{"id":7093,"date":"2025-09-21T10:03:37","date_gmt":"2025-09-21T10:03:37","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2025\/09\/21\/top-zero-day-vulnerabilities-exploited-in-the-wild-in-2025\/"},"modified":"2025-09-21T10:03:37","modified_gmt":"2025-09-21T10:03:37","slug":"top-zero-day-vulnerabilities-exploited-in-the-wild-in-2025","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2025\/09\/21\/top-zero-day-vulnerabilities-exploited-in-the-wild-in-2025\/","title":{"rendered":"Top Zero-Day Vulnerabilities Exploited in the Wild in 2025"},"content":{"rendered":"

Top Zero-Day Vulnerabilities Exploited in the Wild in 2025
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

The cybersecurity landscape in 2025 has been marked by an unprecedented surge in zero-day vulnerabilities actively exploited by threat actors. <\/p>\n

According to recent data, more than 23,600 vulnerabilities were published in the first half of 2025 alone, representing a 16% increase over 2024. <\/p>\n

This alarming trend has seen sophisticated threat actors, including nation-state groups and ransomware operators, weaponizing unknown vulnerabilities faster than ever before. <\/p>\n

Nearly 30% of Known Exploited Vulnerabilities (KEVs) were weaponized within 24 hours of disclosure, with some high-profile edge devices experiencing zero-day exploitation before patches were even available.<\/a><\/p>\n

\n
\"\"
Zero-Day Vulnerabilities Exploited by Vendor\/Platform in 2025<\/figcaption><\/figure>\n<\/div>\n

The scope and sophistication of these attacks have evolved dramatically, targeting everything from widely-used web browsers to critical enterprise infrastructure. <\/p>\n

This comprehensive analysis examines the most significant zero-day vulnerabilities that have been actively exploited throughout 2025, providing cybersecurity professionals with detailed technical insights, impact assessments, and mitigation strategies.<\/p>\n

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
CVE<\/th>\nProduct<\/th>\nType<\/th>\nImpact<\/th>\nAttack Vector<\/th>\nPatch Date<\/th>\n<\/tr>\n<\/thead>\n
CVE-2025-10585<\/a><\/td>\nGoogle Chrome<\/td>\nType Confusion<\/td>\nArbitrary Code Execution<\/td>\nMalicious JavaScript<\/td>\n2025-09-17<\/td>\n<\/tr>\n
CVE-2025-6558<\/a><\/td>\nGoogle Chrome<\/td>\nANGLE GPU Exploit<\/td>\nSandbox Escape<\/td>\nMalicious Graphics<\/td>\n2025-07-15<\/td>\n<\/tr>\n
CVE-2025-7775<\/a><\/td>\nCitrix NetScaler<\/td>\nMemory Overflow<\/td>\nRemote Code Execution<\/td>\nNetwork, Unauthenticated<\/td>\n2025-08-26<\/td>\n<\/tr>\n
CVE-2025-53770<\/a><\/td>\nMicrosoft SharePoint<\/td>\nUnsafe Deserialization<\/td>\nRemote Code Execution<\/td>\nHTTP Requests<\/td>\n2025-07-18<\/td>\n<\/tr>\n
CVE-2025-53771<\/a><\/td>\nMicrosoft SharePoint<\/td>\nHeader Spoofing<\/td>\nAuthentication Bypass<\/td>\nHTTP Headers<\/td>\n2025-07-18<\/td>\n<\/tr>\n
CVE-2025-31324<\/a><\/td>\nSAP NetWeaver<\/td>\nArbitrary File Upload<\/td>\nFull System Compromise<\/td>\nHTTP Requests<\/td>\n2025-08-26<\/td>\n<\/tr>\n
CVE-2025-38352<\/a><\/td>\nAndroid<\/td>\nRace Condition<\/td>\nLocal Privilege Escalation<\/td>\nLocal Access<\/td>\n2025-09-03<\/td>\n<\/tr>\n
CVE-2025-48543<\/a><\/td>\nAndroid<\/td>\nUse-After-Free<\/td>\nChrome Sandbox Escape, Privilege Escalation<\/td>\nLocal Access<\/td>\n2025-09-03<\/td>\n<\/tr>\n
CVE-2025-21043<\/a><\/td>\nSamsung Android<\/td>\nOut-of-Bounds Write<\/td>\nRemote Code Execution<\/td>\nMalicious Image Processing<\/td>\n2025-09-11<\/td>\n<\/tr>\n
CVE-2025-43300<\/a><\/td>\nApple iOS\/macOS<\/td>\nOut-of-Bounds Write<\/td>\nArbitrary Code Execution<\/td>\nMalicious Image Files<\/td>\n2025-08-24<\/td>\n<\/tr>\n
CVE-2025-53779<\/a><\/td>\nMicrosoft Windows<\/td>\nKerberos Authentication Bypass<\/td>\nActive Directory Compromise<\/td>\nKerberos Protocol<\/td>\n2025-08-13<\/td>\n<\/tr>\n
CVE-2025-29824<\/a><\/td>\nMicrosoft Windows<\/td>\nElevation of Privilege<\/td>\nRansomware Deployment<\/td>\nPost-Compromise<\/td>\n2025-05-07<\/td>\n<\/tr>\n
CVE-2025-33053<\/a><\/td>\nMicrosoft Windows<\/td>\nWebDAV Vulnerability<\/td>\nRemote Code Execution<\/td>\nHTTP Requests<\/td>\n2025-06-11<\/td>\n<\/tr>\n
CVE-2025-53690<\/a><\/td>\nSitecore<\/td>\nViewState Deserialization<\/td>\nRemote Code Execution<\/td>\nHTTP Requests<\/td>\n2025-09-02<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/figure>\n

Google Chrome: The Browser Under Siege<\/strong><\/h2>\n

CVE-2025-10585: The Latest Chrome Zero-Day<\/strong><\/h3>\n

The most recent addition to Chrome\u2019s vulnerability roster, CVE-2025-10585<\/a>, was discovered on September 16, 2025, and patched within 24 hours.<\/p>\n

This type confusion<\/a> vulnerability in Chrome\u2019s V8 JavaScript and WebAssembly engine represents the sixth Chrome zero-day exploited in 2025.<\/p>\n

Google\u2019s Threat Analysis Group (TAG) confirmed active exploitation, suggesting sophisticated threat actors, likely nation-state groups, were leveraging this flaw in targeted campaigns.<\/a><\/p>\n

Technical Details:<\/strong><\/p>\n