October 2025 CVE Landscape

Mozilla Firefox, SeaMonkey, and Thunderbird contain a memory-corruption vulnerability in the layout engine's CSS frame construction code (nsCSSFrameConstructor::ContentAppended) that is reachable whenever JavaScript is enabled. A remote attacker triggers the flaw by getting a user to load content — typically a malicious web page, or remote HTML content in Thunderbird — that calls the DOM appendChild method in a way that causes incorrect index tracking and the creation of multiple frames, corrupting memory. Successful exploitation allows the attacker to execute arbitrary code in the context of the affected application and the logged-in user. Anyone running the affected 2010-era Mozilla products with JavaScript enabled is exposed, which historically included the very large install base of these desktop applications. CISA added CVE-2010-3765 to its Known Exploited Vulnerabilities catalog on 2025-10-06, confirming exploitation in the wild (ransomware use not yet reported), and EPSS assigns an 83.3% probability of exploitation within the next 30 days.

Do: Upgrade Firefox, SeaMonkey, and Thunderbird to the fixed releases specified in Mozilla's security advisory for CVE-2010-3765; as an interim measure, disable JavaScript in Firefox/SeaMonkey and block remote content in Thunderbird, since the flaw requires JavaScript to be enabled. Per the CISA KEV required action, apply vendor mitigations, follow applicable BOD 22-01 guidance, or discontinue use of the product if mitigations are unavailable — inventory for legacy Mozilla installations and prioritize remediation given the 83.3% EPSS score and confirmed in-the-wild exploitation.

Microsoft Internet Explorer contains an uninitialized memory corruption vulnerability that can allow a remote attacker to execute arbitrary code. As with other browser memory-corruption flaws, it is triggered when Internet Explorer processes attacker-controlled content such as a malicious or compromised web page, causing the browser to access memory that has not been properly initialized. A successful attacker gains code execution under the privileges of the logged-on user, which can enable installation of programs, theft of data, or ransomware staging (ransomware association for this CVE is currently unknown). Anyone still running Internet Explorer is affected; no specific version ranges were provided in the source data, and because IE is a largely retired product, exposure is concentrated in legacy Windows deployments. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2025-10-06, indicating exploitation in the wild, and EPSS assigns it a 96.9% probability of exploitation within 30 days (100th percentile); no public proof-of-concept is known.

Do: Inventory your environment for any remaining Internet Explorer use, including legacy Windows systems and MSHTML/IE-mode dependencies, and apply Microsoft security updates addressing this vulnerability on any still-supported systems (the December 2010 cumulative security update MS10-090 resolves it). Where patching is not possible, follow the CISA KEV required action and BOD 22-01 guidance: apply vendor mitigations or discontinue use of Internet Explorer, given the 96.9% EPSS probability of exploitation within 30 days.

CVE-2011-3402 is a flaw in the TrueType font parsing engine of win32k.sys, part of the kernel-mode drivers in Microsoft Windows. A remote attacker can trigger it by presenting crafted font data to a user — for example, embedded in a Word document or on a web page — and gains the ability to execute arbitrary code on the target system. All Microsoft Windows versions covered by the vendor advisory are affected; the provided data does not enumerate specific version ranges. The vulnerability was famously exploited in the wild in 2011 by the Duqu malware campaign (the subject of Microsoft Security Advisory 2639658), and CISA added it to the Known Exploited Vulnerabilities catalog on 2025-10-06. EPSS assigns a 78.3% probability of exploitation within the next 30 days; no current public proof-of-concept is known.

Do: Verify that every Windows host — prioritizing legacy, embedded, and internet-exposed machines — has the TrueType font-parsing fix released via Microsoft Security Advisory 2639658 (November 2011), and inventory missing patches rather than assuming modern builds are covered. Per CISA KEV/BOD 22-01 guidance, apply vendor mitigations or discontinue use of the product where patching is not possible. Given the 2025-10-06 KEV listing and 78.3% EPSS, treat any host without the win32k.sys font-parsing update as exposed and remediate within required timelines.

CVE-2013-3918 is an out-of-bounds write vulnerability in the InformationCardSigninHelper Class ActiveX control (icardie.dll) that ships with Internet Explorer on Microsoft Windows. An attacker triggers it by luring a user to a specially crafted web page; when the page invokes the affected ActiveX control, memory is written outside its allocated bounds and remote code execution can result. A successful attacker gains the same privileges as the currently logged-on user, so code executed under an administrator account would run with full administrative rights. Any Windows system with the vulnerable control present is affected — CISA lists 'Microsoft Windows' broadly without specific version ranges, and notes impacted releases may be end-of-life or end-of-service. The flaw has been exploited in the wild since its November 2013 disclosure, was fixed in an out-of-band update at the time, and CISA added it to the KEV catalog on 2025-10-06 with a very high EPSS of 73.9% (probability of exploitation within 30 days).

