CVEs Targeting Remote Access Technologies in 2025

Last modified: October 7, 2025

Connect on Linkedin

Follow me on X

Follow me on Bluesky

Connect on Mastodon

The exploitation of vulnerabilities targeting remote access technologies to gain initial access is continuing relentlessly also during 2025, with initial access brokers, and in general opportunistic and targeted threat actors, quite active in leveraging software flaws to break into organizations.

Similarly to what i did in 2024, I am collecting the list of vulnerabilities targeting security technologies defending the perimeter, which have been exploited so far. As you will notice in the list, a good portion of them are 0-days discovered during 2025, but there are also some vulnerabilities that were disclosed (and patched) a few years ago, but are still exploited by threat actors, since they were left unpatched, an aspect that reinforces the importance of strong security procedures throughout the organization.

Distribution of Vulnerabilities by Vendor

Below the links to the vendors’ bulletins for the exploited vulnerabilities (whenever they were available)

ID	Date Reported	Date Occurred	Date Discovered	Author	Target	Vulnerability	Attack	Target Class	Attack Class	Country	Link	Vendor Bulletin	Vendor
1	08/01/2025	-	-	Unknown Threat Actors	Unknown Organization(s)	Ivanti warns that threat actors exploited a Connect Secure remote code execution vulnerability tracked as CVE-2025-0282 in zero-day attacks to install malware on appliances.	Malware	Unknown	Unknown	Unknown			Ivanti
2	10/01/2025	Since at least early December2024	Early December2024	?	Multiple Organizations	Researchers at Arctic Wolf observe a recent campaign affecting Fortinet FortiGate firewall devices with management interfaces exposed on the public internet, exploiting CVE-2024-55591. Few days later the security product maker confirms that the critical vulnerability is “being exploited in the wild.”	Unknown	Multiple Industries	Unknown	Unknown			Fortinet
3	23/01/2025	-	-	Unknown Threat Actors	Unknown Organization(s)	SonicWall alerts customers of CVE-2025-23006, a critical security flaw impacting its Secure Mobile Access (SMA) 1000 Series appliances that it said has been likely exploited in the wild as a zero-day.	Unknown	Unknown	Unknown	Unknown			Sonicwall
4	23/01/2025	Between mid-2023 and at least mid-2024	Between mid-2023 and at least mid-2024	?	Organizations in the semiconductor, energy, manufacturing (marine, solar panels, heavy machinery), and IT sectors.	Researchers at Black Lotus Labs discover a malicious campaign specifically targeting Juniper edge devices, many acting as VPN gateways, with malware dubbed J-magic that starts a reverse shell only if it detects a “magic packet” in the network traffic.	Malware	Multiple Industries	Cyber Crime	>1			Juniper
5	06/02/2025	-	-	Unknown Threat Actor(s)	Unknown Organization(s) in the U.S.	The U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds CVE-2020-15069 Sophos XG Firewall Buffer Overflow Vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation.	Unknown	Unknown	Unknown	US			Sophos
6	11/02/2025	-	-	Unknown Threat Actors	Unknown Organization(s)	Fortinet warns that threat actors are exploiting a new zero-day vulnerability, tracked as CVE-2025-24472, in FortiOS and FortiProxy to hijack Fortinet firewalls.	Unknown	Unknown	Unknown	Unknown			Fortinet
7	12/02/2025	-	-	?	Unknown Organization(s)	SonicWall customers are advised to patch their products, after it emerged that threat actors are actively exploiting the CVE-2024-53704 vulnerability.	Unknown	Unknown	Unknown	Unknown			Sonicwall
8	12/02/2025	-	-	?	Unknown Organization(s)	Palo Alto Networks customers are advised to patch their products, after it emerged that threat actors are actively exploiting the CVE-2025-0108 vulnerability, chained with CVE-2024-9474 and CVE-2025-0111.	Unknown	Unknown	Unknown	Unknown			Palo Alto Networks
9	18/02/2025	Between June and October 2024	Between June and October 2024	NailaoLocker	European Organizations in the Healthcare Sector	Researchers from Orange Cyberdefense reveal the details of Green Nailao, a previously unknown threat activity cluster targeted European organizations, particularly those in the healthcare sector, to deploy PlugX and its successor, ShadowPad, with the intrusions ultimately leading to deployment of a ransomware called NailaoLocker.	Ransomware	Human health and social work	Cyber Crime	>1			Check Point
10	21/02/2025	Between June 2024 and January 2025	Between June 2024 and January 2025	APT41 (a.k.a. Winnti) suspected	Manufacturers, particularly in the aviation and aerospace industries.	Check Point researchers discover that APT41 exploited CVE-2024-24919, a path traversal vulnerability in their security gateways to gain initial access to dozens of OT organizations globally. The threat actors then deployed the modular ShadowPad backdoor to steal valuable intellectual property.	Targeted Attack	Manufacturing	Cyber Espionage	US MX Europe Middle East, Africa			Check Point
