U.S. CISA adds Adminer, Cisco IOS, Fortra GoAnywhere MFT, Libraesva ESG, and Sudo flaws to its Known Exploited Vulnerabilities catalog

According to U.S.

Cybersecurity and Infrastructure Security Agency (CISA), Adminer, Cisco IOS, Fortra GoAnywhere MFT, Libraesva ESG, and Sudo flaws have been added to the Known Exploited Vulnerabilities (KEV) catalog, with each entry linked to its CVE: Adminer Server-Side Request Forgery (CVE-2021-21311), Cisco IOS and IOS XE Stack-based Buffer Overflow (CVE-2025-20352), Fortra GoAnywhere MFT

Deserialization of Untrusted Data (CVE-2025-10035), Libraesva Email Security Gateway Command Injection (CVE-2025-59689), and Sudo Inclusion of Functionality from Untrusted Control Sphere (CVE-2025-32463, plus CVE-2025-32462 for a separate Sudo issue). The bulletin notes that Cisco fixed the actively exploited zero-day CVE-2025-20352 last week, a high-severity vulnerability in the SNMP subsystem that could allow remote authenticated attackers to trigger a DoS or achieve root code execution.

It also points to active exploitation of CVE-2025-10035 in GoAnywhere MFT as early as 10 September 2025, before public disclosure, and mentions a nation-state actor exploiting Libraesva’s Email Security Gateway flaw. Fortra’s advisory describes a deserialization flaw in GoAnywhere MFT’s License Servlet, with cybersecurity guidance urging upgrades to version 7.8.4 or Sustain Release 7.6.3 and restricting public access to the Admin Console to mitigate exploitation.