Do: Apply Microsoft's vendor fix for CVE-2013-3918 — the November 2013 out-of-band Internet Explorer cumulative security update (MS13-090) — or any later cumulative IE update on systems still in service; on systems that cannot be patched, set the killbit/disable the InformationCardSigninHelper ActiveX control or discontinue use of the EoL/EoS Windows releases per CISA guidance. Federal agencies must complete the required action within the BOD 22-01 deadline following the 2025-10-06 KEV addition. Verify that icardie.dll is no longer loadable in Internet Explorer (or IE mode in Edge) and that legacy IE usage is minimized across the estate.

GNU Bash, the standard command interpreter shipped with most Linux, Unix, and macOS systems, mishandles specially crafted environment variables, allowing attackers to inject and execute arbitrary OS commands (CVE-2014-6278 is one of the follow-on "Shellshock" parsing flaws disclosed in September 2014 alongside the original CVE-2014-6271). Exploitation requires a path where attacker-controlled data reaches Bash through the environment, classically via web CGI scripts, restricted or forced-command SSH configurations, DHCP clients, and other services that invoke the shell. A successful attack yields arbitrary command execution with the privileges of the invoking service, potentially leading to full system compromise. Any unpatched GNU Bash installation is affected, including Linux/Unix servers, macOS endpoints, and embedded or network appliances that bundle the shell. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2025-10-02, confirming exploitation in the wild, and EPSS assigns a 99.5% probability of exploitation within 30 days.

Do: Upgrade Bash to your distribution's or vendor's current patched build (all major Linux distributions and Apple shipped fixes after the September 2014 disclosures) and verify installed package versions rather than assuming patch status. Prioritize remediation on internet-facing systems where Bash may run with attacker-controlled environment variables, such as web/CGI servers, SSH forced-command setups, and embedded appliances, and follow CISA BOD 22-01 mitigation guidance per the KEV listing, or discontinue use if patches are unavailable. Hunt for legacy or embedded images that never received the 2014-era patches, since those are the most likely remaining vulnerable instances.

CVE-2015-7755 is an improper authentication flaw (CWE-287) in Juniper ScreenOS that allows an unauthenticated remote attacker to gain administrative access to affected Juniper firewalls. It is triggered remotely via the device's administrative access path — widely reported as a hardcoded-credential backdoor reachable over SSH/Telnet management sessions, so any network that can reach the management interface is exposed. A successful attacker gains full administrator control of the firewall, enabling configuration changes, traffic manipulation, credential theft, and persistence. Only organizations running Juniper ScreenOS (legacy NetScreen/SSG firewall deployments) are affected. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2025-10-02, confirming exploitation in the wild; no public proof-of-concept is known.

Do: Per the CISA required action and BOD 22-01, upgrade ScreenOS to a fixed release per Juniper's advisory, or if fixed versions are unavailable for your hardware, discontinue use or immediately restrict SSH and Telnet administrative access to trusted management networks. Audit device logs for unexpected administrative logins, rotate or reset administrative credentials, and treat any long-lived ScreenOS firewall as potentially compromised given the backdoor history and current KEV listing.

SKYSEA Client View Ver.11.221.03 and earlier contains an improper authentication flaw (CWE-287) in the processing of authentication on the TCP connection used with the management console program. An attacker with network reachability to that TCP service can send crafted authentication data that triggers remote code execution with no credentials, no user interaction, and no special conditions (CVSS 3.1: 9.8). Successful exploitation gives the attacker full code execution on the console side, with high impact to confidentiality, integrity, and availability, and potential access to the managed-client inventory the console controls. Organizations running SKYSEA Client View Ver.11.221.03 or earlier are affected; the product is a client/IT-asset management suite deployed largely by Japanese organizations. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on October 14, 2025, indicating confirmed in-the-wild exploitation, and EPSS currently estimates a 19.4% probability of exploitation within 30 days.

Do: Upgrade SKYSEA Client View to a fixed release later than Ver.11.221.03 as directed in Sky Group's security advisory (https://www.skygroup.jp/security-info/170308.html), and inventory any console running Ver.11.221.03 or older. Until patched, restrict access to the management console TCP port from untrusted network segments and review console servers for signs of compromise. CISA KEV requires applying vendor mitigations or discontinuing use within the BOD 22-01 timeline.

