Flaws added in November 2025
From Exploited flaws, HARD’s guide to the flaws being used in attacks
This article lists the flaws CISA added in November 2025. For the newest, see Exploited flaws.
In November 2025, CISA added 11 flaws to its list of vulnerabilities being used in attacks, 3 of them in things people have at home. Most came from Fortinet (2), Gladinet (2) and OpenPLC (1).[1]
Six of the eleven let an attacker take over the product, running their own code or taking full control.
List of flaws
Every flaw CISA added in November 2025, newest first, in plain English, each with an article of its own.[2]
Show
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2021-26829At work |
OpenPLC ScadaBR. Attackers can run code in the browser of someone using OpenPLC ScadaBR and act as them. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-61757At work |
Oracle Fusion Middleware. Attackers can get into Oracle Fusion Middleware without a valid password. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-13223At home |
Chrome and other Chromium browsers. A booby-trapped web page can corrupt memory in Chrome and other Chromium browsers, which attackers use to take it over. | At home |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-58034At work |
Fortinet FortiWeb. Someone who already has a way in can use Fortinet FortiWeb to run their own code. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-64446At work |
Fortinet FortiWeb. Attackers can read files on Fortinet FortiWeb that should be out of reach from anywhere, without logging in. | At work |
3 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-9242At work |
WatchGuard Firebox. Attackers can run their own code on WatchGuard Firebox from anywhere, without logging in. | At work |
CVE-2025-62215At home |
Microsoft Windows. Someone who already has a foothold can use Microsoft Windows to take full control of the machine. | At home |
CVE-2025-12480At work |
Gladinet Triofox. Attackers can reach parts of Gladinet Triofox that should be locked to them. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-21042At home |
Samsung Mobile Devices. Attackers can run their own code on Samsung Mobile Devices. | At home |
2 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-48703At work |
CWP Control Web Panel. Attackers can run their own code on CWP Control Web Panel from anywhere, without logging in. | At work |
CVE-2025-11371At work |
Gladinet CentreStack and Triofox. Attackers can read files on Gladinet CentreStack and Triofox that should be out of reach from anywhere, without logging in. | At work |
Companies
The flaws were in nine companies’ products; the most were in Fortinet’s (2).
| Company | Flaws | Ransomware |
|---|---|---|
| Fortinet | 2 | – |
| Gladinet | 2 | – |
| CWP | 1 | – |
| 1 | – | |
| Microsoft | 1 | – |
| OpenPLC | 1 | – |
| Oracle | 1 | – |
| Samsung | 1 | – |
| WatchGuard | 1 | – |
Other months
Every month since CISA started the list; November 2025 is outlined.
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2026 | 17 | 28 | 26 | 31 | 21 | 23 | 26 | 31 | 43 | 36 | 282 | ||
| 2025 | 14 | 27 | 32 | 15 | 24 | 20 | 20 | 15 | 16 | 31 | 11 | 20 | 245 |
| 2024 | 21 | 9 | 10 | 10 | 14 | 9 | 14 | 19 | 25 | 17 | 22 | 16 | 186 |
| 2023 | 5 | 14 | 18 | 17 | 19 | 24 | 16 | 8 | 19 | 18 | 18 | 11 | 187 |
| 2022 | 40 | 32 | 226 | 45 | 83 | 48 | 3 | 23 | 24 | 12 | 10 | 9 | 555 |
| 2021 | 291 | 20 | 311 |
References
- ^ Cybersecurity and Infrastructure Security Agency. “Known Exploited Vulnerabilities Catalog”. Version 2026.10.30, updated 30 Oct 2026. CISA adds a flaw when it has reliable evidence of it being used in attacks; the date is when it was added, not when the attacks began.
- ^ HARD. Plain-English summaries written from CISA’s and NVD’s text, on each flaw’s page.
See also Exploited flaws, Companies, and Search for any app or company.