InfoSecBulletin Cybersecurity for mankind
CISA has added five new CVEs to its Known Exploited Vulnerabilities catalog, including issues from Microsoft, Apple, and Oracle.
The vulnerabilities flagged by CISA include:
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
Palo Alto PAN-OS Flaw Enables Root Arbitrary Code Execution
Critical Check Point VPN flaws allow remote code execution attacks
Cisco confirms CVE-2026-20079 flaw in Secure FMC is exploited in attacks
Hackers exploit PaperCut flaws using hundreds of AI agents, compromising 440 servers globally
CISA Says Chinese Firms Extracted Billions of Tokens From Frontier AI Models
Nightmare Eclipse Drops New Microsoft Defender ‘ShieldCrash’ zero-day
cPanel Flaw Lets Hosting Accounts With Mail Privileges Execute Code as Root
FortiSandbox, FortiOS, FortiProxy ZTNA flaws unveil, while Fortigate firewall actively exploited
CVE-2022-48503 is a critical vulnerability (8.8 severity) in several Apple products that allows for arbitrary code execution via web content. Apple fixed it with better bounds checks.
CVE-2025-33073 is a Microsoft Windows SMB Client vulnerability rated 8.8 for improper access control, which Microsoft said is unlikely to be exploited in the June Patch Tuesday update.
CVE-2025-61884 is a 7.5-severity SSRF vulnerability in Oracle E-Business Suite that was patched by Oracle on October 11.
CVE-2025-2746 and CVE-2025-2747, which are both 9.8-rated password authentication bypass issues in Kentico Xperience Staging Sync Server.
Oracle Vulnerabilities Under Attack:
CISA doesn’t provide details on how vulnerabilities are being exploited, but the October 11 CVE-2025-61884 patch apparently addressed proof-of-concept (PoC) exploit code that the Scattered LAPSUS$ Hunters threat group posted to its Telegram channel on October 3.
The October 11 Oracle E-Business Suite CVE-2025-61884 vulnerability announcement followed an ongoing campaign by the CL0P ransomware group to exploit CVE-2025-61882, a 9.8-severity remote code execution (RCE) flaw in Oracle E-Business Suite that had reportedly been exploited at least since August 9, with “suspicious activity” occurring a month before that.
CVE-2025-61882 was patched by Oracle on October 4, and CISA added the vulnerability to its KEV database on October 6.
CVE-2025-61882 was weaponized by the CL0P ransomware group in an extensive extortion campaign. They sent many emails to executives, falsely claiming the theft of sensitive data from their Oracle E-Business Suite environments, as reported by Google Threat Intelligence.
CL0P has claimed at least four victims in the Oracle campaign on its Tor site: Harvard University, Envoy Air (American Airlines), and two unconfirmed victims.
Microsoft CVE-2025-33073 Vulnerability Discovered by 8 Researchers:
Microsoft credited eight researchers with discovering CVE-2025-33073: Keisuke Hirata from CrowdStrike, Wilfried Bécard from Synacktiv, Cameron Stish from GuidePoint Security, Ahamada M’Bamba from BNP Paribas, Stefan Walter and Daniel Isern from SySS GmbH, RedTeam Pentesting GmbH, and James Forshaw from Google Project Zero.
Stish’s GuidePoint blog post on CVE-2025-33073 provides some interesting background on the vulnerability.
According to Microsoft, an attacker who successfully exploited the vulnerability could gain SYSTEM privileges.
When multiple attack vectors can be used, Microsoft assigns a score based on the scenario with the highest risk. In one scenario for the vulnerability, Microsoft said an attacker could convince a victim to connect to an attacker-controlled malicious application server, such as an SMB server. “Upon connecting, the malicious server could compromise the protocol,” Microsoft said.
“To exploit this vulnerability, an attacker could execute a specially crafted malicious script to coerce the victim machine to connect back to the attack system using SMB and authenticate,” Microsoft said. “This could result in elevation of privilege.”
