Exploited vulnerabilities in 2025: what ENISA reports

This is a short list of what ENISA reports about exploited vulnerabilities in 2025. It draws on chapter 7 and the overview of the ENISA Threat Landscape 2026, published in September 2026 and covering 2025. ENISA does not rank these items, so they are selected by how directly they describe exploitation, in the order the report gives them.

How common is vulnerability exploitation as an intrusion vector?

ENISA reports that exploitation of N-day and 0-day vulnerabilities remains a prevalent intrusion vector. Among incidents of unauthorized access where ENISA could identify the vector, 60.4% were seen leveraging a vulnerability. Misconfiguration and accidental exposure followed at 20.7%. The report gives 5.2% next to that group of incidents, so read 60.4% as a share of the identified cases.

ENISA does not split the 60.4% between N-day and 0-day. For State-nexus intrusion sets, it identified an initial vector in only 20% of recorded incidents. Within that subset, vulnerability exploitation was the most frequently observed vector, at 70% of identified cases. This is the pattern described by the exploit public-facing application technique.

How many vulnerabilities were published in 2025?

ENISA says more than 48 thousand new vulnerabilities were published in 2025 with a CVE identifier, a 22% increase on the previous year. On the CVSS scale, 9% were Critical, 30% High, 49% Medium and 3% Low, while 9% remained unscored. ENISA adds that 71% mention Network as the attack vector, which it says underscores the potential risk of remote exploitation, especially for internet-facing systems. For context on volume, see CVE volume and risk prioritization.

Which weaknesses and known exploited vulnerabilities does ENISA highlight?

ENISA lists the 2025 CWE top 25. CWE-79 (cross-site scripting) is first, followed by CWE-89 (SQL injection) and CWE-352 (cross-site request forgery). Ranks four to ten are CWE-862 (missing authorization), CWE-787 (out-of-bounds write), CWE-22 (path traversal), CWE-416 (use after free), CWE-125 (out-of-bounds read), CWE-78 (OS command injection) and CWE-94 (code injection). In ENISA’s table, the “CVEs in KEV” column shows 20 for CWE-78, 14 for CWE-416 and 12 for CWE-787. It also reports that the CISA Known Exploited Vulnerabilities Catalog added 245 vulnerabilities over the period. The three most common weaknesses tied to those entries are different from the overall top three.

ENISA says the three KEV-related weaknesses can allow memory modification and code execution, which could lead to full control of the system. It also points to the European Vulnerability Database, which it says merges EU and CISA KEV catalogs into a dynamic list of knowingly exploited vulnerabilities. See the glossary entry on known exploited vulnerabilities. ENISA’s chapter does not cite EPSS.

Which CVEs and product types does ENISA name?

ENISA says 2025 was characterized by confirmed attacks against enterprise infrastructure, edge devices and developer tooling, plus unpatched legacy IoT and edge devices. The CVEs below are examples it names, not a ranking.

• VPN and firewall appliances: CVE-2024-55591 was exploited by Qilin and INC Ransom. CVE-2024-40766 and CVE-2023-20269 were exploited by Akira.
• On-premises server zero-days: ENISA describes a wave of exploitation covering CVE-2025-49706, CVE-2025-49704, CVE-2025-53770 and CVE-2025-53771, with EU victimology.
• Enterprise business software: CVE-2025-31324 is called a critical vulnerability. CVE-2025-61882 was a zero-day in Oracle E-Business Suite used by the Clop ransomware group for large-scale data theft followed by extortion demands.
• Endpoint management: CVE-2025-4427 and CVE-2025-4428 were chained critical vulnerabilities, reportedly used to extract Office 365 tokens, mobile device credentials and email configuration files.
• Web framework: CVE-2025-55182, which ENISA calls React2Shell, is among the vulnerabilities China-nexus intrusion sets operationalized rapidly.

In the transport sector, ENISA says data breaches were notably driven by exploitation of managed file-transfer software used in logistics and supply-chain environments.

ENISA’s outlook adds that the same vulnerabilities, platforms and toolsets are likely to be leveraged regardless of a group’s motivation, whether cybercrime, hacktivist or State-nexus. Different threats may therefore gain unauthorized access through similar pathways.

What is ENISA’s own role in vulnerability data?

ENISA says it is a CVE Numbering Authority and maintains the European Vulnerability Database, which supports the community with reliable and timely information on vulnerabilities. Since November 2025 it has also become a Root CVE, a central point of contact within the CVE program for national and EU authorities, EU CSIRTs network members and cooperative partners falling under its mandate. Teams that track exploitation can use that database alongside the CISA catalog.

How fast are new vulnerabilities exploited?

ENISA says attackers continued to weaponize newly disclosed vulnerabilities within a constantly decreasing time span. It does not give an average number of days in chapter 7. It also says model improvements in AI have been seen accelerating vulnerability discovery and exploitation. Related reading: disclosure to exploit speed and vulnerability exploitation trends in H1 2026.

What can security teams check against these findings?

These are checks framed from the facts above, not ENISA recommendations. Teams that own this work can find more on the vulnerability and exposure management role page.

To go further, read CVSS, EPSS and KEV signals and the 2027 threat intelligence priorities.