Trends in Vulnerability Disclosures and Exploitation in Late 2025
Security researchers and industry analysts report that the number of published vulnerabilities (CVEs) remains high in late 2025, with a notable year-over-year increase in overall volume, despite a temporary slowdown in November attributed to administrative changes at major CVE Numbering Authorities (CNAs). Kaspersky's Q3 2025 analysis highlights that attackers continue to exploit flaws in widely used software such as WinRAR and Microsoft Office, and that the number of critical vulnerabilities (CVSS > 8.9) remains significant, though slightly lower than the previous year. The data suggests that the vulnerability landscape is both expanding and evolving, with attackers leveraging new and existing flaws for exploitation, particularly in Windows and Linux environments.
Industry commentary emphasizes that fluctuations in monthly CVE counts are often driven by the operational pace of a few large CNAs, rather than a true reduction in underlying risk. The November 2025 dip in CVE disclosures is linked to internal migrations and process slowdowns at organizations like Patchstack, MITRE, and the Linux kernel ecosystem, rather than a decrease in actual vulnerabilities. Security teams are cautioned not to interpret short-term drops in disclosure volume as a sign of stabilization, as the overall trend points to continued growth in vulnerabilities and persistent exploitation by threat actors.
Get ahead of threats like this
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
How this story unfolded
7 events from the most recent confirmed update back to the earliest known activity.
Patchstack migration cited as likely cause of temporary disclosure slowdown
Analysts said the November 2025 slowdown in CVE issuance may be temporary and linked in part to Patchstack's internal migration. They expected disclosure output to increase again once the transition is completed.
2025 CVE publication rate runs well above 2024 levels
By late 2025, total CVE publications were running 16.9% higher than in 2024, averaging about 128 new disclosures per day. Analysts noted that disclosure volume and real-world exploitation do not necessarily move in lockstep.
November 2025 CVE count drops 25% year over year
In November 2025, published CVE volume fell 25% compared with the same month in 2024. The decline was attributed mainly to reduced output from major CVE Numbering Authorities such as Patchstack, MITRE, and the Linux kernel ecosystem, rather than a genuine reduction in vulnerabilities.
APT actors in Q3 2025 favor zero-days and common C2 frameworks
During Q3 2025, APT activity was characterized by heavy use of zero-days that later saw broader exploitation after disclosure. Common command-and-control frameworks included Metasploit, Sliver, Mythic, and Empire, with rapid adoption of Adaptix C2 also noted.
ToolShell SharePoint flaws highlighted as active Q3 2025 threat
In Q3 2025, researchers highlighted the ToolShell SharePoint vulnerabilities for enabling authentication bypass and remote code execution. The flaws were cited as a notable part of the quarter's exploitation landscape.
Attackers continue exploiting legacy Windows and Linux flaws in Q3 2025
Throughout Q3 2025, exploitation on Windows heavily featured older Microsoft Office Equation Editor and Office vulnerabilities, while Linux detections were dominated by kernel privilege-escalation exploits such as Dirty Pipe. The report says the number of Linux users encountering exploits grew to more than six times the Q1 2023 baseline.
Q3 2025 CVE volume remains elevated year over year
During Q3 2025, the number of published CVEs stayed higher than in prior years, while the share of newly registered critical vulnerabilities was slightly lower than in 2024. The trend was identified through CVE registration data, telemetry, and open-source reporting.
Related entities
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Sources
2 references tracked. Mallory keeps watching after this page renders.
See the full picture, correlated to your attack surface.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Related stories
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Record Surge in CVE Disclosures and Microsoft Vulnerabilities in 2025
In 2025, the cybersecurity landscape was marked by an unprecedented surge in vulnerability disclosures, with nearly 49,209 CVEs published—representing a 43% increase over the previous year. Microsoft alone issued mitigations for 1,246 CVEs, including 158 rated as critical, and faced 41 zero-day vulnerabilities. Security experts noted that while the volume of vulnerabilities reached new highs, the real risk stemmed from a small subset that were actively exploited, particularly those affecting Microsoft platforms and edge devices. Attackers increasingly leveraged AI and new tactics to exploit vulnerabilities faster, often timing attacks around Patch Tuesday cycles to maximize impact before organizations could apply updates. The overwhelming number of vulnerabilities forced security teams to rethink their prioritization strategies, as traditional severity ratings like CVSS proved insufficient for predicting exploitation. Instead, models such as the Exploit Prediction Scoring System (EPSS) and asset criticality became essential for identifying which vulnerabilities posed the greatest risk. State-sponsored actors and ransomware groups were responsible for a significant portion of exploitation activity, with remote code execution and privilege escalation flaws being the most targeted. Experts emphasized the need for rapid, risk-based patching and a shift away from patching solely based on severity scores, as attackers focused on speed, exposure, and critical assets rather than the sheer number of vulnerabilities disclosed.
Mar 21, 2026
Critical Vulnerabilities and Exploitation Trends in 2025
Security researchers highlighted several high-impact vulnerabilities that shaped the threat landscape in 2025, including unauthenticated remote code execution flaws in widely used platforms such as React Server Components (CVE-2025-55182), SAP NetWeaver (CVE-2025-31324), PAN-OS (CVE-2025-0108), Cisco IOS XE (CVE-2025-20188), and Erlang/OTP SSH (CVE-2025-32433). These vulnerabilities were notable for their rapid exploitation following public disclosure, with attackers leveraging unauthenticated access and broad software reach to maximize impact. The year saw a shift in attacker focus, with perimeter devices and enterprise software becoming primary entry points, and defenders were forced to respond quickly as the window between disclosure and exploitation narrowed. In December 2025, Microsoft released one of its lightest Patch Tuesday updates, addressing 56 new CVEs. Despite the lower volume, security experts emphasized the importance of prioritizing vulnerabilities that were already exploited, publicly disclosed, or rated as critical with a high likelihood of exploitation. The analysis provided actionable intelligence for defenders, including technology-specific threat insights and resources for mitigating risk. The convergence of these trends underscored the need for rapid vulnerability management and highlighted recurring blind spots in enterprise defense strategies.
Mar 21, 2026
Overview of High-Risk Vulnerabilities Exploited in 2025
The cybersecurity landscape in 2025 experienced a significant surge in critical vulnerabilities, with over 21,500 CVEs disclosed in the first half of the year, marking a notable increase from previous years. Among these, several vulnerabilities were actively exploited in the wild, including critical flaws in Langflow (CVE-2025-3248), Microsoft SharePoint Server (CVE-2025-53770, 53771), Sudo (CVE-2025-32463), and Docker Desktop (CVE-2025-9074), each enabling attackers to compromise enterprise infrastructure, escalate privileges, or gain unauthorized access to sensitive systems. These vulnerabilities were highlighted for their technical severity, ease of exploitation, and real-world impact on organizations across various sectors, including government and finance. In addition to these high-profile vulnerabilities, the WordPress ecosystem faced its own set of security challenges, with notable vulnerabilities in popular plugins such as Elementor Website Builder (CVE-2025-11220), WooCommerce (CVE-2025-15033), and All in One SEO (CVE-2025-64295). These flaws exposed millions of websites to risks such as cross-site scripting and sensitive data exposure, emphasizing the importance of timely patching and security updates. The overall trend in 2025 underscored the increasing sophistication and industrialization of cybercriminal operations, with attackers leveraging both newly discovered and well-known vulnerabilities to achieve widespread compromise and persistent access to targeted environments.
Mar 21, 2026