Meta Platforms WhatsApp Incorrect Authorization Vulnerability (CVE-2025-55177)
Severity: medium · Patch status: unknown · Since 2025-09-02 · CVE-2025-55177
Meta Platforms WhatsApp contains an incorrect authorization vulnerability due to an incomplete authorization of linked device synchronization messages. This vulnerability could allow an unrelated user to trigger processing of content from an arbitrary URL on a target’s device. CISA added CVE-2025-55177 to its Known Exploited Vulnerabilities catalog on Sep 2, 2025, which means attackers are exploiting it in the wild.
What to do
- Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- US federal agencies must remediate by Sep 23, 2025 (BOD 22-01); treat that as the outer limit.
Sources
All live incidents on Threat Watch