November 2025 saw a significant 69% decrease in high-impact vulnerabilities, with Recorded Future's Insikt Group® identifying 10 vulnerabilities requiring immediate attention, down from 32 in October.

What security teams need to know:

• Fortinet leads concerns: Two critical FortiWeb vulnerabilities (CVE-2025-64446 and CVE-2025-58034) are under active exploitation
• LANDFALL spyware campaign: Threat actors weaponized Samsung's image processing flaw (CVE-2025-21042) for zero-click Android attacks
• Public exploits proliferate: Seven of ten vulnerabilities have public proof-of-concept code available
• OS Command Injection and Out-of-bounds Write were tied as the most common weakness types

Bottom line: The reduced volume shouldn't signal reduced vigilance. November's vulnerabilities demonstrate that threat actors favored quality over quantity in their exploitation campaigns.

Quick Reference: November 2025 Vulnerability Table

All 10 vulnerabilities below were actively exploited in November 2025.

Table 1: List of vulnerabilities that were actively exploited in November based on Recorded Future data (Source: Recorded Future)

Key Trends: November 2025

Vendors Most Affected

• Fortinet dominated with two critical FortiWeb vulnerabilities, both enabling remote exploitation
• Microsoft faced a kernel-level race condition affecting all modern Windows versions
• Samsung saw the weaponization of an image processing vulnerability for sophisticated mobile attacks
• Additional affected vendors: Gladinet, Google, Oracle, WatchGuard, CentOS, and Autonomy (OpenPLC)

Most Common Weakness Types

• CWE-78 – OS Command Injection (tied for first)
• CWE-787 – Out-of-bounds Write (tied for first)
• CWE-284 – Improper Access Control
• CWE-362 – Race Condition
• CWE-306 – Missing Authentication for Critical Function

Threat Actor Activity

LANDFALL Android spyware campaign marked November's most sophisticated operation:

• Exploited CVE-2025-21042 for zero-click remote code execution on Samsung devices
• Targeted Middle Eastern countries (Iraq, Iran, Turkey, Morocco) with commercial-grade spyware
• Deployed via weaponized DNG image files through WhatsApp
• Achieved persistent device compromise without user interaction
• Demonstrated advanced anti-analysis and SELinux bypass capabilities

Priority Alert: Active Exploitation

These vulnerabilities demand immediate attention due to confirmed exploitation in the wild.

CVE-2025-64446 | Fortinet FortiWeb

Risk Score: 99 (Very Critical) | CISA KEV: Added November 14, 2025

Why this matters: Unauthenticated attackers can bypass authentication entirely and create administrative accounts. With 4,768 exposed FortiWeb instances globally, this represents a critical internet-facing risk.

Affected versions: FortiWeb 8.0.0-8.0.1, 7.6.0-7.6.4, 7.4.0-7.4.9, 7.2.0-7.2.11, 7.0.0-7.0.11

Immediate actions:

• Apply Fortinet's security updates (8.0.2, 7.6.5, 7.4.10, 7.2.12, or 7.0.12)
• Monitor for POST requests to /api/v2.0/cmd/system/admin%3F/../../../cgi-bin/fwbcgi
• Check for unauthorized admin accounts created since October 2025
• Review logs for Base64-encoded CGIINFO headers
• Disable HTTP/HTTPS on internet-facing interfaces if patching is delayed

Exposure: ~4,768 FortiWeb instances visible on Shodan (Netherlands, US, Germany, Italy, Peru)

CVE-2025-21042 | Samsung Android Devices

Risk Score: 99 (Very Critical) | CISA KEV: Added November 10, 2025

Why this matters: Zero-click exploitation through image files enables complete device compromise without user interaction. The LANDFALL spyware campaign is actively targeting government and business users in the Middle East.

Affected versions: Samsung Galaxy devices running Android 13, 14, and 15

Immediate actions:

• Install Samsung's April 2025 Security Maintenance Release
• Monitor WhatsApp Media directories for suspicious DNG files
• Check for unexpected processes in /data/data/com.samsung.ipservice/files/
• Review device logs for b.so or l.so module execution
• Educate users about image file risks in messaging apps

Targeted devices: Galaxy S22/S23/S24 series, Z Fold4, Z Flip4

CVE-2025-62215 | Windows Kernel

Risk Score: 99 (Very Critical) | CISA KEV: Added November 12, 2025

Why this matters: Local privilege escalation to SYSTEM allows complete Windows compromise. Attackers are chaining this with initial access techniques for full network penetration.