CVE-2017-1000353 is an unauthenticated remote code execution flaw in the Jenkins CLI (CWE-502): an attacker can send a crafted serialized Java SignedObject to the remoting-based CLI endpoint, where it is deserialized with a new ObjectInputStream and bypasses Jenkins' existing blacklist-based deserialization protection. Triggering it requires only network reachability to the Jenkins remoting CLI — no authentication or user interaction — which is why the flaw scores 9.8 (critical) under CVSS 3.1. Successful exploitation gives arbitrary code execution with the privileges of the Jenkins process, i.e., full control of the CI/CD server and any credentials, source code, and build infrastructure it holds; Jenkins servers have historically been targeted for cryptomining campaigns such as JenkinsMiner, which reportedly generated $3.4 million. All Jenkins versions 2.56 and earlier and 2.46.1 LTS and earlier are affected, including Oracle Communications Cloud Native Core Automated Test Suite deployments that bundle affected Jenkins releases. Exploitation status is serious: a public proof-of-concept exploit exists (Exploit-DB 41965), EPSS estimates a 99.7% probability of exploitation within 30 days, and CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2025-10-02.

Do: Upgrade to Jenkins 2.57 or later (weekly line) or 2.46.2 LTS or later, which add SignedObject to the deserialization blacklist, backport the HTTP CLI protocol, and deprecate/disable the remoting (Java serialization) CLI by default; as an interim mitigation, disable or restrict access to the remoting CLI (e.g., the /cli endpoint) from untrusted networks. Because the flaw is in CISA's KEV catalog, federal agencies must apply vendor mitigations or discontinue use per BOD 22-01, and all administrators of internet-facing Jenkins instances should check for signs of compromise such as cryptomining processes. Oracle Communications Cloud Native Core Automated Test Suite users should apply the applicable Oracle security patch/update addressing CVE-2017-1000353.

CVE-2021-22555 is a heap out-of-bounds write (CWE-787) in the netfilter x_tables code (net/netfilter/x_tables.c) of the Linux kernel, a flaw present since version v2.6.19-rc1. A local attacker can trigger the heap memory corruption through user namespaces, meaning even unprivileged users, such as workloads running inside containers, can reach the vulnerable code path. Successful exploitation lets the attacker gain elevated kernel-level privileges, typically fully escaping a container, or crash the system in a denial of service. Affected users are essentially any Linux deployment on kernels in the affected range (distributions, cloud servers, container hosts), and CISA's product mapping additionally covers NetApp firmware for its c400/c250, H300S/H410S/H410C/H500S/H700S, FAS 8300/8700 and AFF A400 systems plus Brocade Fabric OS. The flaw has public proof-of-concept exploits (including Google security research), a high 78.7% EPSS exploitation probability over 30 days, and CISA added it to the Known Exploited Vulnerabilities catalog on 2025-10-06, confirming exploitation in the wild.

Do: Upgrade Linux kernels to patched versions from your distribution and apply vendor live patches where offered (Ubuntu Kernel Live Patch notices LSN-0080/0081/0083 are referenced in public advisories), and install the corresponding NetApp and Brocade firmware updates for the listed systems. Where patching must wait, restrict creation of unprivileged user namespaces and limit unprivileged users' ability to configure netfilter rules. As a CISA KEV entry, federal agencies must remediate per BOD 22-01 by the catalog due date.

CVE-2021-43226 is an elevation-of-privilege vulnerability in the Windows Common Log File System (CLFS) driver, a kernel-mode component that manages common log files. A local attacker who already has limited privileges on a machine (the CVSS vector requires only low privileges, no user interaction, and a local attack vector) can trigger the flaw through crafted interactions with the CLFS driver and escalate to full SYSTEM-level control of the host. CISA notes known use in ransomware campaigns, where this class of local privilege escalation is typically chained after initial access. Affected deployments span essentially all supported Windows client releases of the era: Windows 7, Windows 8.1 and Windows RT 8.1, Windows 10 versions 1507 through 21H2, and Windows 11 21H2. The bug was patched in Microsoft's December 2021 Patch Tuesday as an actively exploited zero-day, and CISA added it to the Known Exploited Vulnerabilities catalog on 2025-10-06 with ransomware use noted, indicating demonstrated in-the-wild exploitation.

Do: Install the December 2021 Patch Tuesday (or any later) cumulative update for each affected release on all Windows 7, 8.1, Windows 10, and Windows 11 21H2 systems, and verify patch coverage through WSUS/Intune or equivalent inventory, per CISA KEV and BOD 22-01 guidance. Because this is a post-compromise privilege escalation used in ransomware chains, prioritize endpoints where low-privileged users can log in and hosts in ransomware-prone network segments.

CVE-2021-43798 is a path traversal flaw (CWE-22) in Grafana's plugin-serving endpoint that allows unauthenticated remote attackers to read arbitrary files from the server's local filesystem. It is triggered by crafted HTTP requests to the /public/plugins/<plugin-id>/ path, where the traversal payload can use any installed plugin's ID, and no authentication or user interaction is required. An attacker gains read access to local files on the Grafana host, which can expose configuration files, credentials, and other sensitive data (confidentiality impact only; no integrity or availability impact). Self-managed Grafana installations running versions 8.0.0-beta1 through 8.3.0 (other than the patched releases) are affected; Grafana Cloud was never vulnerable. Exploitation is well established: a public proof-of-concept exists, exploitation probability is very high (EPSS 88.5%, 100th percentile), and CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2025-10-09.

