August 2025 CVE Landscape

Recorded Future’s Insikt Group identified eighteen high-impact vulnerabilities actively exploited in August 2025, driven largely by Citrix and D-Link flaws; notable incidents include active exploitation of Citrix NetScaler (CVE-2025-7775) leading to widespread web shell deployment and a RomCom campaign exploiting WinRAR (CVE-2025-8088) to deliver SnipBot, RustyClaw, and a Mythic C2 agent. The report lists affected vendors, published PoCs and detection templates (Nuclei), public IOCs (sample hashes and C2 URLs), CISA KEV additions, and vendor patches or mitigations, and recommends urgent patching and monitoring.