Flaws added in March 2025
From Exploited flaws, HARD’s guide to the flaws being used in attacks
This article lists the flaws CISA added in March 2025. For the newest, see Exploited flaws.
In March 2025, CISA added 32 flaws to its list of vulnerabilities being used in attacks, 9 of them in things people have at home; 4 have been used by ransomware gangs. Most came from Microsoft (7), Ivanti (3) and VMware (3).[1]
Most let an attacker take over the product, running their own code or taking full control. It was the most CISA added in any month of 2025.
List of flaws
Every flaw CISA added in March 2025, newest first, in plain English, each with an article of its own.[2] marks the ones used in ransomware.
Show
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2024-20439At work |
Cisco Smart Licensing Utility. Attackers can use Cisco Smart Licensing Utility to take full control of the machine from anywhere, without logging in. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-2783At home |
Chrome and other Chromium browsers. Attackers can get past a security protection in Chrome and other Chromium browsers. | At home |
2 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2019-9875At work |
Sitecore CMS and Experience Platform (XP). Someone who already has a way in can use Sitecore CMS and Experience Platform (XP) to run their own code. | At work |
CVE-2019-9874At work |
Sitecore CMS and Experience Platform (XP). Attackers can run their own code on Sitecore CMS and Experience Platform (XP) from anywhere, without logging in. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-30154At work |
reviewdog action-setup GitHub Action. A tampered release of reviewdog action-setup GitHub Action was published with malicious code built in. | At work |
3 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-1316At work |
Edimax IC-7100 IP Camera. Attackers can run their own code on Edimax IC-7100 IP Camera. | At work |
CVE-2024-48248At work |
NAKIVO Backup and Replication. Attackers can run their own code on NAKIVO Backup and Replication. | At work |
CVE-2017-12637At work |
SAP NetWeaver. Attackers can read files on SAP NetWeaver that should be out of reach. | At work |
2 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-30066At work |
tj-actions changed-files GitHub Action. A tampered release of tj-actions changed-files GitHub Action was published with malicious code built in. | At work |
CVE-2025-24472† Used in ransomwareAt work |
Fortinet FortiOS and FortiProxy. Attackers can get into Fortinet FortiOS and FortiProxy without a valid password. | At work |
2 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-24201At home |
Apple devices. Attackers can corrupt memory in Apple devices, which they use to take it over. | At home |
CVE-2025-21590At work |
Juniper Junos OS. Someone who already has a way in can use Juniper Junos OS to run their own code. | At work |
6 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-26633† Used in ransomwareAt home |
Microsoft Windows. Attackers can get past a security protection in Microsoft Windows. | At home |
CVE-2025-24993At home |
Microsoft Windows. Attackers can run their own code on Microsoft Windows. | At home |
CVE-2025-24991At home |
Microsoft Windows. Attackers can corrupt memory in Microsoft Windows, which they use to take it over. | At home |
CVE-2025-24985At home |
Microsoft Windows. Attackers can run their own code on Microsoft Windows. | At home |
CVE-2025-24984At home |
Microsoft Windows. Attackers can read information from Microsoft Windows that should be private. | At home |
CVE-2025-24983At home |
Microsoft Windows. Someone who already has a foothold can use Microsoft Windows to take full control of the machine. | At home |
5 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-25181At work |
Advantive VeraCore. Attackers can read or change the database behind Advantive VeraCore. | At work |
CVE-2024-57968At work |
Advantive VeraCore. Attackers can upload a file to Advantive VeraCore from anywhere, without logging in and make it run. | At work |
CVE-2024-13161At work |
Ivanti Endpoint Manager (EPM). Attackers can read files on Ivanti Endpoint Manager (EPM) that should be out of reach from anywhere, without logging in. | At work |
CVE-2024-13160At work |
Ivanti Endpoint Manager (EPM). Attackers can read files on Ivanti Endpoint Manager (EPM) that should be out of reach from anywhere, without logging in. | At work |
CVE-2024-13159At work |
Ivanti Endpoint Manager (EPM). Attackers can read files on Ivanti Endpoint Manager (EPM) that should be out of reach from anywhere, without logging in. | At work |
4 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-22226At work |
VMware ESXi, Workstation, and Fusion. Attackers can corrupt memory in VMware ESXi, Workstation, and Fusion, which they use to take it over. | At work |
CVE-2025-22225† Used in ransomwareAt work |
VMware ESXi. Attackers are using a flaw in VMware ESXi. | At work |
CVE-2025-22224At work |
VMware ESXi and Workstation. Attackers can run their own code on VMware ESXi and Workstation. | At work |
CVE-2024-50302At work |
Linux Kernel. Attackers can read information from Linux Kernel that should be private. | At work |
5 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2024-4885At work |
Progress WhatsUp Gold. Attackers can run their own code on Progress WhatsUp Gold from anywhere, without logging in. | At work |
CVE-2023-20118At work |
Cisco Small Business RV Series Routers. Attackers can run commands on Cisco Small Business RV Series Routers. | At work |
CVE-2022-43939At work |
Hitachi Vantara Pentaho Business Analytics (BA) Server. Attackers can reach parts of Hitachi Vantara Pentaho Business Analytics (BA) Server that should be locked to them. | At work |
CVE-2022-43769At work |
Hitachi Vantara Pentaho Business Analytics (BA) Server. Attackers are using a flaw in Hitachi Vantara Pentaho Business Analytics (BA) Server. | At work |
CVE-2018-8639† Used in ransomwareAt home |
Microsoft Windows. Attackers can run their own code on Microsoft Windows. | At home |
Companies
The flaws were in 18 companies’ products; the most were in Microsoft’s (7).
| Company | Flaws | Ransomware |
|---|---|---|
| Microsoft | 7 | 2 |
| Ivanti | 3 | – |
| VMware | 3 | 1 |
| Advantive | 2 | – |
| Cisco | 2 | – |
| Hitachi Vantara | 2 | – |
| Sitecore | 2 | – |
| Apple | 1 | – |
| Edimax | 1 | – |
| Fortinet | 1 | 1 |
| 1 | – | |
| Juniper | 1 | – |
| Linux | 1 | – |
| NAKIVO | 1 | – |
| Progress | 1 | – |
| 3 others | 3 |
Other months
Every month since CISA started the list; March 2025 is outlined.
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2026 | 17 | 28 | 26 | 31 | 21 | 23 | 26 | 31 | 43 | 36 | 282 | ||
| 2025 | 14 | 27 | 32 | 15 | 24 | 20 | 20 | 15 | 16 | 31 | 11 | 20 | 245 |
| 2024 | 21 | 9 | 10 | 10 | 14 | 9 | 14 | 19 | 25 | 17 | 22 | 16 | 186 |
| 2023 | 5 | 14 | 18 | 17 | 19 | 24 | 16 | 8 | 19 | 18 | 18 | 11 | 187 |
| 2022 | 40 | 32 | 226 | 45 | 83 | 48 | 3 | 23 | 24 | 12 | 10 | 9 | 555 |
| 2021 | 291 | 20 | 311 |
References
- ^ Cybersecurity and Infrastructure Security Agency. “Known Exploited Vulnerabilities Catalog”. Version 2026.10.30, updated 30 Oct 2026. CISA adds a flaw when it has reliable evidence of it being used in attacks; the date is when it was added, not when the attacks began.
- ^ HARD. Plain-English summaries written from CISA’s and NVD’s text, on each flaw’s page.
See also Exploited flaws, Companies, and Search for any app or company.