Vulnerability Report for the year 2025

Introduction

The 2025 threat landscape was characterised by sustained pressure on enterprise infrastructure, edge devices, and developer tooling. Attackers continued to weaponise newly disclosed vulnerabilities within hours of publication, while a long tail of unpatched legacy IoT and edge devices (D-Link, Zyxel, DASAN, Huawei, Realtek, Netgear) kept generating massive exploitation noise. Several flagship incidents shaped the year: the SAP NetWeaver Visual Composer zero-day exploitation in April, the SharePoint “ToolShell” campaign in July, the NetScaler “CitrixBleed 2” saga from June onward, the Oracle E-Business Suite exploitation tied to the Cl0p activity in October, the WSUS critical (CVE-2025-59287) in October-November, the FortiWeb authentication bypasses in November, and the dramatic React Server Components (“React2Shell”) surge in December.

This year-in-review consolidates the twelve monthly reports covering 2025 and aggregates the data collected by Vulnerability-Lookup. Sources used to build this report include:

• Vulnerability-Lookup sightings, community comments, and bundles
• CISA KEV catalog
• CIRCL team curation and security advisories
• EUVD / ENISA Known Exploited Vulnerabilities catalog
• Community contributors via comments and bundles on the platform
• Sighting feeds: MISP, Exploit-DB, Bluesky, Mastodon, GitHub Gists, The Shadowserver Foundation honeypots, Nuclei, SPLOITUS, Metasploit, and more.

This report was generated with AI assistance via VulnMCP, the Model Context Protocol server that exposes Vulnerability-Lookup capabilities to AI agents: https://github.com/vulnerability-lookup/VulnMCP.

The Year at a Glance

The charts below summarise publication trends and the ecosystem most affected throughout 2025.

Evolution of CVE publication

Top 10 CVE Assigners of the Year

Top 10 Weaknesses (CWE) of the Year

Top 10 Vendors in 2025

Recurring themes

2025 delivered an unusually high volume of actively exploited vulnerabilities. Recurring themes across the year include:

• Edge & network devices dominated continuous exploitation: D-Link DIR-645 (CVE-2015-2051), Zyxel P660HN (CVE-2017-18368), DASAN GPON (CVE-2018-10562), Huawei HG532 (CVE-2017-17215) remained in the top sightings every single month.
• VPN / remote access: Ivanti Connect Secure (CVE-2025-0282, CVE-2025-22457), NetScaler ADC (CVE-2025-5777, CVE-2025-6543), Fortinet FortiOS / FortiWeb / FortiSwitchManager, Palo Alto PAN-OS (CVE-2025-0108), SonicWall SMA, Check Point Quantum.
• Enterprise platforms: SAP NetWeaver (CVE-2025-31324), Microsoft SharePoint (CVE-2025-53770), Microsoft Exchange (CVE-2025-53786), Microsoft WSUS (CVE-2025-59287), Oracle E-Business Suite (CVE-2025-61882), Oracle Identity Manager (CVE-2025-61757).
• Developer ecosystem & supply chain: Next.js middleware bypass (CVE-2025-29927), Apache Tomcat (CVE-2025-24813), Erlang/OTP SSH (CVE-2025-32433), tj-actions/changed-files GitHub Action compromise (CVE-2025-30066), React Server Components “React2Shell” (CVE-2025-55182), npm qix/duckdb_admin account compromise.
• Client-side: Apple iOS/iPadOS/visionOS, Google Chrome V8, WinRAR (CVE-2025-8088, CVE-2025-6218), 7-Zip (CVE-2025-11001), Samsung Mobile zero-days (CVE-2025-21042, CVE-2025-21043).
• CWE landscape: Cross-site scripting (CWE-79) and SQL injection (CWE-89) consistently topped the weakness charts, followed by injection (CWE-74), code injection (CWE-94), and memory safety issues (CWE-119/121/122/125/416).

In total, our community recorded tens of thousands of sightings in 2025, with hundreds of patches released, dozens of public proofs of concept, and numerous in-the-wild exploitations confirmed by The Shadowserver Foundation honeypot network, CISA KEV additions, and contributor reports.

Top 50 Vulnerabilities of the Year

Most-sighted vulnerabilities recorded by Vulnerability-Lookup between 2025-01-01 and 2025-12-31. Severities are derived from the VLAI classifier.

