Zero-day report: November 2025
CISA added 11 exploited vulnerabilities to its catalog in November 2025, 20 fewer than October (31). 5 were zero-days, listed within a week of going public. The most-hit vendor was Fortinet, with 2.
By technology
Most-hit vendors
Every flaw added in November 2025
- OpenPLC · ScadaBROpenPLC ScadaBR Cross-site Scripting Vulnerability
- Oracle · Fusion MiddlewareOracle Fusion Middleware Missing Authentication for Critical Function Vulnerability
- Google · Chromium V8Google Chromium V8 Type Confusion Vulnerability
- Fortinet · FortiWebFortinet FortiWeb OS Command Injection Vulnerability
- Fortinet · FortiWebFortinet FortiWeb Path Traversal Vulnerability
- Gladinet · TriofoxGladinet Triofox Improper Access Control Vulnerability
- Microsoft · WindowsMicrosoft Windows Race Condition Vulnerability
- WatchGuard · FireboxWatchGuard Firebox Out-of-Bounds Write Vulnerability
- Samsung · Mobile DevicesSamsung Mobile Devices Out-of-Bounds Write Vulnerability
- Gladinet · CentreStack and TriofoxGladinet CentreStack and Triofox Files or Directories Accessible to External Parties Vulnerability
- CWP · Control Web PanelCWP Control Web Panel OS Command Injection Vulnerability
Source: CISA's Known Exploited Vulnerabilities catalog, by the date CISA added each flaw. Ransomware use is CISA's flag.