Do: Upgrade self-managed Grafana to 8.0.7, 8.1.8, 8.2.7, or 8.3.1 (or any later patched release); Grafana Cloud customers need take no action. Until patched, restrict or monitor access to /public/plugins/ and inspect web server, proxy, and Grafana access logs for traversal sequences against any installed plugin ID to detect file-read attempts. As a CISA KEV entry, federal agencies must apply vendor mitigations per BOD 22-01 guidance or discontinue use if patching is not possible.

CVE-2022-48503 is a bounds-checking flaw (CWE-129, improper validation of array index) in the web content processing engine used by Safari and by web views across Apple platforms, rated 8.8 (High) with a network attack vector and user interaction required. An attacker triggers it by getting a victim to process maliciously crafted web content, typically by visiting a hostile webpage, and gains arbitrary code execution in the context of the application rendering that content. Anyone running Safari or iOS, iPadOS, macOS Monterey, tvOS, or watchOS versions prior to the fixed releases (iOS/iPadOS 15.6, macOS Monterey 12.5, Safari 15.6, tvOS 15.6, watchOS 8.7) is affected, with older devices that cannot upgrade at greatest risk. CISA added the bug to its Known Exploited Vulnerabilities catalog on 2025-10-20, confirming exploitation in the wild, and October 2025 reporting on the Coruna iOS exploit kit describes exploit chains being used against older iOS versions. EPSS currently assigns a 3.2% probability of exploitation in the next 30 days (87th percentile); ransomware use is unknown.

Do: Update affected devices to iOS/iPadOS 15.6 or later, macOS Monterey 12.5 or later, Safari 15.6 or later, tvOS 15.6 or later, and watchOS 8.7 or later; for older devices that cannot run these versions, apply Apple's emergency fixes for older iOS releases as reported in recent advisories. Federal agencies must apply vendor mitigations per BOD 22-01 guidance or discontinue use of affected products if mitigations are unavailable. Inventory managed Apple fleets for OS/Safari versions below the fixed releases and treat unpatched devices' web browsing as an unauthenticated code-execution risk until patched.

Gladinet CentreStack and Triofox, in their default installation and configuration, contain an unauthenticated local file inclusion flaw (CWE-552) that allows unintended disclosure of system files to remote attackers. The flaw requires no privileges or user interaction (CVSS 3.1: AV:N/PR:N/UI:N, 7.5 High), so any internet-facing deployment is directly reachable over the network. An attacker gains access to system files that should not be externally readable, and related reporting indicates active attacks have chained the flaw — including with Gladinet's hardcoded keys — toward unauthorized access, code execution, and deployment of remote access tools. All versions prior to and including 16.7.10368.56560 of both products are affected. Exploitation has been observed in the wild: the vulnerability was added to CISA's KEV on 2025-11-04 and carries a 92.1% EPSS probability of exploitation within 30 days.

Do: Upgrade CentreStack and Triofox to a release newer than 16.7.10368.56560, and apply vendor mitigations per CISA BOD 22-01 requirements (federal agencies must mitigate or discontinue use of affected versions). Until patched, restrict internet exposure of the service and review logs for suspicious unauthenticated requests, unexpected file reads, new accounts, or signs of follow-on compromise such as remote-access tool installation. The Huntress write-up referenced in this record provides exploitation context for detection guidance; no exploit code is required to confirm patch status.

CVE-2025-21043 is an out-of-bounds write vulnerability (CWE-787) in libimagecodec.quram.so, the image-decoding library used by Samsung Mobile Devices. It can be triggered remotely when the vulnerable codec processes maliciously crafted image data, and per the CVSS vector it requires no privileges or user interaction. A successful attack allows a remote attacker to execute arbitrary code on the device with high impact on confidentiality, integrity, and availability (CVSS 9.8, critical). All Samsung mobile devices running a security update prior to the September 2025 Maintenance Release (SMR Sep-2025 Release 1) are affected. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog as of October 2, 2025, indicating exploitation in the wild, and headlines note Samsung patched it as an actively exploited zero-day; a related Samsung image-codec zero-day (CVE-2025-21042) was used to deliver LANDFALL spyware.

Do: Update affected Samsung devices to SMR Sep-2025 Release 1 or later via Settings > Software update, prioritizing devices exposed to untrusted image content (messaging, email, browsers). CISA KEV requires applying the vendor fix (or discontinuing use) under BOD 22-01 timelines for federal systems. Because exploitation has been observed in the wild and a related image-codec zero-day (CVE-2025-21042) was used to deploy LANDFALL spyware, verify fleet patch levels and investigate any devices showing signs of spyware infection.

