CVE-2025-30066

Exploited in the Wild ✓ Confirmed 0-Day
Triaged: March 20, 2026 3 articles

EPSS Score

Source: FIRST.org · 2026-05-24
91.83%
probability
This CVE has a 91.83% probability of being exploited in the next 30 days.
0% Top 99.7th percentile of all CVEs 100%
CVSS score unavailable
Neither CIRCL nor NVD returned a CVSS score for this CVE. View on VulnerabilityLookup ↗

Attack Intelligence

Exploits & PoC

Checkmarx/Checkmarx-CVE-2025-30066-Detection-Tool

PoC CVE-2025-30066 — Checkmarx/Checkmarx-CVE-2025-30066-Detection-Tool

1
1 repo — triés par ⭐ Rechercher sur GitHub ↗

Signal Intelligence

Confidence
85%
EPSS 91.83%
Mentions 3

CNA Information

Analyst Note

CVE-2025-30066 is explicitly confirmed in CISA KEV catalog with active exploitation documented in the wild targeting GitHub Actions supply chain (tj-actions/changed-files). The 2025 publication year combined with immediate CISA listing and widespread exploitation reports across 23,000+ repositories strongly indicate this was exploited before or concurrently with patch availability, meeting zero-day criteria.

Threat Actors 2

Infy
apt_group Information theft and espionage 🇮🇷 IR
Mora_001
apt_group 🇷🇺 RU

Triage Info

Decided atMar 20, 2026