Actively Exploited Zero-Days (2025): Who’s Affected and How to Block the Kill Chain By CyberDudeBivash • Date: September 20, 2025 (IST)

TL;DR — Patch-First Shortlist (with fast mitigations)

• Chrome V8 type confusion — CVE-2025-10585 (active): Update to 140.0.7339.185+ (desktop). Block risky extensions; enable strict site isolation; monitor for child-process crashes from Chrome. BleepingComputer+1

• Apple ImageIO — CVE-2025-43300 (exploited, targeted): Update iOS/iPadOS/macOS to the latest security release; enable Lockdown Mode for high-risk users; treat untrusted images as untrusted code. Apple Support+1

• Ivanti Connect Secure/Policy Secure — CVE-2025-0282 (zero-day carryover): Patch to fixed releases (22.7R2.5+ etc.), rotate creds, reimage if compromise suspected; assume token/session theft. NVD+1

• Windows CLFS kernel — CVE-2025-29824 (ransomware activity): Apply April updates; watch for LSASS access + driver load anomalies; EDR block on unsigned kernel access. Microsoft

• Windows Fast FAT — CVE-2025-24985 (exploited): Apply March updates; hunt for suspicious removable-media events and crafted FAT images. Tenable®

• Citrix NetScaler ADC/Gateway:

  • CVE-2025-5777 (“CitrixBleed 2”) — memory disclosure, in KEV (active). Patch immediately; revoke sessions; rotate auth secrets. CISA

  • CVE-2025-7775 — memory overflow RCE, active. Upgrade per vendor bulletin; check AAA/Gateway/IPv6 configs; hunt for webshells. CISA+1

• Cisco ISE / ISE-PIC — CVE-2025-20281/-20282/-20337 (active): Patch; isolate mgmt plane; hunt for new admin users and odd process launches. The Hacker News+1

• WinRAR for Windows — CVE-2025-8088 (active, RomCom): Manually update to 7.13 (no auto-update); block .rar from unknown senders; hunt for autorun file drops. WinRAR+2We Live Security+2

• N-able N-central — CVE-2025-8876 (command injection, in KEV): Patch or isolate; assume RMM takeover if exposed; rotate API keys. CISA

• Dassault DELMIA Apriso — CVE-2025-5086 (deserialization, in KEV): Patch and remove public exposure; inspect for odd job executions. CISA

Kill-Chain Notes (how these are being weaponized)

• Initial Access: perimeter device bugs (Citrix NetScaler, Ivanti ICS) and user-space apps (Chrome, WinRAR) deliver code or leak tokens—often via spear-phish archives or web drive-bys. Google Cloud+2BleepingComputer+2

• Privilege & Lateral: kernel/CLFS elevation and device-management platforms (ISE/N-central) convert footholds into domain or network control. Microsoft+1

• Exfil/Impact: session theft (CitrixBleed-class) + webshells/RMM persistence → data theft, potential ransomware staging. CISA+1

“Who’s Affected” Quick Matrix

Patch-Now Playbook (90-minute run)

1. Edge devices first: NetScaler, Ivanti, Cisco ISE — patch, revoke sessions/tokens, rotate secrets, scan for webshells. CISA+2Google Cloud+2

2. User apps: Force Chrome/Edge update; push WinRAR 7.13; block risky file types at mail gateway. BleepingComputer+1

3. OS fixes: Roll April & March Windows updates for CLFS/FAT; enable kernel-attack telemetry. Microsoft+1

4. Apple fleet: Ship latest iOS/iPadOS/macOS; enable Lockdown Mode for VIPs and threat-exposed teams. Apple Support

Detection cues 

• Citrix session scraping (CVE-2025-5777): spikes of /var reads + unusual nsconmsg invocations; sudden mass session invalidations. CISA

• WinRAR zero-day: creation of executables within %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\ immediately after .rar extraction. We Live Security

• Chrome exploit attempts: renderer crashes followed by new process spawn chains to LOLBins (mshta, rundll32). BleepingComputer

• CLFS abuse: unusual CLFS log operations preceding EDR-flagged credential theft or driver tampering. Microsoft

#CyberDudeBivash #ZeroDay #CVE #ExploitedInTheWild #PatchNow #Citrix #Ivanti #Chrome #WinRAR #CiscoISE #Microsoft #Apple #ThreatIntel #SOC #IR