U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Oracle, Windows, Kentico, and Apple flaws to its Known Exploited Vulnerabilities catalog.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Oracle, Windows, Kentico, and Apple flaws to its Known Exploited Vulnerabilities (KEV) catalog.
- CVE-2022-48503 Apple Multiple Products Unspecified Vulnerability
- CVE-2025-2746 Kentico Xperience Staging Sync Server Digest Password Authentication Bypass Vulnerability
- CVE-2025-2747 Kentico Xperience Staging Sync Server None Password Type Authentication Bypass Vulnerability
- CVE-2025-33073 Microsoft Windows SMB Client Improper Access Control Vulnerability
- CVE-2025-61884 Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability
Oracle recently released an emergency patch to address an information disclosure flaw, tracked as CVE-2025-61884 (CVSS Score of 7.5), in E-Business Suite’s Runtime UI component (versions 12.2.3–12.2.14).
“Oracle has just released Security Alert CVE-2025-61884. This vulnerability affects some deployments of Oracle E-Business Suite.” wrote Rob Duhart, Oracle’s Chief Security Officer. “This vulnerability has received a CVSS Base Score of 7.5. If successfully exploited, this vulnerability may allow access to sensitive resources. “
The vulnerability can be exploited remotely by unauthenticated attackers to steal sensitive data, prompting Oracle to issue an urgent security update.
Oracle did not reveal if the vulnerability CVE-2025-61884 has been exploited in attacks in the wild or if it is linked to the recently patched CVE-2025-61882. Admins are urged to apply the out-of-band patch immediately to prevent potential exploitation.
CISA also added a high-severity improper access control bug in the Microsoft Windows SMB Client (CVE-2025-33073) to the catalog, which could enable privilege escalation and was patched by Microsoft in June 2025.
The US Agency also warns of the exploitation of two critical authentication bypass issues (CVE-2025-2746 and CVE-2025-2747) in Kentico Xperience CMS. Both issues allowed attackers to gain control over administrative objects through weaknesses in the Staging Sync Server’s password handling.
The last vulnerability added to the catalog is a three-year-old Apple vulnerability (CVE-2022-48503) in its JavaScriptCore component. An attacker could trigger the flaw to execute arbitrary code execution when processing web content.
According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.
Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.
CISA orders federal agencies to fix the vulnerabilities by November 10, 2025.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, CISA)
