Flaws added in February 2025
From Exploited flaws, HARD’s guide to the flaws being used in attacks
This article lists the flaws CISA added in February 2025. For the newest, see Exploited flaws.
In February 2025, CISA added 27 flaws to its list of vulnerabilities being used in attacks, 8 of them in things people have at home; 3 have been used by ransomware gangs. Most came from Microsoft (6), Palo Alto Networks (2) and Zyxel (2).[1]
Most let an attacker take over the product, running their own code or taking full control. It was the third most CISA added in any month of 2025.
List of flaws
Every flaw CISA added in February 2025, newest first, in plain English, each with an article of its own.[2] marks the ones used in ransomware.
Show
2 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2024-49035At work |
Microsoft Partner Center. Attackers can use Microsoft Partner Center to take full control of the machine from anywhere, without logging in. | At work |
CVE-2023-34192At work |
Synacor Zimbra Collaboration Suite (ZCS). Someone who already has a way in can use Synacor Zimbra Collaboration Suite (ZCS) to run their own code. | At work |
2 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2024-20953At work |
Oracle Agile Product Lifecycle Management (PLM). Attackers are using a flaw in Oracle Agile Product Lifecycle Management (PLM). | At work |
CVE-2017-3066At work |
Adobe ColdFusion. Attackers can run their own code on Adobe ColdFusion. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-24989At work |
Microsoft Power Pages. Someone who already has a foothold can use Microsoft Power Pages to take full control of the machine. | At work |
2 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-23209At work |
Craft CMS. Attackers can run their own code on Craft CMS. | At work |
CVE-2025-0111At work |
Palo Alto Networks PAN-OS. Attackers are using a flaw in Palo Alto Networks PAN-OS. | At work |
2 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-0108At work |
Palo Alto Networks PAN-OS. Attackers can run their own code on Palo Alto Networks PAN-OS from anywhere, without logging in. | At work |
CVE-2024-53704† Used in ransomwareAt work |
SonicWall SonicOS. Attackers can get into SonicWall SonicOS without a valid password. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2024-57727† Used in ransomwareAt work |
SimpleHelp. Attackers can read files on SimpleHelp that should be out of reach from anywhere, without logging in. | At work |
2 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-24200At home |
Apple iOS and iPadOS. Attackers can reach parts of Apple iOS and iPadOS that should be locked to them. | At home |
CVE-2024-41710At work |
Mitel SIP Phones. Someone who already has a way in can use Mitel SIP Phones to run their own code. | At work |
4 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-21418At home |
Microsoft Windows. Someone who already has a foothold can use Microsoft Windows to take full control of the machine. | At home |
CVE-2025-21391At home |
Microsoft Windows. Someone who already has a foothold can use Microsoft Windows to take full control of the machine. | At home |
CVE-2024-40891At home |
Zyxel DSL CPE Devices. Someone who already has a way in can use Zyxel DSL CPE Devices to run their own code. | At home |
CVE-2024-40890At home |
Zyxel DSL CPE Devices. Someone who already has a way in can use Zyxel DSL CPE Devices to run their own code. | At home |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-0994At work |
Trimble Cityworks. Someone who already has a way in can use Trimble Cityworks to run their own code. | At work |
5 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-0411At home |
7-Zip. A booby-trapped web page can run an attacker's code through 7-Zip. | At home |
CVE-2024-21413At home |
Microsoft Office Outlook. Attackers can run their own code on Microsoft Office Outlook. | At home |
CVE-2022-23748At work |
Audinate Dante Discovery. Opening a booby-trapped file can let an attacker run their own code through Audinate Dante Discovery. | At work |
CVE-2020-29574† Used in ransomwareAt work |
Sophos CyberoamOS. Attackers can read or change the database behind Sophos CyberoamOS from anywhere, without logging in. | At work |
CVE-2020-15069At work |
Sophos XG Firewall. Attackers can run their own code on Sophos XG Firewall. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2024-53104At work |
Linux Kernel. Someone who already has a foothold can use Linux Kernel to take full control of the machine. | At work |
4 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2024-45195At work |
Apache OFBiz. Attackers are using a flaw in Apache OFBiz. | At work |
CVE-2024-29059At home |
Microsoft .NET Framework. Attackers can run their own code on Microsoft .NET Framework. | At home |
CVE-2018-9276At work |
Paessler PRTG Network Monitor. Attackers can run commands on Paessler PRTG Network Monitor. | At work |
CVE-2018-19410At work |
Paessler PRTG Network Monitor. Attackers can read files on Paessler PRTG Network Monitor that should be out of reach from anywhere, without logging in. | At work |
Companies
The flaws were in 18 companies’ products; the most were in Microsoft’s (6).
| Company | Flaws | Ransomware |
|---|---|---|
| Microsoft | 6 | – |
| Paessler | 2 | – |
| Palo Alto Networks | 2 | – |
| Sophos | 2 | 1 |
| Zyxel | 2 | – |
| 7-Zip | 1 | – |
| Adobe | 1 | – |
| Apache | 1 | – |
| Apple | 1 | – |
| Audinate | 1 | – |
| Craft CMS | 1 | – |
| Linux | 1 | – |
| Mitel | 1 | – |
| Oracle | 1 | – |
| SimpleHelp | 1 | 1 |
| 3 others | 3 |
Other months
Every month since CISA started the list; February 2025 is outlined.
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2026 | 17 | 28 | 26 | 31 | 21 | 23 | 26 | 31 | 43 | 36 | 282 | ||
| 2025 | 14 | 27 | 32 | 15 | 24 | 20 | 20 | 15 | 16 | 31 | 11 | 20 | 245 |
| 2024 | 21 | 9 | 10 | 10 | 14 | 9 | 14 | 19 | 25 | 17 | 22 | 16 | 186 |
| 2023 | 5 | 14 | 18 | 17 | 19 | 24 | 16 | 8 | 19 | 18 | 18 | 11 | 187 |
| 2022 | 40 | 32 | 226 | 45 | 83 | 48 | 3 | 23 | 24 | 12 | 10 | 9 | 555 |
| 2021 | 291 | 20 | 311 |
References
- ^ Cybersecurity and Infrastructure Security Agency. “Known Exploited Vulnerabilities Catalog”. Version 2026.10.30, updated 30 Oct 2026. CISA adds a flaw when it has reliable evidence of it being used in attacks; the date is when it was added, not when the attacks began.
- ^ HARD. Plain-English summaries written from CISA’s and NVD’s text, on each flaw’s page.
See also Exploited flaws, Companies, and Search for any app or company.