U.S. CISA adds Oracle, Windows, Kentico, and Apple flaws to its Known Exploited Vulnerabilities catalog

U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added Oracle, Windows, Kentico and Apple flaws to its Known Exploited Vulnerabilities (KEV) catalogue, with entries including CVE-2022-48503 for Apple, CVE-2025-2746 and CVE-2025-2747 for Kentico Xperience Staging Sync Server, CVE-2025-33073 for Microsoft Windows SMB Client and CVE-2025-61884 for Oracle E-Business Suite Server-Side Request Forgery.

Oracle has released an emergency patch addressing CVE-2025-61884 in E-Business Suite’s Runtime UI component, which Oracle’s Chief Security Officer Rob Duhart described as a vulnerability that could allow access to sensitive resources and carries a CVSS base score of 7.5.

CISA notes that the Windows SMB Client flaw and the two Kentico authentication bypass issues could enable privilege escalation or administrative control, while the Apple bug is described as a three-year-old vulnerability in JavaScriptCore that could lead to arbitrary code execution when processing web content.

According to Binding Operational Directive (BOD) 22-01, FCEB agencies must address these vulnerabilities by the due date to protect networks, and private organisations are advised to review the KEV catalogue and apply fixes accordingly; agencies are instructed to fix the vulnerabilities by 10 November 2025.