Recent CVEs & Mitigations — 2025 Highlights
Overview
The items below summarize recently disclosed vulnerabilities, affected products, and high-level mitigation guidance. This is a defensive, non-actionable summary intended to help administrators prioritize patching and follow vendor advisories. Always test patches in staging and follow your organisation's change-control procedures.
The items below summarize recently disclosed vulnerabilities, affected products, and high-level mitigation guidance. This is a defensive, non-actionable summary intended to help administrators prioritize patching and follow vendor advisories. Always test patches in staging and follow your organisation's change-control procedures.
At-a-Glance Summary
| CVE | Affected Product | Mitigation (short) |
| CVE-2025-10035 | GoAnywhere MFT | Apply vendor patch; isolate MFT servers; monitor logs and license validation. |
| CVE-2025-6554 | Google Chrome / V8 | Update browsers to patched builds immediately. |
| CVE-2025-47981 | Microsoft Windows (SPNEGO) | Apply Microsoft security updates from Patch Tuesday; follow vendor guidance. |
| CVE-2025-32463 | sudo (local privilege escalation) | Update sudo packages to patched versions; restrict sudo access. |
| CVE-2025-6543 / CVE-2025-5777 | Citrix NetScaler ADC / Gateway | Install Citrix emergency patches; remove public exposure until patched. |
| CVE-2025-31324 / CVE-2025-42999 | SAP NetWeaver | Apply SAP emergency updates; monitor for unauthorized uploads and access. |
| CVE-2025-6218 | WinRAR | Upgrade WinRAR to patched release; avoid opening untrusted archives. |
| CVE-2025-3648 | ServiceNow (Now Platform) | Apply vendor updates; review ACLs and audit logs for sensitive table access. |
| CVE-2025-3768 | Devolutions Server | Install vendor fix; restrict feature usage and tighten privileges. |
Expanded Notes (non-actionable summaries)
CVE-2025-10035 — GoAnywhere MFT
A deserialization/license validation vulnerability allowed crafted license responses to trigger unsafe object handling. Mitigation: upgrade to the patched GoAnywhere release, isolate MFT appliances from untrusted networks, review transfer logs, and follow vendor incident guidance.
CVE-2025-6554 — Chrome / V8 type confusion
A type confusion vulnerability in V8 could enable arbitrary memory reads/writes in some contexts. Mitigation: apply Google's out-of-band browser updates and ensure enterprise browser fleets are updated promptly.
CVE-2025-47981 — Windows SPNEGO buffer overflow (wormable)
A critical buffer overflow in SPNEGO could enable remote code execution with potential wormability. Mitigation: apply Microsoft’s security updates from the relevant Patch Tuesday and monitor for suspicious authentication traffic.
CVE-2025-32463 — sudo local privilege escalation
A flaw in sudo’s chroot/option handling allowed privilege escalation by local users. Mitigation: update sudo to the patched upstream/distribution package and audit sudoers rules to minimize allowed commands.
CVE-2025-6543 / CVE-2025-5777 — Citrix NetScaler ADC / Gateway
High-severity issues (including a zero-day) affected NetScaler appliances and were actively exploited. Mitigation: apply Citrix emergency patches immediately and restrict management interfaces until systems are confirmed patched.
CVE-2025-31324 / CVE-2025-42999 — SAP NetWeaver
Critical file-upload and related issues impacting Visual Composer / NetWeaver. Mitigation: install SAP emergency fixes, validate uploaded content handling, and monitor access logs and web endpoints.
CVE-2025-6218 — WinRAR directory traversal
A directory traversal in archive extraction could be abused via crafted paths. Mitigation: upgrade to the patched WinRAR build and treat untrusted archives cautiously (sandbox before opening).
CVE-2025-3648 — ServiceNow ACL misconfiguration
Misconfigured access controls risked data exposure across tables. Mitigation: deploy vendor patches, review and tighten ACLs, and audit user/table access patterns.
CVE-2025-3768 — Devolutions Server access control bypass
An improper access control issue allowed bypass of Tor-blocking features for authenticated users. Mitigation: update to fixed versions, restrict feature use, and segregate admin roles.
A deserialization/license validation vulnerability allowed crafted license responses to trigger unsafe object handling. Mitigation: upgrade to the patched GoAnywhere release, isolate MFT appliances from untrusted networks, review transfer logs, and follow vendor incident guidance.
A type confusion vulnerability in V8 could enable arbitrary memory reads/writes in some contexts. Mitigation: apply Google's out-of-band browser updates and ensure enterprise browser fleets are updated promptly.
A critical buffer overflow in SPNEGO could enable remote code execution with potential wormability. Mitigation: apply Microsoft’s security updates from the relevant Patch Tuesday and monitor for suspicious authentication traffic.
A flaw in sudo’s chroot/option handling allowed privilege escalation by local users. Mitigation: update sudo to the patched upstream/distribution package and audit sudoers rules to minimize allowed commands.
High-severity issues (including a zero-day) affected NetScaler appliances and were actively exploited. Mitigation: apply Citrix emergency patches immediately and restrict management interfaces until systems are confirmed patched.
Critical file-upload and related issues impacting Visual Composer / NetWeaver. Mitigation: install SAP emergency fixes, validate uploaded content handling, and monitor access logs and web endpoints.
A directory traversal in archive extraction could be abused via crafted paths. Mitigation: upgrade to the patched WinRAR build and treat untrusted archives cautiously (sandbox before opening).
Misconfigured access controls risked data exposure across tables. Mitigation: deploy vendor patches, review and tighten ACLs, and audit user/table access patterns.
An improper access control issue allowed bypass of Tor-blocking features for authenticated users. Mitigation: update to fixed versions, restrict feature use, and segregate admin roles.
Key Defensive Takeaways
Patch promptly: Prioritise fixes for CVEs listed in vendor advisories and CISA’s KEV catalog.
Layer defenses: Use network segmentation, WAFs, EDR, and least-privilege access to reduce blast radius.
Limit exposure: Do not expose management consoles or MFT portals directly to the internet; use VPNs or jump hosts.
Monitor & respond: Centralise logs, enable alerts for anomalous activity, and have playbooks ready for incident response.
Validate updates: Test patches in staging to avoid regressions, then roll out in controlled waves.
References & Vendor Advisories
Microsoft / Fortra advisory on GoAnywhere MFT — see vendor security blog for patch details: GoAnywhere advisory.
Google Chrome security updates (V8 fixes): NVD entry and Chrome release notes.
Citrix emergency patches and advisories: reports and vendor links.
SAP security notes for NetWeaver: cyber.gc.ca advisory.
General KEV / prioritisation guidance: CISA KEV catalog.
Note
This article intentionally omits exploit details and proof-of-concept steps. If you want, I can convert this into a downloadable HTML page for your site, split it into per-vendor posts, or produce a short checklist (CSV/HTML) to help operations teams track patch status.
This article intentionally omits exploit details and proof-of-concept steps. If you want, I can convert this into a downloadable HTML page for your site, split it into per-vendor posts, or produce a short checklist (CSV/HTML) to help operations teams track patch status.