InfoSecBulletin Cybersecurity for mankind
CISA has added five new CVEs to its Known Exploited Vulnerabilities catalog, including issues from Microsoft, Apple, and Oracle.
The vulnerabilities flagged by CISA include:
CISA alerts to cyberattacks affecting U.S. water utilities
“CyberStrike” AI-Driven Security Platform for Automated Testing
AIDCQ Propose to invest $2 billion in AI data center in Bangladesh
NVIDIA BlueField Flaw Enables Code Execution Attacks
Massive customer data from India’s Bank of Baroda surfaced online
Active Exploits Hit Fortinet, Arista: AI Discovered Linux Kernel Zero-Day
Sam Altman Claims AI “singularity” has arrived, Where Systems Improve by Themselves
Shinyhunters claimed and set deadline to publish E&Y data
Microsoft, NVIDIA and CrowdStrike Initiate Alliance for Open-Source AI Security
Google Search Results Reportedly Show Claude AI Shared Chats
CVE-2022-48503 is a critical vulnerability (8.8 severity) in several Apple products that allows for arbitrary code execution via web content. Apple fixed it with better bounds checks.
CVE-2025-33073 is a Microsoft Windows SMB Client vulnerability rated 8.8 for improper access control, which Microsoft said is unlikely to be exploited in the June Patch Tuesday update.
CVE-2025-61884 is a 7.5-severity SSRF vulnerability in Oracle E-Business Suite that was patched by Oracle on October 11.
CVE-2025-2746 and CVE-2025-2747, which are both 9.8-rated password authentication bypass issues in Kentico Xperience Staging Sync Server.
Oracle Vulnerabilities Under Attack:
CISA doesn’t provide details on how vulnerabilities are being exploited, but the October 11 CVE-2025-61884 patch apparently addressed proof-of-concept (PoC) exploit code that the Scattered LAPSUS$ Hunters threat group posted to its Telegram channel on October 3.
The October 11 Oracle E-Business Suite CVE-2025-61884 vulnerability announcement followed an ongoing campaign by the CL0P ransomware group to exploit CVE-2025-61882, a 9.8-severity remote code execution (RCE) flaw in Oracle E-Business Suite that had reportedly been exploited at least since August 9, with “suspicious activity” occurring a month before that.
CVE-2025-61882 was patched by Oracle on October 4, and CISA added the vulnerability to its KEV database on October 6.
CVE-2025-61882 was weaponized by the CL0P ransomware group in an extensive extortion campaign. They sent many emails to executives, falsely claiming the theft of sensitive data from their Oracle E-Business Suite environments, as reported by Google Threat Intelligence.
CL0P has claimed at least four victims in the Oracle campaign on its Tor site: Harvard University, Envoy Air (American Airlines), and two unconfirmed victims.
Microsoft CVE-2025-33073 Vulnerability Discovered by 8 Researchers:
Microsoft credited eight researchers with discovering CVE-2025-33073: Keisuke Hirata from CrowdStrike, Wilfried Bécard from Synacktiv, Cameron Stish from GuidePoint Security, Ahamada M’Bamba from BNP Paribas, Stefan Walter and Daniel Isern from SySS GmbH, RedTeam Pentesting GmbH, and James Forshaw from Google Project Zero.
Stish’s GuidePoint blog post on CVE-2025-33073 provides some interesting background on the vulnerability.
According to Microsoft, an attacker who successfully exploited the vulnerability could gain SYSTEM privileges.
When multiple attack vectors can be used, Microsoft assigns a score based on the scenario with the highest risk. In one scenario for the vulnerability, Microsoft said an attacker could convince a victim to connect to an attacker-controlled malicious application server, such as an SMB server. “Upon connecting, the malicious server could compromise the protocol,” Microsoft said.
“To exploit this vulnerability, an attacker could execute a specially crafted malicious script to coerce the victim machine to connect back to the attack system using SMB and authenticate,” Microsoft said. “This could result in elevation of privilege.”
