Zero-day report: April 2025
CISA added 15 exploited vulnerabilities to its catalog in April 2025, 17 fewer than March (32). 9 were zero-days, listed within a week of going public. 4 are known to be used by ransomware. The most-hit vendor was Apple, with 2.
By technology
Most-hit vendors
Every flaw added in April 2025
- SAP · NetWeaverSAP NetWeaver Unrestricted File Upload Vulnerability
- Broadcom · Brocade Fabric OSBroadcom Brocade Fabric OS Code Injection Vulnerability
- Commvault · Web ServerCommvault Web Server Unspecified Vulnerability
- Qualitia · Active! MailQualitia Active! Mail Stack-Based Buffer Overflow Vulnerability
- Microsoft · WindowsMicrosoft Windows NTLM Hash Disclosure Spoofing Vulnerability
- Apple · Multiple ProductsApple Multiple Products Memory Corruption Vulnerability
- Apple · Multiple ProductsApple Multiple Products Arbitrary Read and Write Vulnerability
- SonicWall · SMA100 AppliancesSonicWall SMA100 Appliances OS Command Injection Vulnerability
- Linux · KernelLinux Kernel Out-of-Bounds Read Vulnerability
- Linux · KernelLinux Kernel Out-of-Bounds Access Vulnerability
- Microsoft · WindowsMicrosoft Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability
- Gladinet · CentreStackGladinet CentreStack and Triofox Use of Hard-coded Cryptographic Key Vulnerability
- CrushFTP · CrushFTPCrushFTP Authentication Bypass Vulnerability
- Ivanti · Connect Secure, Policy Secure, and ZTA GatewaysIvanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability
- Apache · TomcatApache Tomcat Path Equivalence Vulnerability
Source: CISA's Known Exploited Vulnerabilities catalog, by the date CISA added each flaw. Ransomware use is CISA's flag.