Top 10 Vulnerabilities per Month

Aggregated from the published monthly reports. The metrics differ slightly across months (some months use sighting counts, others a curated Top ranking).

January 2025

Top vulnerabilities sourced from the January 2025 report:

February 2025

Top vulnerabilities sourced from the February 2025 report:

March 2025

Top vulnerabilities sourced from the March 2025 report:

April 2025

Top vulnerabilities sourced from the April 2025 report:

May 2025

Top vulnerabilities sourced from the May 2025 report:

June 2025

Top vulnerabilities sourced from the June 2025 report:

July 2025

Top vulnerabilities sourced from the July 2025 report:

August 2025

Top vulnerabilities sourced from the August 2025 report:

September 2025

Top vulnerabilities sourced from the September 2025 report:

October 2025

Top vulnerabilities sourced from the October 2025 report:

November 2025

Top vulnerabilities sourced from the November 2025 report:

December 2025

Top vulnerabilities sourced from the December 2025 report:

Known Exploited Vulnerabilities (CISA, CIRCL, EUVD)

KEV catalogs aggregated by Vulnerability-Lookup. The monthly reports formally introduced a dedicated Known Exploited Vulnerabilities section starting in September 2025. The entries below mirror what was published in each monthly report between September and December 2025. Earlier 2025 KEV additions (January–August) are tracked in the live CISA and EUVD catalogs but were not summarised at the time. CIRCL is the publisher of Vulnerability-Lookup and curates KEV data from CISA, EUVD/ENISA, and ad-hoc community sources.

CISA KEV

September 2025

October 2025

November 2025

December 2025

EUVD / ENISA KEV

September 2025

October, November, December 2025

No new entry was added to the EUVD / ENISA Known Exploited Vulnerabilities catalog during October, November and December 2025.

CIRCL KEV

The CIRCL Known Exploited Vulnerabilities catalog (catalog_uuid=1a89b78e-f703-45f3-bb86-59eb712668bd) tracks vulnerabilities that CIRCL has confirmed exploited based on its own incident-response, honeypot, and sinkhole telemetry. The entries below correspond to KEV records with confirmed exploitation activity observed during 2025:

The CIRCL KEV catalog remains intentionally small and high-confidence — every entry is backed by first-hand evidence collected by CIRCL — which is why its 2025 footprint is much narrower than the CISA KEV catalog.

Insights from Contributors

The following community comments and bundles were among the most relevant content shared on Vulnerability-Lookup during 2025.

January

• Unit42 Threat Brief: CVE-2025-0282 and CVE-2025-0283 — Ivanti Connect Secure exploitation analysis.
• CISA and FBI Release Advisory on How Threat Actors Chained Vulnerabilities in Ivanti Cloud Service Applications.
• Sonicwall vulnerabilities including critical ones.
• Haunted by Legacy: Discovering and Exploiting Vulnerable Tunnelling Hosts.
• 6 vulnerabilities in rsync server.
• CISA Releases Fact Sheet Detailing Embedded Backdoor Function of Contec CMS8000 Firmware.

February

• Black Basta’s Leaked Chat Logs — multi-vendor exploitation tracking from leaked Matrix chat logs.
• Update on SVR Cyber Operations and Vulnerability Exploitation.
• SonicWall Firewall Vulnerability Exploited After PoC Publication for CVE-2024-53704.
• Out-of-Cycle Security Bulletin: Juniper Session Smart Router auth bypass (CVE-2025-21589).
• Threat Actors Use CVE-2019-18935 to Deliver Reverse Shells.

March

• VMSA-2025-0004: VMware ESXi, Workstation, and Fusion updates address multiple vulnerabilities (CVE-2025-22224, CVE-2025-22225, CVE-2025-22226).
• Ingress NGINX Controller for Kubernetes — Vulnerabilities fixed in controller-v1.12.1.
• Kaspersky — Operation ForumTroll: APT attack with Google Chrome zero-day exploit chain.
• Pre-authentication SQL injection to RCE in GLPI (CVE-2025-24799/CVE-2025-24801).
• StopRansomware: Ghost (Cring) Ransomware | CISA.

April

• Suspected China-Nexus Threat Actor Actively Exploiting Critical Ivanti Connect Secure Vulnerability (CVE-2025-22457).
• CVE-2025-24054, NTLM Exploit in the Wild — Checkpoint Research.
• PHP Core Security Audit Results.
• Check if SAP system is vulnerable to CVE-2025-31324.
• Path Traversal Vulnerability in Surveillance Software — Luxembourg and Belgium notified.

