Flaws added in October 2025
From Exploited flaws, HARD’s guide to the flaws being used in attacks
This article lists the flaws CISA added in October 2025. For the newest, see Exploited flaws.
In October 2025, CISA added 31 flaws to its list of vulnerabilities being used in attacks, 11 of them in things people have at home; 3 have been used by ransomware gangs. Most came from Microsoft (8), Dassault Systèmes (2) and Adobe (2).[1]
Most let an attacker take over the product, running their own code or taking full control. It was the second most CISA added in any month of 2025.
List of flaws
Every flaw CISA added in October 2025, newest first, in plain English, each with an article of its own.[2] marks the ones used in ransomware.
Show
2 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-41244At work |
Broadcom VMware Aria Operations and VMware Tools. Someone who already has a foothold can use Broadcom VMware Aria Operations and VMware Tools to take full control of the machine. | At work |
CVE-2025-24893At work |
XWiki Platform. Attackers can run their own code on XWiki Platform. | At work |
2 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-6205At work |
Dassault Systèmes DELMIA Apriso. Attackers can reach parts of Dassault Systèmes DELMIA Apriso that should be locked to them. | At work |
CVE-2025-6204At work |
Dassault Systèmes DELMIA Apriso. Attackers can run their own code on Dassault Systèmes DELMIA Apriso. | At work |
2 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-59287At home |
Microsoft Windows. Attackers can run their own code on Microsoft Windows. | At home |
CVE-2025-54236At work |
Adobe Commerce and Magento. Attackers are using a flaw in Adobe Commerce and Magento. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-61932At work |
Motex LANSCOPE Endpoint Manager. Attackers can run their own code on Motex LANSCOPE Endpoint Manager. | At work |
5 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-61884† Used in ransomwareAt work |
Oracle E-Business Suite. Attackers can make Oracle E-Business Suite send requests into the network behind it from anywhere, without logging in. | At work |
CVE-2025-33073At home |
Microsoft Windows. Someone who already has a foothold can use Microsoft Windows to take full control of the machine. | At home |
CVE-2025-2747At work |
Kentico Xperience CMS. Attackers can get into Kentico Xperience CMS without a valid password. | At work |
CVE-2025-2746At work |
Kentico Xperience CMS. Attackers can get into Kentico Xperience CMS without a valid password. | At work |
CVE-2022-48503At home |
Apple devices. Attackers can run their own code on Apple devices. | At home |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-54253At work |
Adobe Experience Manager (AEM) Forms. Attackers can run their own code on Adobe Experience Manager (AEM) Forms. | At work |
4 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-59230At home |
Microsoft Windows. Someone who already has a foothold can use Microsoft Windows to take full control of the machine. | At home |
CVE-2025-47827At work |
IGEL OS. Attackers are using a flaw in IGEL OS. | At work |
CVE-2025-24990At home |
Microsoft Windows. Someone who already has a foothold can use Microsoft Windows to take full control of the machine. | At home |
CVE-2016-7836At work |
SKYSEA Client View. Attackers can run their own code on SKYSEA Client View. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2021-43798At work |
Grafana Labs Grafana. Attackers can read files on Grafana Labs Grafana that should be out of reach. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-27915At work |
Synacor Zimbra Collaboration Suite (ZCS). Attackers can run code in the browser of someone using Synacor Zimbra Collaboration Suite (ZCS) and act as them. | At work |
7 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-61882† Used in ransomwareAt work |
Oracle E-Business Suite. Attackers are using a flaw in Oracle E-Business Suite that its maker hasn't described in detail. | At work |
CVE-2021-43226† Used in ransomwareAt home |
Microsoft Windows. Someone who already has a foothold can use Microsoft Windows to take full control of the machine. | At home |
CVE-2021-22555At work |
Linux Kernel. Attackers can corrupt memory in Linux Kernel, which they use to take it over. | At work |
CVE-2013-3918At home |
Microsoft Windows. A booby-trapped web page can run an attacker's code through Microsoft Windows. | At home |
CVE-2011-3402At home |
Microsoft Windows. Opening a booby-trapped file can let an attacker run their own code through Microsoft Windows. | At home |
CVE-2010-3962At home |
Microsoft Internet Explorer. Attackers can run their own code on Microsoft Internet Explorer. | At home |
CVE-2010-3765At home |
Mozilla products. Attackers can run their own code on Mozilla products. | At home |
5 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-4008At work |
Smartbedded Meteobridge. Attackers can run commands on Smartbedded Meteobridge from anywhere, without logging in. | At work |
CVE-2025-21043At home |
Samsung Mobile Devices. Attackers can run their own code on Samsung Mobile Devices. | At home |
CVE-2017-1000353At work |
Jenkins. Attackers can run their own code on Jenkins from anywhere, without logging in. | At work |
CVE-2015-7755At work |
Juniper ScreenOS. Attackers can get into Juniper ScreenOS without a valid password. | At work |
CVE-2014-6278At work |
GNU Bash. Attackers can run commands on GNU Bash. | At work |
Companies
The flaws were in 20 companies’ products; the most were in Microsoft’s (8).
| Company | Flaws | Ransomware |
|---|---|---|
| Microsoft | 8 | 1 |
| Adobe | 2 | – |
| Dassault Systèmes | 2 | – |
| Kentico | 2 | – |
| Oracle | 2 | 2 |
| Apple | 1 | – |
| Broadcom | 1 | – |
| GNU | 1 | – |
| Grafana Labs | 1 | – |
| IGEL | 1 | – |
| Jenkins | 1 | – |
| Juniper | 1 | – |
| Linux | 1 | – |
| Motex | 1 | – |
| Mozilla | 1 | – |
| 5 others | 5 |
Other months
Every month since CISA started the list; October 2025 is outlined.
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2026 | 17 | 28 | 26 | 31 | 21 | 23 | 26 | 31 | 43 | 36 | 282 | ||
| 2025 | 14 | 27 | 32 | 15 | 24 | 20 | 20 | 15 | 16 | 31 | 11 | 20 | 245 |
| 2024 | 21 | 9 | 10 | 10 | 14 | 9 | 14 | 19 | 25 | 17 | 22 | 16 | 186 |
| 2023 | 5 | 14 | 18 | 17 | 19 | 24 | 16 | 8 | 19 | 18 | 18 | 11 | 187 |
| 2022 | 40 | 32 | 226 | 45 | 83 | 48 | 3 | 23 | 24 | 12 | 10 | 9 | 555 |
| 2021 | 291 | 20 | 311 |
References
- ^ Cybersecurity and Infrastructure Security Agency. “Known Exploited Vulnerabilities Catalog”. Version 2026.10.30, updated 30 Oct 2026. CISA adds a flaw when it has reliable evidence of it being used in attacks; the date is when it was added, not when the attacks began.
- ^ HARD. Plain-English summaries written from CISA’s and NVD’s text, on each flaw’s page.
See also Exploited flaws, Companies, and Search for any app or company.