11	13/03/2025	Between late January and early March	Between late January and early March	Mora_001 (a possible Lockbit affiliate)	Organizations using unpatched Fortinet devices (FortiOS and FortiProxy).	Researchers at Forescout discover the "Mora_001" threat actor using a new ransomware, "SuperBlack," to exploit CVE-2024-55591 and CVE-2025-24472, two authentication bypass vulnerabilities in Fortinet devices. The attacks lead to data encryption and exfiltration.	Ransomware	Multiple Industries	Cyber Crime	US IN BR			Fortinet
12	28/03/2025	Late 2024 and eaarly 2025	January 2025	Suspected China-nexus espionage actors, UNC5337 and UNC5221, and Chinese state-backed threat group Silk Typhoon (formerly Hafnium).	Critical infrastructure organizations, as well as a broad range of sectors including government, defense, finance, and technology	CISA discover the RESURGE malware while analyzing a compromised Ivanti Connect Secure device. The malware, a variant of the SPAWN family, creates web shells, steals credentials, and maintains persistent access.	Cyber Espionage	Multiple Industries	Cyber Espionage	US GB			Ivanti
13	03/04/2025	Mid-March 2025	Mid-March 2025	UNC5221 (Suspected China-nexus espionage actor)	Multiple Organizations	Researchers at Google Mandiant discover that the China-nexus threat actor UNC5221 exploited a stack-based buffer overflow (CVE-2025-22457) in Ivanti Connect Secure VPNs. The unauthenticated attack achieves RCE to deploy persistent espionage malware.	Targeted Attack	Multiple Industries	Cyber Espionage	>1			Ivanti
14	10/04/2025	Between 2022 and 2024	Between 2022 and 2024	?	Multiple Organizations	Researchers at Fortinet discovered an unpatched threat actor technique that used symbolic links after exploiting known vulnerabilities in FortiGate devices. This allowed the actor to maintain persistent read-only access to device files, including configurations.	Targeted Attack	Multiple Industries	Cyber Espionage	>1			Fortinet
15	16/04/2025	-	-	Unknown Threat Actor(s)	Unknown Organization(s) in the U.S.	The U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds CVE-2021-20035, a security flaw impacting SonicWall Secure Mobile Access (SMA) 100 Series gateways to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation.	Unknown	Unknown	Unknown	US			Sonicwall
16	29/04/2025	-	-	Unknown Threat Actor(s)	Unknown Organization(s)	SonicWall reveals that CVE-2023-44221 and CVE-2024-38475, two now-patched security flaws impacting its SMA100 Secure Mobile Access (SMA) appliances have been exploited in the wild.	Unknown	Unknown	Unknown	Unknown			Sonicwall
17	07/05/2025	-	-	Unknown Threat Actor(s)	Unknown Organization(s)	SonicWall releases patches to address three security flaws affecting SMA 100 Secure Mobile Access (SMA) appliances that could be fashioned to result in remote code execution.	Unknown	Unknown	Unknown	Unknown			Sonicwall
18	25/06/2025	-	-	Unknown Threat Actor(s)	Unknown Organization(s)	Citrix releases security updates to address CVE-2025-6543, a critical flaw affecting NetScaler ADC that it said has been exploited in the wild. In August, the Dutch NCSC confirms active exploitation of the vulnerability in critical sectors	Unknown	Unknown	Unknown	NL Other Countries			Citrix
19	10/07/2025	-	-	Unknown Threat Actor(s)	Unknown Organization(s) in the U.S.	The U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds CVE-2025-5777, a critical security flaw impacting Citrix NetScaler ADC and Gateway to its Known Exploited Vulnerabilities (KEV) catalog, officially confirming the vulnerability has been weaponized in the wild.	Unknown	Unknown	Unknown	US			Citrix
20	16/07/2025	Since at least October 2024	January 2025	UNC6148 (Financially motivated threat actor, potentially linked to Abyss-branded ransomware)	Multiple Organizations	Researchers at Google Threat Intelligence Group discover UNC6148 deploying the OVERSTEP rootkit on end-of-life SonicWall SMA 100 devices since at least October 2024. The financially motivated group uses stolen credentials and vulnerabilities to gain persistent access, steal sensitive credentials, and exfiltrate data for extortion.	Targeted Attack	Multiple Industries	Cyber Crime	>1			Sonicwall
21	02/08/2025	22/07/2025	22/07/2025	Akira	Multiple Organizations	Researchers at Arctic Wolf observe an uptick in Akira ransomware activity starting in late July 2025. The attacks target organizations' SonicWall SSL VPN for initial access, possibly exploiting a known vulnerability (CVE-2024-40766). The firm urges organizations to disable unused VPNs and enforce MFA.	Ransomware	Multiple Industries	Cyber Crime	>1			Sonicwall
22	26/08/2025	-	-	?	Unknown Organization(s)	Citrix patches three critical NetScaler ADC/Gateway flaws, including CVE-2025-7775, a Remote Code Execution bug actively exploited in the wild, prompting CISA to add the flaw to its KEV catalog, urging immediate patching.	Unknown	Unknown	Unknown	Unknown			Citrix
23	25/09/2025	-	-	?	Unknown Organization(s)	Cisco urges customers to patch CVE-2025-20333 and CVE-2025-20362, two security flaws impacting the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software, which it said have been exploited in the wild.	Unknown	Unknown	Unknown	Unknown			Cisco
ID	Date Reported	Date Occurred	Date Discovered	Author	Target	Vulnerability	Attack	Target Class	Attack Class	Country	Link	Vendor Bulletin	Vendor