May

• CVE-2025-22252: Authentication bypass in FortiOS, FortiProxy, and FortiSwitchManager.
• CVE-2025-30663: Zoom Workplace privilege escalation.
• CVE-2025-27920: Output Messenger exploited since April 2024.

June

• CitrixBleed 2 (CVE-2025-5777) — analysis comparing the flaw to CVE-2023-4966.
• GCVE-1-2025-0002: Cl0p ransomware data exfiltration utility vulnerable to RCE.
• Stuxnet-related CVEs.
• CVE-2025-31022: PayU WordPress plugin account takeover.
• CVE-2025-4517: CPython tarfile library RCE.

July

• Pre-Auth SQL Injection to RCE — Fortinet FortiWeb Fabric Connector (CVE-2025-25257).
• Ruckus network management solutions riddled with unpatched vulnerabilities.
• VMSA-2025-0013: VMware ESXi, Workstation, Fusion, and Tools updates.

August

• NetScaler ADC and NetScaler Gateway Security Bulletin (CVE-2025-7775, CVE-2025-7776, CVE-2025-8424).
• Citrix forgot to tell you CVE-2025-6543 has been used as a zero day since May 2025.
• Cache Me If You Can — Sitecore Experience Platform cache poisoning to RCE.

September

• SAP Security Patch Day — September 2025.
• npm.js — account qix and duckdb_admin compromised and associated CVEs allocated.
• Cisco AnyConnect/ASA — vulnerabilities.
• Subverting code integrity checks to locally backdoor Signal, 1Password, Slack, and more.

October

• F5 — K000156572: Quarterly Security Notification (October 2025).
• OpenSSL Security Advisory.
• Indicators of Compromise (IOCs) for CVE-2025-59287 (WSUS).
• Growing speculation that the Red Hat compromise may be linked to a recently disclosed vulnerability in Red Hat OpenShift AI.

November

• RCE in Agent DVR.
• Amazon discovers APT exploiting Cisco and Citrix zero-days.
• Suricata 8.0.2 and 7.0.13 released — including multiple vulnerabilities.
• UNC6148 Backdoors Fully-Patched SonicWall SMA 100 Series Devices with OVERSTEP Rootkit.

December

• React2Shell (CVE-2025-55182).
• The LAST Linux 5.4.y release. It is now end-of-life and should not be used by anyone, anymore..
• Apache Tika (CVE-2025-66516).
• Security content of iOS 26.2 and iPadOS 26.2.
• Reports About Cyberattacks Against Cisco Secure Email Gateway And Cisco Secure Email and Web Manager.

Thank you

A heartfelt thank you to all the contributors, source maintainers, and users who reported sightings, posted comments, curated bundles, and provided feedback throughout 2025. Vulnerability-Lookup is a community effort, and the depth of this year-in-review is a direct reflection of your engagement. Special thanks to the Shadowserver Foundation, the MISP project, the CISA KEV, the EUVD / ENISA team, and the many researchers who share information openly with the community.

If you want to contribute to the next report, you can create your account.

Feedback and Support

If you have suggestions, please feel free to open a ticket on our GitHub repository. Your feedback is invaluable to us: https://github.com/vulnerability-lookup/vulnerability-lookup/issues/

You can also explore and reuse the AI tooling that produced this report: VulnMCP — https://github.com/vulnerability-lookup/VulnMCP.

Funding

The main objective of the Federated European Team for Threat Analysis (FETTA) is the improvement of Cyber Threat Intelligence (CTI) products available to the public and private sectors in Poland, Luxembourg, and the European Union as a whole. Developing actionable CTI products (reports, indicators, etc.) is a complex task and requires an in-depth understanding of the threat landscape and the ability to analyse and interpret large amounts of data. Many SOCs and CSIRTs build their capabilities in this area independently, leading to a fragmented approach and duplication of work.

The Computer Incident Response Center Luxembourg (CIRCL) is a government-driven initiative designed to provide a systematic response facility to computer security threats and incidents. The organisation brings to the table its extensive experience in cybersecurity incident management, threat intelligence, and proactive response strategies. With a strong background in developing innovative open source cybersecurity tools and solutions, CIRCL’s contribution to the FETTA project is instrumental in achieving enhanced collaboration and intelligence sharing across Europe.

Press release