CISA Warns of Exploited Apple, Kentico, Microsoft Vulnerabilities

The US agency CISA has warned that recently disclosed vulnerabilities in Windows SMB Client and Kentico Xperience CMS have been exploited in the wild, adding them to its Known Exploited Vulnerabilities (KEV) catalog. The Windows flaw, CVE-2025-33073, has a CVSS score of 8.8 and was patched in June; it can be exploited over the network to elevate privileges to System, with Microsoft noting that PoC exploit code existed.

Kentico defects, CVE-2025-2746 and CVE-2025-2747, carry a CVSS score of 9.6 and affect the CMS’s Staging Sync Server password handling, potentially allowing attackers to control administrative objects; these weaknesses were described as exploitable in March and could be chained with an authenticated remote code execution defect. CISA also warned that CVE-2022-48503, an arbitrary code execution issue in Apple products with a CVSS score of 8.8, has been abused in the wild, and Apple patched the hole in July 2022.

Federal agencies are required to identify vulnerable instances and apply fixes within three weeks, per Binding Operational Directive 22-01; there do not appear to be reports of exploitation prior to CISA’s warning. according to Microsoft’s advisory