The U.S. Cybersecurity and Infrastructure Security Agency (CISA) concluded 2025 with its Known Exploited Vulnerabilities (KEV) Catalog reaching 1,484 entries, reflecting a nearly 20% increase from the 1,239 vulnerabilities listed at the end of 2024. Throughout the year, CISA added a record 245 vulnerabilities—over 30% more than the 185–187 additions seen in 2023 and 2024—driven by heightened evidence of active exploitation across software and hardware ecosystems. This surge, including 24 flaws weaponized in ransomware campaigns, signals an intensifying threat landscape where attackers rapidly capitalize on both new and legacy weaknesses.

Inside the 2025 Surge: 245 New Exploited Vulnerabilities Added to CISA’s KEV Catalog

The KEV Catalog serves as CISA’s authoritative resource for vulnerabilities with confirmed in-the-wild exploitation, prioritizing real-world risks over theoretical CVSS scores. Launched in November 2021, it has grown steadily, but 2025 marked an acceleration with 245 new entries, including a nearly 45% rise in pre-2025 flaws (94 total). The oldest new addition was CVE-2007-0671, a Microsoft Office Excel remote code execution bug, while the catalog’s most ancient entry remains CVE-2002-0367—a Windows privilege escalation flaw still abused today.

Microsoft dominated affected vendors with 39 additions (up from 36 in 2024), followed by Apple, Cisco, Google Chromium, Ivanti, and Linux kernels. Dominant weakness types included OS command injection (CWE-78, prominent in 18 entries), deserialization of untrusted data (CWE-502), path traversal, use-after-free, and out-of-bounds write.

Key Trends in 2025 KEV Additions

• Ransomware Exploitation: 24 vulnerabilities linked to campaigns, including “CitrixBleed 2” (CVE-2025-5777) for information disclosure in Citrix NetScaler and Oracle E-Business Suite flaws (CVE-2025-61882, CVE-2025-61884) exploited by Cl0p for data exfiltration.
• Vendor Breakdown: Microsoft (39), with rising focus on enterprise products like Windows and Office; other notables included Fortinet, Ivanti, SAP, Mitel, and SonicWall.
• Legacy Risks: Increased targeting of older bugs, emphasizing that unpatched systems remain prime targets years after disclosure.
• Exploitation Speed: Many 2025 CVEs added shortly after disclosure, reflecting faster weaponization by threat actors.

Impact and Recommendations

• Heightened Ransomware Exposure: With 24 KEV entries tied to extortion operations, organizations face elevated risks of data breaches and operational disruptions.
• Enterprise Vendor Concentration: Heavy Microsoft and multi-vendor hits demand prioritized patching in Windows ecosystems and network appliances.
• Legacy System Vulnerabilities: Rising older flaw exploitation highlights the dangers of end-of-life software in critical environments.
• Global Threat Acceleration: Faster additions signal broader attacker sophistication, from ransomware affiliates to nation-states.

Recommendations for Organizations

• Integrate KEV Prioritization: Feed the catalog into vulnerability management programs for risk-based patching ahead of standard schedules.
• Accelerate Remediation: Apply patches for KEV entries within days/weeks, aligning with BOD 22-01 timelines even for non-federal entities.
• Hunt for Legacy Exposures: Scan environments for pre-2025 vulnerabilities, especially in internet-facing systems.
• Enhance Detection: Deploy EDR/XDR tools to monitor for exploitation indicators of high-profile KEV flaws like CitrixBleed variants
• Build Resilience: Maintain offline backups, segment networks, and conduct ransomware simulations.
• Collaborate on Intelligence: Share IOCs via ISACs or partners to stay ahead of emerging exploit chains.

As exploitation trends accelerate into 2026, treating the KEV Catalog as a core defense benchmark is no longer optional—it’s essential for staying ahead of real-world adversaries.

“For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.” Cybersecurity and Infrastructure Security Agency (CISA

Source and full details

Read the full CISA Known Exploited Vulnerabilities Catalog here:

https://www.cisa.gov/known-exploited-vulnerabilities-catalog