The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added five security vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog on October 20, 2025. This update includes a newly confirmed exploited flaw in Oracle E-Business Suite (EBS) that threatens sensitive data.

Among the added flaws is CVE-2025-61884, a server-side request forgery (SSRF) vulnerability in Oracle Configurator’s Runtime component. It has a severity score of 7.5 and allows remote attackers to access critical data without needing authentication, according to CISA. This vulnerability now joins CVE-2025-61882 (CVSS score 9.8), a severe bug enabling unauthenticated remote code execution in Oracle EBS, both known to be exploited in active attacks.

Earlier this month, the Google Threat Intelligence Group and Mandiant reported targeting of multiple organizations using CVE-2025-61882. Zander Work, a senior security engineer at Google, noted, “It’s likely that at least some of the exploitation activity we observed was conducted by actors now conducting Cl0p-branded extortion operations.”

The other vulnerabilities added by CISA include:
– CVE-2025-33073, an access control flaw in Microsoft Windows SMB Client (CVSS 8.8).
– CVE-2025-2746 and CVE-2025-2747, both authentication bypasses in Kentico Xperience CMS (CVSS 9.8).
– CVE-2022-48503, improper array index validation in Apple’s JavaScriptCore leading to potential code execution (CVSS 8.8).

Fixes for these were previously released by their respective companies in 2022 and 2025. There are no current details on exploitation in the wild for four of these issues.

Federal Civilian Executive Branch agencies must remediate these five vulnerabilities by November 10, 2025, to secure their IT systems against ongoing attacks.

✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.