CISA KEV added 245 flaws in 2025, raising total known exploited vulnerabilities to 1,484 and highlighting rising ransomware risks.

Cyble's publication is a resource for cybersecurity professionals and businesses seeking to stay ahead of evolving cyber threats. Through detailed analysis of threat intelligence, cybersecurity trends, and real-world cyber incidents, Cyble provides  insights into emerging threats, cyber attack tactics, and risk mitigation strategies. Readers can learn about threat detection methodologies, vulnerability assessment techniques, incident response protocols, and compliance standards to enhance their cybersecurity posture. Additionally, Cyble offers expert commentary, best practices, and actionable recommendations to help organizations protect their digital assets, safeguard sensitive data, and maintain business continuity in the face of cyber threats.

Cyble

CISA's Known Exploited Vulnerabilities catalog grew to 1,484 entries in 2025, adding 245 new flaws—a 30% increase over previous years. The catalog now includes 24 vulnerabilities actively exploited by ransomware groups, with Microsoft leading vendors at 39 additions. OS command injection (CWE-78) remained the most common weakness type. The accelerated growth reflects rising exploitation trends, with older vulnerabilities also being added at higher rates. Security teams should prioritize patching KEV-listed flaws, particularly those linked to ransomware campaigns.

2025 CISA KEV Catalog Hits 1,484 Exploited Vulnerabilities

Older Vulnerabilities Added to CISA KEV Also Grew

Vulnerabilities Used in Ransomware Attacks

Projects and Vendors with the Highest Number of Exploited Vulnerabilities

Most Common Software Weaknesses Exploited in 2025