U.S. CISA adds Sitecore, Android, and Linux flaws to its Known Exploited Vulnerabilities catalog

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Sitecore, Android, and Linux flaws to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Sitecore, Android, and Linux to its Known Exploited Vulnerabilities (KEV) catalog.

Below are the descriptions for these flaws:

• CVE-2025-38352 Linux Kernel Time-of-Check Time-of-Use (TOCTOU) Race Condition Vulnerability
• CVE-2025-48543 Android Runtime Unspecified Vulnerability
• CVE-2025-53690 Sitecore Multiple Products Deserialization of Untrusted Data Vulnerability

This week, Google released security updates to address 120 Android vulnerabilities as part of Android Security Bulletin – September 2025. Two of these vulnerabilities have been exploited in targeted attacks.

“There are indications that the following may be under limited, targeted exploitation.

• CVE-2025-38352 (CVSS score: 7.4) – A privilege escalation flaw in the Linux Kernel component
• CVE-2025-48543 (CVSS score: N/A) – A privilege escalation flaw in the Android Runtime component

“reads the advisory.

Google warned that the two flaws allow local privilege escalation without extra permissions or user interaction.

Benoît Sevens of Google’s Threat Analysis Group (TAG) discovered the flaw CVE-2025-38352, a circumstance that suggests that it may have been exploited by advanced threat actors in spyware attacks.

As usual, the tech giant did not disclose technical details on their exploitation.

The third vulnerability added to CISA’s KeV catalog is CVE-2025-53690 (CVSS score: 7.4). The issue is a deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) that allows code injection. This vulnerability impacts Experience Manager (XM): through 9.0; Experience Platform (XP): through 9.0.

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix the vulnerabilities by September 25, 2025.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, cisa)