CVE Watch—

CVE-2025-55177

Meta Platforms WhatsApp Incorrect Authorization Vulnerability

CVSS

—

No CVSS

EPSS

4.1%

p90

KEV

YES

Sep 2, 2025

Exploit Today

0-100

Published: — · Last modified: —

EPSS · 30d

4.1%EPSS · 30 days4.1%

2026-06-302026-07-16

KEV catalog record

Product

Meta Platforms / WhatsApp

Vulnerability

Meta Platforms WhatsApp Incorrect Authorization Vulnerability

Added to KEV

Sep 2, 2025

Remediate by

Sep 23, 2025

Known ransomware use

Summary description

Meta Platforms WhatsApp contains an incorrect authorization vulnerability due to an incomplete authorization of linked device synchronization messages. This vulnerability could allow an unrelated user to trigger processing of content from an arbitrary URL on a target’s device.

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Notes

https://www.whatsapp.com/security/advisories/2025/ ; https://nvd.nist.gov/vuln/detail/CVE-2025-55177

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2019-18426—

99.2%

KEV—80WhatsApp Cross-Site Scripting Vulnerability—CVE-2019-3568—

98.4%

KEV—80WhatsApp VOIP Stack Buffer Overflow Vulnerability—