CISA Warns of Android 0-Day Vulnerability Exploited in Attacks
The Cybersecurity and Infrastructure Security Agency (CISA) has identified two critical vulnerabilities within the Android Framework, now included in its Known Exploited Vulnerabilities (KEV) catalog. These vulnerabilities pose significant risks to a…
The Cybersecurity and Infrastructure Security Agency (CISA) has identified two critical vulnerabilities within the Android Framework, now included in its Known Exploited Vulnerabilities (KEV) catalog. These vulnerabilities pose significant risks to a vast number of mobile devices globally.
CISA added these vulnerabilities to the KEV catalog on Tue, Dec 2, 2025, mandating federal agencies and critical infrastructure operators to implement patches by Tue, Dec 23, 2025.
CVE-2025-48572 : This privilege escalation vulnerability allows attackers to gain elevated permissions on compromised devices, potentially enabling the installation of malware, access to sensitive data, or establishment of persistent backdoors. CVE-2025-48633 : This information disclosure vulnerability enables unauthorized access to sensitive data from affected devices, potentially without user interaction.
Both vulnerabilities are actively exploited, though their use in ransomware campaigns has not been confirmed. The inclusion of these vulnerabilities in the KEV catalog highlights their active exploitation.
These vulnerabilities pose significant risks to a vast number of mobile devices globally.
CISA urges organizations to apply vendor-supplied mitigations as soon as patches are available. Federal agencies are required to comply with the patching deadline as per binding operational directive BOD 22-01.
Organizations unable to apply patches should consider discontinuing the use of affected products or implement additional security controls to mitigate exposure. Mobile device users are advised to enable automatic security updates and check for pending patches.
Enterprise administrators should prioritize the deployment of Android security updates across company-owned devices and ensure communication of patch availability to users. Moreover, monitoring for indicators of compromise and implementing network segmentation to limit lateral movement is recommended.
The Android security landscape is evolving, necessitating regular patching, security monitoring, and robust incident response capabilities to maintain device security. Organizations are advised to prioritize remediation efforts with urgency in response to this advisory.
Based on reporting by Cyber Security News.