Flaws added in August 2025
From Exploited flaws, HARD’s guide to the flaws being used in attacks
This article lists the flaws CISA added in August 2025. For the newest, see Exploited flaws.
In August 2025, CISA added 15 flaws to its list of vulnerabilities being used in attacks, 7 of them in things people have at home; 1 has been used by ransomware gangs. Most came from Citrix (3), D-Link (3) and N-able (2).[1]
Most let an attacker take over the product, running their own code or taking full control.
List of flaws
Every flaw CISA added in August 2025, newest first, in plain English, each with an article of its own.[2] marks the ones used in ransomware.
Show
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-57819At work |
Sangoma FreePBX. Attackers can run their own code on Sangoma FreePBX from anywhere, without logging in. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-7775At work |
Citrix NetScaler. Attackers can run their own code on Citrix NetScaler. | At work |
3 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-48384At work |
Git. Attackers are using a flaw in Git. | At work |
CVE-2024-8069At work |
Citrix Session Recording. Someone who already has a way in can use Citrix Session Recording to run their own code. | At work |
CVE-2024-8068At work |
Citrix Session Recording. Someone who already has a foothold can use Citrix Session Recording to take full control of the machine. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-43300At home |
Apple iOS, iPadOS, and macOS. Attackers can corrupt memory in Apple iOS, iPadOS, and macOS, which they use to take it over. | At home |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-54948At work |
Trend Micro Apex One. Attackers can run commands on Trend Micro Apex One from anywhere, without logging in. | At work |
2 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-8876At work |
N-able N-Central. Attackers can run commands on N-able N-Central. | At work |
CVE-2025-8875At work |
N-able N-Central. Attackers can run their own code on N-able N-Central. | At work |
3 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-8088† Used in ransomwareAt home |
WinRAR. Opening a booby-trapped file can let an attacker run their own code through WinRAR. | At home |
CVE-2013-3893At home |
Microsoft Internet Explorer. Attackers can run their own code on Microsoft Internet Explorer. | At home |
CVE-2007-0671At home |
Microsoft Office. A booby-trapped web page can run an attacker's code through Microsoft Office. | At home |
3 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2022-40799At home |
D-Link DNR-322L. Attackers are using a flaw in D-Link DNR-322L. | At home |
CVE-2020-25079At home |
D-Link DCS-2530L and DCS-2670L Devices. Attackers can run commands on D-Link DCS-2530L and DCS-2670L Devices. | At home |
CVE-2020-25078At home |
D-Link DCS-2530L and DCS-2670L Devices. Attackers are using a flaw in D-Link DCS-2530L and DCS-2670L Devices that its maker hasn't described in detail. | At home |
Companies
The flaws were in nine companies’ products; the most were in Citrix’s (3).
| Company | Flaws | Ransomware |
|---|---|---|
| Citrix | 3 | – |
| D-Link | 3 | – |
| Microsoft | 2 | – |
| N-able | 2 | – |
| Apple | 1 | – |
| Git | 1 | – |
| RARLAB | 1 | 1 |
| Sangoma | 1 | – |
| Trend Micro | 1 | – |
Other months
Every month since CISA started the list; August 2025 is outlined.
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2026 | 17 | 28 | 26 | 31 | 21 | 23 | 26 | 31 | 43 | 36 | 282 | ||
| 2025 | 14 | 27 | 32 | 15 | 24 | 20 | 20 | 15 | 16 | 31 | 11 | 20 | 245 |
| 2024 | 21 | 9 | 10 | 10 | 14 | 9 | 14 | 19 | 25 | 17 | 22 | 16 | 186 |
| 2023 | 5 | 14 | 18 | 17 | 19 | 24 | 16 | 8 | 19 | 18 | 18 | 11 | 187 |
| 2022 | 40 | 32 | 226 | 45 | 83 | 48 | 3 | 23 | 24 | 12 | 10 | 9 | 555 |
| 2021 | 291 | 20 | 311 |
References
- ^ Cybersecurity and Infrastructure Security Agency. “Known Exploited Vulnerabilities Catalog”. Version 2026.10.30, updated 30 Oct 2026. CISA adds a flaw when it has reliable evidence of it being used in attacks; the date is when it was added, not when the attacks began.
- ^ HARD. Plain-English summaries written from CISA’s and NVD’s text, on each flaw’s page.
See also Exploited flaws, Companies, and Search for any app or company.