U.S. CISA adds Apple and Gladinet CentreStack and Triofox flaws to its Known Exploited Vulnerabilities catalog

According to U.S. Cybersecurity and Infrastructure Security Agency (CISA), Apple and Gladinet CentreStack and Triofox flaws have been added to the Known Exploited Vulnerabilities catalog. The new entries are CVE-2025-43529, a Apple Multiple Products Use-After-Free WebKit Vulnerability, and CVE-2025-14611, a hard coded cryptographic vulnerability affecting Gladinet CentreStack and Triofox.

The advisory notes that last week Apple and Google pushed out urgent security updates after uncovering targeted attacks exploiting these kinds of flaws, with evidence of nation-state involvement and commercial spyware vendors focusing on high-value individuals. Apple’s updates address WebKit flaws (including CVE-2025-43529) across iPhones, iPads, and Macs, while CVE-2025-14611 describes fixed AES keys embedded in the software that can be recovered to decrypt data.

CISA also states that agencies must fix the vulnerabilities by 5 January 2026 under Binding Operational Directive 22-01, and organisations are urged to review the KEV Catalog and address these issues accordingly.