Zero-day report: August 2025
CISA added 15 exploited vulnerabilities to its catalog in August 2025, 5 fewer than July (20). 6 were zero-days, listed within a week of going public. 1 is known to be used by ransomware. The most-hit vendor was Citrix, with 3.
By technology
Most-hit vendors
Every flaw added in August 2025
- Sangoma · FreePBXSangoma FreePBX Authentication Bypass Vulnerability
- Citrix · NetScalerCitrix NetScaler Memory Overflow Vulnerability
- Citrix · Session RecordingCitrix Session Recording Improper Privilege Management Vulnerability
- Citrix · Session RecordingCitrix Session Recording Deserialization of Untrusted Data Vulnerability
- Git · GitGit Link Following Vulnerability
- Apple · iOS, iPadOS, and macOSApple iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability
- Trend Micro · Apex OneTrend Micro Apex One OS Command Injection Vulnerability
- N-able · N-CentralN-able N-Central Insecure Deserialization Vulnerability
- N-able · N-CentralN-able N-Central Command Injection Vulnerability
- Microsoft · OfficeMicrosoft Office Excel Remote Code Execution Vulnerability
- Microsoft · Internet ExplorerMicrosoft Internet Explorer Resource Management Errors Vulnerability
- RARLAB · WinRARRARLAB WinRAR Path Traversal Vulnerability
- D-Link · DCS-2530L and DCS-2670L DevicesD-Link DCS-2530L and DCS-2670L Devices Unspecified Vulnerability
- D-Link · DCS-2530L and DCS-2670L DevicesD-Link DCS-2530L and DCS-2670L Command Injection Vulnerability
- D-Link · DNR-322LD-Link DNR-322L Download of Code Without Integrity Check Vulnerability
Source: CISA's Known Exploited Vulnerabilities catalog, by the date CISA added each flaw. Ransomware use is CISA's flag.