Pierluigi Paganini
October 07, 2025
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Oracle, Linux Kernel, Mozilla, Microsoft Windows, and Microsoft IE flaws to its Known Exploited Vulnerabilities (KEV) catalog.
Below are the descriptions for these flaws:
This week, Oracle released an emergency patch to address the critical vulnerability CVE-2025-61882 (CVSS 9.8) in its E-Business Suite. The flaw was exploited by the Cl0p ransomware group in data theft attacks. Unauthenticated remote attackers can exploit the flaw to take control of the Oracle Concurrent Processing component. CVE-2025-61882 affects Oracle E-Business Suite 12.2.3–12.2.14 (BI Publisher Integration), experts warn it is easily exploitable via HTTP.
Some of the flaws added to the CISA’s KeV catalog are very only, such as the flaw CVE-2013-3918.
The vulnerability CVE-2013-3918 was originally used by the APT group behind the 2009 Aurora attack, but. in 2015 Kaspersky revealed that the nation-state actor EQUATION group captured their exploit and repurposed it to target government users in Afghanistan.
According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.
Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.
CISA orders federal agencies to fix the vulnerabilities by October 27, 2025.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, CISA)
