U.S. CISA adds Oracle, Mozilla, Microsoft Windows, Linux Kernel, and Microsoft IE flaws to its Known Exploited Vulnerabilities catalog

According to the U.S. Cybersecurity and Infrastructure Security Agency (CISA), Oracle, Linux Kernel, Mozilla, Microsoft Windows, and Microsoft Internet Explorer flaws have been added to the Known Exploited Vulnerabilities (KEV) catalog.

The seven entries include CVE-2010-3765 (Mozilla Multiple Products Remote Code Execution), CVE-2010-3962 (Microsoft Internet Explorer Uninitialized Memory Corruption), CVE-2011-3402 (Microsoft Windows Remote Code Execution), CVE-2013-3918 (Microsoft Windows Out-of-Bounds Write), CVE-2021-22555 (Linux Kernel Heap Out-of-Bounds Write), CVE-2021-43226 (Microsoft Windows Privilege Escalation), and CVE-2025-61882 (Oracle E-Business Suite Unspecified Vulnerability).

This week, Oracle released an emergency patch to address CVE-2025-61882 in its E-Business Suite; the flaw was exploited by the Cl0p ransomware group in data theft attacks. The KEV additions underscore the need for both public and private sector organisations to prioritise remediation under Binding Operational Directive 22-01. Agencies are required to fix the identified vulnerabilities by late October 2025 to reduce exposure to exploits targeting the catalog.