Flaws added in September 2025
From Exploited flaws, HARD’s guide to the flaws being used in attacks
This article lists the flaws CISA added in September 2025. For the newest, see Exploited flaws.
In September 2025, CISA added 16 flaws to its list of vulnerabilities being used in attacks, 6 of them in things people have at home; 1 has been used by ransomware gangs. Most came from Cisco (3), TP-Link (3) and Libraesva (1).[1]
Most let an attacker take over the product, running their own code or taking full control.
List of flaws
Every flaw CISA added in September 2025, newest first, in plain English, each with an article of its own.[2] marks the ones used in ransomware.
Show
5 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-59689At work |
Libraesva Email Security Gateway. Attackers can run commands on Libraesva Email Security Gateway. | At work |
CVE-2025-32463At work |
Sudo. Someone who already has a way in can use Sudo to run their own code. | At work |
CVE-2025-20352At work |
Cisco IOS and IOS XE. Someone who already has a way in can use Cisco IOS and IOS XE to run their own code. | At work |
CVE-2025-10035† Used in ransomwareAt work |
Fortra GoAnywhere MFT. Attackers can run their own code on Fortra GoAnywhere MFT. | At work |
CVE-2021-21311At work |
Adminer. Attackers can make Adminer send requests into the network behind it. | At work |
2 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-20362At work |
Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense. Attackers can reach parts of Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense that should be locked to them from anywhere, without logging in. | At work |
CVE-2025-20333At work |
Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense. Attackers can run their own code on Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-10585At home |
Chrome and other Chromium browsers. A booby-trapped web page can corrupt memory in Chrome and other Chromium browsers, which attackers use to take it over. | At home |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-5086At work |
Dassault Systèmes DELMIA Apriso. Attackers can run their own code on Dassault Systèmes DELMIA Apriso. | At work |
3 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-53690At work |
Sitecore products. Attackers can run their own code on Sitecore products. | At work |
CVE-2025-48543At home |
Android Runtime. Someone who already has a foothold can use Android Runtime to take full control of the machine. | At home |
CVE-2025-38352At work |
Linux Kernel. Attackers can corrupt memory in Linux Kernel, which they use to take it over. | At work |
2 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-9377At home |
TP-Link Multiple Routers. Attackers can run commands on TP-Link Multiple Routers. | At home |
CVE-2023-50224At home |
TP-Link TL-WR841N. Attackers can get into TP-Link TL-WR841N without a valid password. | At home |
2 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-55177At home |
Meta Platforms WhatsApp. Attackers can reach parts of Meta Platforms WhatsApp that should be locked to them. | At home |
CVE-2020-24363At home |
TP-Link TL-WA855RE. Attackers can get into TP-Link TL-WA855RE without a valid password. | At home |
Companies
The flaws were in twelve companies’ products; the most were in Cisco’s (3).
| Company | Flaws | Ransomware |
|---|---|---|
| Cisco | 3 | – |
| TP-Link | 3 | – |
| Adminer | 1 | – |
| Android | 1 | – |
| Dassault Systèmes | 1 | – |
| Fortra | 1 | 1 |
| 1 | – | |
| Libraesva | 1 | – |
| Linux | 1 | – |
| Meta Platforms | 1 | – |
| Sitecore | 1 | – |
| Sudo | 1 | – |
Other months
Every month since CISA started the list; September 2025 is outlined.
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2026 | 17 | 28 | 26 | 31 | 21 | 23 | 26 | 31 | 43 | 36 | 282 | ||
| 2025 | 14 | 27 | 32 | 15 | 24 | 20 | 20 | 15 | 16 | 31 | 11 | 20 | 245 |
| 2024 | 21 | 9 | 10 | 10 | 14 | 9 | 14 | 19 | 25 | 17 | 22 | 16 | 186 |
| 2023 | 5 | 14 | 18 | 17 | 19 | 24 | 16 | 8 | 19 | 18 | 18 | 11 | 187 |
| 2022 | 40 | 32 | 226 | 45 | 83 | 48 | 3 | 23 | 24 | 12 | 10 | 9 | 555 |
| 2021 | 291 | 20 | 311 |
References
- ^ Cybersecurity and Infrastructure Security Agency. “Known Exploited Vulnerabilities Catalog”. Version 2026.10.30, updated 30 Oct 2026. CISA adds a flaw when it has reliable evidence of it being used in attacks; the date is when it was added, not when the attacks began.
- ^ HARD. Plain-English summaries written from CISA’s and NVD’s text, on each flaw’s page.
See also Exploited flaws, Companies, and Search for any app or company.