Flaws added in April 2025
From Exploited flaws, HARD’s guide to the flaws being used in attacks
This article lists the flaws CISA added in April 2025. For the newest, see Exploited flaws.
In April 2025, CISA added 15 flaws to its list of vulnerabilities being used in attacks, 4 of them in things people have at home; 4 have been used by ransomware gangs. Most came from Apple (2), Microsoft (2) and Linux (2).[1]
Most let an attacker take over the product, running their own code or taking full control.
List of flaws
Every flaw CISA added in April 2025, newest first, in plain English, each with an article of its own.[2] marks the ones used in ransomware.
Show
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-31324† Used in ransomwareAt work |
SAP NetWeaver. Attackers can upload a file to SAP NetWeaver from anywhere, without logging in and make it run. | At work |
3 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-42599At work |
Qualitia Active! Mail. Attackers can run their own code on Qualitia Active! Mail from anywhere, without logging in. | At work |
CVE-2025-3928At work |
Commvault Web Server. Attackers are using a flaw in Commvault Web Server that its maker hasn't described in detail. | At work |
CVE-2025-1976At work |
Broadcom Brocade Fabric OS. Someone who already has a way in can use Broadcom Brocade Fabric OS to run their own code. | At work |
3 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-31201At home |
Apple devices. Attackers are using a flaw in Apple devices. | At home |
CVE-2025-31200At home |
Apple devices. Opening a booby-trapped file can let an attacker run their own code through Apple devices. | At home |
CVE-2025-24054At home |
Microsoft Windows. Attackers can make something fake look genuine in Microsoft Windows. | At home |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2021-20035At work |
SonicWall SMA100 Appliances. Someone who already has a way in can use SonicWall SMA100 Appliances to run their own code. | At work |
2 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2024-53197At work |
Linux Kernel. Attackers can run their own code on Linux Kernel. | At work |
CVE-2024-53150At work |
Linux Kernel. Attackers can corrupt memory in Linux Kernel, which they use to take it over. | At work |
2 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-30406At work |
Gladinet CentreStack. Attackers can run their own code on Gladinet CentreStack. | At work |
CVE-2025-29824† Used in ransomwareAt home |
Microsoft Windows. Someone who already has a foothold can use Microsoft Windows to take full control of the machine. | At home |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-31161† Used in ransomwareAt work |
CrushFTP. Attackers can get into CrushFTP without a valid password. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-22457† Used in ransomwareAt work |
Ivanti Connect Secure, Policy Secure, and ZTA Gateways. Attackers can run their own code on Ivanti Connect Secure, Policy Secure, and ZTA Gateways from anywhere, without logging in. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-24813At work |
Apache Tomcat. Attackers can run their own code on Apache Tomcat. | At work |
Companies
The flaws were in twelve companies’ products; the most were in Apple’s (2).
| Company | Flaws | Ransomware |
|---|---|---|
| Apple | 2 | – |
| Linux | 2 | – |
| Microsoft | 2 | 1 |
| Apache | 1 | – |
| Broadcom | 1 | – |
| Commvault | 1 | – |
| CrushFTP | 1 | 1 |
| Gladinet | 1 | – |
| Ivanti | 1 | 1 |
| Qualitia | 1 | – |
| SAP | 1 | 1 |
| SonicWall | 1 | – |
Other months
Every month since CISA started the list; April 2025 is outlined.
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2026 | 17 | 28 | 26 | 31 | 21 | 23 | 26 | 31 | 43 | 36 | 282 | ||
| 2025 | 14 | 27 | 32 | 15 | 24 | 20 | 20 | 15 | 16 | 31 | 11 | 20 | 245 |
| 2024 | 21 | 9 | 10 | 10 | 14 | 9 | 14 | 19 | 25 | 17 | 22 | 16 | 186 |
| 2023 | 5 | 14 | 18 | 17 | 19 | 24 | 16 | 8 | 19 | 18 | 18 | 11 | 187 |
| 2022 | 40 | 32 | 226 | 45 | 83 | 48 | 3 | 23 | 24 | 12 | 10 | 9 | 555 |
| 2021 | 291 | 20 | 311 |
References
- ^ Cybersecurity and Infrastructure Security Agency. “Known Exploited Vulnerabilities Catalog”. Version 2026.10.30, updated 30 Oct 2026. CISA adds a flaw when it has reliable evidence of it being used in attacks; the date is when it was added, not when the attacks began.
- ^ HARD. Plain-English summaries written from CISA’s and NVD’s text, on each flaw’s page.
See also Exploited flaws, Companies, and Search for any app or company.