Affected versions: Windows 10/11 (all versions), Windows Server 2019-2025

Immediate actions:

• Install Microsoft's November 2025 Patch Tuesday updates
• Monitor for unusual memory allocation patterns in kernel space
• Review logs for privilege escalation attempts
• Implement application whitelisting to prevent exploitation tools
• Deploy LAPS and enforce MFA as compensating controls

Technical Deep Dive: Exploitation Analysis

Fortinet FortiWeb Authentication Bypass (CVE-2025-64446)

The dual-flaw design failure: CVE-2025-64446 combines path traversal with authentication bypass in FortiWeb's CGI handling. The vulnerability chain works as follows:

• Path traversal via API endpoints – Unsanitized ../ sequences in URIs allow escape to restricted directories
• Authentication context injection – The cgi_auth() function trusts user-supplied HTTP_CGIINFO headers
• Administrative impersonation – Base64-encoded JSON in headers creates valid admin sessions

Why this matters: Attackers achieve full administrative access without credentials, enabling complete WAF bypass and potential downstream application compromise.

Insikt Group created a Nuclei template for non-intrusive detection, available to Recorded Future customers. The template checks for vulnerable path traversal without creating accounts or modifying system state.

LANDFALL Android Spyware Campaign (CVE-2025-21042)

Zero-click sophistication: The LANDFALL campaign represents a significant evolution in mobile threats:

• Weaponized DNG files contain embedded ZIP archives with ELF binaries
• Two-stage infection deploys b.so (loader/backdoor) and l.so (privilege escalation)
• SELinux bypass enables persistent system-level access
• Anti-forensics includes cleanup routines and analysis environment detection

Key technical details:

• Exploits Samsung's libimagecodec.quram.so library
• Targets specific device models with hardcoded identifiers
• Implements encrypted C2 communication with certificate pinning
• Collects IMEI, IMSI, contacts, and location data

Why this matters: This campaign demonstrates nation-state-level capabilities in commercial spyware, targeting high-value individuals without requiring any user interaction.

Windows Kernel Race Condition (CVE-2025-62215)

Timing-based privilege escalation: The vulnerability exploits improper synchronization in shared kernel resources:

• Concurrent threads access shared data without proper locking
• Race condition enables memory corruption and object reuse
• Successful exploitation grants SYSTEM-level privileges

Why this matters: Local attackers with limited access can achieve complete system control, making this a favorite post-exploitation tool for ransomware operators.

Detection & Remediation Resources

Nuclei Templates from Insikt Group®

Recorded Future customers can access Nuclei templates in the platform for:

• CVE-2025-64446 (Fortinet FortiWeb) - Non-intrusive path traversal detection

Note: All templates are designed for authorized testing only and make no system modifications.

Recorded Future Product Integrations

• Vulnerability Intelligence – Prioritize based on real-world exploitation data
• Attack Surface Intelligence – Discover exposed, internet-facing Fortinet, Samsung, and Windows assets
• Third-Party Intelligence – Monitor vendor vulnerabilities across your third parties

November 2025 Summary

Quality over quantity. Threat actors focused on high-impact vulnerabilities with clear paths to compromise, particularly authentication bypasses and privilege escalations.

Mobile threats evolve. The LANDFALL campaign demonstrates that mobile devices face nation-state-level threats previously reserved for traditional endpoints.

Public exploits accelerate risk. With 70% of vulnerabilities having public PoCs, the window between disclosure and mass exploitation continues to shrink.

Take Action

Ready to see how Recorded Future can help your team detect active exploitation, prioritize patching, and reduce attack surface risk? Explore our demo center to see these capabilities in action, or dive deeper into Insikt Group research for more threat intelligence insights.

About Insikt Group®:

Recorded Future's Insikt Group® is a team of elite analysts, linguists, and security researchers providing actionable intelligence to protect organizations worldwide. Our research combines human expertise with AI-powered analytics to deliver timely, relevant threat intelligence.