Exploits and vulnerabilities in Q2 2025

Exploits and vulnerabilities in Q2 2025 show a dynamic landscape, with vulnerability registrations continuing to impact a broad range of subsystems from UEFI and drivers to browsers and web applications. According to Securelist, the first half of 2025 saw threat actors leveraging disclosed flaws in real-world attacks, including widely exploited Office and WinRAR vulnerabilities, alongside weaknesses in Linux and other components.

The report highlights specific CVEs frequently used in Windows exploits, such as CVE-2018-0802, CVE-2017-11882 and CVE-2017-0199, and notes WinRAR gaps like CVE-2023-38831 and CVE-2025-24071, as well as CVE-2024-35250 in ks.sys. It also documents high-severity cases used in APT attacks, including CVE-2025-31324, CVE-2024-1709, CVE-2024-31839, CVE-2024-30850 and CVE-2025-33053, which illustrate how attackers combine vulnerability exploits with C2 frameworks.

The piece emphasises the need for prompt patching and constant monitoring, and points to the Kaspersky Next line as a means to help detect and analyse vulnerabilities and threats across organisations of all sizes.