- CISA included five vulnerabilities in its Known Exploited Vulnerabilities Catalog on October 20, 2025.
- A new server-side request forgery flaw in Oracle E-Business Suite was confirmed as exploited in real attacks.
- Two Oracle EBS vulnerabilities, including a critical code execution bug, are actively targeted by attackers.
- Four additional flaws in Microsoft, Kentico Xperience CMS, and Apple software were also added to the catalog.
- Federal agencies must fix these vulnerabilities by November 10, 2025, to protect against active exploits.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added five security vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog on October 20, 2025. This update includes a newly confirmed exploited flaw in Oracle E-Business Suite (EBS) that threatens sensitive data.
Among the added flaws is CVE-2025-61884, a server-side request forgery (SSRF) vulnerability in Oracle Configurator’s Runtime component. It has a severity score of 7.5 and allows remote attackers to access critical data without needing authentication, according to CISA. This vulnerability now joins CVE-2025-61882 (CVSS score 9.8), a severe bug enabling unauthenticated remote code execution in Oracle EBS, both known to be exploited in active attacks.
Earlier this month, the Google Threat Intelligence Group and Mandiant reported targeting of multiple organizations using CVE-2025-61882. Zander Work, a senior security engineer at Google, noted, “It’s likely that at least some of the exploitation activity we observed was conducted by actors now conducting Cl0p-branded extortion operations.”
The other vulnerabilities added by CISA include:
– CVE-2025-33073, an access control flaw in Microsoft Windows SMB Client (CVSS 8.8).
– CVE-2025-2746 and CVE-2025-2747, both authentication bypasses in Kentico Xperience CMS (CVSS 9.8).
– CVE-2022-48503, improper array index validation in Apple’s JavaScriptCore leading to potential code execution (CVSS 8.8).
Fixes for these were previously released by their respective companies in 2022 and 2025. There are no current details on exploitation in the wild for four of these issues.
Federal Civilian Executive Branch agencies must remediate these five vulnerabilities by November 10, 2025, to secure their IT systems against ongoing attacks.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
Previous Articles:
- Binance’s CZ linked to crypto scam accounts and fake recovery claims
- Evernorth Launches $1B Public XRP Treasury with Ripple Support
- Analyst Forecasts XRP May Generate Millionaires Within Two Months
- Crypto’s $19B Flash Crash Exposes Market Infrastructure Flaws
- Evernorth to Go Public, Raising $1B to Boost XRP Treasury
