Priority interval: 71.5–86.5
Coverage: 85%

↗

230

CVE-2025-59689CISA KEV

Libraesva Email Security Gateway Command Injection Vulnerability

Libraesva Email Security Gateway (ESG) contains a command injection vulnerability which allows command injection via a compressed e-mail attachment.

LibraesvaEmail Security Gateway

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added: 2025-09-29
Due: 2025-10-20
Priority interval: 58.0–73.0
Coverage: 85%

↗

231

CVE-2025-20362CISA KEVConflicting evidence

Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Missing Authorization Vulnerability

Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Software VPN Web Server contain a missing authorization vulnerability. This vulnerability could be chained with CVE-2025-20333.

CiscoSecure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense

Required actionThe KEV due date refers to the deadline by which FCEB agencies are expected to review and begin implementing the guidance outlined in Emergency Directive (ED) 25-03 (URL listed below in Notes). Agencies must follow the mitigation steps provided by CISA (URL listed below in Notes) and vendor’s instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.

Added: 2025-09-25
Due: 2025-09-26
Priority interval: 74.7–95.0
Coverage: 73%

↗

232

CVE-2025-20333CISA KEV

Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buffer Overflow Vulnerability

Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Software VPN Web Server contain a buffer overflow vulnerability that allows for remote code execution. This vulnerability could be chained with CVE-2025-20362.

CiscoSecure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense

Added: 2025-09-25
Due: 2025-09-26
Priority interval: 77.5–92.5
Coverage: 85%

↗

233

CVE-2025-10585CISA KEVConflicting evidence

Google Chromium V8 Type Confusion Vulnerability

Google Chromium contains a type confusion vulnerability in the V8 JavaScript and WebAssembly engine.

GoogleChromium V8

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added: 2025-09-23
Due: 2025-10-14
Priority interval: 66.7–84.2
Coverage: 73%

↗

234

CVE-2025-5086CISA KEV

Dassault Systèmes DELMIA Apriso Deserialization of Untrusted Data Vulnerability

Dassault Systèmes DELMIA Apriso contains a deserialization of untrusted data vulnerability that could lead to a remote code execution.

Dassault SystèmesDELMIA Apriso

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added: 2025-09-11
Due: 2025-10-02
Priority interval: 81.4–96.4
Coverage: 85%

↗

235

CVE-2025-53690CISA KEV

Sitecore Multiple Products Deserialization of Untrusted Data Vulnerability

Sitecore Experience Manager (XM), Experience Platform (XP), Experience Commerce (XC), and Managed Cloud contain a deserialization of untrusted data vulnerability involving the use of default machine keys. This flaw allows attackers to exploit exposed ASP.NET machine keys to achieve remote code execution.

SitecoreMultiple Products

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added: 2025-09-04
Due: 2025-09-25
Priority interval: 73.6–88.6
Coverage: 85%

↗

236

CVE-2025-48543CISA KEV

Android Runtime Use-After-Free Vulnerability

Android Runtime contains a use-after-free vulnerability potentially allowing a chrome sandbox escape leading to local privilege escalation.

AndroidRuntime

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added: 2025-09-04
Due: 2025-09-25
Priority interval: 63.5–78.5
Coverage: 85%

↗

237

CVE-2025-38352CISA KEV

Linux Kernel Time-of-Check Time-of-Use (TOCTOU) Race Condition Vulnerability

Linux kernel contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that has a high impact on confidentiality, integrity, and availability.

LinuxKernel

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added: 2025-09-04
Due: 2025-09-25
Priority interval: 60.8–75.8
Coverage: 85%

↗

238

CVE-2025-9377CISA KEVConflicting evidence

TP-Link Archer C7(EU) and TL-WR841N/ND(MS) OS Command Injection Vulnerability

TP-Link Archer C7(EU) and TL-WR841N/ND(MS) contain an OS command injection vulnerability that exists in the Parental Control page. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.

TP-LinkMultiple Routers

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added: 2025-09-03
Due: 2025-09-24
Priority interval: 64.9–83.4
Coverage: 73%

↗

239

CVE-2023-50224CISA KEV

TP-Link TL-WR841N Authentication Bypass by Spoofing Vulnerability

TP-Link TL-WR841N contains an authentication bypass by spoofing vulnerability within the httpd service, which listens on TCP port 80 by default, leading to the disclose of stored credentials. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.

