Flaws added in July 2025
From Exploited flaws, HARD’s guide to the flaws being used in attacks
This article lists the flaws CISA added in July 2025. For the newest, see Exploited flaws.
In July 2025, CISA added 20 flaws to its list of vulnerabilities being used in attacks, 2 of them in things people have at home; 4 have been used by ransomware gangs. Most came from Microsoft (3), Cisco (2) and Google (2).[1]
About half let an attacker take over the product, running their own code or taking full control.
List of flaws
Every flaw CISA added in July 2025, newest first, in plain English, each with an article of its own.[2] marks the ones used in ransomware.
Show
3 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-20337At work |
Cisco Identity Services Engine. Attackers can run their own code on Cisco Identity Services Engine from anywhere, without logging in. | At work |
CVE-2025-20281At work |
Cisco Identity Services Engine. Attackers can run their own code on Cisco Identity Services Engine from anywhere, without logging in. | At work |
CVE-2023-2533At work |
PaperCut NG/MF. Attackers can run their own code on PaperCut NG/MF. | At work |
6 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-6558At home |
Chrome and other Chromium browsers. Attackers can get past a security protection in Chrome and other Chromium browsers. | At home |
CVE-2025-54309At work |
CrushFTP. Attackers are using a flaw in CrushFTP. | At work |
CVE-2025-49706† Used in ransomwareAt work |
Microsoft SharePoint. Attackers can get into Microsoft SharePoint without a valid password. | At work |
CVE-2025-49704† Used in ransomwareAt work |
Microsoft SharePoint. Attackers can run their own code on Microsoft SharePoint. | At work |
CVE-2025-2776At work |
SysAid On-Prem. Attackers can read files on SysAid On-Prem that should be out of reach from anywhere, without logging in. | At work |
CVE-2025-2775At work |
SysAid On-Prem. Attackers can read files on SysAid On-Prem that should be out of reach from anywhere, without logging in. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-53770† Used in ransomwareAt work |
Microsoft SharePoint. Attackers can run their own code on Microsoft SharePoint. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-25257At work |
Fortinet FortiWeb. Attackers can read or change the database behind Fortinet FortiWeb from anywhere, without logging in. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-47812At work |
Wing FTP Server. Attackers can run their own code on Wing FTP Server. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-5777† Used in ransomwareAt work |
Citrix NetScaler ADC and Gateway. Attackers can corrupt memory in Citrix NetScaler ADC and Gateway, which they use to take it over. | At work |
4 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2019-9621At work |
Synacor Zimbra Collaboration Suite (ZCS). Attackers can make Synacor Zimbra Collaboration Suite (ZCS) send requests into the network behind it. | At work |
CVE-2019-5418At work |
Rails Ruby on Rails. Attackers can read files on Rails Ruby on Rails that should be out of reach. | At work |
CVE-2016-10033At work |
PHPMailer. Attackers can run their own code on PHPMailer. | At work |
CVE-2014-3931At work |
Looking Glass Multi-Router Looking Glass (MRLG). Attackers can corrupt memory in Looking Glass Multi-Router Looking Glass (MRLG), which they use to take it over. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-6554At home |
Chrome and other Chromium browsers. A booby-trapped web page can corrupt memory in Chrome and other Chromium browsers, which attackers use to take it over. | At home |
2 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-48928At work |
TeleMessage TM SGNL. Attackers are using a flaw in TeleMessage TM SGNL. | At work |
CVE-2025-48927At work |
TeleMessage TM SGNL. Attackers are using a flaw in TeleMessage TM SGNL. | At work |
Companies
The flaws were in 14 companies’ products; the most were in Microsoft’s (3).
| Company | Flaws | Ransomware |
|---|---|---|
| Microsoft | 3 | 3 |
| Cisco | 2 | – |
| 2 | – | |
| SysAid | 2 | – |
| TeleMessage | 2 | – |
| Citrix | 1 | 1 |
| CrushFTP | 1 | – |
| Fortinet | 1 | – |
| Looking Glass | 1 | – |
| PaperCut | 1 | – |
| PHP | 1 | – |
| Rails | 1 | – |
| Synacor | 1 | – |
| Wing FTP Server | 1 | – |
Other months
Every month since CISA started the list; July 2025 is outlined.
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2026 | 17 | 28 | 26 | 31 | 21 | 23 | 26 | 31 | 43 | 36 | 282 | ||
| 2025 | 14 | 27 | 32 | 15 | 24 | 20 | 20 | 15 | 16 | 31 | 11 | 20 | 245 |
| 2024 | 21 | 9 | 10 | 10 | 14 | 9 | 14 | 19 | 25 | 17 | 22 | 16 | 186 |
| 2023 | 5 | 14 | 18 | 17 | 19 | 24 | 16 | 8 | 19 | 18 | 18 | 11 | 187 |
| 2022 | 40 | 32 | 226 | 45 | 83 | 48 | 3 | 23 | 24 | 12 | 10 | 9 | 555 |
| 2021 | 291 | 20 | 311 |
References
- ^ Cybersecurity and Infrastructure Security Agency. “Known Exploited Vulnerabilities Catalog”. Version 2026.10.30, updated 30 Oct 2026. CISA adds a flaw when it has reliable evidence of it being used in attacks; the date is when it was added, not when the attacks began.
- ^ HARD. Plain-English summaries written from CISA’s and NVD’s text, on each flaw’s page.
See also Exploited flaws, Companies, and Search for any app or company.