Loading story…
CISA’s Known Exploited Vulnerabilities (KEV) catalog saw a record 244 new entries in 2025, marking a 28% increase from the previous year and reflecting a significant escalation in actively exploited vulnerabilities. The majority of these additions targeted network devices, operating systems, and browsers, with Microsoft, Cisco, and Fortinet among the most affected vendors. The analysis highlights a shift in vulnerability management priorities, emphasizing the need to focus on real-world exploitation patterns rather than traditional CVSS scores, as attackers increasingly target network edge devices and critical infrastructure.
In parallel, 2025 was characterized by a dramatic rise in network device exploitation, including high-profile incidents involving Cisco and F5, and the disclosure of three new network edge device vulnerabilities just before the year’s end. Notably, critical authentication bypass flaws (CVE-2025-59718 & CVE-2025-59719) in Fortinet’s FortiCloud SSO were identified, allowing unauthenticated attackers to gain access if the feature is enabled. These developments underscore the urgency for organizations to rapidly apply vendor patches and reassess vulnerability prioritization strategies, as attackers increasingly exploit both newly disclosed and older, medium-risk vulnerabilities in network infrastructure.
See which actors are running it and whether you're in range.
3 events from the most recent confirmed update back to the earliest known activity.
By the end of 2025, CISA had added 244 vulnerabilities to the KEV catalog, a 28% increase over 2024. Reporting highlighted a shift toward exploitation of network appliances and browsers, with vendors such as Microsoft, Cisco, Fortinet, and Google Chromium heavily represented.
In 2025, CISA added newly disclosed and actively exploited vulnerabilities affecting Fortinet FortiCloud SSO, HPE OneView, and SonicWall SMA1000 to its Known Exploited Vulnerabilities catalog. The listed flaws included authentication bypass, privilege escalation, and remote code execution issues.
During 2025, CISA responded to active exploitation of major network-device vulnerabilities by issuing emergency directives, reflecting the growing operational risk posed by edge appliances.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The United States Cybersecurity and Infrastructure Security Agency (CISA) expanded its Known Exploited Vulnerabilities (KEV) Catalog to 1,484 entries by the end of 2025, reflecting a significant 20% increase in actively exploited vulnerabilities compared to the previous year. This growth, which included the addition of 245 new vulnerabilities in 2025, marks a notable acceleration after a period of stabilization in 2024 and highlights the persistent and evolving threat landscape facing both public and private sector organizations. The KEV Catalog, established under Binding Operational Directive (BOD) 22-01, requires federal agencies to remediate listed vulnerabilities within specified timeframes, focusing on those with confirmed evidence of active exploitation rather than solely on CVSS severity scores. Analysis of the 2025 KEV data revealed that not only did the number of newly discovered vulnerabilities rise, but the inclusion of older vulnerabilities also increased, with 94 vulnerabilities from previous years added—nearly a 45% jump from the 2023-2024 average. The catalog now includes vulnerabilities dating back to 2002, some of which have been exploited by ransomware groups. CISA also removed at least one vulnerability in 2025 due to insufficient evidence of exploitation. The KEV Catalog continues to serve as a critical resource for prioritizing remediation efforts and understanding the tactics of threat actors actively targeting known flaws across a wide range of software and hardware platforms.
Jun 29, 2026
The Cybersecurity and Infrastructure Security Agency (CISA) has expanded its Known Exploited Vulnerabilities (KEV) Catalog by adding six new vulnerabilities that are currently being exploited in the wild. This update includes five vulnerabilities announced on October 14, 2025, and one additional vulnerability added on October 15, 2025. The vulnerabilities affect a range of widely used products, including Microsoft Windows, Rapid7 Velociraptor, SKYSEA Client View, IGEL OS, and Adobe Experience Manager. Among the most critical is CVE-2025-24990, an elevation of privilege flaw in the Agere Modem driver bundled with all Windows releases, which allows local attackers to gain SYSTEM-level access through untrusted pointer dereference. Microsoft addressed this issue by removing the vulnerable driver in the October 2025 Patch Tuesday update, though this may impact dependent hardware. Another significant vulnerability is CVE-2025-54253, a code execution flaw in Adobe Experience Manager Forms, which has been confirmed as actively exploited and poses a substantial risk to federal and enterprise environments. The Rapid7 Velociraptor vulnerability (CVE-2025-6264) involves incorrect default permissions, potentially allowing unauthorized access or privilege escalation. SKYSEA Client View is affected by an improper authentication vulnerability (CVE-2016-7836), while IGEL OS faces a risk from the use of expired cryptographic keys (CVE-2025-47827). Additionally, Microsoft Windows is impacted by an improper access control vulnerability (CVE-2025-59230). CISA’s KEV Catalog serves as a critical resource for tracking vulnerabilities that are confirmed to be exploited in real-world attacks, and federal agencies are mandated under Binding Operational Directive (BOD) 22-01 to remediate these vulnerabilities by specified deadlines. CISA strongly encourages all organizations, not just federal agencies, to prioritize patching these vulnerabilities to reduce exposure to active cyber threats. The addition of these vulnerabilities underscores the ongoing risk posed by unpatched systems and the importance of timely remediation. CISA’s public alerts emphasize that these vulnerabilities are not theoretical and are being leveraged by malicious actors in current attack campaigns. The agency’s updates are based on evidence of active exploitation, highlighting the need for immediate action by security teams. Organizations are advised to consult the KEV Catalog regularly and integrate its findings into their vulnerability management processes. The removal of the Agere Modem driver by Microsoft demonstrates a decisive response to mitigate risk, though it may have operational impacts for some users. The inclusion of vulnerabilities across diverse platforms indicates that attackers are targeting a broad range of technologies. CISA’s ongoing updates to the KEV Catalog reflect its commitment to providing actionable intelligence to protect both federal and private sector networks. The agency’s guidance is clear: prompt remediation of known exploited vulnerabilities is essential to defend against active threats.
Jun 29, 2026
CISA added **five vulnerabilities** to its **Known Exploited Vulnerabilities (KEV) Catalog** based on evidence of **active exploitation**, urging organizations to prioritize remediation and reminding U.S. Federal Civilian Executive Branch (FCEB) agencies that **BOD 22-01** requires fixes by mandated due dates. The newly added KEVs are **CVE-2017-7921** (Hikvision improper authentication), **CVE-2021-22681** (Rockwell insufficiently protected credentials), and three Apple issues: **CVE-2021-30952** (integer overflow/wraparound), **CVE-2023-41974** (iOS/iPadOS use-after-free), and **CVE-2023-43000** (use-after-free affecting multiple Apple products). CISA emphasized that KEV-listed flaws are common attack vectors and represent elevated risk, even for non-federal organizations. CISA’s public *kev-data* repository reflects the same update, increasing the catalog count from **1531 to 1536** and recording a remediation **due date of 2026-03-26** for at least **CVE-2017-7921** (with required action to apply vendor mitigations or discontinue use if unavailable). Separately, Cisco Talos published a 2025 CVE retrospective that provides broader context on the growing volume of vulnerabilities and KEV additions, noting a year-over-year increase in KEVs and highlighting persistent exploitation of older CVEs; however, it does not add incident-specific details about the five newly listed KEVs beyond reinforcing the operational importance of patching and compensating controls for unpatchable systems.
Jun 29, 2026