Zero-day report: September 2025
CISA added 16 exploited vulnerabilities to its catalog in September 2025, 1 more than August (15). 8 were zero-days, listed within a week of going public. 1 is known to be used by ransomware. The most-hit vendor was Cisco, with 3.
By technology
Most-hit vendors
Every flaw added in September 2025
- Adminer · AdminerAdminer Server-Side Request Forgery Vulnerability
- Fortra · GoAnywhere MFTFortra GoAnywhere MFT Deserialization of Untrusted Data Vulnerability
- Cisco · IOS and IOS XECisco IOS and IOS XE Software SNMP Denial of Service and Remote Code Execution Vulnerability
- Sudo · SudoSudo Inclusion of Functionality from Untrusted Control Sphere Vulnerability
- Libraesva · Email Security GatewayLibraesva Email Security Gateway Command Injection Vulnerability
- Cisco · Secure Firewall Adaptive Security Appliance and Secure Firewall Threat DefenseCisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buffer Overflow Vulnerability
- Cisco · Secure Firewall Adaptive Security Appliance and Secure Firewall Threat DefenseCisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Missing Authorization Vulnerability
- Google · Chromium V8Google Chromium V8 Type Confusion Vulnerability
- Dassault Systèmes · DELMIA AprisoDassault Systèmes DELMIA Apriso Deserialization of Untrusted Data Vulnerability
- Linux · KernelLinux Kernel Time-of-Check Time-of-Use (TOCTOU) Race Condition Vulnerability
- Android · RuntimeAndroid Runtime Use-After-Free Vulnerability
- Sitecore · Multiple ProductsSitecore Multiple Products Deserialization of Untrusted Data Vulnerability
- TP-Link · TL-WR841NTP-Link TL-WR841N Authentication Bypass by Spoofing Vulnerability
- TP-Link · Multiple RoutersTP-Link Archer C7(EU) and TL-WR841N/ND(MS) OS Command Injection Vulnerability
- TP-Link · TL-WA855RETP-link TL-WA855RE Missing Authentication for Critical Function Vulnerability
- Meta Platforms · WhatsAppMeta Platforms WhatsApp Incorrect Authorization Vulnerability
Source: CISA's Known Exploited Vulnerabilities catalog, by the date CISA added each flaw. Ransomware use is CISA's flag.