XWiki Platform contains an eval injection flaw (CWE-95) that allows any unauthenticated guest user to execute arbitrary code on the hosting server. An attacker triggers the flaw by sending a crafted request to the platform's SolrSearch functionality, which evaluates attacker-controlled input without authentication. Successful exploitation yields arbitrary remote code execution with the privileges of the wiki application, potentially enabling full server compromise. Any deployment of XWiki Platform is affected, with internet-exposed wikis at the highest risk; the affected version ranges are not specified in the available data. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2025-10-30, indicating confirmed in-the-wild exploitation (ransomware use unconfirmed), and EPSS assigns a ~99.9% probability of exploitation within 30 days.

Do: Upgrade to a patched XWiki Platform release per the vendor's security advisory (fixed version numbers not provided in the available data); as interim mitigation, restrict untrusted access to the SolrSearch endpoint and review access logs for anomalous search requests and post-exploitation indicators such as unusual application-server child processes, new files, or webshells. The 2025-10-30 KEV listing makes remediation mandatory for U.S. federal agencies under BOD 22-01, and given the unauthenticated RCE with near-certain exploitation probability, internet-exposed wikis should be patched urgently.

CVE-2025-59287 is a deserialization of untrusted data flaw (CWE-502) in the Microsoft Windows Server Update Service (WSUS) that permits remote code execution. It is triggered when the WSUS service processes attacker-controlled serialized input, allowing an attacker to run arbitrary code on the server hosting the WSUS role. Organizations running WSUS are affected — typically enterprises that use the role for internal Windows update management — and CISA lists the affected scope as Microsoft Windows broadly. The issue is confirmed exploited in the wild: it was added to the CISA KEV catalog on 2025-10-24, and the EPSS model assigns a 100% (100th percentile) probability of exploitation within 30 days, though no public proof-of-concept is known. CVSS scoring is not yet available, so defenders should treat it as a high-priority remote code execution issue until more detail is published.

Do: Apply Microsoft's latest WSUS security updates on every Windows Server with the WSUS role enabled and verify patch status through your update and configuration-management tooling. Where the WSUS role is not required, disable or remove it, and restrict inbound network access to WSUS service ports (typically TCP 8530/8531) from untrusted networks. Federal agencies must apply the required mitigations per CISA BOD 22-01 given the KEV listing.

CVE-2025-2747 is a critical (CVSS 9.8) authentication bypass (CWE-288) in Kentico Xperience CMS, caused by flawed password handling in the Staging Sync Server component for servers configured with the "None" authentication type, affecting versions through 13.0.178. An unauthenticated remote attacker who can reach the Staging Sync Server endpoint can bypass authentication and take control of administrative objects; public research (WatchTowr Labs) shows the flaw can be chained into a pre-authentication remote code execution chain. No privileges or user interaction are required, so any internet-reachable instance of the sync service is directly exposed. All Kentico Xperience deployments running version 13.0.178 or earlier that have the Staging Sync Server enabled are affected. The vulnerability was added to CISA's Known Exploited Vulnerabilities catalog on 2025-10-20, indicating active in-the-wild exploitation, and EPSS assigns a 92.5% probability of exploitation within 30 days (100th percentile).

Do: Upgrade Kentico Xperience to a release newer than 13.0.178 (apply the latest vendor-patched 13.0 refresh) and verify in the staging configuration that no server entries are defined with the "None" authentication type, which triggers the bypass. If patching is delayed, restrict network access to the Staging Sync Server endpoint (e.g., firewall it to trusted staging peers only) and review access logs for unauthenticated requests to the sync service. Federal agencies must apply vendor mitigations or follow BOD 22-01 guidance per the KEV listing by the required due date.

CVE-2025-27915 is a stored cross-site scripting (XSS) flaw in the Classic Web Client of Synacor Zimbra Collaboration Suite (ZCS) 9.0, 10.0, and 10.1, caused by insufficient sanitization of HTML content in ICS calendar files. It is triggered when a user views an email message containing a malicious ICS entry, at which point embedded JavaScript executes in the victim's session via an ontoggle event handler inside a tag. A successful attacker can run arbitrary JavaScript in the victim's session and perform unauthorized actions on the account, notably creating email filters that silently redirect messages to attacker-controlled addresses, enabling data exfiltration. Any organization running the affected ZCS versions whose users read mail through the Classic Web Client is exposed, since delivery of a single crafted email can compromise a session. Exploitation is confirmed in the wild: the flaw was added to CISA KEV on 2025-10-07, and public reporting describes active zero-day attacks, including targeting of the Brazilian military via malicious ICS files.

Do: Upgrade affected ZCS 9.0, 10.0, and 10.1 deployments to the latest patched builds per Zimbra's security advisory and apply any vendor-recommended mitigations (federal agencies must act per CISA KEV/BOD 22-01 requirements). Hunt for suspicious ICS-based emails and calendar entries, and review user mail filter rules for unauthorized forwarding or redirection to attacker-controlled addresses. Consider restricting or disabling Classic Web Client access until systems are patched.

