CISA Adds Four Actively Exploited Vulnerabilities to the KEV Catalog

CISA added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation: CVE-2025-31125 (Vite/Vitejs improper access control), CVE-2025-34026 (Versa Concerto improper authentication), CVE-2025-54313 (eslint-config-prettier embedded malicious code), and CVE-2025-68645 (Synacor Zimbra Collaboration Suite PHP remote file inclusion). Under Binding Operational Directive (BOD) 22-01, U.S. Federal Civilian Executive Branch agencies must remediate KEV-listed issues by CISA’s specified due dates; CISA also urged all organizations to prioritize patching these KEV entries as part of routine vulnerability management.

Reporting on the update highlighted technical risk details for several of the newly listed items, including an authentication bypass in Versa Concerto (reported as affecting versions 12.1.2 through 12.2.0) tied to a Traefik reverse-proxy misconfiguration that could expose administrative endpoints (including an internal Actuator endpoint with access to heap dumps and trace logs). It also described the supply-chain impact of the eslint-config-prettier malicious code issue, where installing affected versions can execute an install.js that launches Windows malware, and noted the Zimbra webmail flaw enabling unauthenticated file inclusion from the web root in affected 10.0/10.1 versions. Separately, CISA also published an ICS advisory for EVMAPA EV-charging infrastructure vulnerabilities, but that advisory is not part of the KEV-additions event.