Creating the timelines is a very time-consuming task.

Any little helps!

October 2026 Cyber Attacks Timeline
A live view of the month's vetted cyber incidents, updated as new events are confirmed. Explore the timeline, filter by attack type, and see motivations, techniques, initial access methods, targeted sectors and target countries on an interactive map.
Mega Breaches in 2026
Here’s a collection of the main mega breaches (that is data breaches with more than one million records compromised and possibly leaked) during 2026. The information is derived from the cyber attacks timelines that I published, normally, on a bi-weekly basis.
Rogue AI Agents
AI agents are escaping sandboxes, misusing credentials and acting without authorization. This live dashboard tracks every reported incident on a horizontal timeline, with charts showing which AI companies and agents are involved, the techniques used and how they got in. It updates automatically as new ...
List Of Hacked Celebrities Who Had (Nude) Photos Leaked
During Summer we always try to spend our free time in a more profitable manner, for instance reading gossip chronicles. From this point of view, July 2012 has not been a particularly lucky month for Carly Rae Jepsen. On July the 7th, her website has been ...
September 2026 Cyber Attacks Statistics
September 2026 recorded 182 cyber incidents, and Cyber Crime drove roughly three in four of them (73.9%). Malware was the top attack vector at 27.8%, exploitation of public-facing applications led initial access at 28.9%, and Information & Communication was the most targeted sector. Explore the ...