CVE-2025-33073 is an improper access control flaw (CWE-284) in the Windows SMB client that allows an authorized, low-privileged attacker to elevate privileges over the network (CVSS 3.1: 8.8). The attack is network-based with low attack complexity and no user interaction: the attacker must get a vulnerable Windows machine's SMB client to connect to their crafted SMB server, and crafted server responses during the client's authentication flow cause the client to grant the attacker elevated (reportedly SYSTEM-level) access. An attacker gains local privilege elevation on the connecting Windows client, which can be used for full host compromise and lateral movement. Affected systems include essentially all currently supported Windows desktop and server branches in the data: Windows 10 (1507, 1607, 1809, 21H2, 22H2), Windows 11 (22H2, 23H2, 24H2), and Windows Server 2008, 2012, 2016 and 2019. The flaw is actively exploited in the wild — CISA added it to the KEV catalog on 2025-10-20 (ransomware linkage unknown), and EPSS places it at an 80.5% probability of exploitation within 30 days (100th percentile).

Do: Apply Microsoft's June 2025 (or later) cumulative security updates that address CVE-2025-33073 on all listed Windows 10, Windows 11, and Windows Server systems, prioritizing domain-critical, internet-reachable, and server assets given active exploitation. If immediate patching is not possible, restrict SMB client access to trusted servers and follow Microsoft guidance on hardening NTLM authentication; note that federal agencies must meet CISA KEV/BOD 22-01 remediation timelines following the 2025-10-20 KEV listing. Verify the update actually landed on each host (checking that CVE-2025-33073 is listed as addressed) and hunt for connections to untrusted SMB servers from Windows clients.

The Meteobridge web interface, implemented in CGI shell scripts and C, exposes an endpoint vulnerable to command injection (CWE-77) with missing authentication requirements (CWE-306). A remote, unauthenticated attacker who can reach the web interface can supply crafted input that is passed to the underlying shell, gaining arbitrary command execution with root privileges on the device. Affected products are Smartbedded Meteobridge firmware and the Meteobridge VM, used to bridge weather-station data. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2025-10-02, and public reporting indicates it is being actively exploited in the wild; EPSS puts the 30-day exploitation probability at 93.7%. Exploitation details are documented in a public advisory by the discovering researcher (oneKey).

Do: Apply the fix or mitigations per the Smartbedded vendor instructions referenced in the CISA KEV entry (fixed version numbers are not specified in the source data, so consult the vendor advisory and the oneKey write-up before upgrading). Until patched, do not expose the Meteobridge web interface directly to the internet — restrict it to trusted management networks or via VPN/firewall rules — and check exposed instances for signs of compromise given confirmed in-the-wild exploitation. Organizations under BOD 22-01 must apply the required mitigations within the mandated timeframe or discontinue use of the product.

CVE-2025-41244 is a local privilege escalation flaw (CWE-267, improper privilege management) in Broadcom's VMware Aria Operations and VMware Tools, arising from privileged operations performed in an unsafe manner. To exploit it, a malicious actor with non-administrative privileges must already have local access to a virtual machine that runs VMware Tools and is managed by Aria Operations with SDMP enabled, at which point they can escalate to root on that same VM. Successful exploitation yields full root-level control (high confidentiality, integrity, and availability impact per the 7.8 CVSS score) on affected guest VMs. Organizations running VMware Aria Operations-managed estates with VMware Tools or Open VM Tools on guests, including VMware Cloud Foundation, Cloud Foundation Operations, Telco Cloud, and Debian-packaged Tools deployments, are affected. The flaw is being actively exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2025-10-30, and news reports attribute exploitation to a China-linked actor, with EPSS estimating an 8.4% chance of exploitation within 30 days (95th percentile).

Do: Apply the Broadcom patches for CVE-2025-41244 per the vendor advisory to Aria Operations and update VMware Tools/Open VM Tools on all managed guests, including bundled components in VMware Cloud Foundation, Cloud Foundation Operations, and Telco Cloud products; follow CISA KEV/BOD 22-01 requirements (patch per vendor instructions or discontinue use for cloud services). As interim mitigation, restrict non-administrative local access on Aria Operations-managed VMs and review whether SDMP is enabled, prioritizing internet-adjacent and high-value guests; Debian users should track the Debian advisory for updated open-vm-tools packages.

