# september 2025

> markdown for agents. every page and download is listed in [llms.txt](https://cvegen.art/llms.txt).

![drybrush poster for september 2025, painted from 4,319 published cves](https://media.cvegen.art/posters/2025-09/1280.jpg?v=c5e07abfcc)

what the poster shows: 30 days as bands of dry brush, the first day at the top. 9 ran above the 2025 average for their weekday and sweep fast and wide; the other 21 are slow, level strokes. two inks: the deep one for open-source packages, enterprise vendors, the linux kernel, browsers and ai software, the pale one for everything else.

the poster being painted, a 12 second film: [mp4](https://media.cvegen.art/films/2025-09.mp4?v=b97a900d89)

| fact | value |
| --- | --- |
| cves | 4,319 |
| against an average 2025 month | 1.1× |
| busiest day | sep 22, 414 |
| rated critical, cvss 9 or higher | 296 |
| critical with no login and no click | 260 |
| used in real attacks | 16 |

## september 2025 in numbers

september 2025 brought 4,319 cves, close to an average 2025 month. 9 of its 30 days ran above the 2025 average for that weekday.

- 414 on sep 22, the busiest day. patchstack published 291 of them at once.
- 296 rated critical, cvss 9 or higher. 260 of them can be hit over the network with no login and nothing for a user to click.
- 622 came in three single drops: patchstack 291 on sep 22, the linux kernel team 210 on sep 15, the linux kernel team 121 on sep 18.

## 16 already used in real attacks

cisa kev, as of oct 24, 2026.

### by product

- 2 samsung mobile devices, sep 12
- 2 cisco secure firewall adaptive security appliance and secure firewall threat defense, sep 25
- 1 sitecore products, sep 3
- 1 android runtime, sep 4
- 1 linux kernel, sep 5
- 1 adobe commerce and magento, sep 9
- 1 watchguard firebox, sep 17
- 1 fortra goanywhere mft, sep 18
- 1 cwp control web panel, sep 19
- 1 libraesva email security gateway, sep 19
- 1 solarwinds web help desk, sep 23
- 1 cisco ios and ios xe, sep 24
- 1 google chromium v8, sep 24
- 1 broadcom vmware aria operations and vmware tools, sep 29

### every cve

- sep 3, sitecore multiple products, [cve-2025-53690](https://www.cve.org/CVERecord?id=CVE-2025-53690)
- sep 4, android runtime, [cve-2025-48543](https://www.cve.org/CVERecord?id=CVE-2025-48543)
- sep 5, linux kernel, [cve-2025-39682](https://www.cve.org/CVERecord?id=CVE-2025-39682)
- sep 9, adobe commerce and magento, [cve-2025-54236](https://www.cve.org/CVERecord?id=CVE-2025-54236)
- sep 12, samsung mobile devices, [cve-2025-21042](https://www.cve.org/CVERecord?id=CVE-2025-21042)
- sep 12, samsung mobile devices, [cve-2025-21043](https://www.cve.org/CVERecord?id=CVE-2025-21043)
- sep 17, watchguard firebox, [cve-2025-9242](https://www.cve.org/CVERecord?id=CVE-2025-9242)
- sep 18, fortra goanywhere mft, [cve-2025-10035](https://www.cve.org/CVERecord?id=CVE-2025-10035)
- sep 19, cwp control web panel, [cve-2025-48703](https://www.cve.org/CVERecord?id=CVE-2025-48703)
- sep 19, libraesva email security gateway, [cve-2025-59689](https://www.cve.org/CVERecord?id=CVE-2025-59689)
- sep 23, solarwinds web help desk, [cve-2025-26399](https://www.cve.org/CVERecord?id=CVE-2025-26399)
- sep 24, google chromium v8, [cve-2025-10585](https://www.cve.org/CVERecord?id=CVE-2025-10585)
- sep 24, cisco ios and ios xe, [cve-2025-20352](https://www.cve.org/CVERecord?id=CVE-2025-20352)
- sep 25, cisco secure firewall adaptive security appliance and secure firewall threat defense, [cve-2025-20333](https://www.cve.org/CVERecord?id=CVE-2025-20333)
- sep 25, cisco secure firewall adaptive security appliance and secure firewall threat defense, [cve-2025-20362](https://www.cve.org/CVERecord?id=CVE-2025-20362)
- sep 29, broadcom vmware aria operations and vmware tools, [cve-2025-41244](https://www.cve.org/CVERecord?id=CVE-2025-41244)

cisa keeps adding older cves when attacks come to light, so this list can still grow.

## this poster

| fact | value |
| --- | --- |
| period | september 1 to 30, 2025 |
| cves | 4,319 |
| data | cve list v5, cisa kev, drawn 2026-10-24 |
| format | 3:4, drawn for 45 × 60 cm |

[download jpg, 2000 × 2667](https://media.cvegen.art/posters/2025-09/2000.jpg?v=c5e07abfcc)

## other months

- before: [august 2025](https://cvegen.art/2025/08.md), 3,629 cves
- after: [october 2025](https://cvegen.art/2025/10.md), 4,274 cves
- [all months](https://cvegen.art/index.md)