CISA Known Exploited Vulnerabilities

KEV additions — August 2025

13 CVEs entered the KEV catalog in August 2025.

Added August 29, 20251

CVE	Vulnerability	CVSS	EPSS	Due date
CVE-2025-57819	Sangoma FreePBX Authentication Bypass Vulnerability	9.8	67.4 %	September 19, 2025

Added August 26, 20251

CVE	Vulnerability	CVSS	EPSS	Due date
CVE-2025-7775	Citrix NetScaler Memory Overflow Vulnerability	9.8	10.6 %	August 28, 2025

Added August 25, 20253

CVE	Vulnerability	CVSS	EPSS	Due date
CVE-2024-8068	Citrix Session Recording Improper Privilege Management Vulnerability	8	8.1 %	September 15, 2025
CVE-2024-8069	Citrix Session Recording Deserialization of Untrusted Data Vulnerability	8	48.3 %	September 15, 2025
CVE-2025-48384	Git allows arbitrary code execution through broken config quoting	8	0.6 %	September 15, 2025

Added August 21, 20251

CVE	Vulnerability	CVSS	EPSS	Due date
CVE-2025-43300	Apple iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability	10	0.7 %	September 11, 2025

Added August 18, 20251

CVE	Vulnerability	CVSS	EPSS	Due date
CVE-2025-54948	Trend Micro Apex One OS Command Injection Vulnerability	9.8	20.5 %	September 8, 2025

Added August 13, 20252

CVE	Vulnerability	CVSS	EPSS	Due date
CVE-2025-8875	N-able N-Central Insecure Deserialization Vulnerability	7.8	2.4 %	August 20, 2025
CVE-2025-8876	N-able N-Central Command Injection Vulnerability	8.8	7.8 %	August 20, 2025

Added August 12, 20251

CVE	Vulnerability	CVSS	EPSS	Due date
CVE-2025-8088	RARLAB WinRAR Path Traversal Vulnerability	8.8	3.8 %	September 2, 2025

Added August 5, 20253

CVE	Vulnerability	CVSS	EPSS	Due date
CVE-2020-25078	D-Link DCS-2530L and DCS-2670L Devices Unspecified Vulnerability	7.5	94.1 %	August 26, 2025
CVE-2020-25079	D-Link DCS-2530L and DCS-2670L Command Injection Vulnerability	8.8	48.3 %	August 26, 2025
CVE-2022-40799	D-Link DNR-322L Download of Code Without Integrity Check Vulnerability	8.8	40.3 %	August 26, 2025

← All recent KEV additions