CVE-2025-47827 is a Secure Boot bypass in IGEL OS before version 11, caused by improper verification of a cryptographic signature (CWE-347) in the igel-flash-driver module, which improperly validates a signature using a key past its expiration date. An attacker with physical access (CVSS vector AV:P) can boot a crafted root filesystem from an unverified SquashFS image, defeating the platform's Secure Boot guarantee and loading attacker-controlled code at boot time; the CVSS scoring assigns high availability impact. Deployments running IGEL OS 10 or earlier are affected; CISA's affected-product list names IGEL OS only, while the CPE data additionally tags Windows 10 (1507, 1607, 1809, 21H2, 22H2), Windows 11 (22H2-25H2) and Windows Server 2012/2016 releases, reflecting the shared Microsoft Secure Boot key ecosystem rather than a CISA-listed Microsoft impact. The flaw was added to the CISA Known Exploited Vulnerabilities catalog on 2025-10-14, indicating confirmed in-the-wild exploitation, with ransomware use unknown and EPSS estimating a 4.9% (92nd percentile) probability of exploitation within 30 days. A public proof-of-concept is available (github.com/Zedeldi/CVE-2025-47827), and vendors/CISA have required mitigation per BOD 22-01 guidance.

Do: Inventory all IGEL endpoints and upgrade any running OS 10 or earlier to IGEL OS 11 (current 11.x) per vendor instructions, which is the required KEV/BOD 22-01 remediation path. Because the attack requires physical access (AV:P), restrict physical and console access to thin clients in exposed locations such as lobbies, clinical areas and production floors, and inspect any device that may have been accessed for signs of root-filesystem tampering or unexpected boot behavior. The public PoC (Zedeldi/CVE-2025-47827) can be used to verify whether devices still boot an unverified SquashFS image.

Adobe Commerce and Magento Open Source contain an improper input validation flaw (CWE-20), widely tracked as 'SessionReaper', that lets a remote, unauthenticated attacker take over user sessions. The flaw is exploitable over the network with no privileges and no user interaction (CVSS 3.1 9.1, critical). A successful attacker hijacks legitimate customer or admin sessions, yielding high confidentiality and integrity impact; a public writeup additionally describes unauthenticated exploitation potentially reaching code execution. Anyone running Adobe Commerce (including Commerce B2B) or Magento Open Source on the affected 2.4.x releases is exposed. Exploitation is confirmed in the wild: CISA added the flaw to its KEV catalog on 2025-10-24, reporting headlines cite over 250 observed attacks, EPSS is 94.5%, and roughly 3 in 5 stores were reported as still unpatched.

Do: Immediately upgrade every affected 2.4.x line to a release newer than 2.4.9-alpha2/2.4.8-p2/2.4.7-p7/2.4.6-p12/2.4.5-p14/2.4.4-p15 per Adobe's security advisory. Because the flaw is on CISA's KEV list, federal agencies must apply the vendor's mitigations (or BOD 22-01 cloud guidance) or discontinue use; other defenders should prioritize patching given 250+ observed attacks and 94.5% EPSS. Until patched, watch for indicators of session takeover — unexpected customer or admin sessions, unfamiliar admin accounts, and anomalous session activity — and review Adobe's advisory for interim mitigations.

CVE-2025-54253 is a critical (CVSS 3.1: 10.0) misconfiguration vulnerability — classified as incorrect authorization (CWE-863) — in Adobe Experience Manager (AEM) Forms versions 6.5.23 and earlier, which the referenced public research ties to Apache Struts DevMode being exposed on AEM Forms deployments. It is triggerable over the network without authentication or user interaction by sending crafted requests to the exposed dev-mode functionality, allowing an attacker to bypass security mechanisms and execute arbitrary code. Because the exploitation scope is changed, a successful compromise can impact components beyond the vulnerable service, with high impact to confidentiality, integrity, and availability. Any organization running AEM Forms 6.5.23 or earlier — particularly internet-facing Forms servers at enterprises and government agencies — is affected. The flaw is being actively exploited in the wild: CISA added it to the KEV catalog on 2025-10-15, a public proof-of-concept is available, and EPSS assigns an 87.5% probability of exploitation within 30 days (100th percentile).

Do: Upgrade AEM Forms to a release newer than 6.5.23 using the patched service pack/security update in Adobe's security bulletin, and apply vendor-recommended mitigations (e.g., disabling or restricting access to the exposed Struts DevMode endpoints) where patching is delayed. Audit internet-facing AEM Forms instances for exposed dev-mode endpoints and review logs for signs of exploitation. Federal agencies under BOD 22-01 must apply the required mitigations per vendor instructions or discontinue use of the product by the KEV due date.

CVE-2025-61882 is a critical (CVSS 9.8) authentication flaw (CWE-287) in the BI Publisher Integration component of the Oracle Concurrent Processing product within Oracle E-Business Suite. An unauthenticated attacker with network access over HTTP can exploit it remotely with no credentials and no user interaction, achieving a takeover of Oracle Concurrent Processing with high confidentiality, integrity, and availability impact. Any organization running Oracle E-Business Suite 12.2.3 through 12.2.14 is affected, especially instances reachable from the internet. The flaw is being actively exploited in the wild: the Cl0p data-theft group has used it to breach dozens of organizations (including Harvard University, with 1.3 TB of data leaked), CISA added it to the Known Exploited Vulnerabilities catalog on 2025-10-06 with known ransomware use, and EPSS puts its 30-day exploitation probability at 99.7%.