TP-LinkTL-WR841N

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added: 2025-09-03
Due: 2025-09-24
Priority interval: 64.6–79.6
Coverage: 85%

↗

240

CVE-2020-24363CISA KEV

TP-link TL-WA855RE Missing Authentication for Critical Function Vulnerability

TP-link TL-WA855RE contains a missing authentication for critical function vulnerability. This vulnerability could allow an unauthenticated attacker (on the same network) to submit a TDDP_RESET POST request for a factory reset and reboot. The attacker can then obtain incorrect access control by setting a new administrative password. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.

TP-LinkTL-WA855RE

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added: 2025-09-02
Due: 2025-09-23
Priority interval: 69.8–86.1
Coverage: 85%

↗

241

CVE-2025-55177CISA KEV

Meta Platforms WhatsApp Incorrect Authorization Vulnerability

Meta Platforms WhatsApp contains an incorrect authorization vulnerability due to an incomplete authorization of linked device synchronization messages. This vulnerability could allow an unrelated user to trigger processing of content from an arbitrary URL on a target’s device.

Meta PlatformsWhatsApp

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added: 2025-09-02
Due: 2025-09-23
Priority interval: 57.6–72.6
Coverage: 85%

↗

242

CVE-2025-57819CISA KEV

Sangoma FreePBX Authentication Bypass Vulnerability

Sangoma FreePBX contains an authentication bypass vulnerability due to insufficiently sanitized user-supplied data allows unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution.

SangomaFreePBX

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added: 2025-08-29
Due: 2025-09-19
Priority interval: 83.8–99.3
Coverage: 85%

↗

243

CVE-2025-7775CISA KEV

Citrix NetScaler Memory Overflow Vulnerability

Citrix NetScaler ADC and NetScaler Gateway contain a memory overflow vulnerability that could allow for remote code execution and/or denial of service.

CitrixNetScaler

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added: 2025-08-26
Due: 2025-08-28
Priority interval: 71.7–88.2
Coverage: 85%

↗

244

CVE-2024-8069CISA KEVConflicting evidence

Citrix Session Recording Deserialization of Untrusted Data Vulnerability

Citrix Session Recording contains a deserialization of untrusted data vulnerability that allows limited remote code execution with privilege of a NetworkService Account access. Attacker must be an authenticated user on the same intranet as the session recording server.

CitrixSession Recording

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added: 2025-08-25
Due: 2025-09-15
Priority interval: 60.4–82.7
Coverage: 73%

↗

245

CVE-2025-48384CISA KEV

Git Link Following Vulnerability

Git contains a link following vulnerability that stems from Git’s inconsistent handling of carriage return characters in configuration files.

GitGit

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added: 2025-08-25
Due: 2025-09-15
Priority interval: 63.3–78.3
Coverage: 85%

↗

246

CVE-2024-8068CISA KEVConflicting evidence

Citrix Session Recording Improper Privilege Management Vulnerability

Citrix Session Recording contains an improper privilege management vulnerability that could allow for privilege escalation to NetworkService Account access. An attacker must be an authenticated user in the same Windows Active Directory domain as the session recording server domain.

CitrixSession Recording

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added: 2025-08-25
Due: 2025-09-15
Priority interval: 55.1–77.4
Coverage: 73%

↗

247

CVE-2025-43300CISA KEV

Apple iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability

Apple iOS, iPadOS, and macOS contain an out-of-bounds write vulnerability in the Image I/O framework.

AppleiOS, iPadOS, and macOS

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added: 2025-08-21
Due: 2025-09-11
Priority interval: 73.9–88.9
Coverage: 85%

↗

248

CVE-2025-54948CISA KEV

Trend Micro Apex One OS Command Injection Vulnerability

Trend Micro Apex One Management Console (on-premise) contains an OS command injection vulnerability that could allow a pre-authenticated remote attacker to upload malicious code and execute commands on affected installations.

Trend MicroApex One

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added: 2025-08-18
Due: 2025-09-08
Priority interval: 72.6–88.6
Coverage: 85%

↗

249

CVE-2025-8876CISA KEVConflicting evidence

N-able N-Central Command Injection Vulnerability

N-able N-Central contains a command injection vulnerability via improper sanitization of user input.

N-ableN-Central

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added: 2025-08-13
Due: 2025-08-20
Priority interval: 65.5–82.0
Coverage: 73%

↗

250

CVE-2025-8875CISA KEVConflicting evidence

N-able N-Central Insecure Deserialization Vulnerability

N-able N-Central contains an insecure deserialization vulnerability that could lead to command execution.

N-ableN-Central

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added: 2025-08-13
Due: 2025-08-20
Priority interval: 62.0–81.0
Coverage: 73%

↗