Is CVE-2025-21480 (Qualcomm Multiple Chipsets Incorrect Authorization) being exploited in the wild?

By NHI Mgmt Group Editorial Team Updated October 19, 2026 Domain: Threats, Abuse & Incident Response

Yes. CISA added CVE-2025-21480 to its Known Exploited Vulnerabilities catalogue on 3 June 2025, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Multiple Qualcomm chipsets contain an incorrect authorization vulnerability. Any organisation running the affected product should treat remediation as urgent. Check exposure first, then patch or mitigate, then review logs for signs of earlier compromise.

What “being exploited in the wild” means for this CVE

CISA’s KEV listing is the key signal here: when a vulnerability appears there, CISA is treating it as confirmed active exploitation, not just a theoretical issue. For CVE-2025-21480, that means the practical question is no longer whether exploitation is possible, but whether your environment contains affected Qualcomm-based products that could be reachable or already exposed.

For an organisation, the immediate task is to identify where the affected product is present, how it is used, and whether it supports business-critical functions that would make a compromise high impact. If the vulnerable chipset sits in a device class that is hard to patch quickly, exposure scope matters as much as the patch itself, because exploitation in embedded or mobile ecosystems can linger through asset blind spots.

Why incorrect authorization is operationally serious

Incorrect authorization flaws are dangerous because they can let an attacker perform actions the system should have denied. In chipset-adjacent products, that can mean reaching privileged functionality, changing device behaviour, or using the device as a foothold into adjacent services. The issue is not only access, but trust: once authorization boundaries fail, downstream controls may be bypassed as if the request were legitimate.

For products built on shared platform components, the same weakness can have wide blast radius across multiple device lines or deployment contexts. A vulnerability of this kind often becomes more serious when the affected devices are managed at scale, because even a small authorization failure can translate into many potential entry points, especially where inventory is incomplete or device ownership is unclear.

How to respond when exploitation is already confirmed

Start with exposure confirmation, then move to remediation, then to compromise review. The most useful source of truth for technical details is the vendor advisory and the CISA Known Exploited Vulnerabilities Catalog, which should be used to confirm current remediation guidance and any deadline or prioritisation language.

If patching or firmware remediation cannot happen immediately, reduce the attack surface as far as the product allows. That may include removing unnecessary network exposure, limiting management access, segmenting the affected device class, and disabling features or interfaces that are not required. Because exploitation is already credible, compensating controls should be treated as temporary risk reduction, not as an equivalent substitute for fixing the flaw.

After remediation, review logs and adjacent telemetry for signs that the vulnerable product was accessed in ways that would not fit normal operations. If the device or chipset supports authentication, administrative interfaces, or service access, check whether credentials, sessions, or trusted relationships may need rotation or reissue. The need for rotation depends on what the vulnerable component could have exposed, not on whether abuse is already obvious.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8, NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	Active exploitation makes rapid identification and remediation of exposed devices essential.
Recommendation — Prioritize and remediate KEV-listed assets first, then verify the exposure window is closed.
NIST CSF 2.0	ID.RA-01 — Asset vulnerabilities are identified and recorded	The answer depends on confirming where the vulnerable product is deployed.
	RS.MA-01 — Incidents are contained and mitigated	Confirmed exploitation requires containment when patching cannot happen immediately.
Recommendation — Inventory affected assets and track the exposed product to drive urgent response. Contain exposed devices while applying the vendor fix or mitigation.
NIST SP 800-53 Rev 5	RA-5 — Vulnerability Monitoring and Scanning	The response requires exposure confirmation and vulnerability tracking across assets.
Recommendation — Scan for the affected product and validate remediation until the exposure is removed.
MITRE ATT&CK	T1190 — Exploit Public-Facing Application	The question concerns real-world exploitation of a vulnerability as an access path.
Recommendation — Hunt for external exploitation patterns and correlate them with the vulnerable service path.

Practitioner Guidance

What to prioritise: Verify whether the vulnerable Qualcomm-based product is actually deployed, and prioritise systems that are internet-reachable, externally managed, or tied to sensitive workloads. A KEV-listed flaw should be handled as an active risk, not queued with routine patch work.

What to verify: Confirm the exact device model or platform, current firmware or software state, and whether the vendor has issued a fix or mitigation for that specific build. Do not assume a chipset family is safe because one product line is not named in internal inventories.

Decision rule: If the device cannot be patched promptly, treat any exposed management path or privileged service path as a temporary containment problem and reduce access first. If compromise indicators exist, escalate to incident response before completing routine remediation.

Practitioner takeaway: The presence of active exploitation changes the priority order: establish exposure, contain reachability, fix the flaw, then hunt for evidence of use, because waiting to prove compromise before acting gives the attacker the advantage.

Deepen Your Knowledge

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org