U.S. CISA adds WatchGuard Firebox, Microsoft Windows, and Gladinet Triofox flaws to its Known Exploited Vulnerabilities catalog

According to U.S. Cybersecurity and Infrastructure Security Agency (CISA), WatchGuard Firebox, Microsoft Windows, and Gladinet Triofox flaws have been added to the Known Exploited Vulnerabilities catalog. The entries include CVE-2025-9242 for WatchGuard Firebox Out-of-Bounds Write, CVE-2025-12480 for Gladinet Triofox Improper Access Control, and CVE-2025-62215 for a Microsoft Windows race condition vulnerability.

In mid-October, researchers revealed details of CVE-2025-9242, a high-severity flaw (CVSS 9.3) that can allow unauthenticated remote code execution via the Fireware OS IKEv2 VPN services. Mandiant has been tracking exploitation of CVE-2025-12480 by the threat cluster UNC6485, with activity detected using Google Security Operations and PLINK-based RDP tunnelling.

CISA has ordered federal agencies to fix the vulnerabilities by December 3, 2025, and private organisations are advised to review the KEV catalog and address the flaws in their infrastructure.