Flaws added in January 2025
From Exploited flaws, HARD’s guide to the flaws being used in attacks
This article lists the flaws CISA added in January 2025. For the newest, see Exploited flaws.
In January 2025, CISA added 14 flaws to its list of vulnerabilities being used in attacks, 4 of them in things people have at home; 6 have been used by ransomware gangs. Most came from Microsoft (3), Mitel (2) and Apple (1).[1]
Most let an attacker take over the product, running their own code or taking full control.
List of flaws
Every flaw CISA added in January 2025, newest first, in plain English, each with an article of its own.[2] marks the ones used in ransomware.
Show
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-24085At home |
Apple devices. Someone who already has a foothold can use Apple devices to take full control of the machine. | At home |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-23006† Used in ransomwareAt work |
SonicWall SMA1000 Appliances. Attackers can run their own code on SonicWall SMA1000 Appliances from anywhere, without logging in. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2020-11023At work |
JQuery. Attackers can run code in the browser of someone using JQuery and act as them. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2024-50603At work |
Aviatrix Controllers. Attackers can run their own code on Aviatrix Controllers from anywhere, without logging in. | At work |
4 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-21335At home |
Microsoft Windows. Someone who already has a foothold can use Microsoft Windows to take full control of the machine. | At home |
CVE-2025-21334At home |
Microsoft Windows. Someone who already has a foothold can use Microsoft Windows to take full control of the machine. | At home |
CVE-2025-21333At home |
Microsoft Windows. Someone who already has a foothold can use Microsoft Windows to take full control of the machine. | At home |
CVE-2024-55591† Used in ransomwareAt work |
Fortinet FortiOS and FortiProxy. Attackers can get into Fortinet FortiOS and FortiProxy without a valid password. | At work |
2 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2024-12686At work |
BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS). Opening a booby-trapped file can let an attacker run their own code through BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS). | At work |
CVE-2023-48365† Used in ransomwareAt work |
Qlik Sense. Attackers can run their own code on Qlik Sense from anywhere, without logging in. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-0282† Used in ransomwareAt work |
Ivanti Connect Secure, Policy Secure, and ZTA Gateways. Attackers can run their own code on Ivanti Connect Secure, Policy Secure, and ZTA Gateways from anywhere, without logging in. | At work |
3 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2024-55550† Used in ransomwareAt work |
Mitel MiCollab. Attackers can use Mitel MiCollab to take full control of the machine from anywhere, without logging in. | At work |
CVE-2024-41713† Used in ransomwareAt work |
Mitel MiCollab. Attackers can read files on Mitel MiCollab that should be out of reach from anywhere, without logging in. | At work |
CVE-2020-2883At work |
Oracle WebLogic Server. Attackers are using a flaw in Oracle WebLogic Server that its maker hasn't described in detail. | At work |
Companies
The flaws were in eleven companies’ products; the most were in Microsoft’s (3).
| Company | Flaws | Ransomware |
|---|---|---|
| Microsoft | 3 | – |
| Mitel | 2 | 2 |
| Apple | 1 | – |
| Aviatrix | 1 | – |
| BeyondTrust | 1 | – |
| Fortinet | 1 | 1 |
| Ivanti | 1 | 1 |
| JQuery | 1 | – |
| Oracle | 1 | – |
| Qlik | 1 | 1 |
| SonicWall | 1 | 1 |
Other months
Every month since CISA started the list; January 2025 is outlined.
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2026 | 17 | 28 | 26 | 31 | 21 | 23 | 26 | 31 | 43 | 36 | 282 | ||
| 2025 | 14 | 27 | 32 | 15 | 24 | 20 | 20 | 15 | 16 | 31 | 11 | 20 | 245 |
| 2024 | 21 | 9 | 10 | 10 | 14 | 9 | 14 | 19 | 25 | 17 | 22 | 16 | 186 |
| 2023 | 5 | 14 | 18 | 17 | 19 | 24 | 16 | 8 | 19 | 18 | 18 | 11 | 187 |
| 2022 | 40 | 32 | 226 | 45 | 83 | 48 | 3 | 23 | 24 | 12 | 10 | 9 | 555 |
| 2021 | 291 | 20 | 311 |
References
- ^ Cybersecurity and Infrastructure Security Agency. “Known Exploited Vulnerabilities Catalog”. Version 2026.10.30, updated 30 Oct 2026. CISA adds a flaw when it has reliable evidence of it being used in attacks; the date is when it was added, not when the attacks began.
- ^ HARD. Plain-English summaries written from CISA’s and NVD’s text, on each flaw’s page.
See also Exploited flaws, Companies, and Search for any app or company.