Changes in October 2025

In CISA made 14 changes to its list that its own file does not keep.

  1. CVE-2024-1086 Linux KernelRansomware use: Unknown to Known.
  2. CVE-2024-9474 Palo Alto Networks PAN-OSRansomware use: Unknown to Known.
  3. CVE-2025-6264 Rapid7 VelociraptorRemoved from CISA's list.
  4. CVE-2025-61884 Oracle E-Business SuiteRansomware use: Unknown to Known.
  5. CVE-2025-54253 Adobe Experience Manager (AEM) FormsDeadline moved from 6 November 2025 to 5 November 2025. Listing date changed from 16 October 2025 to 15 October 2025.
  6. CVE-2025-6264 Rapid7 VelociraptorRansomware use: Unknown to Known.
  7. CVE-2024-21893 Ivanti Connect Secure, Policy Secure, and NeuronsRansomware use: Unknown to Known. Edited: notes.
  8. CVE-2024-21887 Ivanti Connect Secure and Policy SecureRansomware use: Unknown to Known.
  9. CVE-2024-21412 Microsoft WindowsRansomware use: Unknown to Known.
  10. CVE-2023-46805 Ivanti Connect Secure and Policy SecureRansomware use: Unknown to Known.
  11. CVE-2013-3918 Microsoft WindowsEdited: description.
  12. CVE-2025-61882 Oracle E-Business SuiteRansomware use: Unknown to Known.
  13. CVE-2025-61882 Oracle E-Business SuiteDeadline moved from 28 October 2025 to 27 October 2025. Listing date changed from 7 October 2025 to 6 October 2025.
  14. CVE-2025-10035 Fortra GoAnywhere MFTRansomware use: Unknown to Known.