Zero-day report: March 2025
CISA added 32 exploited vulnerabilities to its catalog in March 2025, 5 more than February (27). 14 were zero-days, listed within a week of going public. 4 are known to be used by ransomware. The most-hit vendor was Microsoft, with 7.
By technology
Most-hit vendors
Every flaw added in March 2025
- Cisco · Smart Licensing UtilityCisco Smart Licensing Utility Static Credential Vulnerability
- Google · Chromium MojoGoogle Chromium Mojo Sandbox Escape Vulnerability
- Sitecore · CMS and Experience Platform (XP)Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability
- Sitecore · CMS and Experience Platform (XP)Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability
- reviewdog · action-setup GitHub Actionreviewdog/action-setup GitHub Action Embedded Malicious Code Vulnerability
- SAP · NetWeaverSAP NetWeaver Directory Traversal Vulnerability
- NAKIVO · Backup and ReplicationNAKIVO Backup and Replication Absolute Path Traversal Vulnerability
- Edimax · IC-7100 IP CameraEdimax IC-7100 IP Camera OS Command Injection Vulnerability
- Fortinet · FortiOS and FortiProxyFortinet FortiOS and FortiProxy Authentication Bypass Vulnerability
- tj-actions · changed-files GitHub Actiontj-actions/changed-files GitHub Action Embedded Malicious Code Vulnerability
- Juniper · Junos OSJuniper Junos OS Improper Isolation or Compartmentalization Vulnerability
- Apple · Multiple ProductsApple Multiple Products WebKit Out-of-Bounds Write Vulnerability
- Microsoft · WindowsMicrosoft Windows Win32k Use-After-Free Vulnerability
- Microsoft · WindowsMicrosoft Windows NTFS Information Disclosure Vulnerability
- Microsoft · WindowsMicrosoft Windows Fast FAT File System Driver Integer Overflow Vulnerability
- Microsoft · WindowsMicrosoft Windows NTFS Out-Of-Bounds Read Vulnerability
- Microsoft · WindowsMicrosoft Windows NTFS Heap-Based Buffer Overflow Vulnerability
- Microsoft · WindowsMicrosoft Windows Management Console (MMC) Improper Neutralization Vulnerability
- Ivanti · Endpoint Manager (EPM)Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability
- Ivanti · Endpoint Manager (EPM)Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability
- Ivanti · Endpoint Manager (EPM)Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability
- Advantive · VeraCoreAdvantive VeraCore Unrestricted File Upload Vulnerability
- Advantive · VeraCore Advantive VeraCore SQL Injection Vulnerability
- Linux · KernelLinux Kernel Use of Uninitialized Resource Vulnerability
- VMware · ESXi and WorkstationVMware ESXi and Workstation TOCTOU Race Condition Vulnerability
- VMware · ESXiVMware ESXi Arbitrary Write Vulnerability
- VMware · ESXi, Workstation, and FusionVMware ESXi, Workstation, and Fusion Information Disclosure Vulnerability
- Microsoft · WindowsMicrosoft Windows Win32k Improper Resource Shutdown or Release Vulnerability
- Hitachi Vantara · Pentaho Business Analytics (BA) ServerHitachi Vantara Pentaho BA Server Special Element Injection Vulnerability
- Hitachi Vantara · Pentaho Business Analytics (BA) ServerHitachi Vantara Pentaho BA Server Authorization Bypass Vulnerability
- Cisco · Small Business RV Series RoutersCisco Small Business RV Series Routers Command Injection Vulnerability
- Progress · WhatsUp GoldProgress WhatsUp Gold Path Traversal Vulnerability
Source: CISA's Known Exploited Vulnerabilities catalog, by the date CISA added each flaw. Ransomware use is CISA's flag.