Do: Apply Oracle's released patch or mitigations for CVE-2025-61882 to affected E-Business Suite 12.2.3-12.2.14 deployments as instructed by the vendor; per CISA KEV requirements, federal agencies must follow BOD 22-01 guidance or discontinue use if mitigations are unavailable. Until patched, limit internet exposure of EBS and its BI Publisher/Concurrent Processing HTTP endpoints, and review web and application logs for unauthenticated access and signs of Cl0p-style data theft or follow-on ransomware.

Oracle Configurator, a component of Oracle E-Business Suite, is affected by a server-side request forgery (SSRF) flaw in its Runtime UI component (CVE-2025-61884). The flaw is easily exploitable: an unauthenticated attacker with network access over HTTP can trigger the server to make attacker-controlled requests, compromising Oracle Configurator and gaining unauthorized access to critical data or complete access to all data accessible to Oracle Configurator. The CVSS 3.1 score is 7.5 (high) with confidentiality-only impact, meaning the flaw primarily exposes sensitive data rather than altering or destroying it. All supported Oracle E-Business Suite 12.2.x releases from 12.2.3 through 12.2.14 are affected, and Oracle has issued an emergency security update in response. Exploitation is confirmed in the wild: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2025-10-20 with known ransomware use, and EPSS assigns a 97.8% probability of exploitation in the next 30 days (100th percentile).

Do: Apply the fixes from Oracle's emergency security update for CVE-2025-61884 across all E-Business Suite 12.2.3-12.2.14 environments, prioritizing internet-exposed instances; U.S. federal agencies must remediate per BOD 22-01 or follow applicable cloud-service guidance by the KEV due date. Until patched, restrict untrusted network access to the Configurator Runtime UI (HTTP) and monitor EBS logs and outbound server-side requests for signs of exploitation. Given the confirmed ransomware association, hunt for follow-on activity such as unusual data access or lateral movement originating from EBS servers.

Motex LANSCOPE Endpoint Manager (On-Premises) — specifically its client program (MR) and detection agent (DA) components — fails to properly verify the source of incoming communications (CWE-940). An attacker who can reach a machine running the vulnerable agent over the network can send specially crafted packets and execute arbitrary code, with no privileges or user interaction required (CVSS 4.0: 9.3, critical, with high impact on confidentiality, integrity, and availability of the compromised endpoint). Organizations running the on-premises product, typically as agent software deployed across their managed endpoints, are affected. The flaw has been exploited as a zero-day in ongoing attacks, reportedly by the China-linked Tick group, and CISA added it to the Known Exploited Vulnerabilities catalog on 2025-10-22. No public proof-of-concept is known, but confirmed in-the-wild exploitation means patching should be treated as urgent.

Do: Upgrade to the patched versions specified in Motex's security advisory (and the JPCERT coordination notice) as soon as possible; CISA KEV inclusion means U.S. federal agencies must patch or apply vendor mitigations per BOD 22-01. Until patched, restrict network access to the ports used for MR/DA agent communications and limit which network segments can send packets to agent hosts, since the flaw requires only network reachability. Given confirmed zero-day use by the China-linked Tick group, also hunt for signs of post-compromise lateral movement on endpoints running the agents.

CVE-2025-6205 is a missing authorization flaw (CWE-862) in Dassault Systèmes DELMIA Apriso, an enterprise manufacturing execution system (MES), affecting all releases from Release 2020 through Release 2025. Because required authorization checks are absent, a remote attacker can reach affected application functionality without any credentials or user interaction, as reflected in the CVSS vector (AV:N/AC:L/PR:N/UI:N). Successful exploitation allows the attacker to gain privileged access to the application, with high impact on confidentiality and integrity, earning a critical CVSS 3.1 score of 9.1. Any organization running DELMIA Apriso Release 2020 through Release 2025 is affected, typically manufacturers using Apriso to run plant-floor and production operations. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2025-10-28 amid reports of active exploitation, and EPSS assigns a 72.2% probability of exploitation within 30 days, though no public proof-of-concept is known.

Do: Apply the mitigations or updates specified in Dassault Systèmes' security advisory for all DELMIA Apriso deployments from Release 2020 through Release 2025, as required by CISA's KEV listing (federal agencies must follow BOD 22-01 timelines or discontinue use). Until patched, restrict network access to Apriso application servers and monitor for unauthenticated or unexpected privileged access to the application. Check vendor release notes for the exact fixed release applicable to your installed Apriso release, since the data here does not specify one.