CISA Alerts on WhatsApp 0-Day Vulnerability Actively Exploited in Attacks

CISA has issued an urgent warning about a newly discovered zero-day vulnerability in WhatsApp, tracked as CVE-2025-55177, which is already being exploited in active attacks. The flaw, due to an incorrect authorization check in WhatsApp’s linked device feature, allows attackers to manipulate synchronization messages and cause a victim’s device to process malicious content from arbitrary URLs, potentially enabling data theft, malware installation, and espionage.

On 2 September 2025, CISA added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, with guidance that federal and critical infrastructure organisations should prioritise patching before the 23 September deadline to reduce exposure. According to CISA’s alert, the vulnerability has not yet been definitively tied to ransomware campaigns, but the nature of the exploit makes it a high-value target for threat actors.

The advisory urges organisations to follow Meta Platforms’ mitigation instructions or discontinue use of vulnerable WhatsApp versions, and to implement steps such as updating, monitoring for abnormal synchronization requests, and considering temporarily disabling the linked device feature in high-risk environments.