Current CVEs You Need to Patch — Critical Threats in August 2025

1. Microsoft SharePoint: ToolShell Exploitation (CVE-2025-53770 / 53771)
   1. What's happening: A critical deserialization vulnerability (CVE-2025-53770, CVSS 9.8) is being actively exploited. It enables unauthenticated remote code execution on-premises. It's part of the "ToolShell" exploit chain, including spoofing bypass (CVE-2025-53771).
   2. Impacted systems: SharePoint Server 2016, 2019, Subscription Edition – SharePoint Online is unaffected.
   3. Recommended action: Patch immediately. Microsoft has issued urgent guidance and CISA added this to its Known Exploited Vulnerabilities catalog.
2. CitrixBleed 2: NetScaler Memory Leak (CVE-2025-5777)
   1. Overview: A critical input validation flaw in Citrix NetScaler ADC and Gateway allows unauthenticated memory overread – leaking tokens, credentials, and more.
   2. Scope: Affects widespread versions (ADC 14.1 and before, Gateway 13.1 and before). CISA placed it in its KEV catalog and mandated patching within 24 hours.
   3. Action required: Patch immediately. Reduce exposure by isolating affected admin interfaces until fixed.
3. Android "No-Touch" Remote Code Execution (CVE-2025-48530, 22441, 48533)
   1. What's going on: Google issued a critical patch for three remote code execution CVEs allowing exploitation without user interaction– dubbed "no-touch" attacks.
   2. Affected devices: Many current Android phone– though older models like Pixel 3a, Galaxy S10, OnePlus 7 are now unsupported and remain vulnerable.
   3. Recommended action: Update Android devices immediately. For unsupported models, consider upgrading.
4. Apple Zero-Day Under Active Exploitation (CVE-2025-6558)
   1. Summary: Apple addressed an actively exploited zero-day flaw in WebKit– affecting iOS, macOS, iPadOS, watchOS, and more– that enables arbitrary code execution via crafted HTML content.
   2. Mandate: CISA added it to its KEV list, requiring patching by federal agencies by August 12.
   3. What to do: Install the latest iOS 18.6 / macOS Sequoia 15.6 updates now.

Why These Matter

ThreatGrid Takeaways

1. Prioritize patching these CVEs immediately, starting with enterprise assets.
2. Monitor logs and anomalous behavior post-patch to detect lingering activity.
3. Harden configurations– e.g, Secure Boot validation, Network segmentation, disabled unused services.
4. Consider temporary mitigations where patches are not yet available or devices are unsupported.