CISA Known Exploited Vulnerabilities

KEV additions — November 2025

11 CVEs entered the KEV catalog in November 2025.

Added November 28, 20251

CVE	Vulnerability	CVSS	EPSS	Due date
CVE-2021-26829	OpenPLC ScadaBR Cross-site Scripting Vulnerability	5.4	13.6 %	December 19, 2025

Added November 21, 20251

CVE	Vulnerability	CVSS	EPSS	Due date
CVE-2025-61757	Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability	9.8	82.8 %	December 12, 2025

Added November 19, 20251

CVE	Vulnerability	CVSS	EPSS	Due date
CVE-2025-13223	Google Chromium V8 Type Confusion Vulnerability	8.8	2.1 %	December 10, 2025

Added November 18, 20251

CVE	Vulnerability	CVSS	EPSS	Due date
CVE-2025-58034	Fortinet FortiWeb OS Command Injection Vulnerability	7.2	48.6 %	November 25, 2025

Added November 14, 20251

CVE	Vulnerability	CVSS	EPSS	Due date
CVE-2025-64446	Fortinet FortiWeb Path Traversal Vulnerability	9.8	88.9 %	November 21, 2025

Added November 12, 20253

CVE	Vulnerability	CVSS	EPSS	Due date
CVE-2025-12480	Gladinet Triofox Improper Access Control Vulnerability	9.1	73.2 %	December 3, 2025
CVE-2025-62215	Microsoft Windows Race Condition Vulnerability	7	0.5 %	December 3, 2025
CVE-2025-9242	WatchGuard Firebox Out-of-Bounds Write Vulnerability	9.8	61.6 %	December 3, 2025

Added November 10, 20251

CVE	Vulnerability	CVSS	EPSS	Due date
CVE-2025-21042	Samsung Mobile Devices Out-of-Bounds Write Vulnerability	9.8	1.7 %	December 1, 2025

Added November 4, 20252

CVE	Vulnerability	CVSS	EPSS	Due date
CVE-2025-11371	Gladinet CentreStack and Triofox Files or Directories Accessible to External Parties Vulnerability	7.5	71.0 %	November 25, 2025
CVE-2025-48703	CWP Control Web Panel OS Command Injection Vulnerability	9	59.1 %	November 25, 2025

← All recent KEV additions