Zero-day report: June 2025
CISA added 20 exploited vulnerabilities to its catalog in June 2025, 4 fewer than May (24). 7 were zero-days, listed within a week of going public. 1 is known to be used by ransomware. The most-hit vendor was Qualcomm, with 3.
By technology
Most-hit vendors
Every flaw added in June 2025
- Citrix · NetScaler ADC and GatewayCitrix NetScaler ADC and Gateway Buffer Overflow Vulnerability
- Fortinet · FortiOSFortinet FortiOS Use of Hard-Coded Credentials Vulnerability
- D-Link · DIR-859 Router D-Link DIR-859 Router Path Traversal Vulnerability
- AMI · MegaRAC SPxAMI MegaRAC SPx Authentication Bypass by Spoofing Vulnerability
- Linux · KernelLinux Kernel Improper Ownership Management Vulnerability
- TP-Link · Multiple RoutersTP-Link Multiple Routers Command Injection Vulnerability
- Apple · Multiple ProductsApple Multiple Products Unspecified Vulnerability
- Wazuh · Wazuh ServerWazuh Server Deserialization of Untrusted Data Vulnerability
- Microsoft · Windows Microsoft Windows External Control of File Name or Path Vulnerability
- Roundcube · WebmailRoundCube Webmail Cross-Site Scripting Vulnerability
- Erlang · Erlang/OTPErlang Erlang/OTP SSH Server Missing Authentication for Critical Function Vulnerability
- Google · Chromium V8Google Chromium V8 Out-of-Bounds Read and Write Vulnerability
- Qualcomm · Multiple ChipsetsQualcomm Multiple Chipsets Incorrect Authorization Vulnerability
- Qualcomm · Multiple ChipsetsQualcomm Multiple Chipsets Incorrect Authorization Vulnerability
- Qualcomm · Multiple ChipsetsQualcomm Multiple Chipsets Use-After-Free Vulnerability
- ASUS · RoutersASUS Routers Improper Authentication Vulnerability
- ASUS · RT-AX55 RoutersASUS RT-AX55 Routers OS Command Injection Vulnerability
- Craft CMS · Craft CMSCraft CMS Code Injection Vulnerability
- Craft CMS · Craft CMSCraft CMS External Control of Assumed-Immutable Web Parameter Vulnerability
- ConnectWise · ScreenConnectConnectWise ScreenConnect Improper Authentication Vulnerability
Source: CISA's Known Exploited Vulnerabilities catalog, by the date CISA added each flaw. Ransomware use is CISA's flag.