Other Notable Critical CVEs from Late 2024 and Early 2025
In addition to the items covered in separate posts, several other critical vulnerabilities were disclosed or exploited during late 2024 and early 2025. The following is a short awareness summary of issues that may affect common enterprise environments.
SolarWinds Web Help Desk (CVE-2024-28986)
An insecure deserialization vulnerability allowed unauthenticated remote code execution on SolarWinds Web Help Desk installations prior to 12.8.3 Hotfix 1. Organizations using this product should confirm they are on a patched release.
GFI KerioControl (CVE-2024-52875)
A CRLF injection issue in KerioControl (versions 9.2.5 through 9.4.5) could be leveraged for remote code execution. Exploitation attempts were observed after a public proof-of-concept appeared. Patched versions were released in December 2024.
Fortinet FortiSIEM (CVE-2025-25256)
In August 2025, Fortinet disclosed a critical unauthenticated command-injection vulnerability in FortiSIEM (CVE-2025-25256, CVSS 9.8). A practical exploit was reported in the wild. Affected organizations should apply the vendor patch and review logs for activity on the phMonitor service.
These summaries are for awareness only and do not include exploit details. Always consult the vendor advisory and the CISA Known Exploited Vulnerabilities catalog for the latest status.