Exploits and vulnerabilities in Q3 2025

Exploits and vulnerabilities in Q3 2025 show attackers continuing to target familiar weaknesses, with the three‑month period seeing a sustained focus on Windows and Linux exploitation alongside new weaponisation of archive handling flaws.

The Windows exploits most detected targeted CVE-2018-0802, CVE-2017-11882 and CVE-2017-0199 in Microsoft Office components, while directory traversal exploits in WinRAR garnered attention via CVE-2025-6218 and CVE-2025-8088, the latter using Alternate Data Streams to influence extraction paths.

The report highlights ToolShell vulnerabilities in Microsoft SharePoint, including CVE-2025-49704, CVE-2025-49706, CVE-2025-53770 and CVE-2025-53771, described as insecure deserialization and an authentication bypass, all patched by July. In addition, CVE-2025-41244 in VMware Aria Operations and VMware Tools is noted as enabling privilege escalation through manipulation of the Service Discovery component.

According to cve[.]org, the overall vulnerability count rose again in Q3 2025 and APT activity increasingly leveraged zero‑days and quick exploitation following disclosure, with a growing emphasis on Linux kernel and system‑level flaws.