Five New Exploited Bugs Land in CISA's Catalog — Oracle and Microsoft Among Targets

According to CISA, five security flaws were added to the Known Exploited Vulnerabilities Catalog, including CVE-2025-61884, a server-side request forgery in the Oracle E-Business Suite Runtime component that could grant unauthorized access to data and is described as remotely exploitable without authentication.

CVE-2025-61882 is noted as a second Oracle EBS flaw that is highly critical (CVSS 9.8) and could allow unauthenticated attackers to execute arbitrary code on affected instances, with dozens of organisations reportedly impacted following its exploitation.

The KEV additions also include four other vulnerabilities: CVE-2025-33073 (CVSS 8.8) in Microsoft Windows SMB Client; CVE-2025-2746 (CVSS 9.8) and CVE-2025-2747 (CVSS 9.8) both in Kentico Xperience CMS involving authentication bypass via Staging Sync Server password handling; and CVE-2022-48503 (CVSS 8.8) in Apple’s JavaScriptCore due to improper array index validation.

Researchers from Synacktiv and watchTowr Labs contributed details on the Kentico flaws, while GTIG’s Zander Work told The Hacker News that attribution for exploitation activity at this time is not clear, though some activity may be linked to Cl0p-branded extortion operations. Agencies are required to remediate these vulnerabilities by 10 November 2025.