CISA's list that day

17 December 2025

On CISA added 3 vulnerabilities to its list of exploited vulnerabilities, in Cisco Multiple Products, SonicWall SMA1000 appliance and ASUS Live Update. The US federal deadlines run from to .

Added that day

Added that day
VulnerabilityProductOur groupListedDeadlineEPSS
CVE-2025-20393Improper Input ValidationCisco Multiple ProductsPatch soon0.32
CVE-2025-40602SMA1000 Missing AuthorizationSonicWall SMA1000 appliancePatch soon0.03
CVE-2025-59374Embedded Malicious CodeASUS Live UpdatePatch soon0.01

Other changes that day

  1. CVE-2019-11510 Ivanti Pulse Connect SecureDeadline moved from 23 April 2021 to 3 May 2022.
  2. CVE-2020-0601 Microsoft WindowsDeadline moved from 29 January 2020 to 3 May 2022.
  3. CVE-2020-1350 Microsoft WindowsDeadline moved from 24 July 2020 to 3 May 2022.
  4. CVE-2020-1472 Microsoft NetlogonDeadline moved from 21 September 2020 to 3 May 2022.
  5. CVE-2020-8243 Ivanti Pulse Connect SecureDeadline moved from 23 April 2021 to 3 May 2022.
  6. CVE-2020-8260 Ivanti Pulse Connect SecureDeadline moved from 23 April 2021 to 3 May 2022.
  7. CVE-2021-22893 Ivanti Pulse Connect SecureDeadline moved from 23 April 2021 to 3 May 2022.
  8. CVE-2021-22894 Ivanti Pulse Connect SecureDeadline moved from 23 April 2021 to 3 May 2022.
  9. CVE-2021-22899 Ivanti Pulse Connect SecureDeadline moved from 23 April 2021 to 3 May 2022.
  10. CVE-2021-22900 Ivanti Pulse Connect SecureDeadline moved from 23 April 2021 to 3 May 2022.
  11. CVE-2021-26855 Microsoft Exchange ServerDeadline moved from 16 April 2021 to 3 May 2022.
  12. CVE-2021-26857 Microsoft Exchange ServerDeadline moved from 16 April 2021 to 3 May 2022.
  13. CVE-2021-26858 Microsoft Exchange ServerDeadline moved from 16 April 2021 to 3 May 2022.
  14. CVE-2021-27065 Microsoft Exchange ServerDeadline moved from 16 April 2021 to 3 May 2022.
  15. CVE-2021-34527 Microsoft WindowsDeadline moved from 20 July 2021 to 3 May 2022.