Zero-day report: July 2025
CISA added 20 exploited vulnerabilities to its catalog in July 2025, 0 more than June (20). 6 were zero-days, listed within a week of going public. 4 are known to be used by ransomware. The most-hit vendor was Microsoft, with 3.
By technology
Most-hit vendors
Every flaw added in July 2025
- PaperCut · NG/MFPaperCut NG/MF Cross-Site Request Forgery (CSRF) Vulnerability
- Cisco · Identity Services EngineCisco Identity Services Engine Injection Vulnerability
- Cisco · Identity Services EngineCisco Identity Services Engine Injection Vulnerability
- SysAid · SysAid On-PremSysAid On-Prem Improper Restriction of XML External Entity Reference Vulnerability
- SysAid · SysAid On-PremSysAid On-Prem Improper Restriction of XML External Entity Reference Vulnerability
- Microsoft · SharePointMicrosoft SharePoint Code Injection Vulnerability
- Microsoft · SharePointMicrosoft SharePoint Improper Authentication Vulnerability
- CrushFTP · CrushFTP CrushFTP Unprotected Alternate Channel Vulnerability
- Google · ChromiumGoogle Chromium ANGLE and GPU Improper Input Validation Vulnerability
- Microsoft · SharePointMicrosoft SharePoint Deserialization of Untrusted Data Vulnerability
- Fortinet · FortiWebFortinet FortiWeb SQL Injection Vulnerability
- Wing FTP Server · Wing FTP ServerWing FTP Server Improper Neutralization of Null Byte or NUL Character Vulnerability
- Citrix · NetScaler ADC and GatewayCitrix NetScaler ADC and Gateway Out-of-Bounds Read Vulnerability
- Looking Glass · Multi-Router Looking Glass (MRLG)Multi-Router Looking Glass (MRLG) Buffer Overflow Vulnerability
- PHP · PHPMailerPHPMailer Command Injection Vulnerability
- Rails · Ruby on RailsRails Ruby on Rails Path Traversal Vulnerability
- Synacor · Zimbra Collaboration Suite (ZCS)Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery (SSRF) Vulnerability
- Google · Chromium V8Google Chromium V8 Type Confusion Vulnerability
- TeleMessage · TM SGNLTeleMessage TM SGNL Initialization of a Resource with an Insecure Default Vulnerability
- TeleMessage · TM SGNLTeleMessage TM SGNL Exposure of Core Dump File to an Unauthorized Control Sphere Vulnerability
Source: CISA's Known Exploited Vulnerabilities catalog, by the date CISA added each flaw. Ransomware use is CISA's flag.